Audit Assistant has two options for sharing pages with clients to gather information concerning their internal controls. We initially provided only the checklist, but it was suggested by a well known auditing guru that open questions were probably better, so we added the questionnaire as an option.
As per the screenshot below, user can choose the checklist, the questionnaire, or if they already have the information there is an option for that. "Other" just opens an option to add a comment.
Internal Controls Questionnaire
The descriptive questionnaire asks open questions of general nature about controls, (e.g. Describe how accounting records are kept secure in terms of hardware security and data backup procedures.) Responses are made in terms of comments (or attachments) added by the client. Some auditors prefer the open-question approach as it leaves more opportunity for the client to describe what they think they are doing to address the risks described.
Internal Controls Checklist
The checklist is more detailed and asks specific questions with yes/no, multi-choice or prompting for a specific name (e.g. who is the system administrator for the general ledger?) Being more prescriptive it is more likely to get exact information, but may not get the breadth that the questionnaire achieves.
Which should I use?
It depends on the client. A client who wants to tell you all about their business will probably enjoy the Questionnaire more and you may gather some additional information you didn't think of asking about. However they may miss some important specific details that the checklist specifically prompts for. A client who is less wordy and just wants to get he job done will probably appreciate the checklist more. I would not recommend using both as this is likely to just annoy the client.
Tips before sharing
- It is good practice to skim through the page before sharing it for any parts that are not relevant for the client. The page can be customised to hide this kind of content, or additional content can be added if required. See notes on customising at a client level.
- Another option to remove content that the client may not need to see but should still be on the page is to hide a whole section. This is done at the point of sharing by de-selecting the specific section. This may be useful where you already have that data, or you are sharing the page with one staff member who knows about one part of the controls, then with a different one later to complete another part. See notes on sharing pages with third parties.