evaluate sufficient appropriate audit evidence. ◼ Know the manual procedures used by internal auditors to gather audit evidence. ◼ Be familiar with selected computer- assisted audit techniques, including generalized audit software. ◼ Understand the importance of well- prepared audit working papers.
and communication with auditee personnel throughout the engagement. Such interactions and communications are critical to conducting the engagement effectively and efficiently. It is important, therefore, for internal auditors to be open, communicative, and collaborative.
Internal Auditors provide reasonable (not absolute) assurance due to:
The nature and extent of evidence gathered and the types of decisions made Reliance on evidence that is persuasive rather than absolutely convincing Audit decisions that are rarely black and white The fact that internal auditors’ conclusions and advice must be formed at a reasonable cost within a reasonable length of time to add economic value
Audit evidence is persuasive if it enables the internal auditor to formulate
well-founded conclusions and advice confidently. To be persuasive, evidence must be:
Relevant. Is the evidence pertinent to the audit objective? Does it logically support the internal auditor’s conclusion or advice? Reliable. Did the evidence come from a credible source? Did the internal auditor directly obtain the evidence? Sufficient. Has the internal auditor obtained enough evidence? Do different, but related, pieces of evidence corroborate each other?
General guidelines for reliability and sufficiency of evidence include:
Evidence obtained from independent third parties is more reliable than evidence obtained from auditee personnel. Evidence produced by a process or system with effective controls is more reliable than evidence produced by a process or system with ineffective controls. Evidence obtained directly by the internal auditor is more reliable than evidence obtained indirectly. Documented evidence is more reliable than undocumented evidence. Timely evidence is more reliable than untimely evidence. Corroborated evidence is more sufficient than uncorroborated or contradictory evidence. Larger samples produce more sufficient evidence than smaller samples.
Documentary evidence is a significant portion of the evidence gathered during most internal audit engagements. The reliability of documentary evidence depends, to a large extent, on its origin and the route it follows before being examined by the internal auditor.
Audit procedures are specific tasks performed by the internal auditor to gather the evidence required to achieve the prescribed audit objectives. They are applied during the audit process to: Obtain a thorough understanding of the auditee, including the auditee’s objectives, risks, and controls. Test the design adequacy and operating effectiveness of the targeted area’s system of internal controls. Analyze plausible relationships among different elements of data. Directly test recorded financial and nonfinancial information for errors and fraud. Obtain sufficient appropriate evidence to achieve the prescribed audit objectives involved in determining the nature, extent, and timing of audit procedures to perform.
“In exercising due professional care, internal auditors must consider the use of technology-based audit and other data analysis techniques.” (Standard 1220.A2)
ISACA defines a technology-based audit technique, or CAAT, as “any automated audit
technique, such as generalized audit software (GAS), test data generators, computerized audit programs and specialized audit utilities.” Common CAATs include: Generalized audit software (GAS) Utility software Test data Application software tracing and mapping Audit expert systems Continuous auditing
Because of the many purposes working papers serve, their importance cannot be overstated. For example, working papers: Aid in planning and performing the engagement. Facilitate supervision of the engagement and review of the work completed. Indicate whether engagement objectives were achieved. Provide the principal support for the internal auditors’ communications to the auditee, senior management, the board of directors, and appropriate third parties. Serve as a basis for evaluating the internal audit function’s quality assurance program. Contribute to the professional development of the internal audit staff. Demonstrate the internal audit function’s compliance with The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards).
A wide variety of working papers are prepared during an internal audit engagement. The following list is intended to be illustrative rather than all-inclusive: Work programs used to document the nature, extent, and timing of the specific audit procedures. Engagement time budgets and resource allocation worksheets. Questionnaires used to obtain information about the auditee, including its objectives, risks, controls, operating activities, etc. Process maps or flowcharts used to document process activities, risks, and controls. Charts, graphs, and diagrams, such as a risk map used to plot the impact and likelihood of business risks. Agendas for internal audit team meetings and meetings with the auditee. Narrative memoranda used to document the results of interviews and other meetings with auditees.
Pertinent auditee organizational information, such as organization charts, job
descriptions, and operating and financial policies and procedures. Copies of source documents, such as purchase requisitions, purchase orders, receiving reports, vendor invoices, vouchers, and checks. Copies of other important documents, such as minutes of meetings and contracts. IT-related documents, such as program listings and exception reports. Accounting records, such as trial balances and excerpts from journals and ledgers. Evidence obtained from third parties, such as confirmation responses from customers and representations from outside legal counsel. Worksheets prepared by the internal auditor, such as a risk and control matrix used to document process-level risks, key control descriptions, the internal auditor’s evaluation of control design adequacy, the tests of controls performed, and the test results.
Other types of working papers prepared by the internal auditor that reflect work performed (for example, analytical procedures, computerized data analysis, and direct tests of transactions, events, account balances, and performance measurements). Evidence compiled by the auditee and tested by the internal auditor. Controls performed by the auditee and reperformed by the internal auditor (for example, bank reconciliations). Written correspondence and documentation of oral correspondence with the auditee during the engagement. The internal audit team’s write-ups of observations, recommendations, and conclusions. Final engagement communications and management’s responses.
Appropriate working paper standardization may include:
A uniform cross-referencing system for all engagements. Consistent working paper layouts. Standardized “tick marks” (that is, symbols used on working papers to represent specific audit procedures). A prescription for the types of information to store in permanent or carry-forward files (that is, files containing pertinent information of continuing importance for a particular auditee).
To stand on its own merits, each working paper should:
Contain an appropriate index or reference number. Identify the engagement and describe the purpose or contents of the working paper. Be signed (or initialed) and dated by both the internal auditor who performed the work and the internal auditor(s) who reviewed the work. (Note that such a signature may be electronic.) Clearly identify the sources of auditee data included on the working paper. Include clear explanations of the specific procedures performed. Be clearly written and easy to understand by internal auditors unfamiliar with the work performed (for example, an internal auditor who refers to the working paper at a later date). The bottom line is that the working paper should contain sufficient information for an internal auditor, other than the one who performed the work, to be able to reperform it.
