May 9, 2004
The current draft does not rule out any relevant evidence of controls effectiveness, which is helpful. However, it only mentions explicitly and in depth the evidence available from:
1 studying the design of the internal control system and
2 testing individual controls to establish if they have operated as intended.
Partly as a result of this focus, also found in earlier drafts and similar documents, many companies are working on these types of evidence alone and this is inefficient.
A recent survey performed online shows that nearly all auditors consider information about inherent risk factors and about process health measures e.g. rate of customer complaints about invoice errors to be relevant evidence in auditing controls effectiveness.
This finding was established by presenting people with examples of such information and asking how relevant they thought it was.
Survey results may be found at : http://homepage.ntlworld.com/m.leitch1/icd/controlquizresults/index.html
Process health measures were particularly persuasive and are characteristic of well controlled companies.
The rules should mention other evidence categories in a positive way and encourage companies to look more widely.
Overall this would result in more reliable, yet less costly audits.