Evaluate Design And Implementation Of Controls - CPA Isc

SECTION 1

Historical Context & Motivation

The evaluation of internal control design and implementation is a cornerstone of modern auditing, yet its formal codification emerged only after a series of catastrophic financial failures exposed the inadequacy of ad hoc assurance approaches. Before the mid-twentieth century, auditors focused primarily on detailed transaction testing—essentially re-performing bookkeeping—rather than evaluating the systems that produced financial information. The shift toward systems-based auditing recognized that organizations process millions of transactions, making it impossible to test every entry; instead, auditors needed to assess whether the controls governing those transactions were properly designed and actually functioning.

1977 • Foreign Corrupt Practices Act (FCPA)

The U.S. Congress enacted the FCPA, which for the first time required publicly traded companies to maintain adequate internal accounting controls. This statute moved internal controls from a voluntary best practice to a legal mandate, establishing the foundation for auditor evaluation of control systems.

1992 • COSO Internal Control Framework

The Committee of Sponsoring Organizations of the Treadway Commission published its landmark Internal Control—Integrated Framework, providing auditors and management with a common language and structured approach for designing, implementing, and evaluating internal controls across five interrelated components.

2002 • Sarbanes-Oxley Act (SOX)

Following the Enron and WorldCom scandals, Congress enacted SOX Section 404, requiring management to assess—and external auditors to attest to—the effectiveness of internal control over financial reporting. This dramatically elevated the importance of evaluating control design and implementation.

2010 • PCAOB AS 2201 (formerly AS 5)

The PCAOB refined auditing standards for integrated audits, introducing a risk-based, top-down approach that explicitly requires auditors to evaluate whether controls are suitably designed and have been placed in operation before testing operating effectiveness.

2013 • COSO 2013 Framework Update

COSO updated its framework with 17 principles and 87 points of focus, providing more granular criteria for auditors to evaluate whether the design of controls adequately addresses all relevant assertions and risks, reflecting the increased complexity of modern business environments.

Against this regulatory evolution, the central question that auditors and CPA candidates must answer is: How does an auditor determine whether a control is properly designed to prevent or detect material misstatements, and how does the auditor confirm that the control has actually been placed in operation? This two-part evaluation—design suitability and implementation status—forms a critical gateway in the audit process, determining the nature, timing, and extent of further audit procedures.

SECTION 2

Core Principles & Definitions

Evaluating the design and implementation of controls involves two conceptually distinct but interrelated assessments. The design evaluation asks whether a control, if operating as prescribed, would effectively prevent or detect a misstatement in a relevant financial statement assertion. The implementation evaluation asks whether the control actually exists and is being used by the entity—that is, whether it has been placed in operation. A control that is beautifully designed but never implemented provides zero assurance; conversely, a control that is implemented but poorly designed may create a false sense of security while failing to address the underlying risk.

Design Suitability

A control is suitably designed if it—alone or in combination with other controls—can reasonably be expected to prevent or detect misstatements in a specific assertion. The auditor evaluates the control's logic, the competence of the person performing it, and whether it addresses the identified risk at the assertion level.

Implementation Status

A control is considered implemented (placed in operation) when the entity has begun using it. The auditor verifies implementation through inquiry, observation, inspection of documents, and walkthroughs—confirming the control is not merely documented in a policy manual but is actively performed.

Relevant Assertions

Controls are evaluated in relation to specific financial statement assertions: existence/occurrence, completeness, valuation/allocation, rights and obligations, and presentation/disclosure. A single control may address multiple assertions, and a single assertion may require multiple controls.

Preventive vs. Detective Controls

Preventive controls stop errors before they enter the accounting system (e.g., input validation edits). Detective controls identify errors after they have occurred (e.g., bank reconciliations). Design evaluation considers whether the mix of control types adequately mitigates the assessed risk.

Walkthrough Procedures

A walkthrough traces a single transaction from origination through the entity's information system to its inclusion in financial reports. Walkthroughs are the primary method for confirming both design suitability and implementation, combining inquiry, observation, inspection, and re-performance.

✦

KEY TAKEAWAY

Think of control evaluation like inspecting a fire suppression system in a building. Design evaluation is like reviewing the blueprints to confirm the sprinkler system is engineered to cover every room and has sensors positioned near likely ignition sources—if the design omits the server room, no amount of testing will compensate. Implementation evaluation is like walking through the building to confirm the sprinklers are actually installed, the pipes are connected to the water supply, and the sensors are powered on. Both checks are necessary before you would ever test whether the system actually extinguishes a fire—which corresponds to testing operating effectiveness.

SECTION 3

Visual Explanation — The Control Evaluation Framework

This diagram illustrates the sequential three-phase approach auditors follow. Phase 1 (Design) evaluates whether controls logically address identified risks. Phase 2 (Implementation) confirms controls are placed in operation via walkthrough procedures. Only after both phases yield favorable conclusions does the auditor proceed to Phase 3 (Operating Effectiveness) testing.

The diagram above highlights a critical sequencing principle: an auditor cannot meaningfully test whether a control operates effectively if the control is not suitably designed in the first place. If Phase 1 reveals a design deficiency—for example, a manual three-way match that lacks any mechanism to flag price discrepancies—the auditor would identify this as a control deficiency without proceeding further. Similarly, if Phase 2 reveals that a well-designed control exists only in a policy manual but personnel are not actually performing it, the auditor identifies an implementation failure. In both cases, the auditor must assess the severity of the deficiency—potentially escalating it to a significant deficiency or material weakness—and modify the audit plan to increase substantive testing.

SECTION 4

How It Works — The Evaluation Process in Depth

Evaluating Design Suitability

When evaluating a control's design, the auditor must consider the specific risk of material misstatement (RMM) that the control is intended to address. The auditor asks: if this control operates as prescribed, would it effectively prevent or detect the identified misstatement? This assessment involves several dimensions. First, the auditor considers the precision of the control—whether it operates at a level of detail sufficient to catch misstatements at the relevant magnitude. A high-level analytical review comparing budgeted to actual revenue at the entity level may be less precise than a detailed review of revenue recognition by product line. Second, the auditor considers the competence and authority of the individual performing the control—a revenue recognition review performed by a junior clerk without accounting expertise is less likely to be effective than one performed by the controller. Third, the auditor evaluates whether the control addresses the correct assertion; a control that verifies the existence of inventory may not address the valuation assertion if it fails to consider net realizable value.

Evaluating Implementation

The evaluation of implementation determines whether the control has been placed in operation as of the date being assessed. The auditor's primary tool is the walkthrough—a procedure in which the auditor selects a representative transaction and traces it through the entire process flow, from initiation to recording in the general ledger. During the walkthrough, the auditor corroborates information obtained through inquiry by observing the actual performance of the control, inspecting the documentation produced, and, in some cases, re-performing the control on the selected transaction. The walkthrough serves dual purposes: it confirms implementation and also provides additional evidence about design suitability, since the auditor may identify design gaps that were not apparent from reviewing documentation alone.

⚠

Important Distinction

Evaluating implementation is not the same as testing operating effectiveness. Implementation asks "does the control exist and is it being used?" Operating effectiveness asks "has the control functioned consistently and correctly throughout the period?" Implementation can be confirmed with a single walkthrough; operating effectiveness requires testing multiple instances over the period under audit.

The Risk Model Connection

AUDIT RISK MODEL

AR = IR × CR × DR

Where AR = Audit Risk (the risk the auditor expresses an inappropriate opinion), IR = Inherent Risk (susceptibility of an assertion to misstatement), CR = Control Risk (risk that the entity's controls fail to prevent or detect misstatement), DR = Detection Risk (risk that the auditor's procedures fail to detect misstatement). When the auditor concludes that controls are well designed and implemented, CR can be assessed at a lower level, allowing DR to increase and thereby reducing the extent of substantive testing required.

DETECTION RISK (REARRANGED)

DR = AR / (IR × CR)

If the auditor determines that controls are suitably designed and implemented and plans to test operating effectiveness, CR may be assessed below maximum. For example, if AR = 0.05, IR = 0.80, and CR = 0.40, then DR = 0.05 / (0.80 × 0.40) = 0.156, allowing the auditor to perform less extensive substantive procedures than if CR were assessed at 1.00 (maximum).

SECTION 5

Control Classification & Deficiency Severity

When the auditor's evaluation of design and implementation identifies a control that is inadequate, the finding must be classified by severity. Auditing standards establish a hierarchy of deficiency classifications, ranging from a simple control deficiency at the lowest level through a significant deficiency to a material weakness at the highest. The classification depends on the likelihood and magnitude of the potential misstatement that could result from the deficiency. Notably, a design deficiency or implementation failure can constitute a material weakness even before any actual misstatement occurs, because the evaluation is forward-looking—it considers what could go wrong, not just what has gone wrong.

This severity matrix shows how the classification of a control deficiency depends on two dimensions: the likelihood that the deficiency could result in a misstatement and the magnitude of the potential misstatement. A design or implementation failure in a high-volume, material account class with probable likelihood of error would be classified as a material weakness.

Classification	Definition	Communication Requirement
Control Deficiency	A control's design or implementation does not allow management or employees to prevent or detect misstatements on a timely basis in the normal course of performing their assigned functions.	May be communicated to management; not required to be communicated to those charged with governance (TCWG).
Significant Deficiency	A deficiency, or combination of deficiencies, that is less severe than a material weakness yet important enough to merit attention by TCWG.	Must be communicated in writing to TCWG. In an integrated audit, reported in the auditor's report on internal controls.
Material Weakness	A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis.	Must be communicated in writing to management and TCWG. Results in an adverse opinion on ICFR in an integrated audit under PCAOB standards.

Summary of control deficiency classifications per PCAOB AS 2201 and AICPA AU-C 265

SECTION 6

Worked Example — Evaluating Purchase Order Controls

Consider the following scenario: you are the senior auditor on the engagement for Greenfield Manufacturing, Inc., a public company. The purchasing department processes approximately 15,000 purchase orders per year. Management has documented a control requiring a three-way match (purchase order, receiving report, and vendor invoice) before any payment is authorized. The relevant assertion is the occurrence assertion for accounts payable and purchasing transactions—specifically, that recorded transactions represent goods or services actually ordered and received.

Evaluating the Three-Way Match Control at Greenfield Manufacturing

1
Step 1 — Identify the Relevant Risk and Assertion

The risk is that the entity records payables for goods or services not actually ordered or received—a fictitious or unauthorized transaction. The relevant assertion is occurrence (that transactions recorded actually occurred) and accuracy (that amounts recorded are correct). We also consider the authorization assertion—that transactions were approved by appropriate personnel.

Identified risks: fictitious/unauthorized purchases; incorrect payment amounts. Assertions: occurrence, accuracy, authorization.
2
Step 2 — Evaluate Design Suitability

We review the documented control description: before the accounts payable clerk processes a payment, the ERP system requires matching a purchase order (authorized by a purchasing manager with a $50,000 limit), a receiving report (entered by warehouse staff upon physical receipt), and a vendor invoice. The system flags discrepancies exceeding 2% or $500, whichever is less, for manual review by the AP supervisor. We assess: (1) Precision—the 2%/$500 threshold is appropriate given the materiality of $750,000 and transaction volumes. (2) Competence—the AP supervisor reviewing exceptions has 12 years of experience and relevant authority. (3) Assertion coverage—the three-way match addresses occurrence (receiving report confirms receipt), accuracy (matching quantities and prices), and authorization (PO approval).

Design conclusion: The control is suitably designed to address the identified risks at the occurrence, accuracy, and authorization assertions.
3
Step 3 — Perform Walkthrough to Evaluate Implementation

We select a representative purchase transaction—PO #2024-4837 for raw materials totaling $32,400—and trace it through the process. (a) Inquiry: We ask the AP clerk to describe the matching process, and her description is consistent with the documented control. (b) Observation: We watch as the clerk initiates the three-way match in the ERP system and observe the system-generated exception report. (c) Inspection: We examine the approved PO (signed by the purchasing manager), the receiving report (with warehouse manager's signature and date stamp), and the vendor invoice. We confirm the ERP system's match log shows all three documents were linked. (d) Re-performance: We independently compare the quantities and unit prices across all three documents and confirm they agree within the tolerance threshold.

Implementation conclusion: The three-way match control has been placed in operation. Personnel are performing the control as designed, and documentation supports its active use.
4
Step 4 — Assess Impact on Audit Strategy

Because the control is suitably designed and implemented, the engagement team plans to rely on it by testing operating effectiveness. Using the audit risk model: AR = 0.05 (target), IR = 0.70 (assessed based on industry and entity-specific factors), and if CR can be assessed at 0.30 (reflecting planned reliance on the three-way match and other purchasing controls), then DR = 0.05 / (0.70 × 0.30) = 0.238. This higher tolerable detection risk means the team can reduce the sample size for substantive tests of purchasing transactions compared to a purely substantive approach where CR = 1.00 and DR would need to be 0.05 / 0.70 = 0.071.

Planned reliance approach: Test operating effectiveness of the three-way match over a sample of transactions across the audit period. Substantive testing scope reduced relative to a non-reliance strategy.

SECTION 7

Strengths, Limitations & Common Pitfalls

The two-phase evaluation of design and implementation is one of the most efficient tools in the auditor's arsenal, but it is not without limitations. Understanding both the power and the boundaries of this evaluation helps CPA candidates appreciate why auditing standards require a combination of approaches rather than sole reliance on any single procedure.

Strengths	Limitations
Enables a risk-based, efficient audit by identifying controls the auditor can potentially rely upon, reducing the volume of substantive testing.	Design and implementation evaluation alone does not provide evidence about operating effectiveness—the control may have been implemented but not consistently performed throughout the period.
Walkthroughs provide deep understanding of the entity's transaction flows and IT systems, improving the auditor's overall risk assessment.	Walkthroughs typically trace only one or a few transactions, which may not be representative of all transaction types or exception scenarios.
Early identification of design deficiencies allows management to remediate before year-end, potentially avoiding adverse ICFR opinions.	Management override of controls cannot be detected through design and implementation evaluation alone; it requires separate fraud risk procedures.
Provides a structured framework (linked to COSO components and principles) that ensures comprehensive coverage of the control environment.	Heavily reliant on professional judgment, particularly when assessing precision, competence, and the sufficiency of compensating controls.
IT application controls, once confirmed as properly designed and implemented, tend to operate consistently, reducing the need for large test samples.	Changes to IT systems mid-period (e.g., ERP migrations) may invalidate earlier design and implementation conclusions, requiring re-evaluation.

Comparative analysis of the control evaluation approach

✦

KEY TAKEAWAY

Evaluating design and implementation is analogous to an engineer's pre-flight checklist for an aircraft: the checklist confirms that every system—hydraulics, avionics, fuel—is properly designed for the flight profile and has been installed and powered on. But the checklist alone does not guarantee the aircraft will perform flawlessly during a ten-hour transatlantic flight; that requires continuous monitoring (operating effectiveness testing). Nevertheless, skipping the checklist—attempting to rely on controls without first confirming design and implementation—would be reckless. The evaluation is a necessary but not sufficient condition for reliance.

SECTION 8

Connection to Integrated Audits & IT Controls

For CPA candidates preparing for the ISC exam, it is essential to understand how the evaluation of control design and implementation connects to the broader landscape of integrated audits under PCAOB standards and the growing importance of IT general controls (ITGCs) and IT application controls. In an integrated audit of a public company, the auditor expresses two opinions—one on the financial statements and one on the effectiveness of internal control over financial reporting (ICFR). The design and implementation evaluation serves as the gateway for both opinions.

Dimension	Financial Statement Audit Only	Integrated Audit (SOX 404)
Design & Implementation Evaluation	Required for all audits under AU-C 315 as part of understanding the entity and its environment. Auditor may choose a substantive-only approach if controls are not well designed.	Required and forms the basis for selecting controls to test. All significant accounts and relevant assertions must have controls evaluated. Walkthroughs are mandatory.
Testing Operating Effectiveness	Optional—only performed if the auditor plans to rely on controls to reduce substantive testing.	Mandatory for controls over all significant accounts. The auditor must obtain sufficient evidence that controls operated effectively throughout the period.
IT General Controls	Evaluated to the extent they affect the reliability of data used in substantive procedures or when relying on automated controls.	Must be evaluated comprehensively—access controls, change management, computer operations, program development—because ITGCs underpin the reliability of all automated application controls.
Deficiency Reporting	Significant deficiencies and material weaknesses communicated in writing to TCWG; no separate opinion on ICFR.	Material weaknesses result in an adverse opinion on ICFR. All significant deficiencies and material weaknesses are reported. Separate opinion required.

Comparison of control evaluation requirements: FS audit vs. integrated audit

Looking ahead, the role of design and implementation evaluation is expanding as entities adopt increasingly complex IT environments including cloud computing, robotic process automation (RPA), and artificial intelligence in financial reporting. Auditors must evaluate whether automated controls embedded in these systems are suitably designed—for example, whether an RPA bot that performs bank reconciliations has appropriate exception-handling logic—and whether the ITGCs governing the bot's deployment (change management, access controls, monitoring) are themselves well designed and implemented. The foundational principles remain the same: assess the control's logic, confirm it addresses the right risks and assertions, verify it has been placed in operation, and then determine the appropriate level of further testing. The ISC exam increasingly tests candidates' ability to apply these principles in technology-rich environments.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

When evaluating the design of an internal control, an auditor is primarily assessing whether the control, if operating as designed, would:

A. Eliminate all risks of material misstatement related to the relevant assertion.
B. Effectively prevent or detect a material misstatement in a relevant assertion.
C. Ensure that the control has been consistently applied throughout the reporting period.
D. Provide reasonable assurance that the entity's financial statements are free from fraud.

Show answer

The correct answer is B. Evaluating the design of a control involves determining whether the control, individually or in combination with other controls, is capable of effectively preventing or detecting material misstatements in relevant assertions. Answer A is incorrect because internal controls are designed to reduce, not eliminate, the risk of material misstatement—no control system can eliminate all risk entirely. Answer C is incorrect because consistent application throughout the period relates to the operating effectiveness of the control, not its design; design evaluation focuses on whether the control is suitably conceived. Answer D is incorrect because while fraud prevention is an important objective, design evaluation is specifically focused on whether a control addresses a particular identified risk at the assertion level, not on providing overall assurance about the financial statements being free from fraud.

Question 2: BASIC CALCULATION

An auditor is evaluating the implementation of controls at a manufacturing company. During a walkthrough of the revenue cycle, the auditor notes that the company requires a credit check before processing customer orders. Which of the following procedures would best help the auditor determine that this control has been implemented?

A. Selecting a sample of 25 sales transactions and testing whether credit checks were performed for each.
B. Reviewing the company's policy manual to confirm that a credit check policy exists.
C. Tracing one or a few transactions through the revenue process and observing whether the credit check was actually performed.
D. Inquiring of the credit department manager about how frequently credit checks are performed.

Show answer

The correct answer is C. Evaluating the implementation of a control involves determining that the control actually exists and that the entity is using it. A walkthrough—tracing one or a few transactions through the process—is the most appropriate procedure for this purpose, as it allows the auditor to observe that the control is actually being applied. Answer A is incorrect because testing a sample of 25 transactions goes beyond implementation testing and constitutes testing the operating effectiveness of the control, which is a separate step. Answer B is incorrect because merely reviewing the policy manual confirms only the design of the control (that the control was designed), not that it has been put into operation. Answer D is incorrect because inquiry alone, without corroborating evidence such as observation or inspection, provides insufficient evidence that the control has actually been implemented, as management may describe intended procedures that are not actually in place.

Question 3: INTERMEDIATE

During the evaluation of controls over the procurement cycle, an auditor identifies that the entity has designed a three-way match control requiring agreement among the purchase order, receiving report, and vendor invoice before payment is authorized. The auditor performs a walkthrough and finds that the accounts payable clerk compares only the purchase order to the vendor invoice and does not reference the receiving report. Which of the following best describes the auditor's conclusion?

A. The control is properly designed but has not been effectively implemented.
B. The control is neither properly designed nor effectively implemented.
C. The control is properly designed and effectively implemented because two of three documents are matched.
D. The control has a design deficiency because the three-way match is not an appropriate control for the procurement cycle.

Show answer

The correct answer is A. The three-way match is a well-designed control for the procurement cycle because, if operating as intended, it would effectively prevent or detect unauthorized or inaccurate payments by ensuring agreement among the purchase order, receiving report, and vendor invoice. However, because the accounts payable clerk is not performing the control as designed—omitting the receiving report from the comparison—the control has not been properly implemented. Answer B is incorrect because the design of the three-way match control is appropriate; the issue lies solely in its implementation. Answer C is incorrect because partial execution of the control does not constitute effective implementation; all three documents must be matched as designed for the control to achieve its intended objective. Answer D is incorrect because a three-way match is a widely recognized and appropriate control in the procurement cycle—there is no design deficiency in the control concept itself.

Question 4: APPLIED

An auditor is evaluating the design and implementation of information technology general controls (ITGCs) at a retail company that recently migrated to a new enterprise resource planning (ERP) system. The auditor discovers that the company has implemented automated controls within the ERP system for revenue recognition, including automated cutoff procedures. However, user access to modify the configuration of these automated controls has not been restricted to appropriate personnel. Which of the following is the most significant implication of this finding for the auditor's evaluation?

A. The automated application controls over revenue recognition cannot be relied upon because the underlying ITGCs related to access controls are deficient.
B. The automated controls are properly designed and implemented because they function correctly within the ERP system regardless of access restrictions.
C. The auditor should increase the sample size for testing the operating effectiveness of the automated revenue recognition controls.
D. The finding only affects the change management ITGCs and does not impact the auditor's ability to rely on the automated application controls.

Show answer

The correct answer is A. The reliability of automated application controls depends on the effectiveness of the underlying ITGCs, including access controls. If unauthorized personnel can modify the configuration of automated controls, there is a risk that these controls could be altered in a way that compromises their effectiveness, meaning the auditor cannot place reliance on them. Answer B is incorrect because the proper functioning of an automated control at a point in time does not ensure its continued integrity if access controls are inadequate—unauthorized modifications could have occurred without detection. Answer C is incorrect because increasing the sample size for testing operating effectiveness does not address the fundamental issue; if the ITGCs are deficient, the auditor generally cannot rely on the automated controls regardless of sample size. Answer D is incorrect because access controls are a critical ITGC category that directly impacts the integrity of automated application controls—a weakness in access controls is not isolated to change management and has pervasive implications for all automated controls in the system.

Question 5: CRITICAL THINKING

A company has implemented a segregation of duties control in its payroll process, requiring that one employee enters payroll data into the system, a second employee reviews and approves the payroll register, and a third employee authorizes the electronic fund transfer for payroll disbursements. During a walkthrough, the auditor observes that the employee who reviews and approves the payroll register is the direct supervisor of the employee who enters payroll data. Additionally, the auditor learns that during peak periods, the supervisor occasionally enters payroll data when the data entry employee is on leave. The auditor should conclude that:

A. The control is properly designed and implemented because three separate individuals are involved in the process under normal circumstances.
B. The control has both a design weakness and an implementation weakness because the supervisory relationship and the override during peak periods each compromise the control's effectiveness.
C. The control design is adequate because the three functions are separated, but implementation is deficient because the supervisor performs incompatible duties during peak periods, undermining the segregation of duties.
D. The control design is deficient because the reviewing employee should not have a supervisory relationship with the data entry employee, regardless of whether the supervisor ever performs data entry.

Show answer

The correct answer is C. The design of the control is adequate because it specifies three separate individuals performing three distinct functions—data entry, review and approval, and authorization of disbursement—which appropriately segregates incompatible duties. However, the implementation is deficient because during peak periods, the supervisor who reviews the payroll register also performs data entry, meaning the same individual is both preparing and reviewing payroll data, which eliminates the segregation of duties that the control was designed to achieve. Answer A is incorrect because the fact that three individuals are involved under normal circumstances does not address the breakdown in segregation during peak periods, which represents a failure in implementation. Answer B is incorrect because the supervisory relationship alone does not constitute a design weakness—it is common and acceptable for a supervisor to review the work of a subordinate, as this is a standard aspect of supervisory review controls. The design properly separates the three functions. Answer D is incorrect because having a supervisor review a subordinate's work is a standard and effective control mechanism; the supervisory relationship itself does not create a design deficiency. The problem arises only when the supervisor performs the subordinate's function, which is an implementation issue rather than a design issue.

SUMMARY

Summary — Evaluating Design and Implementation of Controls

Summary

Evaluating the design and implementation of controls is a required, sequential two-phase process that precedes any testing of operating effectiveness. Design suitability asks whether the control—considering its precision, the competence of the performer, and its coverage of relevant assertions—can reasonably prevent or detect material misstatements. Implementation evaluation confirms through walkthroughs (combining inquiry, observation, inspection, and re-performance) that the control has been placed in operation. These evaluations directly influence the audit risk model by determining whether control risk can be assessed below maximum, which in turn affects the nature, timing, and extent of substantive testing.

When deficiencies are identified—whether in design or implementation—the auditor classifies them as a control deficiency, significant deficiency, or material weakness based on the likelihood and magnitude of potential misstatements. In an integrated audit under PCAOB standards, a material weakness results in an adverse opinion on ICFR. The evaluation must also consider IT general controls that underpin automated application controls, and the auditor must exercise professional skepticism regarding management override—a fraud risk that cannot be fully mitigated by the entity's own controls.