A retailer's inventory count control requires a second counter to verify every high-value bin. The procedure is written, staffed, and performed on schedule. It still misses $1.4 million of shrinkage, because the second counter is the same warehouse supervisor who ordered the goods. The control operated. It was never designed to catch that risk.
An internal control is any action taken by management or the board to manage risk and increase the likelihood that objectives are achieved. Controls do not exist to be present. They exist to move a specific risk to an acceptable level.
You test three distinct qualities, in a fixed order:
- Design: Would the control, if it operated exactly as intended, actually address the risk it targets? This is a logic question, answered on paper.
- Effectiveness (operation): Did the control actually operate as designed, consistently, throughout the period under review? This is an evidence question, answered by testing.
- Efficiency: Does the control deliver its risk reduction at a reasonable cost in money, time, and friction? This is an economics question.
Common mistakes
- Concluding effectiveness from documentation alone. Twelve signed monthly reviews prove the procedure ran. They prove nothing if the reviewer authorizes what he reviews.
- Testing operation before assessing design. A design-deficient control needs no sample; the deficiency is reportable on inspection of the control's logic.
- Calling a walkthrough an effectiveness test. One traced transaction confirms implementation only.
Bottom line
- Evaluate in order: design first, operating effectiveness second, efficiency third; a design failure ends the evaluation.
- Design asks whether the control would address the stated risk if it ran perfectly, testing risk fit, control type, independence, and precision.
- Effectiveness asks whether the control actually operated as designed across the whole period, evidenced by inquiry, observation, inspection, or reperformance, strongest last.
- A walkthrough confirms design and implementation for one transaction and is never an operating effectiveness test.
Exam shortcut
Read the stem for which of the three qualities is actually broken. If the control "was performed every month and documented" but the performer owns the risk, the answer is design, and any choice offering more testing is a distractor. If the control logic is sound but exceptions were found in the sample, the answer is operating effectiveness, and the recommendation is enforcement, not redesign.
The full lesson (about 2,428 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 8
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.