Checklists or questionnaires
Audit firm will have a standard list of control questions. Audit staff can quickly ascertain which if any, are in operation by the client. There are two kinds; the internal control questionnaire (ICQ) and internal control evaluation questionnaire (ICEQ). ICQ's are designed to assess whether a control exists whereas ICEQ's are designed to assess whether frauds or errors are possible.
Advantages
Comprehensive as narrative and should therefore cover all controls
Standerd questionnaires with a little tailoring for the specific business
easy to amend and update
easy to delegate
highlight key features and controls
good for preliminary assessment of controls
Disadvantages
Is not visual or diagram based and not easy to quickly understand
client are able to mislead on the effectiveness of controls
controls operated by client may not be identified because of standerdiezed questionnaire
may contain large number of irrelevent controls