Internal Control

*Control environment
Obtain an understanding of
the control structure *Information system
*Transactions and records
1. Obtain an understanding
*Checklist
Document the understanding *Questionnaire
*Flowchart
*Narrative

Initial assesment of control *Identify relevant controls

risk
*Evaluate weaknesses

Set level of control risk

Audit procedures:
2. Initial assessment and -nature
response to control risk -timing
-extent
Response to control risk

Prepare audit planning -APM

memorandum and audit
programme -AP

A B
 A B

Nature:
Perform tests of control
-inquiry
-observation Increase
3. Final assesment based
-inspection
on tests of controls
-reperformance
Timing
Extent
Evaluate sufficiency of
evidence and reassess internal
control risk

Continue Reduce or
Reduce or no change increase risk
examination
?