If the internal controls are deemed inadequate to support management assertions, the auditor will have to modify the audit program by include the management in gathering information concerning the internal control systems without impairing their objectivity or judgment. The auditor must perform procedures to obtain sufficient evidence regarding the operation and design of the internal control and therefore reduce the attestation risks to low levels. The auditor may consider the management's results and tests but not rely on them as principle evidence. In adequate management, assertion and documentation of internal controls may result to 'significant deficiency or material weakness'.

We have been discussing some of the evidence that can be gathered in this class, but let me ask this: When is there enough evidence? For example, do you only gather evidence if there is an issue? But then how do you verify that you reviewed all evidence?