Summary AUI3702 Notes.

The internal audit process 1. Determining audit assignment and overall plan 2. Planning the internal audit 3. Performing the engagement 4. Audit reporting and follow-up The assurance engagement process I. Planning the internal audit 1. Determine engagement objectives and scope 2. Understand the auditee objectives, including auditee objectives and assertions 3. Identify and assess risks 4. Identify key controls 5. Evaluate adequacy of control design 6. Create a test plan 7. Develop a work program 8. Allocate resources to the engagement II. Performing the engagement 1. Conduct tests to gather evidence 2. Evaluate evidence gathered and reach conclusions 3. Develop observations and formulate recommendations 4. Communication 5. Perform III. Communication (Audit reporting and follow-up) 1. Perform observation, evaluation and escalation process 2. Conduct interim and preliminary engagement communications 3. Develop final engagement communications 4. Distribute formal and informal final communications 5. Perform monitoring and follow-up procedures Identify the engagement objective(s) to be achieved What are Audit/engagement objectives? AUI3702 Notes. Audit objectives are broad statements developed by the internal auditor that define the intended audit accomplishments. Audit objectives are specific statements about some aspect of a particular subject. The audit objectives must be clearly stated, specific, capable of being evaluated by the available audit evidence, sufficient to render an audit opinion and likely to result in a useful audit report. These statements will not limit the scope of the investigation and will ensure that the purpose of the engagement is still accomplished. Based on the information and evidence obtained during the preliminary survey (Step 1), the auditors will determine the objectives of the audit engagement. The objectives must enable the internal auditors to add value to and improve the operations of the engagement activity (department/section/ unit audited), as well as those of the organisation as a whole. While performing the preliminary survey (step 1) the internal auditor should identify the organisational (business) objectives. Engagement (or audit) objectives depend on organisational objectives. The engagement (audit) objective(s) should be established for each audit engagement and should be formulated with reference to the following: 1. the provisions of the charter, 2. the requirements of the audit committee, 3. the origin of the audit assignment, and 4. the consideration of the risk assessment. Standard 2210 – Engagement Objectives Objectives must be established for each engagement. 2210.A1 – Internal auditors must conduct a preliminary assessment of the risks relevant to the activity under review. Engagement objectives must reflect the results of this assessment. 2210. A2 – Internal auditors must consider the probability of significant errors, fraud, noncompliance and other exposures when developing the engagement objectives. 2210. A3 – Adequate criteria are needed to evaluate controls. Internal auditors must ascertain the extent to which management has established adequate criteria to determine whether objectives and goals have been accomplished. If adequate, internal auditors must use such criteria in their evaluation. If inadequate, internal auditors must work with management to develop appropriate evaluation criteria. 2210. C1 – Consulting engagement objectives must address governance, risk management and control processes to the extent agreed upon with the client. 2110. C2 – Consulting engagement objectives must be consistent with the organisation's values, strategies, and objectives or goals. Formulation of engagement/audit objectives The audit objectives are developed from the information obtained from the preliminary survey and should also encompass the relevant risk areas identified in the risk assessment. When you are developing the engagement objectives for the audit, one should ask oneself why you are performing the test of control. An objective should focus on the results rather than on systems and practices, and should be presented as a statement in the following format: “The objective of the audit is to ensure/determine if/whether the . . .” 1. The objective should begin with words such as to ensure, to determine, etc. 2. Your objective must be linked to the risk identified 3. Your objective should include a possible outcome. The objective should not be phrased in an inconclusive manner, such as “. . . assess the extent to which . . .,” as this does not lead to a clear conclusion in a pass or fail format. The following are possible examples of the outcomes which an audit objective should achieve: 1. proof of occurrence 2. proof of completeness 3. proof of classification