Professional Documents
Culture Documents
Operational Audit Overview: Mountain Province State Polytechnic College
Operational Audit Overview: Mountain Province State Polytechnic College
Module 1 of 4 Modules
Operations Auditing
This module is good for 9 hours and is expected to be finished at the end of the
3rd week of our class schedule. You can submit your outputs (only the ANSWER
SHEETS which is provided at the end of this module) through the following:
Via Online:
Scanned copy or picture of your output that is finalized in the ANSWER SHEET
converted to pdf file.
1. Email account: [email protected]
Indicate the course code of this subject on the subject of your email.
2. Facebook Messenger Account: Jude F. Mango
Rename your file with the course code of this subject.
Manually:
1. Through the retrieval facilities as may be arranged by the College later.
2. Personally or if below 21 years old through a family or friends at the BSA
Faculty Room 402 Old Academic Building.
o Note: Please do not submit any of your output through our class group chat. If
you have any issues, you are free to ask me through my facebook account.
MODULE OUTLINE
To give you a picture on what lessons are expected from this module, here is a
summary of the lessons:
Lesson I: Operations Audit Overview
A. Characteristics of Operational Audit
B. Modern Developments in Operations Audit
C. The Standards and Code of Ethics
1
At the end of the module, you should be able to:
1. correctly prepare recommendations as operations auditor on a given situation;
and
2. develop the value of objectivity by understanding the role of an operations
auditor.
LET’S ENGAGE!
Continuous improvement is one of the most challenging goals of every
organization. It is very easy to say than done as they say. On the audit perspective,
what relevance can we make to contribute on the said goal? What are the technical
aspects that are vital for us to know in order to maximize our skills in achieving such
goal?
External auditors rely on internal auditors when using the audit risk model to
assess control risk. If internal auditors are effective, the external auditors can
significantly reduce control risk and thereby reduce substantive testing. As a result,
external auditors may reduce their fees substantially when the client has a highly
regarded internal audit function. External auditors typically consider internal auditors
effective if they are:
a. independent of the operating units being evaluated;
b. competent and well trained; and
c. have performed relevant audit tests of the internal controls and financial
statements.
Auditing standards permit the external auditor to use the internal auditor for
direct assistance on the audit. By relying on the internal audit staff for performing
some of the audit testing, external auditors may be able to complete the audit in less
3
time and at a lower fee. When internal auditors provide direct assistance, the external
auditor should assess their competence and objectivity and supervise and evaluate
their work.
The definition reflects a modern view of the profession in such a way that they
can provide much more valuable assistance to their organizations. The definition
creates a variety of challenges and opportunities for internal auditors, who are no
longer engaged in a static, routine, repetitive, and accounting/finance-focused activity,
but instead admonishes internal auditors to review business programs, processes, and
initiatives in innovative ways that can add tangible value to the organization.
1. Independence has to do primarily with the position of internal audit within the
organization’s hierarchy. Internal audit should report to the audit committee (or its
equivalent) on the board of directors so it receives advice and support to perform its
duties. Furthermore, internal audit should not be under the control of those they
audit. This direct reporting line to the highest authority within the organization will
help internal audit reach its full potential, and also get the attention from those whose
influence, recognition, and respect can compel corrective action of any anomalies
identified by the auditors.
2. Objectivity is related to the auditors’ frame of mind and their ability to examine
documents, processes, and programs without a bias, without an agenda, with no other
motive than to find the truth and communicate it accurately and promptly. Conflicts
of interest are one of the biggest threats to objectivity, so internal auditors must be
careful to balance maintaining healthy professional and social relationships with
others in the organization without becoming too cozy with them.
3. Assurance relates to the auditors’ ability to give confidence and make statements
regarding the condition of matters within the organization. It is often considered a
synonym to “compliance” as has been the traditional focus of internal auditors for
millennia. Compliance audits focus on verifying conformity and adherence of a
particular area, process, or system with policies, plans, procedures, laws, regulations,
contracts, or other requirements that govern the conduct and actions of that area,
process, or system.
4. Consulting means giving advice to management and the board, and engaging in
activities that help the organization resolve nagging business issues. These
engagements address performance, how to improve organizational programs,
processes, and activities, and how to become more flexible, nimble, and responsive to
business challenges. It also relates to the special projects that internal auditors
4
sometimes work on. Lastly, consulting also relates to the way auditors do their work
suggesting that the traditional mind set and role of the auditor as the corporate cop is
being redefined and replaced by a more business-minded professional whose goal is to
be respected more so than being feared.
7. To evaluate and improve the effectiveness. Our role as auditors goes beyond
evaluating business dynamics and writing reports that merely lists the problems
identified. The definition indicates that we evaluate, but also help to improve the
organization’s ability to achieve the goals and objectives related to:
b. Control. This refers to those activities that mitigate relevant risks and helps the
organization avoid surprises.
5
So what is operational auditing?
6
1. Purpose of the Audit: This is the most important difference. Financial auditing
emphasizes whether historical information was correctly recorded, while
operational auditing emphasizes effectiveness and efficiency. Financial auditing
is oriented to the past, while operational auditing focuses on improving future
performance. An operational auditor, for example, may evaluate whether a type
of new material is being purchased at the lowest cost to save money on future
raw material purchases.
2. Distribution of the Reports: Financial auditing reports are typically
distributed to external users of financial statements, such as stockholders and
bankers, while operational audit reports are intended primarily for
management. The widespread distribution of financial auditing reports requires
a well-defined structure and wording. The limited distribution of operational
reports and the diverse nature of audits for efficiency and effectiveness allow
operational audit reports to vary considerably from audit to audit.
3. Inclusion of Nonfinancial Areas Financial audits are limited to matters that
directly affect the fairness of financial statement presentation, while operational
audits cover any aspect of efficiency and effectiveness in an organization. For
example, an operational audit might address the effectiveness of an advertising
program or efficiency of factory employees.
7
Specific Criteria: More specific criteria are usually desirable before starting an
operational audit. For example, suppose that you are doing an operational audit of the
equipment layout in plants for a company. Here are some specific criteria, stated as
questions, that might be used to evaluate plant layouts:
• Were all plant layouts approved by home office engineering at the time of original
design?
• Has home office engineering done a re-evaluation study of plant layout in the past 5
years?
• Is each piece of equipment operating at 60 per cent of capacity or more for at least 3
months each year?
• Does layout facilitate the movement of new materials to the production floor?
• Does layout facilitate the production of finished goods?
• Does layout facilitate the movement of finished goods to distribution centers?
• Does the plant layout effectively use existing equipment?
• Is the safety of employees endangered by the plant layout?
8
Obviously, the second of these three client concerns directly relates to
operational auditing, but the other two also affect efficiency and effectiveness. For
example, management needs reliable cost accounting information to decide which
products to continue producing and the billing price of products. Similarly, failure to
comply with a law can result in a large fine to the company.
Two things distinguish “internal control evaluation and testing” for financial and
operational auditing: purpose and scope.
For both financial and operational auditing, the auditors may evaluate
the control procedures in the same way, but for different purposes. An
operational auditor might test whether internal verification procedures for
duplicate sales invoices are effective to ensure that the company does not offend
customers, but also to collect all receivables. A financial auditor often does the
same internal control tests, but the primary purpose is to reduce confirmation
of accounts receivable or other substantive tests. (A secondary purpose of many
financial audits is also to make operational recommendations to management.)
9
organizational audit emphasizes how efficiently and effectively functions
interact. The plan of organization and the methods to coordinate activities are
important in this type of audit.
The first two objectives of each of these types of performance audits are clearly
operational in nature, while the final objective concerns compliance.
c. CPA Firm does an audit of historical financial statements, part of the audit
often consists of identifying operational problems and making recommendations
that may benefit the audit client. The recommendations can be made orally, but
10
they are typically included in a management letter. (For coverage of
management letters.
The two most important qualities for an operational auditor are independence
and competence. The auditor should report to the appropriate level of management to
ensure that investigation and recommendations are made without bias. Independence
is seldom a problem for CPA firm auditors because they are not employed by the
company being audited. The independence of internal auditors is enhanced by having
the internal audit department report to the board of directors or president.
11
financial statements, the operational auditor must determine the scope of the
engagement and communicate it to the organizational unit. It is also necessary
to:
• Staff the engagement properly
• Obtain background information about the organizational unit
• Understand internal control
• Decide on the appropriate evidence to accumulate
12
Operational auditors often take a significant amount of time to clearly
communicate audit findings and recommendations. Follow-up is common in
operational auditing when auditors make recommendations to management to
determine whether the recommended changes were made, and if not, why not.
LET’S ENGAGE!
After we established the underlying concepts of operations audit, we are now going
to start on certain approaches in applying the discussed concepts starting with risk-
based audit.
Even when auditors perform interviews and walkthroughs, they could allow
their accounting bias to steer the questions they ask and the documents they request
for examination. When performing controls-based audits, the auditor then listens and
searches for references to controls with the intention of verifying their existence and
effectiveness. In effect, they are testing the controls in relative isolation, without fully
understanding their connection to the underlying objectives and risks of the process
or program under review.
13
that threaten the achievement of business objectives. Since internal auditors are being
asked to do more with less, they can’t afford to review controls just because they are
there. Internal auditors need to assess whether those controls are keys to the
achievement of objectives and only focus on those that are.
1. Compliance
The other key focus area was compliance with regulatory requirements. In this
case, auditors adopted a fairly binary approach to audits by attempting to understand
the rules and regulations affecting a program or process. They then would apply a very
effective methodology: Are they doing what the rulebook says? If “Yes,” the test results
were satisfactory. If “No,” the results were documented and communicated as findings.
In essence, a very predictable pass or fail approach to auditing. For many years, this
became the standard operating practice of auditors and even today, some audits
require a similar approach due to their regulatory and compliance focus, but we must
be careful not to default to this approach when the expectation is broader.
2. Poor Management
Over time, business leaders and managers witnessed business failures caused
by poor management decisions and practices. By poor management, we are referring
to inadequate:
In the aggregate, internal auditors serve the public and common interests by
making sure that owners receive the return on their investments that they are entitled
to, and that the means of generating those profits are within the confines of the law.
Beyond shareholders, however, internal auditors help the process of making sure that
the interests of all relevant stakeholders are met. Stakeholders can be categorized as
economic/primary and noneconomic/secondary.
14
understand the power they have to assert these interests. This process is called
stakeholder analysis, which asks three fundamental questions:
To the extent that internal auditors can help management identify, plan for,
and respond effectively to the primary and secondary stakeholders, the organization
will encounter less pushback and it will likely be able to operate with fewer
disruptions. In addition, during the planning phase of any audit, planners should
identify the internal and external stakeholders involved to make sure they seek their
input as to what their objectives, concerns, and plans are for the area audited. This
will result in more effective and value-added reviews.
Secondary Stakeholders
Government Promote economic development Adopting regulations and laws
Raise revenue through taxes Issuing licenses and permits
Media Keep the public informed Publicizing the events that affect
Monitor company actions the public
Activist Groups Monitor company actions for Lobbying government for
ethical and legal behavior regulations
Gaining public support
Business Provide research and Using staff/ resources to help
Support information to improve companies
Groups competitiveness Providing legal political support
Communities Employ local residents Issuing operating licenses
Ensure local development Lobbying government for
regulations
General Public Minimize risks Supporting activists
Achieve prosperity for society Pressing government to act
Source: Adapted from Lawrence, A. T., Weber, J., and Post, J. E. 2011. Business and Society:
Stakeholders, Ethics, Public Policy (11th ed.). Boston: McGraw-Hill Irwin.
15
Internal auditors need to go beyond inspecting transactions long after they were
performed because the focus now leans toward an examination of future threats and
vulnerabilities that can derail the organization’s goals and objectives in the short,
medium, and even the long term. In fact, focusing on future events and the future
implications of present events would add more value to their organizations than
reporting primarily on past events. When this happens, as has been common practice
in the past, the organization dedicates itself on correcting past issues, which creates
rework.
These threats and vulnerabilities can be evaluated in the medium and long
terms, but also beyond the national borders of the organization’s country of
operations. As such, internal auditors are engaged in international auditing,
evaluating home office and host country dynamics, finding out if local laws exist,
whether they are enforced and how, and which requirements supersede which, if
applicable. Even political issues, social unrest, and demographic shifts are of
importance to today’s auditors, since any of these changes can affect their
organizations and their ability to achieve their objectives economically and in timely
fashion.
Integrated Auditing
At the other end of the spectrum, we can place highly technical IT reviews,
involving matters like database configuration and security, user authentication,
operating system reliability, and network perimeter security. Between these two
extremes, we can place IT general controls, such as physical security and
environmental controls, backup procedures, user authorization, business process
controls surrounding reconciliations, and exception reporting. Other areas of focus
include production and change management, disaster preparedness and recovery, and
business continuity.
16
Financial and operational auditors are increasingly expanding their focus and
incorporating IT applications and general IT topics in their reviews. Conversely, IT
auditors, who have traditionally focused on IT technical subjects including general
and application matters, are increasingly widening their view and including
operational and financial elements to their review. This means that operational and
financial auditors need to know the systems in use, and IT auditors need to know the
business and how it uses the systems in place.
17
2. identify and explain the relevant internal auditing standards and code of ethics.
LET’S ENGAGE!
Integrated auditing is a concept that has been in place for decades, yet many
internal auditors still struggle to practice it effectively. We discuss key attributes of
effective integrated audits and why it is essential for effective operational audits.
We end this module with a review of selected Standards for the Professional
Practice of Internal Auditing (the Standards). But more than list them, we discuss
their implications in the broader topic of operational auditing, and how these
standards can be applied successfully.
The Standards
1210—Proficiency Internal auditors must possess the knowledge, skills, and other
competencies needed to perform their individual responsibilities. The internal audit
activity collectively must possess or obtain the knowledge, skills, and other
competencies needed to perform its responsibilities.
Internal audit is not a static profession, but rather one where its practitioners
must remain proficient in terms of knowledge and skill to perform their duties
effectively. Being qualified upon hire is one thing. Internal auditors must make sure
they remain qualified throughout their career. This of course is a big challenge
because business dynamics are constantly changing, but there is no alternative and
we must keep up with the changes affecting our organizations. Internal auditors must
adopt a learning mind-set, continue to educate themselves, and stay up to date.
One of the greatest assets auditors have is their credibility. They earn this by
delivering consistently accurate, useful, and timely communications that incorporate
insightful opinions and recommendations when appropriate. Credibility cannot be
achieved if the auditor lacks knowledge about the organization and the linkages
between the issues noted, the causes of these issues, and an appreciation for the
priorities and challenges of the organization. A deep understanding of the organization
will make it possible to also understand the context in which issues are occurring.
This in turn will help to formulate pragmatic and business-appropriate
recommendations that get to the root cause of the issues identified.
1210.A3—Internal auditors must have sufficient knowledge of key IT risks and controls
and available technology-based audit techniques to perform their assigned work.
However, not all internal auditors are expected to have the expertise of an internal
auditor whose primary responsibility is IT auditing.
1220.A2—In exercising due professional care internal auditors must consider the use of
technology based audit and other data analysis techniques.
18
Another important aspect of technology-based techniques is the use of
electronic work paper packages for work paper and project management, document
retention, and team collaboration. There are many benefits to keeping a centralized
repository of audit work papers. These include ease of storage and retrieval of current
and past work papers, backups of the documents, remote access, coordination among
team members, and standardization of forms and procedures.
1220.A3—Internal auditors must be alert to the significant risks that might a ffect
objectives, operations, or resources. However, assurance procedures alone, even when
performed with due professional care, do not guarantee that all significant risks will be
identified.
2010—Planning. The CAE must establish a risk-based plan to determine the priorities of
the internal audit activity, consistent with the organization’s goals.
The internal audit department’s audit plan, which identifies the audits that will
be performed by the internal audit function, must be based on the identification and
measurement of risks to the organization. In the past, many internal audit
departments developed and executed audit plans that followed other criteria and were
characterized by cyclical and often repetitive reviews. Sometimes these audits were not
the most needed based on past issues or organizational priorities, but were seen as
safe and consistent with what internal auditors traditionally examined.
2120—Risk management. The internal audit activity must evaluate the e ffectiveness and
contribute to the improvement of risk management processes.
There are very specific roles presented here that I want to reiterate: the board
and management establish the structure and mechanism of the risk management
processes, while internal audit evaluates, verifies the degree of effectiveness, and
recommends improvements where appropriate. A large number of organizations do not
have risk management processes in place, and many that do, experience limited
success with them.
2120.A1—The internal audit activity must evaluate risk exposures relating to the
organization’s governance, operations, and information systems regarding the:
1. Achievement of the organization’s strategic objectives
2. Reliability and integrity of financial and operational information
3. Effectiveness and efficiency of operations and programs
4. Safeguarding of assets
5. Compliance with laws, regulations, policies, procedures, and contracts
19
2130.A1—The internal audit activity must evaluate the adequacy and e ffectiveness of
controls in responding to risks within the organization’s governance, operations, and
information systems regarding the:
1. Achievement of the organization’s strategic objectives
2. Reliability and integrity of financial and operational information
3. Effectiveness and efficiency of operations and programs
4. Safeguarding of assets
5. Compliance with laws, regulations, policies, procedures, and contracts
We mention these two Standards together because they address areas of focus
related to risk exposures (2120.A1) and controls (2130.A1), and share similar
language. The focus of the internal audit activity is broad and complex. It must
evaluate risk exposures related to the organization’s governance, risk management,
and compliance infrastructure, the design and function of its operations, and the
reliability of its IT infrastructure. All of these elements must also be examined in
relation to the organizations’:
20
strangers have physical and logical access to data, facilities, assets, customers,
and vendors.
2130—Control. The internal audit activity must assist the organization in maintaining
effective controls by evaluating their effectiveness and efficiency and by promoting
continuous improvement.
While internal auditors have focused on internal controls for decades, the IIA
states that internal auditors must assist their organizations in maintaining effective
controls. This means first of all, that the board and management own the internal
controls and internal auditors assist them by verifying that the controls are effective.
In addition, this standard also indicates that internal auditors should go beyond the
effectiveness of these controls, but also examine their efficiency. In other words, avoid
wasted resources, time, or effort while performing the control activity. Lastly, and in
regard to promoting continuous improvement, while examining the current situation is
pertinent, internal auditors must also help management embrace the practice of
continuous improvement to always search for faster, cheaper, and better ways of
performing control activities. Because an action was effective in the past, it does not
mean that it will continue to be effective in the future. In fact, stubbornly maintaining
the status quo when conditions warrant modification can be costly and impair future
success.
Given these gaps, internal auditors have many opportunities to add value to
their organizations while they work on meeting the requirements of this standard.
21
2310—Identifying information Internal auditors must identify sufficient, reliable,
relevant, and useful information to achieve the engagement’s objectives.
Internal auditors must make sure that in all aspects of their work, they base
their conclusions and support their communications with facts. The rigor of their data
collection activities, the sophistication of their analysis, and the maintenance of
detailed records of the items examined and procedures performed, will increase the
likelihood that management will accept the observations presented and be more
inclined to accept the recommendations made.
To address this misunderstanding, and the resulting halo effect that this would
cause, internal auditors should acknowledge satisfactory performance in their
communications. If the report is relatively short, a sentence may suffice. For longer
reports, sometimes a full paragraph is enough.
22
One of the most important aspects of internal auditing is effective
communications. Although internal auditors spend many hours planning, performing
fieldwork, and writing the report, the client does not see most of this effort. Our
product is the audit report, so it must impress the client.
Effective verbal communications are also essential for effective audits and
overall success. They help auditors communicate the objectives for the audit and
methodology that will be used. It also makes it possible to get the needed documents
and win support for recommendations, while helping to build healthy relationships.
The IIA professional practice framework includes a code of ethics and IIA
International Standards for the Professional Practice of Internal Auditing (known
as the “Red Book”). All IIA members and Certified Internal Auditors agree to follow the
Institute’s Code of Ethics, which requires compliance with the Standards.
Ethical Principles
a. Integrity of internal auditors establishes trust and thus provides the basis for
reliance on their judgment.
b. Objectivity: Internal auditors exhibit the highest level of professional objectivity
in gathering, evaluating, and communicating information about the activity or
process being examined. Internal auditors make a balanced assessment of all
the relevant circumstances and are not unduly influenced by their own
interests or by others in forming judgments.
c. Confidentiality: Internal auditors respect the value and ownership of
information they receive and do not disclose information without appropriate
authority unless there is a legal or professional obligation to do so.
d. Competency: Internal auditors apply the knowledge, skills, and experience
needed in the performance of internal auditing services.
Rules of Conduct
a. Integrity
Internal auditors:
1. Shall perform their work with honesty, diligence, and responsibility.
2. Shall observe the law and make disclosures expected by the law and the
profession.
23
3. Shall not knowingly be a party to any illegal activity or engage in acts that
are discreditable to the profession of internal auditing or to the organization.
4. Shall respect and contribute to the legitimate and ethical objectives of the
organization
b. Objectivity
Internal auditors:
1. Shall not participate in any activity or relationship that may impair or be
presumed to impair their unbiased assessment. This participation includes
those activities or relationships that may be in conflict with the interests of
the organization.
2. Shall not accept anything that may impair or be presumed to impair their
professional judgment.
3. Shall disclose all material facts known to them that, if not disclosed, may
distort the reporting of activities under review.
c. Confidentiality
Internal auditors:
1. Shall be prudent in the use and protection of information acquired in the
course of their duties.
2. Shall not use information for any personal gain or in any manner that would
be contrary to the law or detrimental to the legitimate and ethical objectives
of the organization.
d. Competency
Internal auditors:
1. Shall engage only in those services for which they have the necessary
knowledge, skills, and experience.
2. Shall perform internal auditing services in accordance with the International
Standards for the Professional Practice of Internal Auditing.
3. Shall continually improve their proficiency and the effectiveness and quality
of their services.
The International Standards for the Professional Practice of Internal Auditing are
divided into attribute standards for internal auditors and audit departments, and
performance standards for the conduct and reporting of internal audit activities.
a. Attributable Standards
1. Purpose, Authority and Responsibility. The purpose, authority and
responsibility of the internal audit activity must be formally defined in an
independent audit charter, consistent with the definitions of internal
auditing, the code of ethics, and the standards. The chief audit executive
must periodically review the internal audit charter and present it to senior.
Management and the board for approval.
2. Independence and Objectivity. The internal audit activity must be
independent and internal auditors must be objective in performing their
work.
3. Proficiency and Due Professional Care. Engagements must be performed
with proficiency and due professional care.
4. Quality Assurance and Improvement Program. The chief audit executive
must develop and maintain a quality assurance and improvement program
that covers all aspects of the internal audit activity.
b. Performance Standards
1. Managing the Internal Audit Activity. The chief audit executive must
effectively manage the internal audit activity to ensure it adds value to the
organization.
2. Nature of Work. The internal audit activity must evaluate and contribute to
the improvement of risk management, control, and governance processes
using a systematic and disciplined approach.
24
3. Engagement Planning. Internal auditors must develop and document a plan
for each engagement including the engagement’s objectives, scope, timing
and resource allocations.
4. Performing the Engagement. Internal auditors must identify, analyse,
evaluate, and document sufficient information to achieve the engagement’s
objectives.
5. Communicating Results. Internal auditors must communicate the
engagement results.
6. Monitoring Progress. The chief audit executive must establish and maintain
a system to monitor the disposition of results communicated to
management.
7. Management’s Acceptance of Risk. When the chief audit executive believes
that senior management has accepted a level of residual risk that may be
unacceptable to the organization, the chief audit executive must discuss the
matter with senior management. If the decision regarding residual risk is
not resolved, the chief audit executive must report the matter to the board
for resolution.
Criteria Value
100% 75% 50% 25%
1. Content The output contains The output The output The output
Accuracy all of the required contains all contains contains very
(60%) information* with of the most of the few items of the
some additional required required required
significant information information information
information
2. Lay-out There is a Most Most of the Components
or consistency in its component component are
Delivery components that s are s are not inconsistent.
(40%) allows the reader consistent consistent.
to locate within the
information easily. publication
.
References:
___________(n.d.) What is Internal Audit. https://www.iia.org.uk/what-is-internal-
audit/
Chambers, Andrew D. (2015). The Operational Auditing Handbook: Auditing Business &
IT Processes. Lincolnshire, England.
Lawrence, A. T., Weber, J., and Post, J. E. 2011. Business and Society: Stakeholders,
Ethics, Public Policy (11th ed.). Boston: McGraw-Hill Irwin.
25
Learning objectives clipart [image] (n.d.). https://www.google.com/
26