Probe Audit | 11.30 - Evaluation Of System Of Internal Control

Published: 15/09/2026

The following describes the functionality and features included in Probe Audit Premium+

Instructions:

Objective

The objective of this document is to obtain an understanding of the components of the entity’s system of internal control relevant to the preparation of the financial statements, and to evaluate the design and implementation of controls within the control environment, the entity’s risk assessment process, and the entity’s process to monitor the system of internal control.

The following key concepts of the Probe Audit Premium+ Methodology are set in this document:

Control risk at financial statement level
Understanding of the entity’s control environment, risk assessment process, and monitoring activities (ISA 315)
Control risk assessment that determines the nature, timing, and extent of further audit procedures

Document placement

Document 11.30 – Evaluation of system of internal control can be found in the Planning and risk assessment procedures folder in the Caseware document manager.

Document content

This document is designed to be a questionnaire type document with space to describe the entity’s processes and to explain how you verified your understanding of those processes.

This document evaluates three of the five components of the entity’s system of internal control as required by ISA 315 (Revised 2019):

Control environment – evaluates the integrity and ethical values of the entity, oversight responsibilities, organisational structure, commitment to competence, and accountability.
Risk assessment process – evaluates how management identifies business risks, assesses their significance and likelihood, and decides actions to manage or mitigate those risks.
Monitoring – evaluates how the entity monitors the effectiveness of the system of internal control, including IT controls and remediation of deficiencies.

This document is divided into different bookmarks in the document map to assist you with the evaluation of internal control:

Risk assessment procedures
Control environment
Risk assessment process
Monitoring
Identified risks
Conclusion
Risk of material misstatement

Each component section includes a separate conclusion where the engagement team evaluates whether the component is appropriate, considering the nature and complexity of the entity. The conclusion for the control environment section also addresses whether control deficiencies were identified that may undermine the other components of the system of internal control.

Record control

When recording a control using the RECORD CONTROL BUTTON, all the input fields in the control dialog must be completed before submitting the control.

To edit or delete a recorded control, go to the “Description of control” column in the “Control activities – Identify and evaluate controls” table, right-click the control and select “Edit control” or “Delete control”.

COLUMN	INPUT REQUIRED	OUTCOME
Description of control	Input a short description of the relevant control.	The input will populate the “Control activities – Identify and evaluate controls” table in the section.
Sections	When the engagement team use the Record Control button feature, the section from which they selected the control button will be auto-selected. If the risk applies to more than one section, the engagement team can select an additional section.	The input will populate the “Control activities – Identify and evaluate controls” table in the section.
Is the control designed effectively to address the ROMM of assertions?	In the control dialog, select an answer from the “Yes / No” dropdown menu.	The input will populate the “Control activities – Identify and evaluate controls” table in the section.
Explain how you determined that the control was implemented	Insert a short description of how the engagement team determined that the control was implemented.	The input will populate the “Control activities – Identify and evaluate controls” table in the section.
Is the control implemented?	Select an answer from the “Yes / No” dropdown menu.	The input will populate the “Control activities – Identify and evaluate controls” table in the section.
Assertions	Select the tickbox of the appropriate assertion(s) addressed by the control.	The input will populate the “Control activities – Identify and evaluate controls” table in the section.
Reliance intended?	Select an answer from the “Yes / No” dropdown menu.	When the engagement team selects that reliance is intended, they will be prompted to record a test of control in the control dialog. The tick box for “Test of control” under the sub-heading “Audit procedures” in 12.20 – Audit plan and strategy will be auto-selected. When auto-selected, the “Test of control” section in the work program will be activated. The description of the control will pull through to the section’s work program.
Description of test of control	The field appears when the engagement team selects that reliance is intended. Record the test of controls that the engagement team plans to perform to test the control.	The description of the test of control will pull through to the section’s work program.

Layout

Column	Input required	Outcome
Risk assessment procedures
Type of procedures	No input is required in this column.	No impact on the engagement file.
Select	Select the risk assessment procedures performed by clicking on the relevant tick box (i.e. inquiries, observations and/or inspections).	No impact on the engagement file.
Describe the source(s) from which information was obtained	Insert a short description of the sources of information from which the understanding was obtained or the procedures performed. When inquiries are selected, record the name and designation of the interviewee and the date of the inquiry.	No impact on the engagement file.
Risk	Raise a risk or event, if necessary, relating to the question or the responses reflected.	A risk or event will be recorded in the relevant document. The engagement file will then prompt the engagement team for appropriate responses to the risk or event recorded.
Control environment / Risk assessment process / Monitoring
Procedures	No input is required in this column.	No impact on the engagement file.
Description of processes	Include a description of the entity’s processes relevant to the question. Describe how the entity has designed and implemented the control or process being evaluated.	No impact on the engagement file.
Explain how you verified your understanding of the processes	Describe the procedures performed to verify the understanding of the entity’s processes. This may include walkthroughs, inquiry of personnel, inspection of documents, or observation of processes.	No impact on the engagement file.
Risk	Raise a risk or event, if necessary, relating to the question or the responses reflected.	A risk or event will be recorded in the relevant document. The engagement file will then prompt the engagement team for appropriate responses to the risk or event recorded.
Conclusion
Conclusion questions	Answer the conclusion questions at the end of each component section to evaluate whether the component is appropriate considering the nature and complexity of the entity. For the control environment section, the conclusion also asks whether control deficiencies were identified that may undermine the other components.	The conclusions inform the overall assessment of the system of internal control and may affect the assessment of control risk at financial statement level.
Risk of material misstatement	Conclude on the control risk at financial statement level assessment.	The control risk at financial statement level assessment is documented for the engagement.

The following important questions/procedures are included in the document:

Item

Example

Overall response – Substantive

When the control risk at financial statement level is assessed as medium or high, you can choose to increase the extent of work on all relevant and selected assertions as part of your overall responses to address the assessed ROMM at financial statement level. If you choose to do this, you need to answer Yes to the respective question.

Document outcomes

You must evaluate the design and implementation of controls within the control environment, the entity’s risk assessment process, and the entity’s process to monitor the system of internal control. Each component section must be concluded separately, evaluating whether the component is appropriate considering the nature and complexity of the entity. Where control deficiencies are identified, the engagement team should consider the impact on the other components of the system of internal control and on the overall assessment of control risk at financial statement level. The engagement team must also record an overall conclusion on the system of internal control and conclude on the control risk at financial statement level, which is documented for the engagement.

Group Audits

When the engagement type was selected as ‘Group Audit Single’ or ‘Group Audit Multiple’, questions are modified for the separate group audit engagement file.

The questions are asked at group level and refer to the group, group management and those charged with governance of the group rather than the entity, management and directors. Compared to the single-entity file, the group audit file differs as follows:

Control environment – the question on communicating views on business practices and ethical behaviour asks how group management communicates and reinforces these across the group, and the question on assigning authority and responsibility asks how the group assigns authority and responsibility to management of entities or business units in the group.
Monitoring – two additional questions ask how the group monitors controls across the group, and how the internal audit function is involved in monitoring the system of internal control across the group, including its nature, responsibilities and activities in respect of monitoring of controls at entities or business units in the group.
Risk of material misstatement – the conclusion question asks about risks that group management would have been expected to identify.