A company’s internal controls play a significant role in whether its financial information is reliable. For both external and internal auditors, these controls are highly critical. Before starting their audit process, auditors will assess the company’s internal controls. During this process, they aim to identify any weaknesses or deficiencies that may make the financial information unreliable.
Usually, auditors need to have an understanding of the company’s internal controls to assess it. During this process, they may use several tools or procedures. For example, auditors can use walkthrough tests or enquiries to understand how the company’s internal controls work. Once they do so, they will look at how efficient and effective these controls are. For that, they will use an internal control questionnaire to compare the existing controls with standards.
What is an Internal Audit Questionnaire?
An internal audit questionnaire (ICQ) is a formal document that includes a company’s internal controls. This documents also includes questions regarding how efficient or effective these controls are. As mentioned, these questions relate to how the existing internal controls fare against a standard. This standard usually comes from the COSO framework.
Internal audit questionnaires have several uses, both for internal and external auditors. Usually, auditors use it for large companies to evaluate their internal controls. For external auditors, this information is critical because it defines the reliability of the financial information. ICQs also include a company’s internal control deficiencies, which is crucial for internal auditors.
What are the Limitations of Internal Control Questionnaires?
Despite its many advantages, internal control questionnaires have several limitations. These limitations may stem from how auditors use these documents or how the management responds. Usually, ICQs work better if auditors obtain a company’s internal control systems beforehand. If they fail to do so, the process may not be as effective.
Apart from the above, some of the other limitations of internal control questionnaires are as below.
Can Become Complex
Internal control questionnaires help auditors audit large and complex companies. However, as the process gets more complex, ICQs also become complicated. More internal controls mean that auditors have to consider various factors. Therefore, the audit process can become complex and lengthy. For most audits, more time also adds up to higher costs.
In some cases, internal control questionnaires may also become too formalized. Some auditors may end up the place too much reliance on this process. Due to this, they will lose track of what is more important. Internal control questionnaires help auditors evaluate a client’s internal controls. However, when they place overreliance on it, they will make the process more complex than necessary.
May Include Incomplete Information
Internal control questionnaires require auditors to collect information from several sources. Sometimes, these sources may not provide the most complete or correct information. Usually, auditors must use their professional judgment to decide on whether the information is whole. In some circumstances, however, that may not be possible.
Once auditors allow incomplete information to become a part of the ICQ, the information may not be beneficial anymore. Therefore, internal control questionnaires are highly sensitive to any information that auditors collect. Since auditors make various decisions based on this information, any incompleteness can be highly critical.
Overlooks Some Areas
When auditors use internal control questionnaires, they focus on the client’s internal control systems. In some circumstances, they may only rely on these areas to establish the system’s reliability. Therefore, they may overlook some essential areas which can be critical. It is one of the inherent limitations of the internal control questionnaires. Auditors cannot expect to cover every area at a company.
Similarly, internal control questionnaires are standardized internal control documentation tools. By limiting auditors to a set of standard questions, the ICQ may also only apply to typical internal control systems. If a client’s internal controls include unusual procedures, the ICQ will not be effective. Therefore, auditors may also miss out on those controls.
Depends on Enquiry
Another inherent limitation of the internal control questionnaire is that it depends on enquiry. When auditors fill out an ICQ, they need to obtain information from the management. However, the management may overstate their internal controls to pass the test. Therefore, internal control questionnaires are easily manipulatable by the client’s management.
Even when controls are not sufficient, the presence of an auditor may prompt employees to demonstrate otherwise. In these cases, the auditor may believe the controls are appropriate and efficient. In actuality, however, the internal controls may not be sufficient. In this case, the internal control questionnaires may not be an appropriate documentation tool.
Conclusion
Internal control questionnaires play a significant role in documenting a company’s internal controls. For auditors, ICQs can be highly beneficial. However, these questionnaires may have some limitations. ICQs can become complex, include incomplete information, overlook some areas, and usually depend on enquiry. All of these are the limitations of ICQs.
