Corporate Accounting and Auditing · Audit Risk, Internal Control, Internal Check and Internal Audit

Internal Control Evaluation: Questionnaire and Flow Chart

Updated 10 October 2026 · Fact-checked

Internal control evaluation is the auditor's review of how well a client's controls prevent or detect errors and fraud. Auditors record the system using a questionnaire, checklist, flow chart or narrative, then run tests of controls. Weak controls lead to more substantive testing; strong controls allow less.

Understand Internal Control Evaluation: Questionnaire and Flow Chart

Before an auditor decides how much testing to do, they must understand the client's control system. This has two parts: first record how the system works, then evaluate whether it is well designed and actually working.

There are four common ways to record the system. A narrative record is a written description of the system, such as how a purchase moves from requisition to payment. It is simple but long and hard to review for gaps. A checklist is a list of control points the auditor ticks off as present or absent. It is quick but gives little understanding of the flow. A flow chart is a diagram that uses symbols to show the path of documents and activities through departments. It shows gaps, such as one person doing two incompatible jobs, at a glance. An internal control questionnaire (ICQ) is a standard set of questions, usually answered Yes, No or Not applicable. A No answer points to a weakness.

A checklist and a questionnaire look alike, but they differ in how they are used. A checklist is a list of points the auditor confirms from observation or inquiry and then ticks. A questionnaire is a set of questions put to the client's staff, and the client's staff usually supply the answers. In many textbooks the two are treated closely, so read the question wording before you decide.

Recording the system only shows how it is meant to work. To confirm it does work, the auditor performs a walkthrough (tracing one transaction through the whole system) and then tests of controls. These test whether a control operated effectively throughout the period. Examples are inspecting evidence of approval on a sample of invoices, re-performing a bank reconciliation, or observing stock counts.

Tests of controls are different from substantive procedures. Substantive procedures test the actual amounts and disclosures in the financial statements, through detailed testing of transactions and balances and through analytical procedures. Tests of controls ask: did the control work? Substantive procedures ask: is the number right? If the evaluation finds strong, effective controls, the auditor can reduce substantive testing. If controls are weak, substantive testing must increase.

Key rules to remember

Purpose of evaluation: Control evaluation → assess control risk → decide nature, timing and extent of substantive procedures; Stronger controls mean lower control risk and less substantive work; weaker controls mean the opposite.
Audit risk model: Audit risk = Risk of material misstatement × Detection risk; Risk of material misstatement combines inherent risk and control risk. Control evaluation helps assess control risk.
Questionnaire answer rule: Yes = control present; No = possible weakness; Design questions so that Yes is always the good answer. Each No needs follow-up.
Test of controls vs substantive procedure: Tests of controls → operating effectiveness of controls; Substantive procedures → amounts and disclosures; Substantive procedures include tests of details and analytical procedures.

How to solve Internal Control Evaluation: Questionnaire and Flow Chart questions

Use this order for any question on evaluating internal control or comparing methods.

1Identify what is asked: a method description, a comparison, a weakness-finding task or a test-design task.
2Name the method correctly (narrative, checklist, questionnaire, flow chart) and define it in one line.
3Give its working: who completes it, what format it takes, and how weaknesses appear.
4State one advantage and one limitation, linked to the method.
5If a scenario is given, trace the process and list weaknesses, such as no segregation of duties, no authorisation or no reconciliation.
6For each weakness, state the risk and the audit response, such as a test of controls or a larger substantive sample.
7Close by linking the evaluation to the nature, timing and extent of further audit procedures.

Quickest way: Four-line comparison approach

When to use it: Use this for short notes, differences or MCQs asking which method suits a situation.

Narrative = written description; Checklist = tick-list of controls; Questionnaire = questions with Yes/No/NA; Flow chart = diagram with symbols.
Pick the method by the clue: diagram or gaps at a glance means flow chart; Yes/No answers mean questionnaire.
Pick tests of controls when the question is about whether a control operated; pick substantive procedures when it is about amounts or balances.
Add the consequence: weak control means more substantive testing.

Common mistakes in Internal Control Evaluation: Questionnaire and Flow Chart

Treating tests of controls and substantive procedures as the same thing.
Both are audit tests and both collect evidence.
Fix: Tests of controls check whether a control worked during the period. Substantive procedures check the figures. Write the objective of each in your answer.
Saying a flow chart tests controls.
The diagram looks like analysis, so students think it proves controls work.
Fix: A flow chart only records the system. Operation is confirmed by a walkthrough and tests of controls.
Reading a No answer in a questionnaire as a proven error.
Students link a No directly to a mistake in the accounts.
Fix: A No shows a possible weakness and a higher risk. It calls for more testing, not a conclusion that an error exists.
Giving only advantages of a method and no limitations.
Students memorise the positive points.
Fix: Add a limitation each time. For example, a questionnaire may be answered carelessly, and a narrative can be long and hard to review.
Concluding that good controls mean no substantive testing.
Students overstate the link between strong controls and reduced testing.
Fix: Strong controls reduce substantive testing but never remove it, especially for material balances and significant risks.
Skipping the audit response in scenario questions.
Students list weaknesses and stop.
Fix: For every weakness, add what the auditor will do, such as expand the sample or test the control directly.

Worked examples

Example 1

Compare the internal control questionnaire and the flow chart as methods of recording a client's internal control system.

Show the solution

Define the questionnaire: a standard set of questions on controls, answered Yes, No or Not applicable, usually by the client's staff.
Define the flow chart: a diagram that uses symbols to show how documents and activities move between people and departments.
Advantage of questionnaire: it is comprehensive and quick to use, and a No answer flags a weakness.
Limitation of questionnaire: answers may be careless or inaccurate, and it does not show the overall flow of the system.
Advantage of flow chart: it gives a clear picture, and gaps such as missing authorisation or no segregation of duties are seen quickly.
Limitation of flow chart: it takes skill and time to prepare, and a complex system makes it hard to read.
Conclude: neither proves that controls work. Both must be followed by a walkthrough and tests of controls.

Answer: The questionnaire records the system through Yes/No questions and highlights weaknesses through No answers, while the flow chart records it as a diagram showing the path of documents. Both record design only. Operation is confirmed by tests of controls.

Example 2

In a client's purchase cycle, the same employee raises purchase orders, receives goods and approves supplier payments. Explain the weakness, the likely risk and how the auditor should respond.

Show the solution

Identify the weakness: one person performs initiation, custody and authorisation duties, so segregation of duties is absent.
State the risk: fictitious purchases, theft of goods or payment to bogus suppliers can occur and go unnoticed.
A flow chart or questionnaire would reveal this: the chart shows one person at every stage, and the questionnaire gives a No to 'Are duties segregated?'.
Assess control risk for purchases as high.
If a compensating control exists, such as independent manager review of payments, test it; otherwise expand substantive procedures.
If no compensating control is found, expand substantive procedures: examine more purchase invoices and goods received notes, confirm balances with suppliers and perform analytical procedures on purchases.
Document the weakness and consider reporting it to management.

Answer: The lack of segregation of duties raises control risk in the purchase cycle. If a compensating control exists, such as independent manager review of payments, the auditor should test it; otherwise the auditor should expand substantive testing of purchases and payables. The weakness should also be reported to management.

Exam tips

For 'distinguish' questions, use two columns of points in the same order: meaning, who prepares, format, advantage, limitation.
In MCQs, spot the keyword: diagram or symbols means flow chart; Yes/No means questionnaire; ticking means checklist; written description means narrative.
Always link the evaluation to the next step: tests of controls, then the revised nature, timing and extent of substantive procedures.
In scenario questions, name the weakness, the risk and the audit response. Each part earns marks.
Keep definitions short so you have time for the application, which carries most of the marks.

Practice questions from Audit Risk, Internal Control, Internal Check and Internal Audit

Internal Control Evaluation: Questionnaire and Flow Chart in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Internal Control Evaluation: Questionnaire and Flow Chart: frequently asked questions

What is the difference between an internal control questionnaire and a checklist?

A questionnaire is a set of questions answered Yes, No or Not applicable, usually by client staff. A checklist is a list of control points that the auditor confirms and ticks off. Some books treat them almost alike, so follow the definition in the question.

Which method is best for evaluating internal control?

No single method is best. A flow chart gives a clear picture of the flow, a questionnaire is thorough, and a narrative suits small clients. Auditors often combine methods and then perform tests of controls.

What is the difference between tests of controls and substantive procedures?

Tests of controls check whether a control operated effectively during the period. Substantive procedures check the amounts and disclosures in the financial statements, through tests of details and analytical procedures.

What is a walkthrough in internal control review?

A walkthrough means tracing one or a few transactions from start to finish through the system. It confirms that your record of the system is correct and that the controls work as described.