How to Apply the Internal Control Questionnaire for Audit?

The qualified auditor should consider that the internal control questionnaire is a sole evaluation method of the auditor. In no case, the internal control questionnaire should be delivered to the client, for the client to respond, nor as a resource to carry the information about the structures or to supplement this evaluation.

The evaluation questionnaires must be answered by the auditor after completion of the verification stage of the internal control structure or system, because at the end of the verification process, the auditor has general knowledge of the company and the weaknesses in which to focus the evaluation.

It is necessary to consider that a question is never answered that the auditor heard or was told, but only by supporting what is known to him as a result of his observations and the tests carried out.

The following points should be taken into consideration when responding to the internal control questionnaires for audit;

They are supported to determine the reliability of the internal control system established by the company, but they are not intended to cover all the aspects or specific situations of each client.

The questionnaire should be modified in those parts where there are specific questions applicable to the particular company.

The spaces provided for the questions should be answered with YES, NO or NA (not applicable); Not with other expressions that may cause any sort of doubts.

The questions should be prepared, so that, when there are negative responses, the auditor can consider the alternative procedures and, where appropriate, take into account these responses for the purpose of the nature, scope and timing of the substantive tests at the intermediate and final stages.

The resolution of the questionnaire is not sufficient to evaluate the internal control, so it should be complemented with the flow charts or narrative descriptions whose contents will be authenticated through the audit procedure.
At the end of each section, it should be indicated in the body of the questionnaire if the internal control is HIGH, MODERATE or LOW, in addition, where appropriate, the comments on the segments that face greater risks or areas of the opportunity. If the space is not sufficient, the back of the questionnaire should be used.

Each questionnaire must be answered by the auditor in charge and approved by the Audit Manager. Under no circumstances, the questionnaire will be answered by the client.

For subsequent reviews, internal control questionnaires should be updated in the framework of preliminary stage of work.