Probable areas of attack w.r.

t internal control for a external audit are

1. External auditor has to comment when the audit could not determine the significance and
the sensitivity of the risk for which controls are being assessed.
2. When audit could not assess the susceptibility to misuse of resources, failure to attain
objectives regarding ethics, economy, efficiency and effectiveness, or failure to fulfill accountability
obligations, and non-compliance with laws and regulations.
3. When audit could not identify and understand the relevant internal controls.
4. When audit could not determine what is already known about control effectiveness.
5. When audit could not assess the adequacy of the control design .
6. When audit could not determine through testing , if controls are effective
7. When the reporting on the internal control assessments and necessary corrective actions
can not be made with reasonable accuracy .