Management is responsible for the design, implementation, and maintenance of internal controls to ensure the reliability of financial reporting and the safeguarding of assets. While auditors evaluate these controls during an audit, they do not create or maintain them. The board of directors and management must ensure that the accounting system is robust enough to prevent errors and fraud, fulfilling their fiduciary duty to the stakeholders of the company.

Access control systems typically rely on three factors of authentication: knowledge (something you know, like a password), possession (something you have, like a physical token or card), and inherence (something you are, like biometric data). All these methods are standard practices for verifying identity and granting access to secure systems.

In audit planning, if an auditor assesses internal controls as strong, they may choose to rely heavily on them to reduce substantive testing. The 'acceptable risk of over-reliance' refers to the risk that the auditor incorrectly concludes that controls are effective when they are not. A higher reliance on controls inherently accepts a higher risk that the controls might fail to prevent or detect material misstatements.

Internal check refers to the arrangement of duties and responsibilities within an organization such that the work of one person is automatically checked by another. This mechanism is an integral part of the overall internal control system, which is designed to ensure the accuracy of accounting records, safeguard assets, and promote operational efficiency.

The auditor evaluates the internal control system to determine the reliability of financial reporting. By observing procedures and testing controls, the auditor assesses whether the organization's mechanisms are effective in preventing errors and fraud.