AUD, Auditing and Attestation

Sources for Understanding Internal Control and IT

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Understanding Internal Control and IT. The topic rests on AU-C 315.

About this topic

Every entity runs on systems and habits meant to keep its numbers right. The auditor has to learn how those work, because knowing where they could fail is what says where to look.

Stated technically, the auditor obtains an understanding of the entity's internal control relevant to the audit. It has to reach far enough to identify where things can go wrong and to design a response. Nothing is tested for operating effectiveness at this stage. The auditor first evaluates whether the controls are designed well and are implemented. Information technology sits inside this understanding, both as a strength and as a source of risk.

Key points

• Internal control has five components: control environment, risk assessment, information and communication, control activities, and monitoring.
• IT general controls (ITGCs) support the reliable functioning of application controls and include access security, change management, and operations.
• The auditor must obtain an understanding of internal control relevant to the audit, regardless of planned reliance.
• A control deficiency exists when a control cannot prevent or detect a misstatement on a timely basis.

What the lessons cover

1. The five components
2. Design and implementation
3. Information technology
4. Controls relevant to the audit, and the limits of internal control
5. From the understanding to the response
6. The same ground under PCAOB standards: AS 2110, AS 2201 and AS 2301

Authoritative references

Where these requirements sit in the literature. The two are listed separately on purpose.

AICPA (nonissuer)

• AU-C 315.12, the definitions paragraph, carries the five components of the system of internal control and defines twelve terms including IT environment, IT processes, IT operations and risks arising from the use of IT. It also anchors that controls relevant to the audit are primarily those bearing on the reliability of financial reporting, chosen by professional judgment, and that application (information processing) controls are a subset of control activities.
• AU-C 315.22 carries the control environment: the attitudes, awareness and actions that set the tone, the independence and involvement of those charged with governance, whether it provides an appropriate foundation for the other components, whether deficiencies in it undermine them, and whether management with governance oversight maintains a culture of honesty and ethical behavior. It also supports the smaller-entity point that concentrated owner authority is at once oversight and override exposure.
• AU-C 315.26 requires risk assessment procedures beyond inquiry alone to evaluate design and determine implementation: inquiry combined with observation, inspection, or reperformance.
• AU-C 315.29b is the requirement to identify the general IT controls addressing risks arising from the use of IT. "General IT controls" is not a term defined in .12, and Appendix F explains their nature.
• AU-C 330.08 conditions tests of operating effectiveness on two triggers: intent to rely, or substantive procedures alone cannot provide sufficient appropriate evidence at the assertion level. AU-C 330.18 requires substantive procedures for each relevant assertion of every material class, balance and disclosure irrespective of the assessed risk.
• AU-C 265.07 and .11 carry the deficiency vocabulary and its communication, and belong to a different blueprint area.
  • .07 defines a material weakness by the reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis.
  • .11 requires significant deficiencies and material weaknesses to be communicated in writing to those charged with governance on a timely basis.
• At standard level, AU-C 315 carries the general-IT-versus-application distinction, the dependence of application controls on the IT environment, the input/processing/output classification, the entity-level versus process-level split, the inherent limitations, and the boundary that a nonissuer audit yields no opinion on internal control. AU-C 315 with AU-C 330 carries single-instance testing and benchmarking, conditioned on effective program-change and access controls. AT-C 320 carries the SOC 1 report types: a Type 1 covers description and design at a date, a Type 2 adds operating effectiveness over a period with the service auditor's tests and results.

PCAOB (issuer). The comparison tables carry the substance; these are the anchors to search by.

• AS 2110.18 through .22: objective of the understanding, evaluate design and determine implementation, the component list with information and communication third and monitoring of controls fifth, and management's own suitable framework with .23 through .36 adapted to it.
• AS 2110.23 through .36: the components one by one, including these:
  • .25 a control-environment deficiency as a possible fraud risk factor.
  • .28 the period-end financial reporting process.
  • .29 how IT affects the flow of transactions.
  • .36 the source of the information used in monitoring.
• AS 2110.37 through .40: walkthroughs and the separation of understanding internal control from testing controls.
• AS 2110 Appendix B, on manual and automated systems and controls.
  • .B1 the extent of manual and automated controls including the ITGCs important to the automated controls.
  • .B4 the specific IT risks.
  • .B5 the company's response to them.
  • .B6 testing the consistency of manual controls relied on.
• AS 2201.03 and .05: the opinion on ICFR effectiveness, using management's framework. AS 2201.22 through .27: testing the entity-level controls important to the conclusion, their three tiers of precision, what they include, and the required evaluation of the control environment and the period-end reporting process.
• AS 2201.34 through .47 carry likely sources of misstatement and walkthroughs, then three numbered points.
  • .41 selection on which controls sufficiently address the assessed risk rather than on the label.
  • .42 through .45 testing design and operating effectiveness.
  • .46 and .47 the risk associated with a control.
• AS 2201.60, .61, .B28 through .B33: benchmarking, its dependence on related files, tables, data and parameters, reestablishing the baseline, and varying control testing year to year.
• AS 2201.62 through .70 with AS 2201.A3, .A5, .A7, .A8, .A11: the evaluation of deficiencies and the definitions of deficiency, ICFR and its inherent limitations, material weakness, preventive and detective controls, and significant deficiency.
• AS 2201.B7, .B9, .B18, .B20: substantive procedures regardless of the ICFR work, no inferring effectiveness from an absence of detected misstatements, service-organization services inside information and communication, and no operating-effectiveness evidence from a report without tests of controls.
• AS 2301.16 through .24: the entire period of reliance, required tests where substantive procedures alone cannot suffice, and control tests ranked inquiry, observation, inspection, reperformance. AS 2301.31 through .38, .47: evidence from past audits, control risk at the maximum, the response when relied-on controls prove ineffective, substantive procedures regardless of control risk, and dual-purpose tests.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary