* Adapted from AICPA CPExpress via MicroMash

There are many tools that can be used to assist the auditor and/or management in documenting internal control over financial reporting. But one of the leading techniques involves internal control questionnaires (ICQs).

ICQs have been used by auditors for decades to document the presence or absence of a control. The traditional format is a “yes/no/n/a” checklist approach. ICQs typically document the presence or absence of a procedure and the personnel who perform the procedure.

Tips on Formatting ICQs

There are different methods for completing an ICQ. These include completing the questionnaire after:

• Discussion with appropriate personnel about a particular system or component of internal control.  
• Observation and walkthrough of the system by the auditor after the auditor performs tests of the system.
• Circulation of the questionnaire to various personnel and having them complete the ICQ.

ICQ Goals

When auditors discuss a particular system with appropriate personnel, they may encounter a bias for the respondent to answer “yes” to all questions. This accomplishes two objectives on the part of the respondent. The respondent tells the auditor what the auditor wants to hear and the respondent spends less time with the auditor. The respondent can then perform other assigned tasks. It is important for senior management to communicate to employees the importance of cooperating with auditors and taking the time to consider each question and providing reliable responses.

Another method to complete an ICQ is to circulate the questionnaire to a large number of personnel. This method is suggested when there is a large, pervasive system where standard procedures are followed by a significant number of staff. In this scenario, the auditor can assess if standard company-level procedures are being followed and understood organization-wide. This method would not be appropriate for systems that are narrow in scope and involve a smaller number of personnel, such as a general ledger system. A weakness in this approach is that the respondent might not understand a particular question. The questionnaire should provide for a path of communication to the auditor so that the respondent can clarify questions.

Completing an ICQ based upon observation of a process and/or a walkthrough of the system allows the auditor to finish the questionnaire after having performed audit procedures. In a walkthrough, the auditor obtains an understanding of the major classes of transactions by taking a transaction and following the processing from the transaction origination to its ultimate posting on the general ledger.

The problem in this approach is that employees might follow procedures when they know they are being observed and then not follow them when they are not being observed.

A more reliable method for completion of an ICQ may be waiting until after the system has been tested. Testing the system provides evidence whether or not the system description obtained through inquiry, observation and walkthroughs is actually being practiced.

Conclusion

Some critics of ICQs note that they do not address the sequence of procedures, may not include all relevant questions or classify controls as preventive or detective. Additionally, ICQs typically do not contain open-ended questions.

It is important to document the sequence of procedures as a control might be present and the auditor might conclude the control is good and the system is functioning properly when, in fact, the system is dysfunctional.

For more information, visit AICPA CPExpress.