## Testing of Internal Controls
### Purpose of Tests of Controls
Tests of controls obtain audit evidence about the effectiveness of:
1. The design of the accounting and internal control system
2. The operation of internal control throughout the period
### Types of Tests of Controls
| Test Type | What It Involves | Example |
|---|---|---|
| Inspection of documents | Examining documents supporting transactions to verify controls operated properly | Verifying that a transaction bears authorisation evidence |
| Inquiry and Observation | Used for controls that leave no audit trail | Determining who actually performs each function — not merely who is supposed to |
| Re-performance | Auditor's independent execution of procedures/controls originally performed by the entity | Re-doing bank reconciliation to verify it was correctly performed |
| IT-specific testing | Testing controls over computerised applications or overall IT function | Testing access controls or program change controls |
> Key rule: Inquiry alone is not sufficient as a test of control.
### Key Considerations When Assessing Evidence of Operating Effectiveness
When obtaining audit evidence about the effective operation of internal controls, the auditor must consider:
- How the controls were applied
- The consistency with which they were applied during the period
- By whom they were applied
### Understanding Controls vs. Testing Operating Effectiveness
| Activity | Purpose | Sufficient? |
|---|---|---|
| Understanding controls (risk assessment) | Know what controls exist and are designed to do | Does NOT establish operating effectiveness |
| Tests of controls | Obtain evidence that controls worked throughout the period | Required to place reliance on controls |
### IT Controls — Special Consideration
Due to the inherent consistency of IT processing, implementing an automated control may also serve as evidence of its operating effectiveness — provided IT general controls (especially program change controls) are also tested and found effective.