FYI ICFR - Testing Controls and Evaluating Identified Deficiencies—The evidence that should be obtained increases with the risk of the control being tested. (The objective is to express an opinion on ICFR overall, not on the effectiveness of individual controls.)

A. Evaluating “Design Effectiveness”—Procedures include a mix of inquiry, observation of the entity's operations, and inspection of relevant documentation. (A walkthrough is usually sufficient to evaluate design effectiveness.) b. Testing “Operating Effectiveness”—Procedures include a mix of inquiry, observation of the entity's operations, inspection of relevant documentation, recalculation, and reperformance of the control. (Note that these procedures are presented in order of increasing persuasiveness of the resulting evidence.) Inquiry alone is insufficient for evaluating the operating effectiveness of controls.