Operational Auditing--Fall 2010 1

Operational Auditing

Fall 2010

Professor Bill O’Brien

Operational Auditing--Fall 2010 5-2

Workpaper Usage

Planning and execution Supervision and review Objective tracking Conclusion support Supports quality assurance Professional development IIA standards’ compliance

Operational Auditing--Fall 2010 5-3

Workpaper Guidelines Cross-referencing system Consistent layouts Standardized symbols or “tick marks” Standardization for permanent files Unique indexing Description of purpose Initialed by preparer and reviewer Source of information indicated Clear explanations of symbols Legibly written and easy to understand Must stand alone Must relate to the engagement objectives

Operational Auditing--Fall 2010 5-4

Sample Work Paper

Heading Ref.

Review

T/M Legend:

Source

Purpose:

Conclusions

Operational Auditing--Fall 2010 5-5

Generalized Audit Software (GAS)

Two most popular applications ACL (ACL) IDEA (CaseWare)

Typical uses File examination Recalculations Sample selection File comparison Reformatting Pivot tables Benford’s Law analysis Reporting Data analysis log

Operational Auditing--Fall 2010 5-6

GAS, continued Benefits

Minimizes customization Independent of company IT Efficient Facilitates 100% testing Frees BPP for analytical work

Obstacles Data access Physical access Format knowledge Downloading issues to BPP’s computer Importing data in usable format

Operational Auditing--Fall 2010 5-7

Control Self Assessment (CSA)

Methodology Review and Identification

Key business objectives Related risks Mitigating controls

Operational Auditing--Fall 2010 5-8

CSA-History

Introduced by Gulf Canada in 1987 Gulf used facilitated meetings

Operational Auditing--Fall 2010 5-9

Facilitated Meetings

Management and staff participate through interviews and polling

Objectives Risks Processes Soft and/or informal controls

Operational Auditing--Fall 2010 5-10

General Methodology

Shared process Assessment of internal controls Evaluation of risks Development of action plans Assess the likelihood of achieving objectives SJSU simulation

Operational Auditing--Fall 2010 5-11

General Approaches

Facilitated meetings--group workshops Questionnaires--yes/no answers Management analysis--self studies

Operational Auditing--Fall 2010 5-12

Uses

Self analysis for risk* Selection of audit areas* Internal control review* Special projects Soft control analysis

* alternatives to the traditional approach to the I/A process

Operational Auditing--Fall 2010 5-13

Benefits

Increases I/A scope Target review of high risk areas Increases the effectiveness of corrective action Builds team-oriented relationships

Operational Auditing--Fall 2010 5-14

Engagement Process Planning:

Selecting the BPO Pre-site planning

Performing: Conducting the preliminary survey Review internal controls Expanding tests as necessary Generating findings

Communicating: Reporting the results Conducting follow-up Assessing the process

Operational Auditing--Fall 2010 5-15

Audit Evidence

Healthy skepticism Attributes

Relevant: consistent with objectives Reliable: credible Sufficient: convincing

Operational Auditing--Fall 2010 5-16

Business Processes

Basic entity for I/A services Understanding business processes is key

Operational Auditing--Fall 2010 5-17

Process Documentation

Flow charts

Storyboarding

Identifying business risks What gets in the way of objective achievement

Operational Auditing--Fall 2010 5-18

FlowchartingBegin or End

File

Decide

Document

Activity

Operational Auditing--Fall 2010 5-19

What Is Storyboard Flowcharting?

New method for documenting a process. Clean and simple flowcharting method. Allows for clients and auditors to clearly understand

process under review. Simple technique that requires a good graphics

package and a little imagination. Can use Microsoft PowerPoint, Harvard Graphics,

Corel Draw, etc. Does not replace IS flowcharting.

Operational Auditing--Fall 2010 5-20

The Basics of Storyboard

Meet with client and document process. Use your imagination to choose/draw picture. Under picture write narrative for each step represented. Be creative - good control narrative in green; poor controls in red. Completed storyboard must be reviewed with client. Make any changes necessary. Final copy should be in color for most effective presentation. Different process may require different approach.

Operational Auditing--Fall 2010 5-21

How to Storyboard

• Meet with client and document process.

• From client interview create storyboard.

A

A

• Print out story board - black and white draft and color for final.

• Review storyboard with client and obtain sign off.

Operational Auditing--Fall 2010 5-22

Start

Customer Service

Rep ReceivesOrder

Scan Form IntoSystem

Shipping FilesYellow

Customer ServiceRep ResearchesAnd CorrectsInformation

Shipping Pulls And

Packs Orders

End

By Phone?

By Mail or Fax?

On StandardOrder Form?

Shipping SendsOrder and Green

Copy (Invoice)

Customer Service Rep.Key Enters

Data on-Line

ApprovedBy Manager?

Send to SpecialOrder

Department

Print Three-Part

Shipper

Yellow and GreenTo ShippingDepartment

Pink to AccountsReceivable

Department

YES

YES YES

NO

NO

YES

Company XYZOrder-fulfillment process

NO

Operational Auditing--Fall 2010 5-23

A

A

Customer Representative

Receives orders by faxor mail.

Receives orders by phone.

Standard orders arescanned into system.

Customer Representativeenters order data on-line.

A three-part packing slip is printed per order.

Pink copy sent toaccounts receivabledepartment.

Company XYZOrder-fulfillment process

Packing slip approved by Manager.If not approved, returnedto Customer Representativefor correction

Packing slip

Yellow and green copy go to shipping department.Shipping pulls andpacks orders.

Yellow copy filed inshipping department.

Green copy sentwith order.

Operational Auditing--Fall 2010 5-24

Mapping Risk to Processes

Identify risks Link risks to the processes Evaluate risks in terms of likelihood and impact

(exposure) Determine risk responses

Avoidance, reduction, sharing, acceptance