View/Export Results
Manage Existing Surveys
Create/Copy Multiple Surveys
Collaborate with Team Members
OR
Sign inSign in with Facebook
Sign inSign in with Google

Internal control questionnaire for one process and its owner

Sixteen checks the owner of one process answers Yes, Partly or No. Preview it, then open it in the editor.

  • 16questions
  • About 8 minto answer
  • Yes, Partly, Noor not applicable
  • 1 processper response
Use this template Try the questionnaire first
Internal Control Questionnaire · answer to move through it
Use this template
Question 1 of 16 The process
Which process are you answering for?
Question 2 of 16 The process
How many people carry out the steps of this process in a normal month?
Only me
2 or 3
4 to 10
More than 10
Question 3 of 16 Control environment
A current written description of this process names who carries out each step.
Yes
Partly
No
Not applicable
Question 4 of 16 Control environment
Everyone who carries out a step knows what they are expected to check before passing it on.
Yes
Partly
No
Not applicable
Question 5 of 16 Risk assessment
In the last 12 months, somebody has listed what could go wrong in this process, including fraud.
Yes
Partly
No
Not applicable
Question 6 of 16 Control activities
No one person can take a transaction from start to finish without a second person checking it.
Yes
Partly
No
Not applicable
Question 7 of 16 Control activities
Every approval in this process is given within a written limit of authority.
Yes
Partly
No
Not applicable
Question 8 of 16 Control activities
Balances this process feeds are reconciled on a set schedule by somebody who did not post them.
Yes
Partly
No
Not applicable
Question 9 of 16 Control activities
Access to the systems and assets in this process was reviewed in the last 12 months.
Yes
Partly
No
Not applicable
Question 10 of 16 Control activities
When a step cannot be done as designed, the exception is logged and signed off.
Yes
Partly
No
Not applicable
Question 11 of 16 Information and communication
The reports used to check this process can be traced back to the source records.
Yes
Partly
No
Not applicable
Question 12 of 16 Information and communication
A problem found in this process reaches somebody with the authority to fix it.
Yes
Partly
No
Not applicable
Question 13 of 16 Monitoring
Somebody independent of this process has tested at least one of its controls in the last 12 months.
Yes
Partly
No
Not applicable
Question 14 of 16 Monitoring
Every weakness raised at the last review has a named owner and a due date.
Yes
Partly
No
Not applicable
Question 15 of 16 In your words
Which control in this process would you least want tested tomorrow, and why?
Question 16 of 16 Overall
Overall, how confident are you that this process would catch a material error before it reached the accounts?
Very confident
Confident
Somewhat confident
Not very confident
Not at all confident

The 16 internal control questions

An internal control questionnaire asks the person who owns a process whether its checks exist and run: who approves, who reconciles, who has access and what happens when a step is skipped. This one covers one process per response, grouped under the five components of internal control,[1] and every question opens ready to edit in the questionnaire builder.

Plain text, one question per line, with the answer scale.

The process

So every response can be followed up.

  1. Which process are you answering for?Short textUse the process name on your audit plan.
  2. How many people carry out the steps of this process in a normal month?Pick one of 4A team of one to three changes how question 6 reads.

Control environment

Is the process written down and understood?

  1. A current written description of this process names who carries out each step.Yes, Partly, No, Not applicableA No often means the process lives in one head.
  2. Everyone who carries out a step knows what they are expected to check before passing it on.Yes, Partly, No, Not applicablePartly is common: people know their own step only.

Risk assessment

Has anyone named what could go wrong?

  1. In the last 12 months, somebody has listed what could go wrong in this process, including fraud.Yes, Partly, No, Not applicableFraud is named so it stays on the list.

Control activities

Separation, authority, reconciliation, access and exceptions.

  1. No one person can take a transaction from start to finish without a second person checking it.Yes, Partly, No, Not applicableThe No to fix first.
  2. Every approval in this process is given within a written limit of authority.Yes, Partly, No, Not applicablePartly: the limits exist and nobody checks approvals against them.
  3. Balances this process feeds are reconciled on a set schedule by somebody who did not post them.Yes, Partly, No, Not applicableA poster reconciling their own entries checks arithmetic, not judgment.
  4. Access to the systems and assets in this process was reviewed in the last 12 months.Yes, Partly, No, Not applicableLeavers and role changes are where access drifts.
  5. When a step cannot be done as designed, the exception is logged and signed off.Yes, Partly, No, Not applicableWith no exception log, a Yes above describes the design only.

Information and communication

Can the evidence be trusted?

  1. The reports used to check this process can be traced back to the source records.Yes, Partly, No, Not applicableA re-keyed spreadsheet is the usual reason for a No.
  2. A problem found in this process reaches somebody with the authority to fix it.Yes, Partly, No, Not applicableA No means problems are found and then sit.

Monitoring

Does anybody outside the process check it?

  1. Somebody independent of this process has tested at least one of its controls in the last 12 months.Yes, Partly, No, Not applicableAt a small organization: a board treasurer or an outside accountant.
  2. Every weakness raised at the last review has a named owner and a due date.Yes, Partly, No, Not applicableA weakness with no owner is still open at the next review.

In your words, then the verdict

One open answer, then one rating.

  1. Which control in this process would you least want tested tomorrow, and why?Long text, optionalOwners usually know where the weak control is.
  2. Overall, how confident are you that this process would catch a material error before it reached the accounts?Pick one of 5Read it against the Nos above.

How to use the internal control questionnaire

Send one questionnaire per process to the person who owns it: the finance manager for payments, the payroll lead for payroll, the treasurer at a small nonprofit. Question 1 names the process, so each response traces to its owner. For every employee's anonymous view of the rules, send the employee compliance survey instead.

Send it before the year-end audit and after any big change: a new finance system, a merged team or a key leaver.

Leave out Not applicable, then count the Nos and Partlys under each component. Start with control activities. Then read the open answer beside the confidence rating: a confident owner who names a control they would not want tested has shown you where to look.

An isometric conveyor carrying document trays past a barrier, a magnifier and a shield with a tick, ending at a locked cabinet
Each gate is a check. The questionnaire asks whether it runs.

Internal control questionnaire FAQ

What are the five components of internal control?

Control environment, risk assessment, control activities, information and communication, and monitoring. The US Green Book sets out its standards under these five components.[1] COSO also describes five components of effective internal control.[2]

Does an internal control questionnaire work for a nonprofit or small business?

Yes. Nonprofit organizations may adopt the Green Book as their framework.[1] It says a smaller entity can answer the challenge of segregating duties by adding levels of review for key processes.[1] A board treasurer who reviews bank statements is one such level.

Which processes need an internal control questionnaire?

Start with the ones that move money or stock: purchasing and payments, payroll, cash receipts, and inventory in a manufacturing company. Send each owner a separate questionnaire.

How do auditors use an internal control questionnaire?

To plan where testing starts. The answers record what the owner says happens, and a test then checks samples against the evidence.

Related business survey templates

When a process is controlled but slow, the operational efficiency survey asks where the time goes. After a control has failed and caused an incident, review it with a crisis management survey. Access problems often trace back to staff habits, which the cyber security questionnaire for employees covers. A nonprofit treasurer can also hear from supporters with a donor survey. Procurement and strategy have their own forms among the business survey templates.

BusinessCompliance SurveyWhen you want every employee's anonymous view of the rules, not one owner's account of a process.15 questions, 5 min BusinessOperational Efficiency SurveyWhen the process is controlled but slow, and the question is where the time goes.15 questions, 7 min EmployeeCyber Security Questionnaire for EmployeesWhen the weak point is how staff handle data and access day to day.14 questions, about 5 min BusinessProcess Improvement SurveyWhen the people doing the work should suggest what to change.10 questions, 5 min BusinessCrisis Management SurveyWhen a control has already failed and the people who dealt with it should review what happened.16 questions, 4 min BusinessSupplier Satisfaction SurveyWhen the question is how your suppliers find you as a customer.12 questions, 3 min

Michael Hodge, survey methodology · Updated 2 October 2026 · How templates are reviewed

Sources (2)
  1. US Government Accountability Office. Standards for Internal Control in the Federal Government (the Green Book), GAO-25-107721, May 2025. gao.gov
  2. Committee of Sponsoring Organizations of the Treadway Commission. Guidance on Internal Control. coso.org

Send it to the owner of your riskiest process

Sixteen questions, about eight minutes. Put your own process names in and start with the Nos.

Use this template