Internal and Forensic Audit · Internal Audit Engagements and Planning

Understanding the Entity and Internal Controls in Internal Audit

Updated 11 October 2026 · Fact-checked

Understanding the entity means learning the auditee's business, industry, processes, risks and control environment before you plan. You then evaluate how controls are designed and whether they operate. This evidence sets the scope, depth and resources of the engagement, and it focuses testing on high-risk areas.

Understand Understanding the Entity and Internal Controls

An internal audit plan built without knowing the business is a guess. Before you decide what to test, you must know what the auditee does, how it earns and spends, who runs it, what rules bind it and what can go wrong.

Start with the entity and its environment. Look at the industry, regulation, ownership, products, locations, systems, key people and recent changes such as acquisitions, new software or new laws. Look at past audit reports and the deficiencies found and fixed. Talk to management and process owners.

Next, understand internal control. The control environment is the base: management's attitude to control, ethics, structure, authority and accountability. Above it sit risk assessment, control activities (approvals, reconciliations, segregation of duties, access limits), information and communication, and monitoring. Weak tone at the top weakens every other control.

Then evaluate controls in two steps. First, design: would this control, if it works, prevent or catch the risk? Second, implementation and operating effectiveness: is it in place, and does it work consistently through the period? Walkthroughs, questionnaires, flowcharts and inquiry help with design. Testing samples helps with operation.

The result drives planning. Strong controls allow lighter testing. Weak controls in a high-risk area call for more testing, senior staff and more time. SA 300 requires the auditor to identify the characteristics that define scope, consider factors that direct the team's efforts and ascertain the resources needed. These are external-audit standards, but the same logic applies when you plan an internal audit.

Key rules to remember

Scope of internal audit activities (SA 610, A1): Governance + Risk management + Internal control (evaluation of controls, examination of financial and operating information, review of operating activities, review of compliance); Use this list to show what an internal audit function typically covers and so what you must understand about the auditee.
Overall audit strategy (SA 300, para 7): Scope characteristics + Reporting objectives and timing + Significant factors directing the team + Preliminary activities + Resources (nature, timing, extent); Understanding the entity feeds each of these five items.
Audit plan contents (SA 300, para 8): Risk assessment procedures + Further audit procedures at assertion level + Other procedures required by the SAs; Strategy sets direction. The plan details the procedures.
Control evaluation sequence: Understand → Document → Assess design → Test operation → Conclude on reliance → Adjust the audit programme; A working order, not a quoted rule. Always keep design and operation separate.
Competence and objectivity factors (SA 610, A8, A32): Competence: resources, hiring and training policies, technical proficiency, knowledge of the framework, professional bodies. Objectivity: organisational status, family or personal relationships, association with the area audited, significant financial interests; Apply when judging whether an internal audit function's work can be relied on.

How to solve Understanding the Entity and Internal Controls questions

Use this order for any question on understanding the auditee or evaluating controls. It shows the examiner provision, analysis and conclusion.

1Read the facts and note the entity type, industry, size, recent changes and any hint of control weakness.
2List what you must understand: business and industry, regulation, processes, systems, people, past findings and risks.
3Identify the control environment and the control activities in the facts, such as approvals, segregation of duties and access.
4Assess design for each key risk: would the control prevent or detect the error or fraud if it worked?
5State how you would test operation: walkthrough, inquiry, observation, inspection and re-performance on samples.
6Link your findings to planning: scope, areas of higher risk, staffing, time budget and testing depth.
7Conclude clearly, for example which controls you will rely on, which you will not, and what you will report to management.

Quickest way: Entity, Environment, Control, Plan (E-E-C-P)

When to use it: Use when time is short or the question is a short case with a request to advise or list points.

Entity: name the business, industry and key changes in one line.
Environment: state the control environment and any weakness in tone, structure or authority.
Control: for each risk, say whether design is adequate and how you would test operation.
Plan: state the effect on scope, resources and testing depth, then conclude.

Common mistakes in Understanding the Entity and Internal Controls

Treating understanding the entity as a one-line formality.
Students rush to the testing procedures because they feel more technical.
Fix: Spend a paragraph on business, industry, regulation, systems and past findings, and show how each shapes the plan.
Mixing design evaluation with operating effectiveness.
Both are called control evaluation, so they blur.
Fix: Answer in two parts: is the control suitably designed, and does it work throughout the period.
Listing control components without applying them to the facts.
Students memorise a framework and recite it.
Fix: Tie each component to a fact in the case, such as a missing approval or shared passwords.
Assuming strong controls mean no testing.
Students overstate reliance on controls.
Fix: Say that strong controls reduce the extent of testing but do not remove it. Tests still confirm that controls operate.
Ignoring the objectivity and competence of the internal audit function when relying on its work.
Students focus on the auditee and forget the auditor.
Fix: Check resources, training, proficiency and threats such as personal relationships, association with the area audited and financial interests.
Giving a conclusion that does not change the plan.
Answers end with findings instead of consequences.
Fix: End with how scope, staffing, timing and sample sizes will change.

Worked examples

Example 1

Sunrise Textiles Ltd., a Surat manufacturer, has just implemented a new ERP system and appointed a new CFO. The purchase team raises and approves its own purchase orders. Advise how you will use your understanding of the entity to plan the internal audit of purchases.

Show the solution

Understand the entity: a manufacturer whose raw material purchases are material. Two recent changes, a new ERP and a new CFO, raise risk.
Control environment: a new CFO may change policies and tone. Review whether authority and responsibility are clearly defined.
Control design: the same team raising and approving purchase orders breaks segregation of duties. A control that should prevent unauthorised or fictitious purchases is weak.
ERP risk: check migration of master data, user access, approval workflows and the audit trail.
Testing: walk through a purchase cycle, then test a larger sample of orders for approval, vendor validity, price and receipt of goods.
Planning: treat purchases as a higher-risk area, assign experienced staff, allow more time and include IT review.

Answer: Treat purchases as high risk. The design weakness (no segregation of duties) and the ERP and management changes call for wider scope, larger samples, experienced staff and an IT-controls review. Report the weakness and recommend separating raising and approval of orders.

Example 2

An internal auditor wants to rely on the work of the auditee's in-house compliance team on statutory returns. List the factors you would consider before relying on it.

Show the solution

Identify the work: the compliance team reviews compliance with laws and management policies, an activity that SA 610 (A1) lists among internal audit activities.
Competence: check whether the team is adequately resourced, whether it has hiring and training policies, adequate technical proficiency, knowledge of the framework and membership of professional bodies.
Objectivity: check organisational status and reporting line, family or personal relationships with the area audited, association with the department concerned and significant financial interests.
Function test: staff with operational or managerial duties outside an internal audit function usually face threats to objectivity that preclude treating them as part of that function.
Decision: rely only to the extent competence and objectivity are established. Re-perform a sample of the work.

Answer: Rely on the team only after assessing competence (resources, training, proficiency, knowledge, professional membership) and objectivity (status, relationships, association, financial interests). If the team has operational duties in the area, its work is not treated as internal audit work. Test its work on a sample.

Exam tips

In case questions, use the facts to name the entity changes, the weak control and the plan impact. Generic lists earn fewer marks.
Show the sequence: understand, assess design, test operation, adjust the plan.
Quote the SA 610 and SA 300 lists, such as competence and objectivity factors or the strategy items, only as support, and apply them to the case.
Open book electives still need speed. Prepare a one-page note of the control components and the E-E-C-P method.
End each answer with a conclusion and a practical recommendation to management.

Practice questions from Internal Audit Engagements and Planning

Understanding the Entity and Internal Controls in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Understanding the Entity and Internal Controls: frequently asked questions

Why must an internal auditor understand the entity before planning?

Risks, processes and controls differ across entities. Understanding them tells you where errors and fraud are likely, so you can set scope, resources and test depth sensibly.

What is the difference between evaluating control design and operating effectiveness?

Design asks whether a control would prevent or detect a risk if it worked. Operating effectiveness asks whether it actually worked consistently during the period. You test them differently.

What is the control environment?

It is the foundation of internal control. It covers management's attitude to control, ethics, organisational structure and assignment of authority. Weakness here affects all other controls.

Does SA 300 apply to internal audit?

SA 300 governs the audit of financial statements, but its planning logic is a useful model for internal audit. Use it for strategy, plan and resources, and say so in your answer.