Audit

Program

Generally, audit programs need to be adjusted/designed for each engagement. The success or failure of an audit engagement can depend upon an audit program that is appropriately designed and properly focused.

TOP DOWN

Audit programs should be focused from the "Top Down". Internal auditors should not start with the "nuts and bolts", but rather with the big, significant issues. Failure to "start at the top" can result in:

1. Missing the most significant issues! For example, even though it can be important that bank accounts are being reconciled, failure to do such normally does not cause an organization to "go out of business". However, if goals and objectives are not being met or are not congruent with those of the organization, this circumstance can impact the success of the business.

2. Inefficiencies. Starting with the "nuts and bolts" requires the auditor to go to the top in order to draw a conclusion. Unnecessary detail work can usually be avoided when reviewing issues from the top down. It is not necessary to look at all of the issues in order to arrive at a conclusion.

START & STOP

Where to start and when to stop are two important issues to be taken into account when developing an audit program.

. Areas with the highest degree of potential risk should be the focus of audit.

. Once at the high risk areas we may want to start reviewing those activities with low or inadequate amount of management involvement. Although this can be indicative of ineffective management, this may also be the result of the internal auditor incorrectly assessing the area as being of high risk.

. Additionally, once at the high risk areas we want to start where the degree of risk is the highest and the amount of audit time required to review the area is the least. Like operating management, we are also concerned about a quick "pay-back".

. Areas with low to moderate risks typically do not warrant our attention. However, we need to be aware of the low risk areas, to make sure they do not become high risk.

. Also, when low risk areas are receiving an exceptionally high degree of management attention we must ask the question, why.

QUALITY

To enhance the quality of the work product and to assist in delivering the service effectively and efficiently:

. Estimate the time required to complete each audit step as well as the time needed for each major caption/subject.

. Prioritize the audit steps in order of importance relative to business risks and the audit objective

. Allocate audit resources based upon priorities of individual audit tests and/or sections

OUTPUT

The audit focus should be on "Output Measurements", as opposed to "Performance Measurements".

. Management, including executives, focuses on output: measurements indicating the successful accomplishment of goals and objectives.

. Too often audit programs focus on "Performance Measurements": finding out if the payables clerks are processing an average of at least "x" number of invoices daily, as opposed to determining if the goals and objectives are being met - processing invoices properly to ensure correct, timely payments, etc.