Objectives and Phases of Operational Audits

Objectives and Phases of Operational Audits

• An operational audit reviews activities in a program or process.
• The success of an operational audit depends on the people involved, areas of focus, and communication.
• Operational audits are similar to financial reviews, requiring business objective identification.
• The life cycle of an operational audit: planning, fieldwork, and reporting.
• Follow-up actions depends on issue severity.

Key Objectives of Operational Audits

• Clearly defined, communicated, and understood objectives are essential for success, and alignment with engagement sponsors is key.
• Internal audit should involve management to meet their needs.
• New rules, internally (policies/procedures) or externally (laws/regulations), drive objectives.

Rules Considerations as Objectives

• New rules can result from voluntary adoption, such as Corporate Social Responsibility (CSR).
• Ethical conduct attracts customers, employees, and investors.
• Funds employing social screens have increased, holding trillions in assets.
• Poor performance, such as inefficiencies and complaints, may trigger internal audit reviews.
• Compliance issues, whether internal quality control or external regulator findings, can prompt audits.
• Anomalous revenues or expenses may lead to a review to verify legitimacy and correct recording.

Infrastructure Examination for Objectives

• Effective internal auditors examine the organization's infrastructure.
• Infrastructure includes resources, planning, budget, and technological systems.
• Management reports must be accurate, detailed, and properly distributed.
• Organizational structure should assign responsibility and accountability effectively.
• Business risks, internal/external changes, and governance impacts also influence objectives.

Governance and Compliance

• Consideration for ethics, EHS, operational consistency, and CSR.
• Focus on efficiency, effectiveness, and economy of operations, activities, and programs.
• Engagements conducted on governance, risk management, and control.
• Technology affects objective definitions; effective systems support goal achievement.

Phases of the Operational Audit

• Operational audits follow traditional planning, fieldwork, and reporting phases.
• Planning includes scoping, budgeting, defining the population of interest, testing methods, and announcing the audit.
• Planning is crucial to avoid inefficient practices and scheduling issues.

Planning Process

• The planning process begins with a risk assessment to prepare an audit plan, which allows the CAE to prepare an audit plan based on the results of an analysis of the organization's audit universe.
• The audit universe spans auditable activities, assessing risks to objective achievement at the enterprise level.
• Enterprise risk assessment involves senior management and the board for input and buy-in.

Audit Plan

• Should generate a strategic plan for management and an audit plan.
• Audit plan identifies review areas based on resources, needs, and organizational priorities.
• CAEs using multiyear audit plans facilitate future planning and identify resource needs.

Auditor Tasks

• Communicating timing, requesting reports/documents, coordinating staff, and defining scope, objectives, work schedule, and budget.
• Tactical risk assessment identifies auditable activities, risk factors, and their significance.
• Risk considerations expand beyond accounting/financial risks to include operational, legal, and IT-related risks.

Risk Factors

• Understanding potential negative aspects such as legal liability and corporate image.
• Identifying potential risks and how the unit could fail can be identified by asking key questions.
• Identify any assets that require special care and oversight, intellectual or digital assets which help determine key success factors.

Considerations

• What are the objectives and how do we know if the unit is achieving them?
• Where are the people, processes, systems and assets vulnerable?
• On what information to they rely on most?
• Internal audit is able to assist management in achieving organizational goals by limiting the harm that could have been done to a company.
• Need to also identify opportunities and prepare responses for those events

Internal Auditor Skills and Limitations

• Should determine how the organization should be allocating it's resources.
• Risk assessments should not be limited, instead help to identify the opportunities that can help an organization's preparedness.
• Risk factors play an important role which could diminish underlying factor.
• Competence of employees increase, especially that of errors, omissions, and other operational problems decrease.
• Extent of judgement that can be exercised when performing relevant operational and control activities.

Participative Practices

• Internal auditors should engage with process owners.
• Auditors are better equipped to define the scope more precisely, including identifying the risks that should be examined during the audit.
• While reviewing prior workpapers caution is warranted, as auditors must remember that each audit is the reflection of the objectives, scope, conditions, and expectations at the time it was performed.

Audit Steps

• Are shown in Table 2.1.
• Board of directors, senior management, and middle management are accountable for the strategy, objectives, risks, and controls of the areas under their responsibility.
• Auditors work is to verify that management has put structure, policies, procedures, and metrics into place to achieve its objectives.
• Time Logs can provide previous estimates.
• Auditors reviewing the amount of time it takes to perform tasks is usually not a good idea.

Fieldwork Phase

• This phase consists of verifying if the process or program can is effectively designed so that the management goals and objectives are likely to be achieved.
• Even though identifying issues are a part of testing, that doesn't mean that it can't be identified in earlier stages, those outcomes should be documented.
• Planning may occur during fieldwork due to finding conditions that were different than anticipated or items that were not seen as low.

Audit Evidents

• Internal auditor's are concerned with whether the program is working as designed.
• Gather evidence to support/persuade others for satisfactory conditions.
• There are different types of audit evidence that auditors gather and evaluate during the reviews.
• Verbal or written statements given as a proof for the matter being discussed are known as testimonial evidence.
• There are two types of testimonial knowledge, those being whether that is someone's knowledge about somehting, while hearsay is based on what was heard.

More on Audit Evidents

• Auditors assume that auditees are making truthful statements.
• False statements made to the auditor are grounds for disciplinary action.
• Interviews are a common form of gathering evidence which may involve speaking to one or more individuals.
• Have a pair of auditors present to improve the quality and detail of the information gathered.

Auditors Observations

• Observing the security measures to prevent unauthorized individuals from entering the facility.
• Ensure that machinery exists and is working properly.
• Auditors visually evaluate physical facilities, conditions, and practices to verify they exist, their condition, valuation, and protection.
• There are two ways this can be done: auditee knows and when auditee does not.

More on Observation

• Auditees are unaware of observation, allowing for genuine behavior.
• Social desirability bias may alter behavior when auditees know they are observed.
• The change and behavior may influence to the way things are reported.

Collecting Evidence

• Collection through reviewing documents is the most common.
• Verify data and amounts of transactions, agreements made between various parties, and all record of decisions made.
• The documents can be internal/external
• Auditors are not experts on altered/forged documents, they should pay close attention to each document in search of anomalous elements constituting red flags.

Audit Evidence: Evaluation

• Mathematical recalculation checks accuracy of documents/records and confirms correctness.
• Example: Allowance for uncollectible balances based on percentage of sales.
• Companies can fraudulently modify financial results by manipulating allowance amounts.
• Consistent review process with month-end/quarterly updates being enough.
• Persuasiveness of audit evidence gives auditor confidence in conclusion.

Attributes of Persuasive Audit Evidence

• Relevance to audit objectives.
• Objective evidence (two auditors likely to agree).
• Documentation over unrecorded evidence.
• Externality third-party is better over internally.
• Sample sizes play a role in providing persuasion for larger samples.
• Statistical samples as well.
• Authoritative Evidence is more persuasive.
• A walkthrough adds additional level of evidence.

Auditor Scope: Best Practices

• Step by step in addition to asking questions may reduce the possibility of fraudulent behavior.
• Balance inquisitor with conversational dynamics to avoid causing stress and anxiety for the auditee.
• Professional judgement with the amount of evidence is needed.
• Professional skepticism: auditors verify data integrity.
• Verify reliable information and corroboration with documentation and statements.
• Subject matter experts (SMEs) provide knowledge and assistance. SMEs could be internal/external.

Audit Documentation

• Workpapers document audit work and support results.
• Collect and show all of the evidence to show planning and findings.
• IIA Standard 2330: Must document relevant information to conclusions.

Documentation Considerations

• Narrative are common types of workpapers, as they describe a business process.
• Auditors are able to understand the process, which can illustrate potential weakness and strengths.
• A flowchart is a diagram of the sequence of movements or actions of people or things involved in a process or activity.
• Process mapping leads to a better understanding of potential weaknesses and strengths.

Internal Control Questionnair

• Helps to evaluate internal controls in specific areas.
• ICQs are a starting point with other information gathering and control evaluation techniques.
• Preparing and sending a questionnaire can be helpful to collect large amounts of data quickly.
• Auditors should remember that respondents are only going to answer the question asked, so the questions should be worded clearly.

Workpapers Essential Features

• Neat, easy to read and in uniform.
• Includes the objectives, source, auditor's name, when the work was done and what the results were.
• References to all supporting documents.
• Key steps ensure high workpaper quality.

Types of Tickmarks

• Show for each transaction whether the transaction met the criteria applied to the test.
• Auditors select a samples of transactions and examine each of them to verify these for attributes.
• The auditor would indicate the name of the organization, audit, process, and the source of the information.
• Auditor would indicate the transactions are being examined, which has four attributes and would receive tickmarks in the corresponding location.

Formulas for testing

• To verify or test the amount of payment is accurate: a formula that would subtract the amount of the invoice from the amount paid is simple, should be $0.00.0
• An analysis can be done by approved.

The Reporting Phase

• Consists of communicating findings, observations, and best practices noted during the review, developing recommendations for corrective action.
• The term "finding" is in disuse by an increasing number of auditors who have found that their clients resent the label and prefer a term that is less controversial, but not always.
• Must document the criteria, condition, cause, and effect as well.
• There are two types of deficiencies: design and operating.

Follow up Phase

• To verify that the corrective actions are indeed applied.
• Timeline depends on the risk associated with the finding.
• The purpose for a follow up is to check on what management did to address the issue reported.
• If the severity of the observation was low a review of the item may suffice to close the observation in the finding database.

Metrics Considerations

• Show the value internal auditing has on an organization.
• Key tool for the monitor performance and the achievement of organizational goals.
• Organizations lack reliable data and use metrics to only a small degree.
• Can improve by including the application of the balanced scorecard.

Internal Environment

• It is better to improve through workers, processes and technology.
• But must have goals that drive the direction, prioritize the allocation of resources and give employees a sense of mission.
• This requires clear expectations about what is allowed and can be done regarding behavior, management is ultimately responsible.