QUESTION 10 Non-public and smaller public companies are not required to have an audit of their internal control over financial reporting. Because of this, auditors usually assume the controls are not effective and perform extensive substantive tests. Even so, the auditor must obtain an understanding of internal control to the same extent as would be required for a large public company Auditors of these companies only need to obtain an understanding of internal control and audit evidence sufficient to assess control risk. The auditor of these companies is not required to do any work with regard to internal control