Businesses rely on internal controls to help ensure the accuracy and integrity of their financial statements, as well as prevent fraud, waste and abuse. Given their importance, internal controls are a key area of focus for internal and external auditors.

Many auditors use detailed internal control questionnaires to help evaluate the internal control environment — and ensure a comprehensive assessment. Although some audit teams still use paper-based questionnaires, many now prefer an electronic format. Here’s an overview of the types of questions that may be included and how the questionnaire may be used during an audit.

The basics

The contents of internal control questionnaires vary from one audit firm to the next. They also may be customized for a particular industry or business. Most include general questions pertaining to the company’s mission, control environment and compliance situation. There also may be sections dedicated to mission-critical or fraud-prone elements of the company’s operations, such as:

  • Accounts receivable,
  • Inventory,
  • Property, plant and equipment,
  • Intellectual property (such as patents, copyrights and customer lists),
  • Trade payables,
  • Related party transactions, and
  • Payroll.

Questionnaires usually don’t take long to complete, because most questions are closed-ended, requiring only yes-or-no answers. For example, a question might ask: Is a physical inventory count conducted annually? However, there also may be space for open-ended responses. For instance, a question might ask for a list of controls that limit physical access to the company’s inventory.

3 approaches

Internal control questionnaires are generally administered using one the following three approaches:

1. Completion by company personnel. Here, management completes the questionnaire independently. The audit team might request the company’s organization chart to ensure that the appropriate individuals are selected to participate. Auditors also might conduct preliminary interviews to confirm their selections before assigning the questionnaire.

2. Completion by the auditor based on inquiry. Under this approach, the auditor meets with company personnel to discuss a particular element of the internal control environment. Then the auditor completes the relevant section of the questionnaire and asks the people who were interviewed to review and validate the responses.

3. Completion by the auditor after testing. Here, the auditor completes the questionnaire after observing and testing the internal control environment. Once auditors complete the questionnaire, they typically ask management to review and validate the responses.

Enhanced understanding

The purpose of the internal control questionnaire is to help the audit team assess your company’s internal control system. Coupled with the audit team’s training, expertise and analysis, the questionnaire can help produce accurate, insightful audit reports. The insight gained from the questionnaire also can add value to your business by revealing holes in the control system that may need to be patched to prevent fraud, waste and abuse.

© 2021


---

The information contained in the Knowledge Center is intended solely to provide general guidance on matters of interest for the personal use of the reader, who accepts full responsibility for its use. In no event will CST or its partners, employees or agents, be liable to you or anyone else for any decision made or action taken in reliance on the information in this Knowledge Center or for any consequential, special or similar damages, even if advised of the possibility of such damages.