Scientific Testing Of Internal Controls

No internal control can ever be proven to be 100% effective. The effectiveness assertion can only be supported or rejected. If our observation of the internal controls finds no issues related to the effectiveness assertion, then the assertion is reinforced and our reliance on that internal control increases. Each time the assertion is tested and found to be valid, it becomes more useful as an explanation of how controls work. But if any future event or testing finds the same internal control to be weak, the internal control must be rejected or modified. This modified internal control must in turn, be tested again. This is how our knowledge of internal control advances.

However, many of us form a hard opinion about the internal controls that have been found to be effective or otherwise in the past. Hence, possibility exists in such cases that all evidences that are needed to prove the assertion are not being collected and thus the evidence collection procedure is not corroborative. We often want an internal control to work in a certain way. The tendency in such cases is always to look only for confirming evidence and neglect denying evidence. But, when we step back a pace from our opinion and are willing to see our testing proving the assertion right or wrong, we are following the scientific method.

Einstein once said that no amount of experimentation can ever prove him right but a single experiment can prove him wrong. Let us understand how most of us search for evidence and how we should be doing it scientifically from the following exercise.

You have been told that the cards with light grey faces have a circle on the other side. Now suppose before you are four cards laid out, two having its face up and two having its face down as shown below.

What is the minimum number of cards you may need to flip to test whether the statement that all the light grey cards have a circle on their other side is true of false?

Think about the answer before you read ahead.

This simple exercise examines your tendency as to how you collect evidence. Many people opt to flip the cards that confirm the rule. They flip the cards with the light grey face, and leave it at that. Or they may also turn over the card with the circle. Flipping the card with circle does not add to the evidence because it could show either a light grey or a dark grey surface with the rule being still true as dark grey cards may also have circle.

The correct answer is two. You should first flip the card showing up the light grey face. If the reverse side of the light grey card is a circle, the rule is confirmed. But this does not give you all evidence you need. Now you must see on the other side of the square and not the circle. If that shows a light grey face, the proposed rule is false, because you have found a light grey card which does not have a circle on the other side and if it is a dark grey, or anything else, the rule remains intact.

So, if you are a next generation Internal Auditor, be clear with your logic of various assertions to be tested and use the scientific method whenever possible. Don't rely on internal controls at their face value, but observe them carefully, test them and be willing to adjust your opinion about them based on the evidence you gather.