Does a full internal controls audit require testing every control?

No. A full internal controls audit should still be risk-based. The auditor considers materiality, regulatory exposure, operational impact, fraud risk, system dependence, prior findings, change activity, and management concern. High-risk processes receive deeper documentation and testing than low-risk processes.

For example, Harbor Vale Foods might prioritize procure-to-pay, inventory cycle counts, and privileged user access because they connect to cash, inventory accuracy, and system integrity. A low-risk office-supply approval process may be documented at a lighter level or deferred.

The exam trap is equating completeness with testing everything. Due professional care means designing work sufficient for the objective, not exhausting every possible control.