GuideInternal Controls
How to Test Internal Controls
A practical six-step approach to testing both control design and operating effectiveness — choosing the strongest test method and evaluating exceptions before concluding.
PDF • 6 Pages • Free
Checklist
Internal Control Testing Checklist
Verify both control design and operating effectiveness — clear risk and owner, complete populations, tests beyond inquiry, meaningful review evidence, validated exceptions and a conclusion another auditor could reperform.
What you'll find inside
- Design effectiveness checks: the risk addressed, a specific objective, an empowered owner, suitable frequency and verifiable evidence
- Operating effectiveness checks: complete population, tests beyond inquiry, risk-based samples, timely performance and meaningful review
- Exceptions and conclusion checks: validation with the owner, frequency and impact, root cause, design versus execution failure, and reperformable workpapers
- Risk prompts on control bypass, one-person control of an outcome and exceptions that have become normal practice
- An “evidence to retain” list for your workpapers, plus a Done / Review / N/A status key, with space for auditor notes and testing exceptions
- A completion page with six closing checks and a final conclusion, owner and follow-up date
Best for
- Internal Auditors
- Senior Internal Auditors
- Finance Auditors
- Compliance Professionals
Resource information
- Format:
- Pages:
- 6
- Price:
- Free
- Registration:
- Not required
About This Resource
Control testing conclusions are easy to challenge when the control objective is vague, the sample does not reflect the population, or exceptions are dismissed. This checklist helps auditors design, perform and conclude control tests that another auditor could reproduce.
Use it when preparing test scripts, performing tests and reviewing testing before sign-off. Design effectiveness checks confirm the risk addressed is clearly defined, the control objective is specific and observable, the owner has authority and information, frequency matches the speed of the risk, and the control produces independently verifiable evidence. Operating effectiveness checks cover a complete and appropriate population and period, test methods that go beyond inquiry, sample selection that reflects risk and population characteristics, and evidence that the control was performed on time and that reviews were meaningful rather than simply signed. Exceptions and conclusion checks cover validating exceptions with the control owner, assessing their frequency and impact, considering root cause and compensating controls, distinguishing design failure from execution failure, and workpapers that allow another auditor to reproduce the conclusion.
Use the Done, Review or N/A status, the risk prompts and the evidence-to-retain list during fieldwork, and complete the final conclusion page for each tested area.
© Salih Ahmed Islam
Related Internal Audit Resources
ToolInternal Controls
Control Test Method Selector
Choose the strongest practical test method — inquiry, inspection, observation, reperformance or data analytics — for each control and assertion.
PDF • 6 Pages • Free
ToolInternal Controls
Control Design Evaluation Tool
Check whether a control is designed well enough to address its risk — owner, frequency, evidence, precision and exception response — before you test it.
PDF • 6 Pages • Free
TemplateInternal Controls
Risk & Control Matrix Template
Build a practical risk and control matrix that links each business objective and risk to its control, owner, frequency and evidence, then records the planned test and conclusion.
PDF • 6 Pages • Free