Auditing and Ethics · Risk Assessment and Internal Control

Internal Control Evaluation Tools and Audit Documentation under SA 230

Updated 4 October 2026 · Fact-checked

Auditors record and evaluate internal control using an Internal Control Questionnaire (ICQ), an Internal Control Evaluation (ICE), and flowcharts. Each records how controls work and where they are weak. SA 230 requires the auditor to document the work done, evidence obtained and conclusions reached, so an experienced auditor with no prior link to the audit can understand it.

Understand Internal Control Evaluation Tools and Audit Documentation

Before you test anything, you must understand the client's internal control system. This means knowing how transactions are initiated, authorised, recorded and protected. The auditor then judges whether the controls are well designed and, later, whether they work. This judgment decides how much substantive testing is needed.

Three tools help you record and evaluate controls. The Internal Control Questionnaire (ICQ) is a comprehensive series of questions about the controls in each area, such as purchases or payroll. The questions ask whether a specific control exists. They are usually answered Yes, No or Not applicable. A "No" points to a possible weakness. It is often answered by client staff and reviewed by the auditor, but this is not a fixed rule.

The Internal Control Evaluation (ICE) is also a questionnaire-type tool, but it is built around control objectives. It evaluates the system by asking whether specified control objectives are met, that is, whether a particular error or fraud could occur and go undetected given the controls in place. The main difference is the type of question: the ICQ asks whether specific controls exist, while the ICE asks what could go wrong if a control were absent or failed.

A flowchart is a diagram that shows the flow of documents and activities through a process using symbols and lines. It gives a clear picture of the system, shows duplication or gaps, and is easier to review than long narrative notes. A narrative record is the written description alternative, and a checklist is a list of controls the auditor ticks off as present or absent.

Whatever you do must be documented. SA 230 Audit Documentation requires the auditor to prepare documentation that is sufficient and appropriate. It must let an experienced auditor with no previous connection to the audit understand the procedures performed, the results and evidence obtained, and the significant matters and judgments. Evaluation tools like completed ICQs and flowcharts become part of this documentation.

Key rules to remember

ICQ versus ICE: ICQ = questions asking whether specific controls exist (Yes/No/N/A); ICE = questions asking whether control objectives are met, i.e. whether an error or fraud could occur and go undetected given the controls in place; Tell them apart by the type of question: ICQ asks "Is there a control?", ICE asks "Could this error or fraud happen undetected?". ICQ is often answered by client staff and reviewed by the auditor, but do not treat this as a rule.
Reading an ICQ: Yes = control present; No = possible weakness; N/A = question not relevant; Every "No" should be followed up and its effect on audit procedures considered.
Purpose of a flowchart: Flowchart = graphic record of the flow of documents and activities in a process; It helps spot gaps, duplication and missing checks.
SA 230 objective: Documentation must let an experienced auditor with no previous connection understand the work done, the evidence and the conclusions; This is the test of sufficiency of documentation.
Matters SA 230 expects to be recorded: Nature, timing and extent of procedures + who performed and when + who reviewed and when + results and conclusions; Also record significant matters, judgments and discussions with management.

How to solve Internal Control Evaluation Tools and Audit Documentation questions

For any question on control evaluation tools or documentation, use this sequence.

1Identify what the question asks: define a tool, compare tools, evaluate a given scenario, or state documentation requirements.
2Define the tool in one line, stating its nature and purpose.
3Explain how it works: ICQ questions ask whether specific controls exist and are answered Yes/No/N/A, ICE questions ask whether control objectives are met and whether errors or frauds could go undetected, flowchart as symbols and lines, narrative as written description.
4Apply it to the facts given. Point out the weaknesses a "No" answer or a gap in the flowchart reveals.
5State the effect on the audit: weak controls mean more substantive procedures; strong controls allow testing of controls and reduced substantive work.
6Link to SA 230: say the work, evidence and conclusions must be documented so an experienced auditor can understand them.
7Finish with a one-line conclusion that answers the exact question asked.

Quickest way: Define, differentiate, apply, document

When to use it: Use this when time is short, in both MCQs and written answers.

MCQ: identify the tool by its type of question. Questions asking whether specific controls exist, answered Yes/No/N/A, point to an ICQ. Questions asking whether control objectives are met, or whether an error or fraud could occur and go undetected, point to an ICE. A diagram with symbols and lines is a flowchart.
MCQ: for SA 230, pick the option that mentions an experienced auditor with no previous connection to the audit.
MCQ: a "No" in an ICQ always means a possible weakness, not a confirmed fraud.
Written: use the four-part structure of meaning, working, advantage or limitation, and audit impact. Use short bullet points.
Written: always add a closing line on documentation. It often earns an extra mark.
If the question is a scenario, list each weakness found and the audit response next to it.

Common mistakes in Internal Control Evaluation Tools and Audit Documentation

Treating ICQ and ICE as the same tool.
Both are questionnaire-type tools dealing with controls, and the names sound alike.
Fix: Remember the type of question. ICQ asks whether specific controls exist. ICE asks whether control objectives are met, that is, whether an error or fraud could occur and go undetected given the controls in place.
Saying a "No" answer in an ICQ proves a control failure or fraud.
Students read "No" as final.
Fix: Say it indicates a possible weakness that needs follow-up and may change the audit procedures.
Describing a flowchart without stating its benefit.
Students only write what it is.
Fix: Add that it gives a concise, visual picture, helps spot gaps and duplication, and is easier to review than narrative.
Writing that audit documentation is only for the auditor's own use or only for legal protection.
Students remember one purpose from the standard.
Fix: State that documentation supports the audit plan and report, helps the team direct and review work, and provides evidence that the audit was done as per the SAs.
Forgetting that documentation must show who did the work and who reviewed it, and when.
Students focus on content and overlook identification.
Fix: Include who performed, when completed, who reviewed and the date and extent of review in your answer.

Worked examples

Example 1

Distinguish between an Internal Control Questionnaire and an Internal Control Evaluation. How does each help the auditor?

Show the solution

Meaning of ICQ: a comprehensive series of questions about the internal control system in each area. The questions ask whether a specific control exists and are usually answered Yes, No or Not applicable.
Who answers the ICQ: often client staff, with the auditor reviewing the answers, but this is not a fixed rule.
Help from ICQ: it gives a standard way to collect information on the controls in place and shows weak points where answers are "No".
Meaning of ICE: a questionnaire-type tool framed around control objectives. It asks whether the objectives are met, that is, whether a particular error or fraud could occur and go undetected given the controls in place.
Help from ICE: it shows the auditor where the system could fail to prevent or detect errors and frauds, supports the opinion on the strength of controls and guides the nature, timing and extent of further procedures.
Link to documentation: both are kept in the audit file as per SA 230.

Answer: The ICQ is a comprehensive series of questions asking whether specific controls exist in each area. The ICE is a tool that asks whether control objectives are met, that is, whether errors or frauds could occur and go undetected given the controls in place. The ICQ shows where controls are missing or weak, and the ICE helps decide how much further audit work is needed.

Example 2

In an ICQ for purchases of a trading company, the same person raises purchase orders, receives goods and approves supplier payments. Evaluate the position and state the audit response and documentation requirement.

Show the solution

Identify the weakness: one person performs ordering, custody (receiving) and payment approval. There is no segregation of duties.
State the risk: unrecorded or fictitious purchases, theft of goods and payments to fake suppliers may go undetected.
Classify the answer: the relevant ICQ questions on segregation of duties are answered "No", indicating a significant weakness.
Audit response: treat controls over purchases as not reliable, assess a higher risk of material misstatement, and increase substantive procedures such as vouching purchases to orders, goods received notes and supplier invoices, and confirming supplier balances.
Documentation under SA 230: record the completed ICQ, the weakness found, the risk assessment made, the procedures performed, who performed and reviewed them, and the conclusions reached.

Answer: The lack of segregation of duties is a significant control weakness. The auditor should not rely on purchase controls, should extend substantive testing of purchases and payables, and must document the weakness, the response and the conclusions as required by SA 230.

Exam tips

Questions often ask you to distinguish ICQ from ICE. Use a two-column comparison in bullet form: meaning, type of question, purpose.
For scenario questions, name the weakness first, then the risk, then the audit response. Do not skip the middle step.
Flowcharts are asked as short notes. Cover meaning, symbols and lines, advantages and limitations.
Add an SA 230 line to answers on control evaluation. The standard's test of an experienced auditor with no previous connection is a favourite MCQ point.
In MCQs on this topic, identify the tool by its type of question: "does a control exist?" is ICQ, "could this error or fraud occur undetected, are control objectives met?" is ICE, and a diagram with symbols is a flowchart.

Practice questions from Risk Assessment and Internal Control

Internal Control Evaluation Tools and Audit Documentation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control Evaluation Tools and Audit Documentation: frequently asked questions

What is the main difference between ICQ and ICE?

Both are questionnaire-type tools, but the type of question differs. ICQ is a comprehensive series of questions asking whether specific controls exist, usually answered Yes, No or N/A. ICE is framed around control objectives and asks whether errors or frauds could occur and go undetected given the controls in place.

What is the use of a flowchart in auditing?

A flowchart shows the flow of documents and activities in a process using symbols and lines. It gives a clear picture of the system and helps the auditor spot gaps and duplication. It is also easier to review than long written notes.

What does SA 230 require the auditor to document?

SA 230 requires documentation that lets an experienced auditor with no previous connection to the audit understand the procedures performed, the evidence obtained and the conclusions reached. It also covers significant matters and judgments. The auditor should record who did and who reviewed the work, and when.

How does an auditor evaluate an internal control system?

The auditor first understands the system using tools like ICQ, narrative notes, checklists and flowcharts. Then the auditor assesses whether controls are well designed and, where relied upon, tests whether they operate effectively. The result decides the nature, timing and extent of substantive procedures.