Which of the following is a method to document an auditor's understanding of internal controls?

Using internal control questionnaires is an effective method for documenting an auditor's understanding of internal controls because these questionnaires are designed to elicit information about the specific controls in place within an organization. They typically include a series of questions related to the policies and procedures that govern the control environment, risk assessment, control activities, information and communication, and monitoring activities.

By having management and relevant staff complete these questionnaires, auditors can gain insights into how internal controls are functioning, which areas might need improvement, and where potential risks lie. The responses provide a structured way to capture and record this understanding in a manner that can be easily referenced during the audit process.

While financial statements are essential for the overall audit, they do not directly convey details about internal controls. Risk assessment matrices can help in assessing risks but may not always reflect the operational aspects of internal controls as clearly as a questionnaire. Audit sampling techniques focus more on selecting a subset of transactions or controls for testing rather than documenting an understanding of the overall control environment. Thus, internal control questionnaires stand out as a dedicated method for this purpose.