3.7 Documenting Internal Control Systems: Narrative Notes, Flowcharts & Questionnaires
Key Takeaways
- ICAB Syllabus 2023 requires candidates to identify, for a specified organisation, the sources of information that will enable a sufficient record to be made of accounting or other systems and internal controls.
- The four recording methods are narrative notes, flowcharts, internal control questionnaires (ICQs) and internal control evaluation questionnaires (ICEQs), each with distinct strengths and weaknesses.
- An ICQ asks whether a specific control exists; an ICEQ asks whether a control objective is achieved, which is better at exposing missing controls.
- Sources of information include prior-year files, the entity's own procedure manuals and organisation charts, inquiry of staff at all levels, observation, and inspection of completed documents.
- Whatever method is used, the record must be confirmed by a walkthrough and retained in the audit file, and understanding must be updated rather than rolled forward unchanged.
Documenting Internal Control Systems: Narrative Notes, Flowcharts & Questionnaires
Learning outcome 2(i) of ICAB Syllabus 2023 requires candidates to "identify, for a specified organisation, the sources of information which will enable a sufficient record to be made of accounting or other systems and internal controls." Documenting the system is a distinct skill from evaluating it, and it is examined separately.
1. Why the system must be recorded
Recording the system is not administrative tidiness. It serves four purposes:
- Understanding. You cannot identify a missing control until you have set out what the system actually does.
- Evaluation. The record is the raw material for identifying weaknesses and designing tests.
- Evidence. Audit documentation must let an experienced auditor with no previous connection to the engagement understand the work performed. A system record is part of that.
- Continuity. The record forms a baseline that is updated in later years rather than rebuilt from nothing.
2. Sources of information about the system
For a specified organisation, the auditor draws on all of the following. An exam answer that lists only "ask the client" is incomplete.
| Source | What it yields | Caution |
|---|---|---|
| Prior-year audit file | Existing system notes, flowcharts and prior weaknesses | Must be updated, not simply rolled forward; systems change |
| Entity procedure manuals and job descriptions | The system as management intends it to operate | Frequently out of date; describes design, not actual practice |
| Organisation charts | Reporting lines and the intended segregation of duties | Shows structure, not whether it is respected in practice |
| Inquiry of staff at all levels | How the process actually runs day to day | Junior staff often describe reality more accurately than managers |
| Observation | Confirms activities are performed as described | Valid only at the moment of observation |
| Inspection of completed documents | Evidence that controls leave a trail: signatures, stamps, exception reports | Presence of a signature does not prove the check was made |
| System configuration and access reports | Automated controls, authorisation limits, user rights | Requires IT competence to interpret |
| Minutes of board and audit committee meetings | Known control failures, internal audit findings, remedial plans | Often the fastest route to known weaknesses |
| Internal audit reports | Independent evaluation already performed | Must assess internal audit's competence and objectivity before using |
3. The four recording methods
Narrative notes
A written description of the system, department by department or transaction by transaction.
- Advantages: simple, need no specialist skill or software, flexible enough to describe any system, and easy to amend for small changes.
- Disadvantages: cumbersome for complex systems, hard to identify missing controls because the eye slides over gaps, ambiguity in prose, and difficult for a reviewer to follow quickly.
- Best for: small entities and simple processes.
Flowcharts
A diagrammatic representation of document and data flow using standard symbols.
- Advantages: show the whole system at a glance, make gaps and duplications visually obvious, are quick for a reviewer to absorb, and hard to be ambiguous about.
- Disadvantages: need training and time to prepare, awkward for describing controls that are not document-based (such as supervision or tone at the top), and require complete redrawing when the system changes materially.
- Best for: complex, document-heavy transaction cycles.
Internal control questionnaires (ICQs)
A standard list of questions asking whether specific controls exist, generally answered yes or no, where "no" flags a potential weakness.
- Advantages: quick, comprehensive coverage of standard controls, easy to complete and review, and ensures nothing standard is forgotten.
- Disadvantages: the standard list may not fit an unusual business; a client may answer yes for a control that exists on paper but is not operated; over-controlled areas are not identified; and the format encourages mechanical completion.
- Typical question: "Are all goods dispatch notes pre-numbered and sequence-checked against sales invoices?"
Internal control evaluation questionnaires (ICEQs)
A shorter list of questions asking whether a control objective is achieved, rather than whether a named control exists.
- Advantages: focuses on what matters — the objective — and is far better at revealing that a control is missing altogether, because the answer depends on outcome rather than on the presence of a named procedure.
- Disadvantages: requires more judgement and experience to complete and to interpret.
- Typical question: "Can goods be dispatched without being invoiced?"
The difference between the two is worth learning as a contrast. An ICQ asks "is there a control?"; an ICEQ asks "can the bad thing happen?" An ICEQ answered "yes, goods can be dispatched without being invoiced" identifies a completeness failure immediately, whereas an ICQ that happens not to include the relevant question would miss it.
4. Comparison table
| Method | Records | Best suited to | Main weakness |
|---|---|---|---|
| Narrative notes | Prose description | Small, simple systems | Gaps are hard to spot |
| Flowcharts | Document and data flow | Complex document-based cycles | Time-consuming; poor for soft controls |
| ICQ | Existence of specific controls | Standard, comparable systems | Misses non-standard risks; "yes" may be nominal |
| ICEQ | Achievement of control objectives | Identifying missing controls | Needs judgement and experience |
In practice, firms combine methods: a flowchart of the document flow, narrative notes for the control environment and supervisory controls, and an ICEQ to test whether the key objectives are met.
5. Confirming and maintaining the record
Two disciplines complete the work.
Walkthrough. Trace one transaction of each type through the recorded system from initiation to the general ledger. This confirms the record is accurate and that the controls described have been implemented. A walkthrough is not a test of operating effectiveness.
Updating, not rolling forward. Where prior-year documentation exists, the auditor must confirm with the client whether the system has changed — new ERP modules, restructured departments, changed authorisation limits, staff turnover in key roles — and amend the record. Copying last year's flowchart without inquiry is a common real-world failing and a standard exam scenario.
6. Traps in this area
- Confusing an ICQ with an ICEQ. Remember: ICQ = does the control exist? ICEQ = is the objective achieved?
- Claiming flowcharts are always superior. They are poor at recording the control environment, management review and other non-document controls.
- Treating the presence of an authorising signature as proof the control operated. It evidences that the control left a trail, not that the reviewer actually checked anything.
- Treating a walkthrough as a test of controls. One item cannot support a conclusion on operating effectiveness across a period.
What is the essential difference between an internal control questionnaire (ICQ) and an internal control evaluation questionnaire (ICEQ)?
An audit junior copies the prior-year flowchart of the purchases cycle into the current file without further work. Why is this inadequate?
Which recording method is generally least effective at capturing controls such as management supervision, review meetings and the overall control environment?