Internal Control Documentation:
Which Format is Preferred?

by James Lloyd Bierstaker

Assistant Professor, University of Massachusetts Boston

INTRODUCTION
Internal control is receiving increased attention in public accounting. In response to the increase of management fraud and related control deficiencies, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) released a report that defines internal control and sets standards for evaluating internal control effectiveness (COSO 1992). SAS No. 78 incorporates the COSO framework and requires that, on every engagement, auditors obtain a “sufficient understanding of internal control” to plan the audit and determine the nature, timing and extent of audit testing (AICPA 1995). Auditors must also document their understanding of internal control. However, there is no specific guidance as to the type or number of formats that should be used for documentation.

The purpose of this study is to investigate which documentation formats auditors commonly use, the number of formats used, and if certain formats are preferred. The results of this study may serve as a baseline for auditors who are considering which, and how many, formats to use for documenting their understanding of internal control. The results may also be of interest to accounting students and faculty who wish to learn more about which formats are used most often by auditors.

The choice of documentation format is an important issue because each format imposes a different structure on the data collection process, which may affect auditors’ internal control evaluations and their assessments of control risk (Carscallen 1982; Mock and Willingham 1983). Formats that have been used by auditors in the past to document their understanding of internal control include the narrative, questionnaire, matrix and flowchart (Mock and Turner 1981; Cushing and Loebbecke 1986). However, recent evidence suggests that the use of certain formats may be on the decline. For example, interviews with members, ranging in rank from the senior to partner level, of several Big 5 firms indicate that while flowcharting is still “suggested” by many audit manuals, it may be rarely used in practice. Formats such as flowcharts may be used less often by auditors because they are relatively costly and time-consuming to prepare. In contrast, formats such as narratives may be prepared more quickly and easily.

In addition, given the current competitive audit environment and the emphasis placed on efficiency, auditors may choose to rely on one format to minimize internal control documentation costs. If more than one format is used, many pieces of information could be recorded twice because there is a substantial overlap of information between formats. However, if a single format is used, significant internal control deficiencies may be overlooked, especially if they are not specifically addressed by that format (Purvis 1989). For example, the overview of control activities provided by a flowchart may lend itself to the evaluation of segregation of duties. If another format is used to evaluate internal control, an important weakness related to segregation of duties could be missed.

Methods and Participants
Questionnaire data was collected from 92 auditors to investigate if certain internal control documentation formats are preferred, and the number of documentation formats that auditors commonly use. The auditors who participated in this study had an average of 41.7 months of public accounting experience, and had been responsible for preparing internal control documentation for an average of 20.2 months.

Results
Auditors were asked to indicate any and all formats that they commonly use to document and evaluate internal control. Approximately 88 percent of the auditors reported using narratives, 60 percent reported using questionnaires, 46 percent reported using flowcharts, and 37 percent reported using an internal control matrix. In addition, 8 percent reported that they commonly use some other method for documenting and evaluating internal control including: best practices (3 percent), walkthroughs (1 percent), box diagrams (1 percent), firm software (1 percent), industry-specific questionnaires (1 percent), and benchmarking (1 percent).

Results were also analyzed based on the number of formats that auditors indicated they commonly use. This analysis focused on narratives, questionnaires, flowcharts and matrices because other formats were rarely used. Most of the auditors indicated that they commonly use either two (45 percent) or three formats (33 percent) to document internal control. Only 11 percent indicated that they rely on a single format, and 8 percent indicated that they use all four formats. (Numbers total less than 100 percent due to rounding error.) The combination of formats mentioned most often was questionnaires and narratives (26 percent), followed by questionnaires, flowcharts and narratives (12 percent), questionnaires, matrices and narratives (11 percent), flowcharts, matrices and narratives (10 percent), and flowcharts and narratives (10 percent). Narratives were the most popular single format used to document internal control (8 percent). Interestingly, none of the auditors indicated that they used only questionnaires to document their understanding of internal control, suggesting that questionnaires are used primarily to gather data, which is then input into another internal control documentation format such as a narrative. Narratives and questionnaires may work well together because questionnaires are highly structured, whereas the structure of the narrative depends on the auditor. It is also interesting to note that the majority of auditors who use flowcharts also use narratives, which suggests that the graphic format of the flowchart may be easier to interpret when it is used in combination with the textual format of a narrative.

Conclusion
The results of this study suggest that narratives are the most popular format for documenting internal control, followed by questionnaires, flowcharts and matrices. Narratives and questionnaires may be preferred by auditors because they are relatively easy to prepare, as compared to flowcharts or matrices. The results also suggest that auditors often use two or three formats to document internal control. In particular, about one-fourth of the auditors participating in this study indicated that they used a combination of narratives and questionnaires. Thus, most auditors did not appear to rely exclusively on a single format to document internal control. While reliance on a single format could minimize training costs and enhance audit efficiency, using multiple formats may help to ensure that important internal control weaknesses are not overlooked. The use of two or three formats may represent a strategy that preserves audit effectiveness without sacrificing audit efficiency.

REFERENCES

American Institute of Certified Public Accountants (AICPA). 1995. Consideration of the Internal Control Structure in a Financial Statement Audit: An Amendment to SAS No. 55. New York, NY: AICPA.

Carscallen, M. P. 1982. Audit efficiency. CPA Journal (May): 20–22.

Committee of Sponsoring Organizations of the Treadway Commission (COSO). 1992. Internal Control: Integrated Framework. Harborside, NJ: AICPA.

Cushing, B. E., and J. K. Loebbecke. 1986. Comparison of Audit Methodologies of Large Accounting Firms. Sarasota, FL: American Accounting Association.

Mock, T., and J. L. Turner. 1981. Internal Accounting Control Evaluation and Auditor Judgment. Audit Research Monograph No. 3. New York, NY: AICPA.

———, and W. Willingham. 1983. An improved method of documenting and evaluating a system of internal accounting controls. Auditing: A Journal of Practice & Theory (Spring): 91–99.

Purvis, S. E. C. 1989. The effect of audit documentation format on data collection. Accounting, Organizations and Society 14: 551–563.

Next Item
Back to Front Page