r

AE Form No.7

Internal Control Questionnaire/Checklist

AUDIT ENGAGEMENT TITLE:

AUDIT ENGAGEMENT NO :

Audit Objective No.

ICC No
Ref. # Control Technique Yes SOG CC Remarks
Control Objectives: CORS (acronym)

Control Environment

Risk Assessment

Control Activities
Manual or Guidelines

Review of Performance Measures and Indicators

Information and Communication

Controls Over Information Processing

Accurate and Timely Recording of Transactions and Events

.
Access Restrictions to and Accountability for Resources and Records

Monitoring

Accomplished by: Administered by:

Signature: Signature:
Name: Name:
Position/Designation: Position/Designation
Office: Office:

Objectives of the Template:

 verify existence of some policies
 check whether a particular control exists or not
 document the control activities in place
 appraise the design of the IC system (completeness)
 determine audit focus
 make improvements

How to prepare an ICC/ICQ:

 An ICQ/ICC should carry basic information such as: 
 Name of the document (ICQ/ICC) 
 Agency/ auditee to whom it relates
 System to which it relates (e.g. procurement)
 Period under review
 Control objectives which should be achieved

 An ICQ /ICC should provide columns for: 

 Yes
 No- if not without CC, should be written in the column of SOG
 Not Applicable answers or Not Sure
 Comments where neither Yes or No are applicable, indicating the significance or otherwise
of apparent weaknesses

 An ICQ should have: 

 Names and positions of who accomplished the ICQ
 Names and positions of who administered the ICQ. 
 Evaluate the adequacy of the control design and formulate question for any potential gap.
 The questions should be crafted to obtain information on the attributes and effectiveness of
internal controls, with follow-up questions to validate the previous answers

How to administer ICC/ICQ:

• Before preparing the ICQ/ICC, target respondents should first be identified within the strategic
requirements of the information gathering and for the conduct of orientation to set a common
understanding and language.

How to validate answers to ICC/ICQ:

 “No” answers without compensating controls should be identified as control deficiencies and
should be written in the SOG and their root cause/s determined before courses of action are
recommended in the interim report. Their content should eventually be included in the Interim
Report and the Final Audit Report.
 “Yes” answers to questions would require submission of evidence by the personnel concerned
or gathering of evidence by the auditor to validate such answer.
 “No” answers with compensating controls will be subject to test of controls/validation.