Chapter 8, Performing Effective Internal Audits

An effective internal auditor serves as a frontline set of eyes and ears for the audit committee
and senior management, and must do more than just review the enterprise’s compliance with
published documented procedures. Internal auditors visit organization facilities where the actual
work is performed and records are maintained, observing operations and providing management‐
level reports. Internal auditors can then develop an understanding of the processes in place and
design and perform appropriate tests to evaluate supporting internal controls.

INITIATING AND LAUNCHING AN INTERNAL AUDIT

The justifications for initiating and launching an internal audit are:

1. Corporate reorganizations, including legal or physical threat events.
2. Audit committee formal requests.
3. A request to schedule an audit by senior management or the external auditors.
4. Need for a follow‐up audit based on the results of a prior audit.
5. A special audit performed at the request of local or unit management.
6. Other auditable areas identified in the audit universe as described in Chapter 15 but not in
the regular, approved annual internal audit plan.
Once internal audit has identified and selected an area for an internal audit review, the next
steps are to allocate internal audit resources, gather additional supporting information as needed,
and start the processes of announcing and launching the internal audit.

ORGANIZING AND PLANNING INTERNAL AUDITS

Before an internal audit function can launch any planned audits, it needs to have some
building blocks in place to establish an effective internal audit resource or function. Outlined in
other chapters, these internal audit foundation building blocks include:
1. An effective plan or organization and a charter for launching internal audit activities.
2. A long‐range annual audit plan.
3. Standard and effective approaches for performing all internal audits.

INTERNAL AUDIT PREPARATORY ACTIVITIES

Each internal audit project or assignment should be carefully planned prior to its start.
Audits should be initiated as a scheduled element in internal audit’s annual planning and risk
assessment process through a management or audit committee special request or in response to
unplanned events, such as the discovery of a fraud, new regulations, or unexpected economic
events. After internal audit has developed an annual plan for the upcoming year, planning and
scheduling individual internal audits can often be a challenge. Despite well‐thought‐out plans,
unscheduled events, requests from management, or situations such as unfavorable results from
other audits may cause changes in an internal audit’s long‐range plan. While there often are
pressures to begin such special audits immediately, a properly planned audit will almost always
produce better audit results. In addition, internal audit can obtain significant savings in time and
effort with adequate advance planning and preparatory work.
Once the need for the new audit has been identified, the next steps should be to define or
reaffirm the specific audit objectives, work out logistics arrangements for the review, and then
develop a detailed individual audit plan for that review. The following sections discuss the major
components for performing such an internal audit.
1. Determine the Audit Objectives. Internal audits must generally determine plans for
internal audit activities that typically cover the annual fiscal period.
2. Scheduling an audit and estimating the most important time (annual / quarter / monthly;
person; scope; object) is the number of staff per assignment should be made in a more
detailed scheduling
3. Initial survey: reviewing previous working papers, reviewing previous audit reports,
organizational entities, other related audit material.

STARTING THE INTERNAL AUDIT

This letter should notify auditee management of the following:

1. Addressee. The communication should be addressed to the manager directly responsible for
the unit being audited.
2. Objectives and scope of the planned audit. The auditee should be clearly advised of the
purpose of the planned internal audit and the areas it will cover. For example, the letter
might advise that internal audit plans to review internal controls over the shop floor labor
collection system, including main‐plant shop floor operations.
3. Expected start date and planned duration of the audit. As much as possible, the
engagement letter should give the auditee some understanding of the timing of the audit.
4. Persons responsible for performing the review. At a minimum, the in‐charge auditor
should be identified for this planned audit. This will help auditee management to identify
this key person if a team of auditors arrives on site.
5. Advance preparation needs. Any requirements needed in advance of the field visit or at the
audit site should be outlined. This might include copies of certain reports in advance of the
visit. This is also an appropriate place to request internal audit temporary office space,
computer systems network access, and access to key IT systems or databases.
6. Engagement letter copies. Although the term carbon copy or CC is outdated today, copies
of the engagement letter should be directed to appropriate persons in the enterprise with a
need to know.

Internal Audit Field Surveys

 A preliminary survey is often critically important in determining the direction, detailed
scope, and extent of the audit effort; it is the first step taken at the audit siteA field survey allows
auditors to:
1) Familiarize themselves with the major local processes in place, and
2) Evaluate the control structure and level of control risk in the various processes and
systems included within the audit.
The following information elements should be assembled by the in‐charge auditor and other
members of the team during a typical field survey:
 Organization
 Manuals and directives
 Reports
 Personal observations
 Discussions with key personnel

Documenting the Internal Audit Field Survey

Normally, the field survey will occupy the first day or two at the audit site. For large
reviews, the survey can be performed during a separate visit in advance of the auditor’s detailed
testing and analysis work. In either case, the work performed and summaries of data gathered
through the field survey should be documented in audit workpapers. Copies of key reports and
published procedures should be obtained, summary notes and observations recorded from all
interviews and tours, and flowcharts prepared for all systems or processes.

Field Survey Auditor Conclusions

The purpose of an internal audit field survey is to confirm the assumptions gained from the
preliminary audit planning and to develop an understanding of key systems and processes.

DEVELOPING AND PREPARING AUDIT PROGRAMS

To help achieve goal of audit consistency, internal auditors should use what are called audit
programs to perform audit procedures in a consistent and effective manner for similar types of
audits. The term program refers to a set of auditor procedures similar to the steps in a computer
program,instructions that go through the same program instructions every time the process is run.

Audit Program Formats and Their Preparation

An audit program is a procedure describing the steps and tests to be performed by the
auditor when actually doing fieldwork. The program should be finalized after the completion of
the preliminary and field surveys and before starting the actual audit. It should be constructed
with several criteria in mind, the most important of which is that the program should identify the
aspects of the area to be further examined and the sensitive areas that require audit emphasis. A
second important purpose of an audit program is that it should guide both junior and more
experienced internal auditors.
Types of Audit Evidence
Audit evidence, covers
everything an internal auditor
reviews or observes. The
internal auditor should gather
audit evidence in support of the
auditor’s evaluation-what
internal audit standards call
sufficient, competent, relevant,
and useful audit evidence.

PERFORMING THE INTERNAL AUDIT

Internal Audit Fieldwork Initial Procedures

The in‐charge auditor and members of the audit team should begin by meeting with
appropriate members of auditee management to outline preliminary plans for the audit, including
areas to be tested, special reports or documentation needed, and personnel to be interviewed. The
auditors should request that management contact all affected members of the auditee
organization to provide them with an auditor‐prepared tentative schedule of the planned audit
work. If a key component of the planned audit is missing, such as a missing data file, audit
management should develop a revised strategy to get around the problem. This might include:
 Revising audit procedures to perform additional tests in other areas. This type of change,
however, should only be performed with care. If there was a strong reason for selecting the
now missing file—such as the need to tie it to some other data—it may be necessary to
reconstruct the missing balances.
 Completing the audit without the missing data file. The workpapers and the final report
would indicate internal audit’s inability to perform the planned tests. The in‐charge auditor
should always gain approval from internal audit management for this approach.
 Completing other portions of the audit and rescheduling a later visit to perform tests. (This is
only an option if the missing data file cannot be reconstructed or if a different cycle of data
would be sufficient.) Management should be informed, of course, of audit budget overruns
because of this problem.

Audit Fieldwork Technical Assistance

The field survey or the audit program development process may have identified any need for
specialized technical help to perform an internal audit; however, other complex problems
requiring technical support may arise in the course of the audit fieldwork.

Audit Management Fieldwork Monitoring

If the internal audit covers an extended period of time or level of required resources, internal
audit management should review the audit’s progress and provide technical direction through
visits and communications. The purpose of these visits should be to review the work in progress
and to help resolve problems encountered.

Potential Audit Findings

Preliminary audit findings typically have the following elements:
 Identification of the findings
 The conditions of the completed audit
 References to the documented audit work
 Auditor’s preliminary recommendations
 Results of discussing the findings with management
 Recommended disposition of the matter

Audit Program and Schedule Modifications

The audit program is the overall guide for conducting an internal audit. Developed from
preliminary survey data and from any past internal audits on file, it may be subject to adjustment
during the course of the review. The need for audit program modifications is most frequent when
internal audit has developed a common audit program for use in reviews of similar but not
identical units. Changes are often required in the audit schedule and plan as work progresses.
Some flexibility should be factored into plans to meet unforeseen requirements.

Reporting Preliminary Audit Findings to Management

Potential audit findings should be reviewed with unit management during the audit to
determine if they are factual and appear to be significant. Depending on the scope and size of the
audit, these potential findings should be analyzed at several points during the course of the
review.

WRAPPING UP THE FIELD ENGAGEMENT INTERNAL AUDIT

Internal audits should be managed in the same manner as any large project requiring
personnel time and other resources and resulting in a defined deliverable. Personal resources and
costs must be planned and budgeted at a detailed level. The time extension for the audit must be
further reviewed by the internal audit management to provide an overview of the planned or
ongoing audits. A period of 3 months is often the right time for planned activities.

PERFORMING AN INDIVIDUAL INTERNAL AUDIT

An internal auditor must carry out
performance and have the ability to plan
and carry out individual internal audits. The
most important value provided by the
internal audit process to the audit
committee and management is a detailed
report on the results of the audit in the field
or as part of the overall operation.