Sarbanes Oxley requires that per Section 404 that Internal Controls within a publicly held company are to be reviewed, evaluated and tested at year end to insure that adequate controls are in place.
In addition to understanding the Internal Controls present within your client's company, the auditor must also evaluate whether these controls are in place, and implemented.
How does an auditor evaluate these controls to see that they are working and in place?