Assessing Internal Controls in an Audit

Assessing internal controls is one of the most important parts of an audit. By understanding and evaluating a company's internal controls, the auditor decides how much to rely on them and shapes the whole audit approach. This practical guide explains what internal control is, its components, how auditors assess controls, the difference between tests of controls and substantive procedures, and why it matters — in plain language. It's a core auditing topic, central to ISA 315 and relevant to ACCA study. (Always refer to the relevant standards for authoritative requirements.)

What is internal control?

Internal control is the process designed and operated to provide reasonable assurance about the achievement of an entity's objectives — in the context of an audit, particularly the reliability of financial reporting, along with the effectiveness of operations and compliance with laws. In simple terms, it's the system of policies and procedures a business uses to safeguard its assets, prevent and detect errors and fraud, and ensure its records are accurate. Auditors are required to obtain an understanding of internal control relevant to the audit.

The components of internal control

Internal control is commonly analysed into five components:

• The control environment — the overall tone, attitude and culture around control, set by management and those charged with governance (integrity, ethical values, competence).
• The entity's risk assessment process — how the business identifies and responds to the risks it faces.
• The information system and communication — the processes and records that capture and report transactions, and how responsibilities are communicated.
• Control activities — the specific policies and procedures that help ensure management's directives are carried out (such as authorisations, reconciliations, segregation of duties).
• Monitoring of controls — the ongoing process of checking that controls are operating effectively over time.

How auditors assess controls

The auditor's assessment of controls is part of understanding the entity and identifying the risks of material misstatement. The auditor obtains this understanding through procedures such as inquiry of staff, observation of controls in operation, inspection of documents, and walkthroughs — tracing a transaction through the system from start to finish. The aim is to understand how controls are designed and whether they have been implemented — identifying where controls are strong and where they are weak, which in turn shapes where audit effort is directed.

Tests of controls vs substantive procedures

A key decision flows from the assessment: whether to rely on the controls. This determines the mix of two types of further audit procedure:

• Tests of controls test whether controls are operating effectively throughout the period. The auditor performs these when they intend to rely on the controls to reduce substantive testing — for example, where controls appear strong. Techniques include reperformance, inspection and observation.
• Substantive procedures test the figures themselves for misstatement — through tests of detail and analytical procedures. Some substantive procedures are always required, regardless of controls.

Where controls are weak or the auditor chooses not to rely on them, the audit relies more heavily on substantive testing.

The limitations of internal control

Even a well-designed control system can only provide reasonable, not absolute, assurance. This is because of inherent limitations: human error and mistakes in judgement; the possibility of controls being circumvented by collusion between two or more people; and the risk of management override of controls. There is also a cost-benefit constraint, as controls must be proportionate to the risks they address. Auditors keep these limitations firmly in mind — which is why strong controls reduce, but never eliminate, the need for substantive testing.

Why assessing internal controls matters

Assessing internal controls matters because it directly shapes the audit: a strong control environment can allow the auditor to rely on controls and do less detailed testing, while weak controls demand more substantive work and signal higher risk. It's also valuable to the entity, since weaknesses identified are communicated (under ISA 265) so they can be fixed. For auditors, understanding the components of internal control and how their assessment drives the audit approach is fundamental and frequently examined.

Frequently asked questions

What is internal control?

The process designed to provide reasonable assurance about achieving an entity's objectives — especially reliable financial reporting — through policies and procedures that safeguard assets and prevent and detect errors and fraud.

What are the components of internal control?

The control environment, the entity's risk assessment process, the information system and communication, control activities, and monitoring of controls.

How do auditors assess internal controls?

Through inquiry, observation, inspection of documents and walkthroughs, to understand how controls are designed and whether they have been implemented — identifying strengths and weaknesses that shape the audit.

What's the difference between tests of controls and substantive procedures?

Tests of controls check whether controls operate effectively (performed when relying on controls); substantive procedures test the figures themselves for misstatement. Some substantive procedures are always required.

Build your auditing skills with Learnsignal

Assessing internal control is central to auditing. Learnsignal's tutor-led ACCA courses develop the audit knowledge the ISAs require — with clear teaching and exam-focused practice. (Always refer to the latest standards for authoritative requirements.)