Skip to content

Audit and Assurance · The use and evaluation of systems of internal control by auditors

Understanding the Entity's Internal Controls for ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

Auditors understand internal controls by finding out how the control environment and systems are designed and whether they are in place. They use inquiry, observation, inspection and walkthrough tests, then record the system using narrative notes, flowcharts, ICQs or ICEs. This understanding drives risk assessment and the audit approach.

Understand Understanding the Entity's Internal Controls

An entity's internal control system is the set of policies and procedures management sets up to run the business, protect assets, keep records reliable and comply with laws. The auditor does not design it. The auditor needs to understand it.

Under ISA 315, you obtain an understanding of the control environment and the entity's risk assessment and monitoring processes. You also look at the information system and the control activities relevant to the audit. For each relevant control you ask two things: is it designed well enough to prevent or detect misstatement, and has it been implemented, meaning is it actually in use? Whether it operated effectively all year is a different question. That is tested later by tests of controls.

To gather this understanding you use inquiry of staff, observation of procedures, inspection of documents and walkthrough tests. A walkthrough follows one transaction from start to finish through the system, for example a sales order from receipt to cash banking. You ask staff to explain each step and you look at the documents. It confirms that your understanding is right and that the controls exist.

You then record what you learnt. There are four common methods:

  • Narrative notes: a written description of the system. Quick and flexible, but hard to follow for complex systems and easy to leave gaps.
  • Flowcharts: a diagram using symbols and arrows to show the flow of documents and processes. Easy to see missing controls and segregation of duties, but time-consuming to draw and update.
  • Internal control questionnaire (ICQ): a list of questions about whether controls exist. A "no" answer shows a weakness. Standard and quick to use, but it can encourage a mechanical approach and may miss unusual controls.
  • Internal control evaluation questionnaire (ICE): asks what the control objective is and which controls should be in place, then what is missing. It focuses on whether the system would prevent or detect errors, so it helps directly with identifying weaknesses.

The difference to remember: an ICQ asks "Does the control exist?" (yes or no answers about controls). An ICE asks "Are the control objectives met?" and lists the controls expected, so a missing control shows a deficiency at once.

Key rules to remember

Two questions on each control
Understanding = Design (is it suitable?) + Implementation (is it in use?)
Operating effectiveness over the period is a separate matter, tested by tests of controls.
Walkthrough test
One transaction traced from initiation → recording → reporting
Used to confirm understanding and that controls are implemented. It is not enough on its own to prove controls operate effectively.
ICQ vs ICE
ICQ: "Is the control there?" | ICE: "Is the objective met, and what control is missing?"
Both highlight weaknesses. ICE is aimed at the control objectives.
Documentation methods
Narrative notes | Flowcharts | ICQ | ICE
Choose by system size and complexity. Often more than one is combined.

How to solve Understanding the Entity's Internal Controls questions

Use this method for any question on understanding and documenting controls.

  1. 1Read the requirement and note exactly what is asked: methods of obtaining understanding, methods of documenting, or advantages and disadvantages of one method.
  2. 2Identify the system or area in the scenario (for example sales, payroll, purchases) and the size and complexity of the entity.
  3. 3For obtaining understanding, list the techniques: inquiry, observation, inspection of documents and walkthrough tests. Apply each to the scenario.
  4. 4For documenting, pick the method that fits: narrative for simple systems, flowcharts for complex ones, ICQ or ICE for standard checks of controls.
  5. 5Tie each point to the scenario. Name the actual staff, documents and steps given, rather than writing general theory.
  6. 6Say why it matters: the understanding supports risk assessment, identifies deficiencies and decides whether to test controls.
  7. 7Use short headed points, one point per mark, and check you have enough distinct points for the marks.

Quickest way: Four-methods comparison grid

When to use it: Use when a question asks you to compare or choose between documentation methods, or to explain a walkthrough test.

  1. Write the four method names down the page: narrative, flowchart, ICQ, ICE.
  2. For each, jot one advantage and one disadvantage in a few words.
  3. Add one line on walkthroughs: trace one transaction, confirm design and implementation.
  4. Match the method to the scenario: simple small entity suits narrative, complex multi-step system suits flowcharts.
  5. Finish with the link: understanding leads to risk assessment and then the audit approach.

Common mistakes in Understanding the Entity's Internal Controls

  • Saying a walkthrough test proves controls operated effectively all year.

    Students confuse it with a test of controls.

    Fix: State that a walkthrough confirms understanding, design and implementation for one transaction. Operating effectiveness needs tests of controls on a sample.

  • Treating ICQ and ICE as the same thing.

    The names are similar and both are questionnaires.

    Fix: Say an ICQ asks whether specific controls exist, while an ICE asks whether control objectives are met and what controls are missing.

  • Describing the methods without any advantages or disadvantages.

    Students memorise definitions only.

    Fix: For each method give at least one strength and one weakness, such as flowcharts being clear but slow to draw.

  • Giving generic answers that ignore the scenario.

    Students rush to write what they learnt.

    Fix: Use the entity's own details, such as its size, IT system and named staff, and say which method suits them and why.

  • Confusing understanding of controls with testing of controls.

    Both happen in the audit and use similar words.

    Fix: Remember the order: understand and document first at the planning stage, then test controls only if you plan to rely on them.

Worked examples

Example 1

Eastgate Ltd is a small company with a simple sales system and two accounts staff. Explain how the auditor would obtain an understanding of the sales system and which documentation method would suit best. (6 marks)

Show the solution
  1. Techniques: the auditor inquires of the sales manager and accounts staff how orders are taken, approved, despatched and invoiced.
  2. Observation: the auditor watches goods being despatched and invoices raised.
  3. Inspection: the auditor looks at sales orders, despatch notes and invoices to see they are used and cross-referenced.
  4. Walkthrough: the auditor traces one sales order from receipt through despatch, invoicing, recording and cash receipt to confirm the understanding and that controls are in place.
  5. Documentation: the system is simple, so narrative notes suit best. They are quick to prepare and easy to update.
  6. Caveat: narrative notes can leave gaps, so the auditor should check them against the walkthrough and consider a brief flowchart if the system is more complex than expected.

Answer: Use inquiry, observation, inspection and a walkthrough of one sales transaction to confirm design and implementation. Narrative notes suit this simple system because they are quick and flexible, but they should be checked for gaps.

Example 2

Explain the difference between an ICQ and an ICE, and give one advantage and one disadvantage of each. (6 marks)

Show the solution
  1. ICQ: a standard list of questions asking whether specific controls exist, answered yes or no. A "no" signals a possible weakness.
  2. ICQ advantage: quick to complete and gives a standard approach across clients.
  3. ICQ disadvantage: can become mechanical and may miss unusual controls or compensating controls.
  4. ICE: sets out the control objectives, asks what controls should achieve them, and identifies where controls are missing.
  5. ICE advantage: highlights deficiencies directly, because each objective not met shows a missing control.
  6. ICE disadvantage: needs more judgement and skill to complete, and so takes longer to prepare.

Answer: An ICQ asks whether controls exist; an ICE asks whether control objectives are met and which controls are missing. ICQ is quick but mechanical. ICE shows deficiencies directly but needs more skill and time.

Exam tips

  • In Section C, give a point for each technique and each documentation method, then link it to the scenario to earn the mark.
  • In Section A and B objective questions, watch the wording: walkthrough confirms design and implementation, not operating effectiveness.
  • If asked to recommend a documentation method, always justify with the system's size and complexity.
  • Do not drift into tests of controls or control weaknesses unless the requirement asks for them.
  • Keep advantages and disadvantages balanced when asked to evaluate a method.

Understanding the Entity's Internal Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Understanding the Entity's Internal Controls: frequently asked questions

What is a walkthrough test in audit?

It is tracing one transaction through the system from start to finish. You ask staff to explain each step and inspect the documents. It confirms your understanding and that the controls are implemented.

What is the difference between an ICQ and an ICE?

An ICQ asks whether specific controls exist, with yes or no answers. An ICE asks whether control objectives are met and which controls are missing. The ICE therefore points more directly to deficiencies.

When should auditors use flowcharts instead of narrative notes?

Flowcharts suit larger or more complex systems where many steps and documents are involved. They show missing controls and segregation of duties clearly. Narrative notes suit simple systems.

Does understanding controls mean the auditor will rely on them?

No. Understanding is needed for risk assessment on every audit. The auditor only tests and relies on controls if they appear well designed and relying on them is efficient, or if substantive procedures alone are not enough.