1. Operational Auditing--Fall 2009 1 Operational Auditing Fall 2009 Professor Bill O’Brien

2. Operational Auditing--Fall 2009 2-2 Corporate Governance n Strategic direction n Governance oversight n Enterprise risk management n Assurance that processes are working

3. Operational Auditing--Fall 2009 2-3 Risk Management n Strategy formulation n Range of activities n Risk = barriers to objective achievement

4. Operational Auditing--Fall 2009 2-4 COSO and ERM n COSO 2 cube n ERM defined: n “A process, effected by an entity’s board of directors, management and other personnel, applied in a strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives”

5. Operational Auditing--Fall 2009 2-5 Remember this Key Point BOTH n Risk is BOTH positive and negative

6. Operational Auditing--Fall 2009 2-6 COSO ERM Objectives: S-C-O-R n S n S trategic n C n C ompliance n O n O perations n R n R eporting

7. Operational Auditing--Fall 2009 2-7 Integrating COSO-ERM with COSO-I/C The COSO-ERM Model incorporates rather than replaces the COSO-I/C Model. -Control Environment -Risk Assessment Processes -Operational Control Activities -Information Flow Systems -Monitoring Activities COSO APPROACH TO CONTROL ACHIEVEMENT -Internal Environment -Objective Setting -Event Identification -Risk Assessment -Risk Response -Control Activities -Information & Communication -Monitoring COSO-ERM COMPONENTS

8. Operational Auditing--Fall 2009 2-8 COSO-ERM Components n Internal Environment n Objective Setting n Event Identification n Risk Assessment n Risk Response n Control Activities n Information and Communication n Monitoring

9. Operational Auditing--Fall 2009 2-9 ERM and Ops. Audit n Provide assurance on risk mgt. n Provide assurance of risk evaluation n Evaluate risk mgt. processes n Evaluate risk reporting n Review the mgt. of key risks. n See Exhibit 3-7

10. Operational Auditing--Fall 2009 2-10 IIA ERM Advisory n Audit plan should be based on risk assessment n Audit plan may include the strategic planning process n Audit plan should be updated for significant changes n Audit plan should be prioritized based on risk likelihood and exposure n Audit reporting should convey risk related conclusions

11. Operational Auditing--Fall 2009 2-11 O’Brien’s Suggestions conceptual n Finance should be involved in active conceptual support. driver n Finance should be an implementation driver. assessment n Finance should provide on-going assessment of the process. insight n Finance should add insight to ERM and vice-versa. coordinator n Finance should assume the role of process coordinator.

12. Operational Auditing--Fall 2009 2-12 Where Do We Go from Here? n Increased demand n Increased respect n Increased contribution n Increased advancement opportunities… n IT’S A GREAT TIME TO BE FOCUSED ON OPERATIONAL AUDIT OPPORTUNITIES!!!

13. Operational Auditing--Fall 2009 2-13 Business Processes n Basic entity for I/A services n Understanding business processes is key n Consider the “O’Brien Seven” (similar to p.4-6) n Mission statement n Objectives n Resources n Restrictions n Processes and related risks n Organization chart n Key management bios

14. Operational Auditing--Fall 2009 2-14 Process Documentation n Flow charts n Storyboarding n Identifying business risks n What gets in the way of objective achievement

15. Operational Auditing--Fall 2009 2-15 Flowcharting Begin or End File Decide Document Activity

16. Operational Auditing--Fall 2009 2-16 What Is Storyboard Flowcharting? n New method for documenting a process. n Clean and simple flowcharting method. n Allows for clients and auditors to clearly understand process under review. n Simple technique that requires a good graphics package and a little imagination. n Can use Microsoft PowerPoint, Harvard Graphics, Corel Draw, etc. n Does not replace IS flowcharting.

17. Operational Auditing--Fall 2009 2-17 The Basics of Storyboard n Meet with client and document process. n Use your imagination to choose/draw picture. n Under picture write narrative for each step represented. n Be creative - good control narrative in green; poor controls in red. n Completed storyboard must be reviewed with client. n Make any changes necessary. n Final copy should be in color for most effective presentation. n Different process may require different approach.

18. Operational Auditing--Fall 2009 2-18 How to Storyboard Meet with client and document process. From client interview create storyboard. A A Print out story board - black and white draft and color for final. Review storyboard with client and obtain sign off.

19. Operational Auditing--Fall 2009 2-19 Start Customer Service Rep Receives Order Scan Form Into System Shipping Files Yellow Customer Service Rep Researches And Corrects Information Shipping Pulls And Packs Orders End By Phone? By Mail or Fax? On Standard Order Form? Shipping Sends Order and Green Copy (Invoice) Customer Service Rep. Key Enters Data on-Line Approved By Manager? Send to Special Order Department Print Three-Part Shipper Yellow and Green To Shipping Department Pink to Accounts Receivable Department YES NO YES Company XYZ Order-fulfillment process NO

20. Operational Auditing--Fall 2009 2-20 A A Customer Representative Receives orders by fax or mail. Receives orders by phone. Standard orders are scanned into system. Customer Representative enters order data on-line. A three-part packing slip is printed per order. Pink copy sent to accounts receivable department. Company XYZ Order-fulfillment process Packing slip approved by Manager. If not approved, returned to Customer Representative for correction Packing slip Yellow and green copy go to shipping department. Shipping pulls and packs orders. Yellow copy filed in shipping department. Green copy sent with order.

21. Operational Auditing--Fall 2009 2-21 Mapping Risk to Processes n Identify risks n Link risks to the processes n Evaluate risks in terms of likelihood and impact (exposure) n Determine risk responses n Avoidance, reduction, sharing, acceptance

22. Operational Auditing--Fall 2009 2-22 Managing the Internal Audit Activity n Effective management n Establish a risk-based plan n Communicate the plan n Ensure adequate resources n Coordinate services n Report on a regular basis n Monitor implementation of recommendations

23. Operational Auditing--Fall 2009 2-23 Reporting Structure n Solid to Audit Committee n Dotted line to functional and committed executive

24. Operational Auditing--Fall 2009 2-24 Planning Activities n Operating plan and financial plan (budget) n Establish goals and objectives n Determine overall resources

25. Operational Auditing--Fall 2009 2-25 Process Owner (BPO) Selection n Dates and results of last engagement n Updated risk assessment n Senior management requests n Current governance issues n Major operational changes n Operating benefit opportunities n Audit staff capabilities

26. Operational Auditing--Fall 2009 2-26 Resource Management n Staffing approaches n Flat versus hierarchical n Futures’ files n Commitment to training n Pathways for career development n Co-sourcing and outsourcing

27. Operational Auditing--Fall 2009 2-27 Working with External Auditors n Coordinated coverage n Cross access to workpapers n Exchange of reports n Expansion of expertise n Facilitation of relationship w/senior mgt.

28. Operational Auditing--Fall 2009 2-28 Ops. Audit & Governance n Process of overseeing the achievement of objectives n Some elements of good governance n Assessing the control environment n Serving as an ethics advocate

29. Operational Auditing--Fall 2009 2-29 Control Objectives n Staying under control as evidenced by n Safeguarding of assets n Compliance with laws and regulations n Organizational goal & obj. achievement n Reliability & integrity of information n Economical & efficient use of assets n Expansion of material on 8-22 — 8-23

30. Operational Auditing--Fall 2009 2-30 Control Environment n Integrity and ethical values n Management philosophy and operating style n Organizational structure n Assignment of authority and responsibility n H/R policies and practices n Sustained competency of personnel

31. Operational Auditing--Fall 2009 2-31 Other Management Issues n Performance metrics n Control self assessment n We will cover these in the next class