What is your favorite form of internal control documentation for audits? Most of us answer based on the practices we learned early in our careers, which have become our personal preferences. Prior to the risk assessment standards of 2006, internal control documentation didn't matter much to most of us because we primarily used substantive tests to collect evidence to verify financial statement assertions. We included the minimum internal documentation in our files and carried it forward forever. In each of these years, we defaulted to high control risk and forgot about internal controls.
The times have changed. Not only do we have to have sufficient documentation of an entity's internal controls, we are required to identify potential risks of misstatement due to error or fraud and link those risks to specific audit responses (procedures). To our question then, what is your favorite form of documentation? Your answer should beg another question: Is your documenation the most efficient in each engagement's circumstances?
Flowcharts, memos and internal control questionnaires (ICQ) all can be used to adequately document an entity's accounting and internal control systems. In our quest for audit efficiency, particularly on small audits, CPA firm leadership must consider the circumstances of each engagement to plan appropriate audit documentation. Selecting appropriate internal control documentation formats offers significant opportunities for time savings.
One of the keys to creating efficiencies in planning audit documentation is replication. The more documents that can be replicated and used for updating in a succeeding year, the greater the time savings. All forms of internal control documentation can be carried forward and updated. When considering time savings opportunities, however, each form of documentation will require different amounts of time to update.
A memo or an internal control questionnaire has to be re-read in its entirety. We can't simply ask a client what has changed and be satisfied with their answer. We must ask them every question again or read each sentence of the memo as we make inquiries. Going one step further, we normally would perform a systems walk-through procedure to reinforce our understanding. Relating individual documents and procedures to a memo or ICQ is cumbersome at best.
An internal control flowchart is the only form of documentation that can be replicated, easily updated and used as an efficient guide for the systems walk-though procedure. The cliche, "a picture is worth a thousand words," really is true! While initial creation of flowcharts may require a small amount of extra time, replication and reuse in subsequent years will return the investment many times over.
Flowchart preparation time can be saved by using the draw symbols in Word or Excel, or by using flowcharting software such as Visio or other packages. To facilitate preparation, I've created a Flowcharting Guide which I'll email to you upon request. Simply go to my website, www.cpafirmsupport.com and make a request under the Contact Us button.
Planning and using the most effective and efficient internal control documentation is a major key to complying with auditing standards, in the least amount of time! Post a comment and tell us what your internal control documentation preference is and why.