How do auditors test internal controls? That would have been a very valid question written by an auditing professional in 2010! He/she was using the “auditors may test internal controls” criteria in their auditing review, as a way to ensure that these controls work on a specific client’s development schedule, but it does feel biased and flawed. For this, what we were doing was to check the internal controls’ results. Am I wrong? The following table shows the internal controls’ results from previous versions: I agree, and this is the equivalent of this with regard to some of the 3-5 year improvements because the documentation from the previous version (3.0) included an explicit parameter for the internal controls: