Before an auditor can assess the risks of material misstatement, the auditor has to understand how the entity controls its financial reporting. Two working tools do most of that job. The internal control questionnaire (ICQ) captures the control environment and key controls across the cycles in a structured set of questions. The walkthrough follows one real transaction through a process to confirm the controls described actually exist and are in use.
This guide covers what AU-C 315 requires, how to build and use an ICQ, how to perform and document a walkthrough, and a worked example from the purchasing cycle. For testing whether controls operated all year, see the control testing guide.
What AU-C 315 requires
AU-C 315, as amended by SAS No. 145 for audits of periods ending on or after December 15, 2023, requires the auditor to obtain an understanding of the entity's system of internal control through its five components:
- the control environment
- the entity's risk assessment process
- the entity's process to monitor the system of internal control
- the information system and communication
- control activities
For the first four, the auditor obtains an understanding and evaluates it. For control activities, the auditor identifies specific controls and evaluates their design and determines whether they are implemented. The controls that require that evaluation are controls that address a significant risk, controls over journal entries including nonstandard entries, controls the auditor plans to test for operating effectiveness, and other controls the auditor considers appropriate. For each, the auditor identifies related IT applications and general IT controls. See SAS 145, control environment, control activities and entity-level controls.
Understanding is obtained through inquiry combined with other procedures such as observation and inspection. Inquiry alone is not enough to determine implementation.
The internal control questionnaire
An ICQ is a list of questions, usually grouped by cycle, answered by management and staff and corroborated by the auditor. A typical structure:
- Entity-level: tone at the top, code of conduct, board or owner oversight, how accounting staff are hired and trained, how management monitors results.
- Revenue and receipts
- Purchasing and disbursements
- Payroll
- Inventory
- Fixed assets
- Financial reporting and close
- IT environment
Each question is phrased so that a "yes" is the answer a well-controlled entity gives, with space to describe how it works. A "no" or "partially" points to a potential deficiency. A good ICQ also records who answered, so that the file shows whether the answer came from the person who performs the control.
Sample questions
| Cycle | Question | What a "no" suggests |
|---|---|---|
| Entity-level | Does the owner or board review monthly financial results against budget or prior year? | Weak monitoring |
| Entity-level | Is there a process for staff to report concerns about accounting or fraud? | No reporting channel; see whistleblower program |
| Receipts | Are cash receipts recorded by someone who does not also reconcile the bank account? | Segregation of duties gap; see segregation of duties |
| Receipts | Are credit memos approved by someone other than the person who records sales? | Revenue and receivable misstatement risk |
| Purchasing | Are purchases above a set amount approved before the order is placed? | Unauthorized spending |
| Purchasing | Can the person who approves invoices also add or change vendors? | Fictitious vendor risk; see embezzlement detection |
| Disbursements | Are checks signed by someone who is not the one who prepared them, with supporting documents in front of them? | Disbursement fraud risk |
| Payroll | Does someone outside payroll approve new hires, terminations and pay changes? | Ghost employee risk |
| Inventory | Are physical counts performed and compared to the records at least annually? | Existence and valuation risk |
| Close | Who prepares and who reviews journal entries and reconciliations? | Management override and error risk. See journal entry testing |
| IT | Who has administrator rights to the accounting system, and are they reviewed? | Access risk. See user access review |
An ICQ is only as good as the answers. A blank form filled in by the bookkeeper who does everything records an assertion, not evidence. Corroborate with observation, inspection of documents and a walkthrough.
Performing a walkthrough
A walkthrough follows one transaction from initiation through authorization, recording, processing and reporting, using the same documents and systems the entity uses. See walkthrough.
- Pick the process and the risk it addresses. Typically a process with a significant risk or a major class of transactions.
- Select a transaction from the recent population, not one the client prepared for the auditor.
- Meet the people who perform each step and have them show, not only tell, how they do it.
- Inspect the documents and system records at each step: requisition, purchase order, receiving report, invoice, match, approval, payment and posting.
- Look for differences between what the narrative says and what happened. A control described but not used is not implemented.
- Identify points where a misstatement could arise and the control that addresses each.
- Document the transaction chosen, the people and their roles, the documents inspected and the conclusion about design and implementation.
A walkthrough supports the conclusion that the control is designed to address the risk and in use. It does not support reliance on the control's operation throughout the period. That requires testing a sample.
Worked example: purchasing
Illustrative. The auditor selects a $14,300 payment to a freight carrier from the October disbursements and follows it.
| Step | Control described | What the auditor saw | Conclusion |
|---|---|---|---|
| Requisition | Department manager emails the request | Email from the operations manager, dated October 3 | In use |
| Purchase order | Purchasing clerk issues a numbered PO above $2,500 | PO 4471 dated October 4, signed by the clerk | In use |
| Receipt | Warehouse signs a receiving report | Signed report dated October 9 | In use |
| Invoice match | AP clerk matches PO, receipt and invoice | Match initialed, with the invoice for $14,300 agreeing to the PO | In use |
| Approval | Controller approves invoices above $10,000 | No approval on file; the controller said she approves verbally | Not in use as described |
| Payment | Two-signature policy for checks above $10,000 | One signature on the check | Not in use as described |
| Posting | AP clerk posts to expense and payables | Entry agreed to the ledger | In use |
The auditor records two deviations from the described design. The control exists on paper but did not operate for this transaction. The auditor asks whether it operates at other times, assesses the effect on the risk of material misstatement for disbursements and payables, and adjusts the approach: either extended substantive testing or a test of the controls over a sample. The deviations may indicate a deficiency to evaluate under AU-C 265.
Small entities: informal controls
In an owner-managed business, the control environment may rest on the owner's involvement. Controls may be informal and undocumented: the owner signs every check, reviews the bank statement or approves every purchase. These can be effective, and AU-C 315 recognizes that a smaller entity's controls may be less formal. The auditor still documents what the owner does, observes it and decides whether it addresses the risk. Where the owner is also the person who could override, the risk assessment needs to reflect that. See fraud risk assessment and management override of controls.
Documentation
Document the understanding obtained of each component and the sources of information, the identified controls and the evaluation of design and implementation, the risk assessment procedures performed, and the conclusions about risk. See audit risk assessment worksheet and control narrative template.
Common mistakes
- Reusing last year's ICQ with no updates for staff or system changes.
- Accepting yes/no answers with no description.
- Performing the walkthrough with a transaction the client picked.
- Concluding that a walkthrough supports reliance.
- Documenting the narrative from management and not noting where reality differed.
Frequently asked questions
What is an internal control questionnaire?
A structured list of questions about an entity's controls, answered by management and corroborated by the auditor, to document the understanding of internal control.
What is the difference between a walkthrough and a test of controls?
A walkthrough follows one transaction to confirm the control is designed and implemented. A test of controls examines a sample to conclude whether the control operated effectively throughout the period.
Is an ICQ required?
AU-C 315 requires an understanding of the system of internal control and documentation of it. It does not prescribe a form, so an ICQ, narrative or flowchart can serve if it records the required understanding.
What are the five components of internal control?
The control environment, the entity's risk assessment process, the process to monitor the system of internal control, the information system and communication, and control activities.
Do small businesses need formal controls for an audit?
No. The auditor evaluates the controls that exist, however informal, and responds to the risks they leave.
Sources
- AICPA, AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, as amended by SAS No. 145
- AICPA, AU-C Section 265
- COSO, Internal Control—Integrated Framework (2013), coso.org
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error