Professional Documents
Culture Documents
Chapter 2 Opaud
Chapter 2 Opaud
1. List three reasons management may ask for an operational audit to be performed and explain how
the audit program would be impacted by each of them.
First, if there are any complaints from the customers as well as the vendors, the first thing that
the company will think is that where do they go wrong. From that, the company should send a request
to an internal auditor to review this matter.
If there are compliances issues, it means that there are anomalies in the internal quality control.
The internal audit department should investigate if there are noncompliance issues at their organization
to help assess the issue and be able to make sound decision.
Anomalous revenues or expenses occurs when these figures look suspicious and untrustworthy,
the management may ask for an operational audit to review the related transactions to ascertained that
these figures are correct in all aspect. It would be easier to perform an operational audit if there is an
audit program that contains detailed information about audit procedures that the auditor will follow to
execute proper auditing.
2. Explain the importance of identifying risk factors and using them during the planning phase.
Risk factors plays an important role during the planning phase. Risk factors are conditions and
other variables that in their present, or absence either exacerbate or diminish the underlying risk
(Murdock, 2016, p. 38). Even though it is not possible to eliminate or anticipate all risk, identifying risk
factors can help to reduce the occurrence of those risks. Examination of the tasks, activities, and
processes in an organization when planning should be executed. During planning meetings, internal
auditors should engage in participative practices, involving process owners as much as possible to
identify relevant activities, systems, people, and performance standards. When auditors do this, they
are better equipped to define the scope more precisely. It plays an important role in identifying the
risks that should be examined during the audit (Murdock, 2016, p. 39). It will help the internal auditor to
identify possible risk and make reasonable steps to prevent it. Internal auditor should also look at
certain risk and try to generate a plan on how to control it effectively and efficiently. Put simply,
understanding, and identifying risk factors can help the internal auditor to identify possible risks of the
company which can serves as a guide in planning the procedures in performing the audit.
b. Vouch - involves the “reverse-trace” of a transaction from the destination to its source. Like for an
example, from financial operational, or regulatory report to sales order, purchase, and time sheet.
c. Reconcile - tie information from two separate sources to verify the accuracy or expected discrepancies
5. Give two examples where observation is a useful technique to examine operational risks and related
controls.
Murdock (2016 p. 42) enumerated six examples of items that internal auditors may want to
observe and why. Two of those six examples are (1) observe the security measures to prevent
unauthorized individuals from entering the facility and (2) walk the perimeter of a construction site to
confirm there is a fence that restricts access to only authorized individuals.
Murdock (2016 p. 43) enumerated different types of documents both internal and external. He
also states that document inspection is one of the most common procedures performed by auditors who examine
documents to verify the date and amount of transactions, agreements made between various parties, evidence of
authorizations and record of decisions made, among others.
Inspecting financial statements of a company provides more credibility to the reported financial
position and performance of a business. Auditors need to check if the financial statements to be
reported shows a legitimate view of the standing and performance of the company. Obtaining an
understanding in the business and how it operates, and assessing information collected can help to
examine whether there may be operational risks which will possibly occur that can impact financial
statements.
Examining customer orders and compare it to the invoices that sent out and there should be an
identical numerical figure on both documents. You should also compare invoices of checks and receipts
and the amounts should match exactly. Invoices both produced and received should always be reconcile
with its original establishments.
Professional skepticism is an attitude that is used to verify the integrity of the data obtained and
conclusions formulated. Auditors should always have the doubt in certain circumstances when gathering
evidence or information and they should exercise healthy professional skepticism to evaluate the quality
of data collected and used. Internal auditors should be sufficiently suspicious of data received and
reasonably verify that the information is free from manipulation or modification in ways that can
compromise its quality (Murdock, 2016, p. 46). Since interview is the most common way to gather
testimonial evidence, internal auditors should do this kind of data gathering while observing changes in
the surrounding or in the behavior of the interviewee. Professional skepticism should always be
exercised by all the editors specially when performing auditing activities to find risk and potential errors
and make a sound decision out of it.
8. Provide three benefits of drawing process maps (flowcharts or value stream maps, as some would
rather call them).
Another benefit of drawing flowcharts and process mapping is that is it easier to review. In this
case, the process mapping should be available to everyone at anytime which gives them a place to go to
review what and how things should be done.
9. What is an internal controls questionnaire and how can auditors use it during the planning and
fieldwork phases of audits?
An internal control questionnaire helps to evaluate internal controls in specific areas by asking
key questions (Murdock, 2016, p. 50). Internal auditors usually use internal control as their starting point
of collecting information then later gathers more information applicable to the assessment of the
operation. It is usually used when there is a large amount of information necessary to be collected. In
this case, preparing questionnaires like this can be very helpful in collecting data easily and quickly.
During planning and fieldwork phases, it is still required to gather as much data available for
auditing. Internal control questionnaires help internal auditors to save their time and efficiently use it
because they can obtain information easier than asking the employees one by one.
CCCER stands for criteria, condition, cause, effect, and recommendation (Murdock, 2016, p. 55).
Condition – refers to what actually exist. It is what the auditor found out as a result of the execution of
audit procedures.
Cause – It is the reason why condition exists and what is its difference from the criteria. Auditors should
focus on the root cause of the problem and avoid focusing on symptoms.
Effect – also called as the consequence. It consists the impact of the condition.
Recommendation – is the action item needed to correct the condition so that the performance is
consistent with the criteria.
References:
Murdock, Hernan. (2016). Operational auditing: Principles and techniques for a changing world. Boca
Raton, FL: CRC Press.