What would be the proper sequence of steps for an internal auditor to take in order to draw a conclusion on internal control effectiveness and adequacy after ascertaining the key controls?

Question

Options

• AEvaluate the adequacy of the controls and then test the controls for effectiveness.
• BTest the controls for effectiveness and then evaluate the adequacy of the controls.
• CIdentify risks and then evaluate the controls for effectiveness.
• DEvaluate the controls for effectiveness and then assess the risks in the area.

• A
  71% (20)
• B
  4% (1)
• C
  18% (5)
• D
  7% (2)

Explanation

Option A is correct because the logical sequence after identifying key controls is to first evaluate adequacy (asking "are these controls well-designed to address the risk?") and then test for effectiveness (asking "are they actually working in practice?") - you must confirm a control is properly designed before investing time testing whether it operates as intended.

Why the distractors fail:

• B reverses the order: testing a control for effectiveness before knowing if it's adequately designed wastes effort - a poorly designed control can "work as designed" and still leave risks unmitigated.
• C misplaces the step - risk identification occurs before ascertaining key controls, not after; the question specifies you've already completed that earlier phase.
• D also reverses logic: assessing risks comes early in the audit process, not as a conclusion step after evaluating effectiveness.

Memory tip: Think of it as a builder's checklist - first confirm the blueprint is sound (adequacy), then inspect whether construction followed it (effectiveness). You wouldn't inspect construction quality on a flawed blueprint.

No community discussion yet for this question.