Questionnaires to Evaluate Internal Controls
When evaluating your control risk, you need to find out as much as you can about your client’s internal control procedures. When evaluating your client’s internal controls, you can use two questionnaires to help you gather important information for your assessment:
The first, created by your CPA firm and given to the client, consists of “yes” and “no” questions about the company’s operating structure. It also asks who performs each of the operating tasks so that you know which employee to pursue with your auditing questions.
This questionnaire, which is different from the management’s assessment documentation, is one of the first documents you give to the client after your firm accepts the engagement. Give the client a firm deadline early in the audit for its return. You’ll refer to it during the entire audit as you question the client’s management and staff and review books and records.
The second questionnaire, which you fill out, documents your understanding of the client’s control environment. It covers topics such as the client’s commitment to competence, the assignment of authority and responsibilities, and human resources policies and procedures.
This document is your checklist to make sure you’ve gone over all the tasks you need to perform to understand the client’s control environment. Whether this is the first time you audit the client or the hundredth, you still need to review and answer all the questions on your firm’s client internal control questionnaire.
Think about aircraft pilots — no matter how many hours they’ve logged in the cockpit, they still run through an exhaustive list of questions prior to taking that plane down the runway. Although your questionnaire isn’t as critical to safety, its information is still significant to you.
The strength of an internal control questionnaire is that it provides you with a comprehensive way to evaluate the client’s internal controls. A weakness of using an internal control questionnaire is that you look at and evaluate your piece of the internal control system without an overall view of the system.
That’s because you’re part of a team, and other team members look at other internal controls. Your team leader or senior associate will review all the pieces and advise you if anything you’re doing is affected by someone else’s work.
Your CPA firm may opt not to use questionnaires. Instead, it may use a written narrative (description of internal controls) or flowcharts. The same type of information is secured regardless of what method your CPA firm uses. Clarify with your audit supervisor which method it prefers.