Internal and Forensic Audit · Internal Audit Tools and Techniques

Internal Control Questionnaire, Checklist and Flowchart in Internal Audit

Updated 11 October 2026 · Fact-checked

Internal control questionnaires, checklists and flowcharts are tools to document and evaluate a system of control. A questionnaire asks questions about controls, with Yes, No or Not Applicable answers. A checklist lists tasks to confirm as done. A flowchart draws the process in symbols. Weak points show up as No answers or missing controls on the chart.

Understand Flowcharting, Checklists and Questionnaires

An internal auditor cannot test a system until the system is understood and written down. Three tools do this job: the internal control questionnaire (ICQ), the checklist and the flowchart. Each records the system in a different form, and each helps you judge whether controls are adequate.

An ICQ is a set of questions on the controls in an area, such as purchases or payroll. It is framed so that a Yes shows a control exists and a No shows a weakness. Example: "Is every purchase order approved by an authorised person before it is sent to the supplier?" The client's staff answer it, and you review the answers. A No answer points to a gap that needs further work.

A checklist is a list of points, steps or documents that you must confirm or complete. It is for the auditor's own use. You tick each item as done and note the evidence. Its aim is completeness: nothing on the list is missed. A checklist does not ask whether a control is good. It asks whether the step was done.

A flowchart is a diagram of how a transaction moves through the system, using standard symbols and arrows. It shows who does what, in what order, which documents are raised, where they go and where checks happen. Because it is visual, gaps stand out: a missing approval, one person doing both custody and recording, or a document that goes nowhere.

The tools work best together. Use the flowchart to understand the process, the ICQ to probe each control, and the checklist to make sure the fieldwork is complete. Then test the controls by walkthrough and sample checks. Answers alone are not evidence, as staff may answer what they believe the auditor wants to hear.

Key rules to remember

ICQ reading rule: Yes = control present; No = possible weakness; N/A = question not relevant; Questions must be framed so that Yes is the good answer. Every No needs follow-up and a recommendation.
Questionnaire vs checklist: ICQ = questions on control quality; Checklist = list of items to confirm as done; An ICQ evaluates the system. A checklist ensures completeness of work.
Flowchart purpose: Flowchart = diagram of the process: activities, documents, decisions, checks, flow; Shows the sequence and the segregation of duties at a glance.
Common flowchart symbols: Oval = start or end; Rectangle = process step; Diamond = decision; Arrow = flow; Document shape = document; Symbol sets can vary. State the key you use on the chart.
Order of use: Understand → Document → Evaluate → Test → Report; These tools serve the documenting and evaluating stages. Testing comes after.

How to solve Flowcharting, Checklists and Questionnaires questions

Exam questions ask you to explain a tool, compare tools, design a questionnaire or checklist, or draw and read a flowchart. Use this method for all of them.

1Read the verb. Explain, distinguish, draft or draw each need a different answer shape.
2Name the tool and define it in one or two lines.
3State its purpose: documenting, evaluating or ensuring completeness.
4If asked to draft, pick the area given and write questions framed so that Yes means a control exists. Cover authorisation, segregation of duties, documentation and reconciliation.
5If asked to draw, list the steps in order, assign each to a person or department, mark documents and decisions, and add a short key.
6Evaluate: point out the weak points, such as No answers or missing checks, and say what you would recommend.
7Add advantages and limitations in brief, then end with how you would test the controls.
8For comparison questions, use a point-by-point format on meaning, nature, user, purpose and outcome.

Quickest way: Four-line answer frame

When to use it: Use when time is short or the question asks for a short note on any of the three tools.

Line 1: Define the tool in your own words.
Line 2: Say who uses it and for what purpose.
Line 3: Give one short illustration, such as a sample ICQ question or a three-step flow.
Line 4: Give one advantage and one limitation, then say that controls are still tested afterwards.

Common mistakes in Flowcharting, Checklists and Questionnaires

Treating a checklist and an ICQ as the same thing
Both are lists, so they look alike.
Fix: Say that an ICQ asks whether a control exists and works, while a checklist confirms that tasks or items are done.
Framing ICQ questions so that No is the good answer
Students write questions loosely, such as "Can one person raise and approve orders?"
Fix: Frame every question so Yes shows a control, such as "Are orders approved by someone other than the person who raised them?"
Drawing a flowchart with no owners or documents
Students focus on arrows and forget what is being checked.
Fix: Show who performs each step, which documents are raised and where checks or approvals occur.
Accepting ICQ answers as audit evidence
A completed form feels like proof.
Fix: Treat answers as a starting point. Confirm them by walkthrough, inspection and tests of transactions.
Listing only advantages
Students remember the benefits and skip limitations.
Fix: Add limits: a standard ICQ may not fit every entity, answers can be biased, flowcharts become outdated, and none of them tests operation of controls.
Not concluding on weaknesses
Students describe the tool but stop before evaluation.
Fix: Identify the gap, state the risk it creates and give a recommendation.

Worked examples

Example 1

Draft six questions for an internal control questionnaire on the purchase function of a manufacturing company, and explain how you will use the answers.

Show the solution

Pick the control areas: requisition, ordering, receipt, invoice checking and payment.
Frame each question so that Yes shows a control.
Q1: Is every purchase requisition approved by the authorised department head?
Q2: Are purchase orders issued only against approved requisitions and only by the purchase department?
Q3: Are goods received checked against the purchase order and recorded on a goods received note?
Q4: Are supplier invoices matched with the order and the goods received note before payment?
Q5: Are the persons who order goods different from those who receive them and those who approve payment?
Q6: Are supplier statements reconciled with the ledger periodically?
Use of answers: each Yes is a control to be tested by sampling. Each No is a weakness, to be followed up, assessed for risk and reported with a recommendation.

Answer: The six questions cover approval, ordering, receipt, invoice matching, segregation of duties and reconciliation. Yes answers lead to testing of the control. No answers are reported as weaknesses with recommendations.

Example 2

Distinguish between an internal control questionnaire and a checklist, and state when a flowchart is more useful than either.

Show the solution

Meaning: an ICQ is a set of questions on controls. A checklist is a list of items or steps to be confirmed.
User: the ICQ is answered by the client's staff and reviewed by the auditor. The checklist is used and ticked by the auditor or team.
Purpose: the ICQ evaluates the strength of controls. The checklist ensures nothing is missed.
Answers: the ICQ gives Yes, No or N/A. The checklist gives done or not done, with a reference to evidence.
Outcome: No answers in an ICQ show weaknesses. Items left unticked in a checklist show incomplete work.
Flowchart: it is more useful when the process is complex, spans several departments or has many documents. The picture shows the sequence, owners and missing checks faster than text.

Answer: An ICQ tests the quality of controls through questions, while a checklist confirms completion of work. A flowchart is better for complex, multi-department processes because it shows flow, owners and gaps visually.

Exam tips

Draft questions with Yes as the good answer. Examiners notice this.
When asked to draw a flowchart, add a small key for symbols and name the owner of each step.
For distinguish questions, write point by point: meaning, user, purpose, answer format, outcome.
Always end with how the weaknesses will be tested and reported, as this earns the evaluation marks.
Keep a few ready ICQ questions for purchases, sales, payroll and inventory.

Practice questions from Internal Audit Tools and Techniques

Flowcharting, Checklists and Questionnaires: frequently asked questions

What is an internal control questionnaire in audit?

It is a structured set of questions on the controls in an area of operations. Answers of Yes, No or Not Applicable show where controls exist and where they are weak. The auditor follows up on the No answers.

What is the difference between an audit checklist and a questionnaire?

A questionnaire asks whether controls exist and work, so it evaluates the system. A checklist lists items or steps to confirm as done, so it ensures completeness of work. One judges control quality and the other tracks the work.

How do I prepare a flowchart for an internal audit?

List the steps of the process in order and note who performs each one. Mark documents, decisions and checks with standard symbols and join them with arrows. Then review the chart for missing approvals, duplicated roles and breaks in flow.

Are these tools enough to conclude that controls are effective?

No. They document and evaluate the design of the system. You still need walkthroughs and tests of transactions to confirm that the controls actually operate.