1. Directing and Performing Internal Audits ACT3642 1/2009 A.Phassawan S.

2. Agenda Organizing and performing IA Audit planning preparatory activities Starting the IA Using audit programs to perform IA

3. Organizing & Performing IA When performing an audit, an IA must do more than just review published documentation and procedures.  IA must visit organization facilities where the actual work is performed and where records are maintained To observe and develop an understanding of the processes in place and, To design and perform appropriate tests to evaluate supporting internal controls.

4. Organizing & Performing IA IA should know the procedures to direct and perform internal audits:  Such as surveys, documentation of internal controls, workpaper documentation, and administrative controls. IA will be more effective:  if all members of audit staff follow consistent, professional procedures in performing their review.  in the eyes of management, who will come to expect a consistent, quality approach from IA in the ongoing performance of their work.

5. Agenda Organizing and performing IA Audit planning preparatory activities Starting the IA Using audit programs to perform IA

6. Audit Planning Preparatory Activities Every audit assignment should be planned carefully prior to its start as part of internal audit’s annual planning and risk-assessment process. Despite plans for unscheduled or special reviews, other requests either may from the management or situations such as unfavorable results from other audits may cause changes in the audit planning process.

7. Audit Planning Preparatory Activities While there often are pressures to begin such special audits immediately, a properly planned audit will almost always have better audit results. IA can obtain the savings in time and effort with adequate advance planning and preparatory work.  Although some preparatory activities can be performed during the audit itself, most take place in advance of visiting the audit site or beginning the audit.

8. Audit Planning Preparatory Activities The preparatory activities include defining the objectives, scope, and procedures used in an individual internal audit. Relative-risks should have been considered. Based on risk evaluation, a long-range audit plan would have been developed.

9. Audit Planning Preparatory Activities Procedures required to develop detailed individual audit plans are as follows: (a) Determining audit objectives (b) Audit scheduling and time estimates (c) Preliminary surveys

10. Audit Planning Preparatory Activities a) Determining audit objectives The need to establish audit objectives is the most important aspect of audit planning. Objectives based on management’s desires, the audit approaches available, audit staff capabilities, the nature of prior audit work, available resources and time, and the specific objectives and limitations of all audit project should be considered.

11. Audit Planning Preparatory Activities a) Determining audit objectives General objectives are part of overall audit plan and define high-risk areas for internal audit consideration. Once overall audit purpose is defined, the scope of specific audits can be established.

12. Audit Planning Preparatory Activities a) Determining audit objectives Internal audit management sets forth this scope, audit objectives, and planned procedures in an engagement-planning memo. (See exhibit 14.1) Although the memo may be altered later through a preliminary audit process, a formal statement of scope and objectives communicates the general intentions of planned audit to the assigned staff members.

13. Audit Planning Preparatory Activities b) Audit Scheduling and Time Estimates The annual IA plan should be used to decide which audits are to be performed in any given period. Preliminary time estimates are established and time frames set for performing each audit. Changes are often made to this annual plan during the course of the year.

14. Audit Planning Preparatory Activities b) Audit Scheduling and Time Estimates Individual audit schedules based on the plan should be prepared. Depending on the nature of audits performed and audit staff size, the individual schedules may cover a month, a quarter, or even a longer period. Detailed audit schedules should be prepared and reviewed at least monthly to reflect changes or adjustments, e.g. time conflict. (see exhibit 14.2)

15. Audit Planning Preparatory Activities b) Audit Scheduling and Time Estimates The number and level of staff depends on an evaluation of the nature and complexity of the audit projects as well as auditor abilities and time constraints. Auditor skills and developmental needs should be considered in selecting personnel for any audit project assignment.

16. Audit Planning Preparatory Activities c) Preliminary Surveys The annual and long-range audit plans should be made with some knowledge of the expected area to be audited. The preliminary surveys are performed to gather background materials regarding the entity to be audited. This survey is often the responsibility of audit management or the designated in-charge auditor and is followed by a “field survey”.

17. Audit Planning Preparatory Activities c) Preliminary Surveys Prior to starting actual fieldwork, it is necessary that there be some review of an area’s background and other materials covering planned audit. Some of this background information may be available from prior audit workpapers or correspondence.

18. Audit Planning Preparatory Activities c) Preliminary Surveys The following items should, generally, be reviewed if available during an IA preliminary survey: Review of prior workpapers Review of prior audit reports Organization of entity Other related audit materials

19. Audit Planning Preparatory Activities c) Preliminary Surveys (1) Review of prior workpapers The prior audit objectives and scope, audit workpapers, and programs used should be reviewed to gain familiarity with approaches used and the results of those audits. Special attention should be given to any problems encountered in the prior audit and the suggested methods of solving them.

20. Audit Planning Preparatory Activities c) Preliminary Surveys (1) Review of prior workpapers Knowing the amount of time that the prior audit took as well as any problems encountered can help IA to determine the planned resources needed. The results of prior tests should be reviewed, deciding whether any should be reduced, eliminated, expanded, or performed on a rotating basis in future audits.

21. Audit Planning Preparatory Activities c) Preliminary Surveys (2) Review of prior audit reports Past audit findings and their significance should be considered, as well as the extent of management commitments to take corrective actions. Particular attention should be given if substantial corrective actions were required.  Those planning the upcoming planned audit may want to include an examination of these areas.

22. Audit Planning Preparatory Activities c) Preliminary Surveys (3) Organization of entity The auditor should obtain an organization chart of the entity to be audited to understand its structure and responsibilities. Particular attention should be given to areas where there may be a potential separation of duties problem.

23. Audit Planning Preparatory Activities c) Preliminary Surveys (3) Organization of entity The following items may be obtained as background materials: The number of employees and the name of key employee contacts The entity’s mission statement or similar functional descriptions Budgets and financial-performance data

24. Audit Planning Preparatory Activities c) Preliminary Surveys (4) Other related audit materials Supporting data from related audits completed, planned, or in process should also be studied.  This may include audits by the external auditors, with an emphasis on any management letters or any reviews by government regulatory auditors. The results from internal reviews by departmental or other officials provide additional background materials.

25. Agenda Organizing and performing IA Audit planning preparatory activities Starting the IA Using audit programs to perform IA

26. Starting the Internal Audit The first step in starting most internal audits is to inform the organization to be audited- audittee-that an internal audit has been scheduled. This is often done through an informal call or conversation followed by a formal engagement letter notifying audittee management of the planned review.

27. Starting the Internal Audit A sample engagement letter is shown in Exhibit 14.3. The letter should notify audittee management of the following: Addressee Objectives and scope of the audit Expected start date and planned duration of the audit Persons responsible for performing the review Advance preparation needs Appropriate engagement letter copies

28. Starting the Internal Audit However, there may be circumstances where no formal engagement letter is released.  E.g. the review might be performed on a surprise basis in case of the fraud-related audit. Pros: A surprise audit allows a review of actual conditions without giving the audittee the benefits of cleaning up records, documentation, and other matters. Cons: Without notification, it is possible that the prime audittee may be on vacation or away at the same time the audit team arrives. This causes some serious disruptions.

29. Starting the Internal Audit Once the audit has been scheduled and audittee management informed, the assigned audit team should be ready to begin work at the audittee site.  This phrase of audit is called “fieldwork”. After obtaining relevant policies and procedures, IA team would perform a “field survey” to improve the understanding of the areas to be reviewed.

30. Starting the Internal Audit Internal audit field survey This survey is very important in determining the direction, detailed scope, and extent of the audit effort.  It is the first step taken at the audit site. A field survey allows auditors to: (1) Familiarize themselves with systems (2) Evaluate the control structure and level of control risk in the various systems.

31. Starting the Internal Audit Internal audit field survey The following elements should be considered during a typical field survey: (1) Organization (2) Manuals and directives (3) Reports (4) Personal Observation (5) Discussions with key personnel

32. Starting the Internal Audit Internal audit field survey (1) Organization  Confirm that organization charts are correct.  Be familiar with functional responsibilities and key people involved in the operations.  Requested formal position descriptions.  If the function is not shown on the chart at the time of survey, the IA should draft a rough chart and review its assumption with audittee management.

33. Starting the Internal Audit Internal audit field survey (2) Manuals and directives  Copies of applicable policy and procedure manual should be obtained.  Applicable laws and regulations should be studied, as well as management directives to comply with them.  Appropriate access should be obtained if the required documents are available through an online system.

34. Starting the Internal Audit Internal audit field survey (3) Reports  Relevant management reports and minutes of meeting covering areas such as budgeting, operations, cost studies, personnel matters, and the results of any external inspections or management review, as well as action taken, should be analyzed. These may provide leads for the audit, a summary of problems faced, recommendation made, and the progress made in their implementation.

35. Starting the Internal Audit Internal audit field survey (4) Personal Observation  A tour or walkthrough of the activity familiarizes internal auditors with the entity, its basic operations, personnel, and space utilization. It also provides the opportunity to ask questions and observe operations. The impressions gained from this tour should be documented in the audit workpaper.  Compliance with company procedures should be observed and documented.

36. Starting the Internal Audit Internal audit field survey (5) Discussions with key personnel  It helps to determine any known problem areas, the current results of the unit’s operations, and any planned changes or reorganizations.  Questions should be raised based on preliminary data reviewed or tour observation.

37. Starting the Internal Audit Documenting the IA field survey The work performed and summaries of data gathered through the field survey should be documented in audit workpapers. There are several procedures for documenting the understanding gained during the audit field survey.  E.g. flowcharts could be prepared to describe major processes, control risks, and internal control points. They explain the complexities and control points in a system or process.

38. Starting the Internal Audit Documenting the IA field survey Flowcharts should attempt to show the relationships between different operational elements and where control points exist in a process. Once completed, these flowcharts become part of the auditor’s permanent workpaper file.  They also support requirements that organizations maintain documentation covering their internal controls.

39. Starting the Internal Audit Documenting the IA field survey How to get flowcharts  IA may have prepared them as part of an earlier review, and may need only to be updated.  IA may use the internal flowcharts prepared by organization. But IA has to ensure that they are correct and current.

40. Starting the Internal Audit (i) Flowcharting approaches Flowcharts are a pictorial or symbolic representation of a process. Useful in describing general business procedures, noninformation systems flowcharts generally follow one of three formats:  Process, Procedural, or Functional.

41. Starting the Internal Audit (i) Flowcharting approaches A process flowchart describes the flow of information or the significant steps in various operations.  It is often used for describing automated systems. An IA may find the process flowchart style to be most useful for audit documentation. Exhibit 14.4 describes the steps necessary to process incoming mail.

42. Starting the Internal Audit (i) Flowcharting approaches Paperwork or procedural flowcharts track the manual flow of paperwork, including where copies are filed or who approves a given copy. The paperwork flowchart is most useful when auditor needs to describe a complex paperwork process with numerous document approval steps and filing requirements. Exhibit 14.5 is an example showing the approval of employee travel expense forms.

43. Starting the Internal Audit (i) Flowcharting approaches A functional flowchart documents the progress of a document through various departmental entities in an organization. (See exhibit 14.6) The functional flowchart is useful when the auditor wants to describe procedures or operations across various organizational or departmental boundaries. It is also useful to describe the paperworks steps flowing across various departments.

44. Starting the Internal Audit (i) Flowcharting approaches Two approaches are commonly used for developing process-oriented flowcharts:  Method approach  End-result approach

45. Starting the Internal Audit (i) Flowcharting approaches The method approach places emphasis on the system, including an analysis of controls to prevent errors, rather than describe system outputs. The auditor describes and documents system processes.  If there are acceptable controls, the assumption is that the end results are acceptable.

46. Starting the Internal Audit (i) Flowcharting approaches The end-result approach starts with documenting from the final information product, such as an accounting month-end budget performance report. The data elements that feed into this report are traced back to their sources, and only data that affect the final product need to be identified.

47. Starting the Internal Audit (i) Flowcharting approaches In an actual audit, the method approach will almost always require more steps and areas for consideration than an end-result-style flowchart.

48. Starting the Internal Audit (ii) Flowcharting symbols and tools Exhibit 14.7 shows typical symbols used in preparing flowcharts for manual or automated processes. Various automated tools are available to help develop auditor flowcharts.

49. Agenda Organizing and performing IA Audit planning preparatory activities Starting the IA Using audit programs to perform IA

50. Using Audit Programs to Perform Internal Audit Internal auditors should use “audit programs” to perform audit procedures in an effective manner for similar types of audits.  This helps the internal audits organize and perform the audit work in a consistent manner with an objective of minimizing arbitrary or unnecessary procedures.  It is a useful document that auditors can use to guide their efforts and to record activities.

51. Using Audit Programs to Perform Internal Audit The term “program” refers to a set of auditor procedures, instructions that go through the same program instructions every time the process is run. An audit program is a set of reestablished steps that an internal auditor performs.  It is a tool for planning, directing, and controlling audit work and a blueprint for action, specifying the steps to be performed to meet audit objectives.  It outlines the required steps to be performed by the auditor when actually doing the audit.

52. Using Audit Programs to Perform Internal Audit An effective IA department should have a series of generalized audit programs prepared for recurring audit activities. The auditor may have to modify a standard program to adjust it to the unique aspects of a particular audit.  Based on the planned audit objectives and data gathered in preliminary and field surveys, the auditor may want to prepare a customized audit program for guiding the review.

53. Using Audit Programs to Perform Internal Audit The audit program is revised as necessary, with the changes being approved by audit management prior to the start of the review. In general, the program should be finalized after the completion of the preliminary and field surveys and before starting the actual audit field work. There is no best or set format for an audit program.

54. Using Audit Programs to Perform Internal Audit Depending on the type of planned audit, programs usually follow one of three general formats: A set of general audit procedures  Exhibit 14.9 Audit procedures with detailed instructions A check list for compliance reviews  Exhibit 14.10

55. QUESTIONS