Any auditor would need documentary evidence in order to test controls. Such documentary evidence might include exception reports, control logs, and other documents which support the controls. Documentary evidence can be examined and tested at any time. However, operation of many controls does not produce any documentary evidence.

Many controls which are people dependent usually won't have a documentary evidence. Such controls depend upon the competence and diligence of the person performing the control. Such control might include say inspection of goods by a quality control person, control environment in the company, management's philosophy and operating style etc. So how does an auditor test controls for which there is no documentary evidence available? The best way to test such controls is to conduct interviews with control owners and persons responsible for the operation of the control. Another way to test such controls would be through visual observation of the operation of controls. Both the above methods can give a high level of comfort to the auditor in testing such controls.

Related Posts

Risk Treatment Plans for Sarbanes Oxley
Determing Significant Accounts - Sarbanes Oxley Compliance