Tools for Evaluating Internal Control: ICQ, Checklist & Flowcharts
1. Need for Evaluating Internal Control
Before an auditor decides the depth, timing, and extent of substantive testing (such as checking vouchers and verifying ledger balances), they must determine whether the client’s internal control system is reliable.
Under SA 315 (Identifying and Assessing the Risks of Material Misstatement), the auditor must obtain an understanding of internal controls and document their evaluation. Four established diagnostic tools are utilized in practice:
The Four Primary Diagnostic Tools for Control Evaluation
1. Narrative Records (Text)
Written paragraphs describing the origin, flow, and documentation of transactions within a department.
2. Internal Control Questionnaire (ICQ)
Comprehensive pre-printed questions requiring "Yes", "No", or "N/A" answers to highlight control deficiencies.
3. Checklists
Action lists filled by audit staff to confirm specific verification steps and compliance checks were executed.
4. Flowcharts
Graphic, diagrammatic blueprints illustrating transaction flow, authorization points, and document movements.
2. Narrative Records (Written Descriptions)
A Narrative Record is a formal written description prepared by the auditor documenting their understanding of the client’s internal controls based on discussions with department heads, review of operational manuals, and observation of daily routines:
Advantages:
- Highly flexible and tailored to non-standard, unique manufacturing or service businesses.
- Provides comprehensive context without artificial formatting constraints.
Limitations:
- Can become lengthy and cumbersome in large multinational conglomerates.
- Identifying control gaps requires reading through pages of dense text.
- Updating written descriptions to reflect ongoing operational changes requires substantial effort.
3. Internal Control Questionnaire (ICQ)
The Internal Control Questionnaire (ICQ) is the most widely adopted analytical tool in modern auditing. It consists of structured questions covering distinct operational areas (e.g., cash receipts, credit sales, payroll, inventory):
Key Structural Rules of an ICQ:
- Questions are formulated so that a “YES” answer denotes a healthy internal control.
- A “NO” answer immediately flags a potential control weakness or fraud risk requiring extended testing.
- An “N/A” (Not Applicable) indicates the query does not apply to that particular client.
Specimen Extract of an ICQ for Purchases & Accounts Payable
Q1
Are all purchases initiated solely on written Purchase Requisitions signed by authorized department heads?
Yes / No / N/A — Evaluates authorization control at point of origin.
Q2
Are purchase orders pre-numbered sequentially and kept under lock and key?
Yes / No / N/A — Prevents unrecorded orders and unauthorized vendor commitments.
Q3
Are supplier invoices matched independently with POs and Goods Received Notes (GRN) before payment approval?
Yes / No / N/A — Guarantees payment is made only for goods physically received and inspected.
Q4
Are ledger clerks prohibited from handling physical cash or signing disbursement cheques?
Yes / No / N/A — Enforces vital segregation between bookkeeping and asset custody.
Advantages of an ICQ:
- Provides a comprehensive, standardized approach across multiple audit engagements.
- Allows immediate visual identification of high-risk operational areas by scanning for “NO” answers.
- Enables senior audit partners to delegate preliminary evaluations to junior assistants effectively.
Limitations of an ICQ:
- Client employees may provide mechanical, unverified “YES” answers without implementing controls in practice.
- May fail to capture unusual, innovative, or automated software workflows.
4. Checklists in Auditing
A Checklist is an operational verification tool containing a list of specific audit procedures that the audit staff must perform:
Key Differences: Checklist vs. Internal Control Questionnaire (ICQ)
| Dimension | Internal Control Questionnaire (ICQ) | Checklist |
|---|---|---|
| Primary Focus | Evaluates the design and existence of internal controls implemented by the client. | Guides the execution of specific audit procedures by the auditor’s staff. |
| Filled By | Client department heads or audit assistant interviewing client staff. | Exclusively filled and signed by the auditor’s staff during testing. |
| Answer Format | “Yes”, “No”, or “Not Applicable” (N/A). | Initials, date completed, and tick-marks signifying verification. |
| Outcome | Highlights control strengths and weaknesses in client systems. | Verifies that all scheduled audit steps were executed in the field. |
5. Flowcharts for Control Evaluation
A Flowchart is a graphic, visual representation of the sequential movement of documents and operations through various organizational departments:
Sample Document Flowchart: Internal Control in Purchases & Accounts Payable
Requisition
User Dept initiates purchase req
➔
Purchase Order
Purchasing Dept vets & issues PO
➔
Goods Receipt (GRN)
Store verifies & issues GRN
➔
3-Way Matching
Accounts verifies PO + GRN + Invoice
➔
Disbursement
Cheque / EFT payment released
Visual Symbols Used in Audit Flowcharts:
- Rectangle: Operational action (e.g., matching invoice, counting inventory).
- Diamond: Decision node (e.g., does invoice amount match purchase order?).
- Document Symbol: Physical or electronic source documents (vouchers, bills, POs).
- Arrows: Direction of physical document movement and electronic data flow.
Merits of Flowcharts:
- Provides an immediate visual overview of the entire operational chain.
- Exposes bottlenecks, redundant approvals, and lack of segregation of duties at a glance.
- Essential for reviewing complex Enterprise Resource Planning (ERP) environments (e.g., SAP, Oracle, Tally Prime).
6. Walk-Through Tests
After documenting the system using an ICQ or flowchart, the auditor conducts a Walk-Through Test:
- The auditor selects a handful of actual transactions (e.g., 2 purchase orders, 2 payroll records) and traces them through every step of the accounting system from origin to final financial statement entry.
- Objective: Confirms that the controls described on paper are genuinely functioning in practice rather than existing as theoretical policies.
7. Key Exam Review Questions
- Compare and contrast an Internal Control Questionnaire (ICQ) with an Audit Checklist.
- What are the key advantages of using Flowcharts over Narrative Descriptions when evaluating internal controls in large enterprises?
- What is a Walk-Through Test? How does it validate the findings of an Internal Control Questionnaire?