Understand the nature of internal controls (as opposed to testing the effectiveness of control operations).
The purpose of CPA understanding of internal control is to evaluate the effectiveness of the control design and whether the control is being implemented. There is a difference between evaluating whether the controls that are designed to be effective are being implemented and testing the effectiveness of the control operation, i.e., whether the controls are consistently implemented. The former is to understand the purpose of internal control, and the latter is the purpose of control testing.
Understand the extent of internal controls.
The degree of understanding of internal control refers to the CPA's understanding of the scope and depth of the internal control of the audited entity when implementing the risk assessment procedure. This includes evaluating the effectiveness of the control design and determining whether it is being implemented, but does not include testing whether the controls are consistently implemented.
Understand the procedures for internal controls.
Ask the personnel of the audited unit;
Observe the application of specific controls;
Check documents and reports;
Track the processing of transactions in the Financial Reporting Information System (walk-through test).
Why is the analytical process not used to understand the internal controls of the audited entity?
By definition, the analytical program refers to the evaluation of financial information by the certified public accountant by analyzing the internal relationship between different financial data and between financial data and non-financial data, that is, the analysis object of the analytical program is "data" and the evaluation object is "financial information". The CPA understands the internal control of the audited entity, which is essentially to obtain information about the rules and regulations, policies and procedures, and does not meet the requirements of the analysis procedure for the analysis object and the evaluation object. In summary, CPAs should use analytical procedures in understanding the auditee and its environment, but it does not mean that they need to be used in every step of the process (and not when understanding internal controls).