Evaluation of internal controls

The auditor evaluates a control by asking three different questions. The evidence needed depends on the question. standards.xrb.govt.nz

Stage	Auditor’s question	Application to the weekly review
1. Evaluate design	If staff perform the control as intended, can it prevent, or detect and correct, the misstatement?	To detect missing sales, the review must start with the delivery records and look for the corresponding invoices. Starting with invoices already issued would miss a delivery that was never invoiced.
2. Determine implementation	Has the company actually put the control into use?	The auditor asks the supervisor to demonstrate the review, inspects a completed weekly report and traces an exception to the action taken. Enquiry is supported by documentary evidence.
3. Test operating effectiveness, when required	Did the control work consistently during the period on which the auditor intends to rely?	The auditor selects weekly reports from different parts of the year, checks who reviewed them and when, and inspects whether staff investigated exceptions. The auditor may independently repeat selected matches.

The auditor tests controls when planning to rely on their operating effectiveness, or when substantive procedures alone cannot provide sufficient appropriate evidence. If testing reveals that the supervisor frequently skipped the weekly review, the auditor reassesses reliance and may perform more direct testing. For example, the auditor can trace additional year-end deliveries to invoices and the sales ledger to look for omitted sales.