Certified Government Auditing Professional (CGAP) Practice Exam

Under GAGAS, how does an auditor assess the performance of internal controls?

1. By conducting interviews with management

2. Through a combination of testing and evaluations

3. By solely relying on internal reports

4. By comparing against best practices

The correct answer is: Through a combination of testing and evaluations

The assessment of internal controls under Generally Accepted Government Auditing Standards (GAGAS) involves a methodical approach that goes beyond just interviews or reports. A combination of testing and evaluations provides a comprehensive understanding of how effectively the controls are functioning within the organization. This approach allows auditors to gather empirical evidence through various testing methods, such as walkthroughs, reperformance, and control observations, thereby ensuring that controls are not only adequately designed but also operating as intended in practice. Evaluations help in understanding the context and environment in which the controls operate, assessing their effectiveness and efficiency, and identifying any potential weaknesses or areas for improvement. In contrast, simply conducting interviews with management can provide insight but lacks the rigorous validation that testing affords. Relying solely on internal reports may not uncover discrepancies or issues that internal teams might overlook. Comparing against best practices might offer guidance but does not result in the direct assessment required by auditors who need to evaluate the specific internal controls in place and their effect on the organization’s risk management, governance, and operational efficiency. Therefore, the correct approach to assessing internal controls under GAGAS is through a combination of testing and evaluations, which ensures a thorough and reliable assessment.