How Auditors Assess Internal Controls

Audits by Governmental Organizations are generally conducted in accordance with Generally Accepted Government Auditing Standards (GAGAS), also known as the GAO Yellow Book. In order to comply with GAGAS, auditors are required to be familiar with these standards and apply them in the particular audit. One of the standards, found in section 601.46 requires auditors to obtain an understanding of the design of specific controls. Suggested methods of satisfying this requirement include;

• Question: inquiries of appropriate management, supervisory, and staff personnel
• Read: inspection of the contractor's documents
• Look: observation of the contractor's activities and operations.

The nature and extent of procedures performed vary from contractor to contractor and are influences by factors such as the following:

• the newness and complexity of the specified requirements
• the auditor's knowledge of internal control over compliance obtained in previous assignments (e.g. reported deficiencies)
• the nature of the specified compliance requirements
• an understanding of the industry in which the contractor operates
• judgments about materiality

"Materiality" is always a big factor in assessing internal control adequacy.

Any policy and procedure or other internal controls that may have a material impact on the significant elements/areas being audited and the procedures for obtaining an understanding of those will depend on the nature of the elements/areas under audit and the basis for their development.  For each element/area selected for evaluation, contractors will be expected to explain the processes and related policies and procedures or other internal controls related to the development of those elements or areas identified for evaluation.  For the most part, auditors will try to obtain and document their understanding of those during an initial walk-through (probably as part of an entrance conference).


The auditor's objective is to gain an understanding of the applicable key processes and the related policies and procedures (formal or informal) or other internal controls so that they can be considered in designing/tailoring audit procedures to meet the objectives of the audit.  Good internal control systems pay dividends in reduced audit oversight.