1. Operational Auditing--Fall 2010 1 Operational Auditing Fall 2010 Professor Bill O’Brien

2. Operational Auditing--Fall 20105-2 Workpaper Usage n Planning and execution n Supervision and review n Objective tracking n Conclusion support n Supports quality assurance n Professional development n IIA standards’ compliance

3. Operational Auditing--Fall 20105-3 Workpaper Guidelines n Cross-referencing system n Consistent layouts n Standardized symbols or “tick marks” n Standardization for permanent files n Unique indexing n Description of purpose n Initialed by preparer and reviewer n Source of information indicated n Clear explanations of symbols n Legibly written and easy to understand n Must stand alone n Must relate to the engagement objectives

4. Operational Auditing--Fall 20105-4 Sample Work Paper Heading Ref. Review T/M Legend: Source Purpose: Conclusions

5. Operational Auditing--Fall 20105-5 Generalized Audit Software (GAS) n Two most popular applications n ACL (ACL) n IDEA (CaseWare) n Typical uses n File examination n Recalculations n Sample selection n File comparison n Reformatting n Pivot tables n Benford’s Law analysis n Reporting n Data analysis log

6. Operational Auditing--Fall 20105-6 GAS, continued n Benefits n Minimizes customization n Independent of company IT n Efficient n Facilitates 100% testing n Frees BPP for analytical work n Obstacles n Data access n Physical access n Format knowledge n Downloading issues to BPP’s computer n Importing data in usable format

7. Operational Auditing--Fall 20105-7 Control Self Assessment (CSA) n Methodology n Review and Identification n Key business objectives n Related risks n Mitigating controls

8. Operational Auditing--Fall 20105-8 CSA-History n Introduced by Gulf Canada in 1987 n Gulf used facilitated meetings

9. Operational Auditing--Fall 20105-9 Facilitated Meetings n Management and staff participate through interviews and polling n Objectives n Risks n Processes n Soft and/or informal controls

10. Operational Auditing--Fall 20105-10 General Methodology n Shared process n Assessment of internal controls n Evaluation of risks n Development of action plans n Assess the likelihood of achieving objectives n SJSU simulation

11. Operational Auditing--Fall 20105-11 General Approaches n Facilitated meetings--group workshops n Questionnaires--yes/no answers n Management analysis--self studies

12. Operational Auditing--Fall 20105-12 Uses n Self analysis for risk* n Selection of audit areas* n Internal control review* n Special projects n Soft control analysis * alternatives to the traditional approach to the I/A process

13. Operational Auditing--Fall 20105-13 Benefits n Increases I/A scope n Target review of high risk areas n Increases the effectiveness of corrective action n Builds team-oriented relationships

14. Operational Auditing--Fall 20105-14 Engagement Process n Planning: n Selecting the BPO n Pre-site planning n Performing: n Conducting the preliminary survey n Review internal controls n Expanding tests as necessary n Generating findings n Communicating: n Reporting the results n Conducting follow-up n Assessing the process

15. Operational Auditing--Fall 20105-15 Audit Evidence n Healthy skepticism n Attributes n Relevant: consistent with objectives n Reliable: credible n Sufficient: convincing

16. Operational Auditing--Fall 20105-16 Business Processes n Basic entity for I/A services n Understanding business processes is key

17. Operational Auditing--Fall 20105-17 Process Documentation n Flow charts n Storyboarding n Identifying business risks n What gets in the way of objective achievement

18. Operational Auditing--Fall 20105-18 Flowcharting Begin or End File Decide Document Activity

19. Operational Auditing--Fall 20105-19 What Is Storyboard Flowcharting? n New method for documenting a process. n Clean and simple flowcharting method. n Allows for clients and auditors to clearly understand process under review. n Simple technique that requires a good graphics package and a little imagination. n Can use Microsoft PowerPoint, Harvard Graphics, Corel Draw, etc. n Does not replace IS flowcharting.

20. Operational Auditing--Fall 20105-20 The Basics of Storyboard n Meet with client and document process. n Use your imagination to choose/draw picture. n Under picture write narrative for each step represented. n Be creative - good control narrative in green; poor controls in red. n Completed storyboard must be reviewed with client. n Make any changes necessary. n Final copy should be in color for most effective presentation. n Different process may require different approach.

21. Operational Auditing--Fall 20105-21 How to Storyboard Meet with client and document process. From client interview create storyboard. A A Print out story board - black and white draft and color for final. Review storyboard with client and obtain sign off.

22. Operational Auditing--Fall 20105-22 Start Customer Service Rep Receives Order Scan Form Into System Shipping Files Yellow Customer Service Rep Researches And Corrects Information Shipping Pulls And Packs Orders End By Phone? By Mail or Fax? On Standard Order Form? Shipping Sends Order and Green Copy (Invoice) Customer Service Rep. Key Enters Data on-Line Approved By Manager? Send to Special Order Department Print Three-Part Shipper Yellow and Green To Shipping Department Pink to Accounts Receivable Department YES NO YES Company XYZ Order-fulfillment process NO

23. Operational Auditing--Fall 20105-23 A A Customer Representative Receives orders by fax or mail. Receives orders by phone. Standard orders are scanned into system. Customer Representative enters order data on-line. A three-part packing slip is printed per order. Pink copy sent to accounts receivable department. Company XYZ Order-fulfillment process Packing slip approved by Manager. If not approved, returned to Customer Representative for correction Packing slip Yellow and green copy go to shipping department. Shipping pulls and packs orders. Yellow copy filed in shipping department. Green copy sent with order.

24. Operational Auditing--Fall 20105-24 Mapping Risk to Processes n Identify risks n Link risks to the processes n Evaluate risks in terms of likelihood and impact (exposure) n Determine risk responses n Avoidance, reduction, sharing, acceptance