So far as the auditor is concerned, the examination and evaluation of the internal control system is an indispensable part of the overall audit programme. The auditor needs reasonable assurance that the accounting system is adequate and that all the accounting information which should be recorded has in fact been recorded. Internal control normally contributes to such assurance. The auditor should gain an
understanding of the accounting system and related internal controls and should study and evaluate the operations of these internal controls upon which he wishes to rely in determining the nature, timing and extent of other audit procedures. The review of internal controls will enable the auditor to know:
- whether errors and frauds are likely to be located in the ordinary course of operations of the business;
- whether an adequate internal control system is in use and operating as planned by the management;
- whether an effective internal auditing department is operating;
- whether any administrative control has a bearing on his work (for example, if the control over worker recruitment and enrolment is weak, there is a likelihood of dummy names being included in the wages sheet and this is relevant for the auditor);
- whether the controls adequately safeguard the assets;
- how far and how adequately the management is discharging its function in so far as correct recording of transactions is concerned;
- how reliable the reports, records and the certificates to the management can be;
- the extent and the depth of the examination that he needs to carry out in the different areas of accounting;
- what would be appropriate audit technique and the audit procedure in the given circumstances;
- what are the areas where control is weak and where it is excessive; and
- whether some worthwhile suggestions can be given to improve the control system.
The auditor can formulate his entire audit programme only after he has had a satisfactory understanding of the internal control systems and their actual operation. If he does not care to study this aspect, it is very likely that his audit programme may become unwieldy and unnecessarily heavy and the object of the audit may be altogether lost in the mass of entries and vouchers. It is also important for him to know whether the system is actually in operation. Often, after installation of a system, no proper follow up is there by the management to ensure compliance. The auditor, in such circumstances, may be led to believe that a system is in operation which in reality may not be altogether in operation or may at best operate only partially. This state of affairs is probably the worst that an auditor may come across and he would be in the midst of confusion, if he does not take care. It would be better if the auditor can undertake the review of the internal control system of client. This will give him enough time to assimilate the controls and implications and will enable him to be more
objective in the framing of the audit programmes. He will also be in a position to bring to the notice of the management the weaknesses of the system and to suggest measures for improvement. At a further interim date or in the course of the audit, he may ascertain how far the weaknesses have been removed.
From the foregoing, it can be concluded that the extent and the nature of the audit programme is substantially influenced by the internal control system in operation. In deciding upon a plan of test checking, the existence and operation of internal control system is of great significance. A proper understanding of the internal control system in its content and working also enables an auditor to decide upon the appropriate audit procedure to be applied in different areas to be covered in the audit programme. In a situation where the internal controls are considered weak in some areas, the auditor might choose an auditing procedure or test that otherwise might not be required; he might extend certain tests to cover a large number of transactions or other items than he otherwise would examine
and at times he may perform additional tests to bring him the necessary satisfaction. For example, normally the distribution of wages is not observed by the auditor. But if the internal control over wages is so weak that there exists a possibility of dummy workers being paid, the auditor might include observation of wages distribution in his programme in order to find out the workers who do not turn up
for receipt of wages. On the other hand, if he is satisfied with the internal control on sales and debtors, the auditor can get debtors’ balances confirmed at almost any time reasonably close to the balance sheet date. But if the control is weak, he may feel that he should get the confirmation exactly on the date of the year closing so that he may eliminate the risk of errors and frauds occurring between the
intervening period. Also, he may in that situation, decide to have a large coverage of debtors by the confirmation procedure.
A review of the internal control can be done by a process of study, examination and evaluation of the control system installed by the management. The first step involves determination of the control and procedures laid down by the management. By reading company manuals, studying organisation charts and flow charts and by making suitable enquiries from the officers and employees, the auditor may
ascertain the character, scope and efficacy of the control system. To acquaint himself about how all the accounting information is collected and processed and to learn the nature of controls that makes the information reliable and protect the company’s assets, calls for considerable skill and knowledge. In many cases, very little of this information is available in writing; the auditor must ask the right people the right questions if he is to get the information he wants. It would be better if he makes written notes of the
relevant information and procedures contained in the manual or ascertained on enquiry. To facilitate the accumulation of the information necessary for the proper review and evaluation of internal controls, the auditor can use one of the following to help him to know and assimilate the system and evaluate the same :
- Narrative record;
- Check List;
- Questionnaire; and
- Flow chart.
