Internal Controls: Conclusions
An auditor can conclude whether relevant automated and manual transaction-level internal controls are effectively designed and placed in operation by following these steps:
- Understand the control design: Evaluate the design of each identified control, including the purpose, process flow, and control objectives. Assess the adequacy of the control design in addressing the associated risks and whether the control is preventive or detective.
- Perform walkthroughs: Conduct walkthroughs of the identified controls, tracing sample transactions from initiation to completion, and observe the control activities in action. This helps in understanding the control process and assessing whether it operates as designed.
- Test the design and implementation: Perform tests of controls to evaluate the design and implementation of the identified controls. These tests may include reviewing relevant documentation, inspecting system configurations, observing control activities, or performing computer-assisted audit techniques (CAATs).
- Evaluate segregation of duties: Assess the appropriateness of segregation of duties within the control process, ensuring that no single individual has the ability to initiate, authorize, record, and review transactions without independent oversight.
- Assess control effectiveness: Based on the walkthroughs, tests of controls, and other information gathered, assess the effectiveness of the identified controls in addressing the risks associated with the key control points. This assessment should consider whether the controls are operating as designed and whether they are likely to achieve their control objectives.
- Document test results: Create clear and comprehensive documentation of the tests performed, including the sample transactions tested, the procedures performed, and the results obtained. Highlight any identified control deficiencies or deviations and assess their potential impact on the financial statements.
- Assess control deficiencies: Based on the test results, assess the identified control deficiencies and determine whether they represent significant deficiencies or material weaknesses in the entity’s internal control over financial reporting. This information will be used to plan further audit procedures, including additional tests of controls or substantive procedures, as necessary.
- Conclude on control effectiveness: After completing the above steps, the auditor can conclude whether the relevant automated and manual transaction-level internal controls are effectively designed and placed in operation. If the controls are found to be effective, the auditor may rely on them to reduce the extent of substantive testing. If the controls are found to be ineffective or have material weaknesses, the auditor will need to plan and perform additional audit procedures to obtain sufficient appropriate audit evidence.
By following these steps, auditors can conclude whether relevant automated and manual transaction-level internal controls are effectively designed and placed in operation, allowing them to plan and perform their audit procedures accordingly.
