Operational and Internal Auditing

Operational Auditing Definition

• A future-oriented, systematic, and independent evaluation of organizational activities
• Financial data can be used
• The primary sources of evidence are the operational policies and achievements related to organizational objectives
• Internal controls and efficiencies can be evaluated during this type of review
• A review of how an organization's management and its operating procedures function with respect to their effectiveness and efficiency in meeting stated objectives.
• A business might perform an operational audit

Internal Auditing Overview

• An independent, objective assurance and consulting activity designed to add value and improve an organization's operations
• Helps an organization accomplish its objectives by bringing a systematic, disciplined approach
• Evaluates and improves the effectiveness of risk management, control, and governance processes

Elements of Internal Auditing

• Independence is tied to the position of internal audit within the organization's hierarchy
• Internal audit should report to the audit committee (or its equivalent) on the board of directors for advice and support
• Should not be under the control of those they audit; requires a direct reporting line to the highest authority within the organization
• Requires support by top management
• Objectivity is related to the auditor's ability to examine documents, processes, and programs without bias or an agenda
• Objectivity means finding the truth and communicating it accurately and promptly
• Maintaining healthy professional and social relationships without becoming too cozy with others in the organization
• Assurance relates to the auditor's ability to give confidence and make statements regarding matters within the organization (Compliance)
• Compliance audits focus on verifying conformity and adherence of an area, process or system
• Compliance adherence to policies, plans, procedures, laws, regulations, contract, or other requirements
• Consulting means giving advice to management and the board
• Consulting involves engaging in activities that helps the organization resolve nagging business issues
• Designed to add value to the organization
• Improving an organization's operations includes their evaluation, their recommendation gives improvement on organization's operations
• Improvement of operations enhances efficiency, effectiveness, speed, and reduces errors when implemented
• Help an organization accomplish its objectives through controls-based auditing
• Auditors look at controls within the process then check if the controls are present and operating as expected
• Auditors should properly respond to risks that threaten the organization's objectives
• Bringing a systematic, disciplined approach refers to the work approach

Further Internal Audit Functions

• Internal audit can evaluate and improve effectiveness and improve the organization's ability to achieve the goals and objectives related to risk management
• Risk management includes the identification, measurement, assessment, and response to risks
• Control refers to those activities that mitigate relevant risks and help the organization avoid surprises
• Governance processes refers to organizational structure, reporting lines, span of control, resource allocation, accountability measures, discipline and reward mechanisms
• Corporate governance relates to ethical behavior by directors and others charged with the creation

Negative Impacts Caused By Poor Management Decisions

• Business leaders and managers witnessed business failures from poor management decisions and practices
• Operations management causes waste, inefficiencies, supplies that arrive late, poor customer satisfaction and limited capacity to grow as opportunities arise or customers' demand change
• Human resources causes poorly supervised, trained and evaluated employees who sometimes become unmotivated and unproductive
• IT systems create an inaccurate understanding of the business needs and uses of these systems
• IT systems utilize poor data capture and inadequate reporting mechanism
• Marketing causes wasteful campaigns because the company target the wrong audience
• Corporate Social Responsibility (CSR) issues range from child labor, sweatshop conditions, abusive management, and inappropriate waste disposal
• Environmental Health and Safety (EHS) results in poor ventilation, excessive heat, extreme noise levels, and workplace hazards caused by chemicals, machinery and workplace configurations, among others.

Primary Stakeholders

• Primary stakeholders include employees, suppliers, customers, creditors and investors
• Their interest is for maintaining fair work environments and practices and receiving value for services and goods
• Their power stems from bargaining power and the use of legal avenues

Secondary Stakeholders

• Secondary stakeholders include governments, media, activist groups, business support groups, communities and the general public
• Their interest in the organization relates to economic development, ethical behavior, competitiveness and general safety
• Their power stems from the ability to influence the public and use lobbying for regulations

Identifying Operational Threats and Vulnerabilities

• Instead of focusing on past issues, internal audits should focus on future threats and vulnerabilities
• Operational capacity, speed of execution, staffing levels, employee motivation, knowledge transfer, system development and implementation
• Technological including protection of intellectual property and personally identifiable information, denial of service attacks, business continuity due to staff turnover, and system development
• Strategic concerns related to strong customer and vendor relations, customer loyalty, building effective business partnerships, outsourcing arrangements, and mergers and acquisitions
• Environmental concerns may include reliable supply of water and electricity, achieving a lower carbon footprint, and reducing the amount of natural resources used during business activities.

Skills Required for Operational Audits

• Internal auditors must acquire and apply different skills for controls and risk based auditing
• Auditors must examine risk exposures and the measures in place to address more than accounting and financial risks
• Core competencies: communication skills, problem identification and solution skills, ability to promote the value of internal audit, knowledge of industry, regulatory, and standards changes
• Core competencies include: organization skills, conflict resolution/negotiation skills, staff training and development, accounting frameworks/tools/techniques, change management skills
• Core competencies include IT/CT framework/tools/techniques, cultural fluency and foreign language skills
• Behavioral skills include: confidentiality, objectivity, communication, judgment, work well with all management levels, possess governance and ethics sensitivity
• Behavioral skills include: being team players, relationship building, working independently, team building, leadership, influence, facilitation, staff management and change catalyst skills

Internal Audit Capability Model (IA-CM)

• Level 1: Initial - audits are ad hoc/isolated
• Level 2: Infrastructure - compliance auditing
• Level 3: Integrated - advisory services
• Level 4: Managed - overall assurance on governance, risk management, and control
• Level 5: Optimizing - Internal auditing recognized as a change agent

Intergrated Auditing

Key Objectives of Financial Audit

• Ascertain whether in all materials respects, the income statement and cash flows accurately and reliably reflects activities during a fiscal year
• Ascertain whether in all material respects, the balance sheet shows the condition of the organization as of the last day of the fiscal year

The Standards For International Internal Auditors

• 1210-Proficiency includes knowledge skills, and other competencies needed to perform their individual responsibilities
• 1210.A3: Internal auditors must have sufficient knowledge of key IT risks, controls, and technology-based audit techniques
• 1220.A2: When exercising due professional care internal auditors must consider the use of technology-based audit and other data analysis techniques
• 1220.A3: Internal auditors must be alert to the significant risks that might affect objectives, operations, or resources
• 2010-Planning: The Chief Audit Executive must establish a risk-based plan to determine the priorities of the internal audit activity and the consistency of the organization's goals
• 2120-Risk management: The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes
• 2120.A1: The internal audit activity must evaluate risk exposures relating to the organization's governance, operations, and information systems regarding objectives, financials, ethics and assets
• 2130-Control: The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement
• 2201-Planning considerations: Objectives, risk, and resources
• 2220.A1: Scope of engagement must include consideration of relevant systems, records, personnel, and physical properties
• 2310-Identifying information: Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement's objectives
• 2410.A2-Internal auditors are encouraged to acknowledge satisfactory performance in engagement communications, including in the report or notes on those who did well.
• 2420-Quality of communications: communications must be accurate, objective, clear, concise, constructive, complete, and timely