If auditors determine that internal controls over data which are significantly dependent upon computerized information systems are not effective or if auditors do not plan to test the effectiveness of such controls, auditors should include audit documentation regarding the basis for that conclusion by addressing (1) the reasons why the design or operation of the controls is ineffective, or (2) the reasons why it is inefficient to test the controls.
If auditors find the internal controls over data are not effective, they should include that documentation in the appendix.