Internal control evaluation is a crucial component of external auditing. This study uses more direct research techniques than traditional studies, to investigate what practising auditors consider to be good internal control evaluation methods. It then compares these with the current Australian auditing standard (AUS 402). A review of audit methodologies of three of Australia's largest firms, and interviews with five audit experts were conducted. The results demonstrated a shift towards a 'business risk' approach to internal control evaluation. AUS 402 may not always reflect the modern practice, particularly in relation to the significance of individual control elements. The results therefore raise potential implications for standard setters, if professional pronouncements are to be consistent with practice.