Firstly check whether there exists an internal control system than check whether it is effective or not.Apply Substantial and Compliance procedures to evaluate the internal control system.