Corporate Accounting and Auditing · Report on Internal Financial Control over Financial Reporting

Auditor's Procedures and Testing of Controls for IFC over Financial Reporting

Updated 10 October 2026 · Fact-checked

The auditor audits internal financial controls by planning, understanding how transactions flow, evaluating whether controls are well designed, testing whether they operated effectively, and then grading any deficiencies. A deficiency that could cause a material misstatement to go undetected in time is a material weakness, which leads to an adverse IFC opinion.

Understand Auditor's Procedures and Testing of Controls

Internal financial controls over financial reporting (IFCoFR) are the policies and procedures a company uses to prepare reliable financial statements, safeguard assets and prevent or detect errors and fraud. Under the Companies Act, 2013 the statutory auditor reports on whether the company has adequate IFC and whether they operated effectively. The auditor's job is to gather evidence for that opinion.

The work follows a logical sequence. First you plan and decide which risks matter. Then you understand the flow of transactions from origin to the financial statements. Next you evaluate design: would this control, if it worked, stop or catch a material error? Then you test operating effectiveness: did it actually work through the period? Finally you evaluate deficiencies and form your opinion.

A walkthrough is the key tool for understanding flow. You pick one transaction and trace it end to end, through each document, system and approval, asking staff to explain what they do and observing it. It confirms that you understand the process and that controls exist as described.

Design and operation are different questions. A control can be well designed but not followed, or followed but badly designed. Design is assessed by inquiry, observation and inspection. Operating effectiveness needs tests on a sample across the period, such as re-performance, inspection of evidence of approval, or observation.

Not every failure has the same weight. A control deficiency exists when a control does not allow timely prevention or detection of misstatements. A significant deficiency is less severe than a material weakness but important enough to merit attention of those charged with governance. A material weakness means there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis.

Key rules to remember

Control deficiency: Control missing, badly designed, or not operating as designed → misstatement may not be prevented or detected on time; Lowest level. Report to management; it does not by itself change the opinion.
Material weakness: Deficiency (or combination) + reasonable possibility of material misstatement not prevented or detected on a timely basis; Leads to a modified (adverse) opinion on the adequacy of the IFC system and/or its operating effectiveness, depending on whether the weakness lies in design, operation or both.
Significant deficiency: Deficiency less severe than a material weakness but important enough for those charged with governance; Communicate to the audit committee or board. Does not by itself make the opinion adverse.
Severity judgement framework: Severity depends on the likelihood of misstatement and the magnitude of the potential misstatement (a judgement, not a literal multiplication); Judged on potential, not on whether a misstatement actually occurred. Consider compensating controls.
Audit sequence: Plan → Understand flow (walkthrough) → Evaluate design → Test operating effectiveness → Evaluate deficiencies → Report; Use this order as the skeleton of any descriptive answer.

How to solve Auditor's Procedures and Testing of Controls questions

For any question on procedures or deficiencies, follow the audit sequence and tie each step to evidence and its conclusion.

1Identify what is asked: the procedure steps, a test of one control, or grading of a deficiency.
2State planning points: materiality, significant accounts and assertions, and risk of material misstatement.
3Describe the walkthrough: trace one transaction from initiation to the ledger and financial statements, noting controls at each point.
4Evaluate design: name the control, the risk it addresses, and whether it can prevent or detect the error.
5Test operating effectiveness: choose the nature (inquiry, observation, inspection, re-performance), timing and extent of sample.
6Grade each deficiency using likelihood and magnitude as a judgement, and consider compensating controls.
7Conclude: control deficiency, significant deficiency or material weakness, and state the effect on the IFC report.
8Mention communication to management and those charged with governance, and documentation.

Quickest way: Design, then operation, then severity

When to use it: Use for short case questions that describe a control failure and ask for its classification or the auditor's response.

Ask: is the control missing or badly designed, or designed well but not followed?
Name the risk it was meant to cover and the account affected.
Ask whether a material error could go unnoticed: if reasonably possible, it is a material weakness.
Check for a compensating control that reduces the risk.
Write the conclusion and its effect on the report in one line.

Common mistakes in Auditor's Procedures and Testing of Controls

Treating a walkthrough as a test of operating effectiveness over the whole year.
Both involve looking at real transactions.
Fix: Say a walkthrough confirms understanding and design for one transaction; operating effectiveness needs a sample across the period.
Grading a deficiency only on whether a misstatement actually occurred.
Students look at the actual outcome.
Fix: Grade on the reasonable possibility and potential magnitude of misstatement, even if none has occurred.
Calling every deficiency a material weakness.
The terms sound alike.
Fix: Use the three levels: deficiency, significant deficiency, material weakness. Only the last forces an adverse opinion.
Ignoring compensating controls.
Students assess each control in isolation.
Fix: Check whether another control would catch the error on time before grading severity.
Skipping the design evaluation and testing straight away.
Testing feels like the real audit work.
Fix: Evaluate design first. Testing a badly designed control wastes effort because it cannot be effective.
Forgetting communication and documentation.
Answers stop at the opinion.
Fix: Add that deficiencies are communicated to management and those charged with governance and documented in working papers.

Worked examples

Example 1

List the steps an auditor follows in auditing internal financial controls over financial reporting of a company, and explain the role of a walkthrough.

Show the solution

Planning: understand the business, set materiality, identify significant accounts and risks of material misstatement.
Understand the flow of transactions: map each significant process from initiation to financial statements.
Walkthrough: trace one transaction end to end by inquiry, observation and inspection of documents; this confirms the process and the controls in it.
Evaluate design: judge whether each key control can prevent or detect a material error.
Test operating effectiveness: sample transactions across the period and use re-performance, inspection and observation.
Evaluate deficiencies: grade them as deficiency, significant deficiency or material weakness.
Report: give the IFC opinion and communicate deficiencies to management and those charged with governance.

Answer: The steps are planning, flow understanding, design evaluation, operating tests, deficiency evaluation and reporting. A walkthrough confirms understanding of the process and whether controls exist as described, but does not prove they worked all year.

Example 2

In Sharma Textiles Ltd, purchase invoices are paid without matching to goods received notes. The accounts head reviews monthly payables only for totals. Purchases are material. The auditor finds several invoices paid for goods never received. Classify the issue and state the effect on the IFC report.

Show the solution

Control: three-way matching of invoice, order and goods received note is missing, so the design is inadequate.
Risk: payment for goods not received leads to overstated purchases and payables, and possible fraud or loss of assets.
Likelihood: actual instances were found, so a misstatement is reasonably possible.
Magnitude: purchases are material, so the potential error is material.
Compensating control: a monthly review of totals only would not detect individual wrong payments, so it does not compensate.
Conclusion: the combination of missing control and material exposure is a material weakness.

Answer: It is a material weakness in the purchases-to-payment process. The auditor should give an adverse opinion on the IFC: the company did not have adequate IFC for the purchases-to-payment process, and the controls were not operating effectively. The matter should also be communicated to management and those charged with governance.

Exam tips

In descriptive answers, write the steps in the audit sequence and add one line on evidence for each; this earns step marks.
For MCQs, remember the order of severity: deficiency, significant deficiency, material weakness. Only material weakness leads to an adverse IFC opinion.
Always separate design evaluation from operating effectiveness testing; examiners test this difference often.
In case questions, grade on potential misstatement and mention compensating controls before concluding.
End with communication and documentation to complete the answer.

Practice questions from Report on Internal Financial Control over Financial Reporting

Auditor's Procedures and Testing of Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Auditor's Procedures and Testing of Controls: frequently asked questions

What is the difference between a significant deficiency and a material weakness?

A material weakness means there is a reasonable possibility that a material misstatement will not be prevented or detected on time. A significant deficiency is less severe but still deserves attention of those charged with governance. A material weakness leads to an adverse IFC opinion, while a significant deficiency by itself does not.

What is a walkthrough in testing internal financial controls?

It is tracing one transaction from start to finish through the process, using inquiry, observation and inspection. It helps the auditor confirm understanding of the flow and that the controls exist as described.

How does the auditor test operating effectiveness?

The auditor selects a sample of transactions across the period and checks whether the control was applied, using inspection, re-performance, observation and inquiry. The nature, timing and extent depend on the risk.

Does a control deficiency always affect the audit opinion?

No. A simple deficiency is reported to management and may not change the opinion. The opinion is affected when deficiencies, alone or combined, amount to a material weakness.