Checklist for Evaluating Internal Controls There are five components to internal controls. A comprehensive checklist should adequately define these components and ensure that each component has been adequately met. According to Louwers, Ramsay, Sinason, and Strawser (2007) the five components to internal controls include: 1. Control environment – Involves the tone of the organization and includes “the integrity, ethical values, and competence of the company's people” (Louwers, Ramsay, Sinason, & Strawser, 2007). 2. Risk assessment – Involves a thorough assessment which “identify(s) risks, estimate their significance and likelihood, and consider how to manage the risks” (Louwers, Ramsay, Sinason, & Strawser, 2007). 3. Control activities – Involve specific actions which help ensure that management’s objectives and expectations are carried out. 4. Monitoring – Ongoing evaluation of internal controls performed on a timely basis. 5. Information and Communication – Relates to the efficiency and reliability of information and communication refers to how the information is presented to communicated to users.
|Defining the Control Environment |Yes/No |
|Is there a clear method of assigning authority and responsibility? | |
|Is there a clear transparency within the audit trail? | |
|Are company policies and practices accessible understood at the employee level? | |
|Defining Risk |Yes/No |
|Is there an adequate amount of information gathered contributing to the decision-making process? | |
|Are assumptions and forecast realistic? | |
|Is risk assumption practiced at all levels within the organization? | |
|Defining Control Activities |Yes/No |
|Are the internal controls in place and effective? | |
|Is there a clear segregation of duty? | |
|Are there physical controls in place ensuring authorized personnel? | |
|Defining Monitoring Activities |Yes/No |
|Are internal controls within proper compliance of proper regulations and laws? | |
|Do recorded amounts reflect net amounts (e.g. asset accounts = net assets for the period)? | |
|Is the objective clearly identified amongst personnel emphasizing the importance of each control? | |
|Defining Information and Communication |Yes/No |
|Have the accounting transactions at risk been properly identified? | |
|Is there an understanding of authorized, documented, and reported transaction? | |
|Is the information obtained within a reasonable time period? | |

References
Louwers, T. J., Ramsay, R., Sinason, D., & Strawser, J. (2007). Auditing and assurance services: A look beneath the surface (2nd ed.). New York, NY: McGraw-Hill