Hi ALl:

In order to develop an understanding of internal control in an organization the auditor will:

(a) Determine whether internal controls have been properly designed and implemented.

(b) if in his view controls are properly designed and implemented, s/he may assess control risk to be very low.

(c) If the auditor determines that control risk is very low then he needs to determine the effectiveness of internal controls to really support his conclusion about control risk.

The order, thereforeshould be A--> C.

If the auditor believes that control risk is verh high then there is no need to determine the effectiveness of internal controls because this will be inefficient. He, therefore, proceeds to substantive tests. he must, of course document why he believes that control risk is high.

It is possible to perform the procedures concurrently.

Typical tests of controls are:

R-- Repreformance of some tasks -(Calculations like in our simulations)

I -- Inspection of documents

I -- Inquiries of management and others in the organization

O-- Observation of employees while performing tasks (useful if done in hiding -- just kidding)

Hope you find this useful and hope that someone will confirm.  

Thanks cpadpm, it is much more clear.