If internal controls are deemed insufficient to support management assertions, auditor will have to alter audit program by include management in collecting information concerning internal control systems without impairing their objectivity or judgment. Auditor should carry out procedures to get adequate evidence regarding operation and design of internal control and hence decrease attestation risks to low levels. Auditor may consider management's results and tests but not rely on them as principle evidence. In sufficient management, assertion and documentation of internal controls may result to 'important deficiency or material weakness'.
We have been explaining some of the evidence which can be collected: When is there sufficient evidence? For instance, do you only collect evidence if there is the issue? But then how do you authenticate that you reviewed all evidence?