C HAPTER 21

Internal, Operational, and Government Auditing

Learning Objectives

Chapter 21 focuses on a variety of other types of audits: particularly, internal auditing,

operational auditing, and governmental auditing. The learning objectives for Chapter 21 have
been stated in terms of auditor knowledge the student should know about these types of audits.
They are:

Auditor Knowledge
K1: Know the definition of internal auditing and the IIA professional practices framework.
K2: Know the IIA code of ethics, attribute standards, and performance standards.
K3 Know the definition of operational auditing and describe the phases of an operational
audit.
K4: Know the standards that independent public accountants should follow in performing
operational audits.
K5: Know the three types of governmental audits.
K6: Know the general standards, additional fieldwork standards, and additional reporting
standards associated with generally accepted governmental auditing standards (GAGAS)
for financial audits and performance audits.
K7: Know the objectives and applicability of the Single Audit Act.
K8: Know the components of a single audit and the procedures and reports associated with
each.

Chapter Outline

1. Chapter-opening Vignette: Understanding the Risk of Fraud in Governmental Audits, 983

2. Preview of Chapter 20, 934
3. Focus on Auditor Knowledge, 984
4. Internal Auditing, 985
4.1. Internal Auditing Defined
4.2. Evolution of Internal Auditing, 984………………………(Figure 21-1: IIA Professional
Practices Framework)
4.3. IIA Code of Ethics, 986…………………………………..(Figure 21-2: IIA Code of
Ethics)
4.4. IIA Performance and Attribute Standards………………..(Figure 21-3: IIA Attribute
and Performance Standards)

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-1
 4.5. Relationship with Internal Auditors, 990
5. Operational Auditing, 991
5.1. Operational Auditing Defined, 991
5.2. Phases of an Operational Audit, 991…………………….(Figure 21-4: Financial
Statement vs. Operational Audits)
5.2.1. Select Auditee, 992
5.2.2. Plan Audit, 993
5.2.3. Perform Audit, 993
5.2.4. Report Finings, 994
5.2.5. Perform Follow-up, 994
5.3. Standards for Independent Public Accountants, 995
6. Governmental Auditing, 996
6.1. Types of Governmental Audits, 996
6.2. Generally Accepted Governmental Auditing Standards (GAGAS), 996…..(Figure 21-5:
Fieldwork and Reporting Standards for Performance Audits)
6.2.1. General Standards, 998
6.2.2. Fieldwork Standards for Financial Audits, 999
6.2.3. Reporting Standards for Financial Audits, 1001
6.3. Reporting on Compliance with Laws and Regulations, 1003…………(Figure 21-6:
Example Report on Compliance)
6.4. Reporting on Internal Control, 1005
7. Single Audit Act, 1006
7.1. Objectives of the Act, 1006
7.2. Applicability and Administration, 1006
7.3. Scope of an Audit Under the Single Audit Act, 1007…………….(Figure 21-7:
Summary of Auditor’s Responsibilities Under the Single Audit Act)
7.3.1. General, 1007
7.3.1.1. Financial Statements, 1007
7.3.1.2. Internal Controls, 1008
7.3.1.3. Compliance, 1008
7.3.1.4. Audit Follow-up, 1009
7.3.1.5. Reporting Requirements, 1009
7.3.1.6. Opinion on Financial Statements, 1009
7.3.1.7. Report on Internal Controls, 1010
7.3.1.8. Schedule of Findings and Questioned Costs, 1010
8. Focus on Auditor Knowledge, 1012 ……………………………… (Figure 21-8: Summary of
Auditor Knowledge Discussed in Chapter 21)
9. Objective Questions, online at www.wiley.com/college/boynton
10. Comprehensive Questions, 1013

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-2
11. Cases, 1017
12. Professional Simulation, 1018

New to the 8th Edition

The 8th edition has several new features:

1. Chapter-opening vignette that discusses the risk of fraud in governmental audits.
2. Focus on audit decisions at the beginning of the chapter, in the margin throughout the chapter
and an end of chapter summary that focus on important audit decisions covered in the
chapter.
3. Updates for changes in the IIA Professional Practices Framework
4. Updates for changes in governmental auditing standards.
5. Updates for changes in the single audit act.
6. A CPA exam style professional simulation has been added at the end of the chapter.

Focus on Auditor Knowledge and Teaching Notes

An explicit focus on audit decisions is new to the 8th edition. The final chapter focuses on
internal auditing, operational auditing, and governmental auditing (GAGAS and Single Audit
Act audits). The following discussion addresses each learning objective and the relevant
teaching notes that go with each audit decision.

K1: Know the definition of internal auditing and the IIA professional practices framework.

The Institute of Internal Auditors (IIA) defines internal auditing is an independent,

objective assurance and consulting activity designed to add value and improve an
organization’s operations. It helps an organization accomplish its objectives b bringing a
systematic, disciplined approach to evaluate and improve the effectiveness of risk
management, control, and governance processes.

This is important for many students to understand as many may find jobs in the internal
audit field. The IIA professional practices framework is depicted in Figure 21-1 (page
987).

The guiding principles of the IIA professional practices framework that guide any work
performed by IIA members are the professional practices framework. The key elements
are the code of ethics, attribute standards, and performance standards. These are
discussed in the next learning objective.

K2: Know the IIA code of ethics, attribute standards, and performance standards.

The IIA code of ethics is depicted in Figure 21-2. It has four guiding principles:
o Integrity
o Objectivity

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-3
 o Confidentiality
o Competency

There are 4 attribute standards that address the characteristics of organizations and
individuals performing internal audit services. They are:

1000 Purpose, Authority, and Responsibility: The purpose, authority, and responsibility of
the internal audit activity should be formally defined in a charter, consistent with the
Standards, and approved by the board.
1100 Independence and Objectivity: The internal audit activity should be independent, and
internal auditors should be objective in performing their work.
1200 Proficiency and Due Professional Care: Engagements should be performed with
proficiency and due professional care.
1300 Quality Assurance and Improvement Program: The chief audit executive should
develop and maintain a quality assurance and improvement program that covers all
aspects of the internal audit activity and continuously monitors its effectiveness. This
program includes periodic internal and external quality assessments and ongoing internal
monitoring. Each part of the program should be designed to help the internal auditing
activity, add value and improve the organization’s operations and to provide assurance
that the internal audit activity is in conformity with the Standards and the Code of Ethics.

The Performance Standards describe the nature of internal audit services and provide
quality criteria against which the performance of these services can be measured.

The seven major performance standards are as follows.

2000 Managing the Internal Audit Activity: The chief audit executive should effectively
manage the internal audit activity to ensure it adds value to the organization.
2100 Nature of Work: The internal audit activity should evaluate and contribute to the
improvement of risk management, control, and governance processes using a systematic
and disciplined approach.
2200 Engagement Planning: Internal auditors should develop and record a plan for each
engagement, including the scope, objectives, timing and resource allocations.
2300 Performing the Engagement: Internal auditors should identify, analyze, evaluate, and
record sufficient information to achieve the engagement's objectives.
2400 Communicating Results: Internal auditors should communicate the engagement results.
2500 Monitoring Progress: The chief audit executive should establish and maintain a system
to monitor the disposition of results communicated to management.
2600 Management’s Acceptance of Risks: When the chief audit executive believes that
senior management has accepted a level of residual risk that may be unacceptable to the
organization, the chief audit executive should discuss the matter with senior management.
If the decision regarding residual risk is not resolved, the chief audit executive and senior
management should report the matter to the board for resolution.

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-4
 By the time that students have a thorough discussion of auditing, these standards make
common sense in the context of providing services to the organization. It may be helpful
to compare these standards to the definition of auditing and assurance service presented
in chapter 1. These are:

The Report of the Committee on Basic Auditing Concepts of the American Accounting
Association (Accounting Review, vol. 47) defines auditing as

a systematic process of objectively obtaining and evaluating evidence regarding assertions

about economic actions and events to ascertain the degree of correspondence between those
assertions and established criteria and communicating the results to interested users.

Assurance services are independent professional services that improve the quality of
information, or its context, for decision makers.

It may be helpful to have a discussion about the work of internal auditors and how the
IIA standards fit within an overall audit framework.

K3 Know the definition of operational auditing and describe the phases of an operational
audit.

The IIA defines operational auditing as the systematic process of evaluating an

organization’s effectiveness, efficiency, and economy of operations under management’s
control and reporting to appropriate persons the results of the evaluation along with
recommendations for improvements.

The emphasis in an operational audit is on evaluating efficiency and effectiveness. The

discussion on pages 991 - 994 focuses on how an operational audit would be planned and
performed. Figure 21-4 compares the process of planning and performing an operational
audit with a financial statement audit. The basics steps of accepting the engagement,
planning the audit, performing the audit, and reporting findings, are discussed in the
context of evaluating an organizations efficiency and effectiveness. Finally the step of
performing follow-up procedures is intended to ensure that findings actually result in
organizational changes. There should be some follow-up procedures to see that
recommendations are in fact implemented, or that steps are taken to improve organization
efficiency and effectiveness.

K4: Know the standards that independent public accountants should follow in performing
operational audits.

If an independent CPA performs an operational audit, the engagement should be guided

by both the Management Consulting Services (MCS) standards issued by the AICPA and
the AICPA code of professional ethics.

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-5
K5: Know the three types of governmental audits.

The three types of governmental audits are:

o Financial audits that are primarily concerned with providing reasonable assurance
about whether financial statements are presented fairly in all material respects in
conformity with generally accepted accounting principles (GAAP), or with a
comprehensive basis of accounting other than GAAP.
o Attestation engagements concern examining, reviewing, or performing agreed-upon
procedures on a subject matter or an assertion about a subject matter and reporting on
the results. The subject matter of an attestation engagement may take many forms,
including historical or prospective performance or condition, physical characteristics,
historical events, analyses, systems and processes, or behavior.
o Performance audits entail an objective and systematic examination of evidence to
provide an independent assessment of the performance and management of a program
against objective criteria as well as assessments that provide a prospective focus or
that synthesize information on best practices or cross-cutting issues. Performance
audits provide information to improve program operations and facilitate decision
making by parties with responsibility to oversee or initiate corrective action, and
improve public accountability. Performance audits encompass a wide variety of
objectives, including objectives related to assessing program effectiveness and
results; economy and efficiency; internal control; compliance with legal or other
requirements; and objectives related to providing prospective analyses, guidance, or
summary information.

K6: Know the general standards, additional fieldwork standards, and additional reporting
standards associated with generally accepted governmental auditing standards (GAGAS)
for financial audits and performance audits.

Generally Accepted Governmental Auditing Standards (GAGAS) are established by the

U.S. General Accounting Office. GAGAS governs many audits of state and local
governments, and not-for-profit organizations that receive federal funds. A GAGAS audit
is usually required by a law, regulation, or legal contract.

The GAGAS standards are classified into six categories and are outlined below.

(1) General Standards

o Independence.
o Professional judgment
o Competence
o Quality Control and Assurance

(2) Field Work Standards for Financial Audits

o Auditor communication.
o Considering the results of previous audit and attestation engagements.

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-6
 o Detecting Material Misstatements Resulting from Violations of Contract
Provisions or Grant Agreements, or from Abuse.
o Developing Elements of a Finding.
o Audit documentation

(3) Reporting Standards for Financial Audits;

o Reporting auditors’ compliance with GAGAS.
o Reporting on internal control and on compliance with laws, regulations, and
provisions of contracts or grant agreements.
o Reporting deficiencies in internal control, fraud, illegal acts, violations of
provisions of contracts or grant agreements, and abuse.
o Reporting views of responsible officials.
o Reporting privileged and confidential information.
o Report issuance and distribution.

(4) General, Field Work and Reporting Standards for Attestation Engagements
NOTE: THE GENERAL, FIELDWORK AND REPORTING STANDARDS
FOR ATTESTATION ENGAGEMENT ARE NOT COVERED IN THE
CHAPTER AND ARE NOT PART OF THE LEARNING OBJECTIVE.

(5) Field Work Standards for Performance Audits

o Planning:
o Supervision:
o Evidence
o Audit Documentation.

(6) Reporting Standards for Performance Audits.

o Form:
o Report Contents:
o Report Quality Elements:
o Report Issuance and Distribution:

K7: Know the objectives and applicability of the Single Audit Act.

The Single Audit Act has four objectives. They are to:
1. Improve the financial management of state and local governments and non-profit
organizations with respect to federal financial assistance programs.
2. Establish uniform requirements for audits of federal financial assistance provided to
state and local governments.
3. Promote the efficient and effective use of audit resources.
4. Ensure that federal departments and agencies, to the maximum extent practicable,
rely on and use audit work done pursuant to the requirements of the Single Audit Act.

The Single Audit Act applies to state and local governments and nonprofit organizations
that receive $500,000 or more in federal financial assistance in any fiscal year, either

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-7
 directly from a federal agency or indirectly through another state or local government
entity, are required to have an annual single audit pursuant to the Act.

Note: The Federal Office of Management and Budget (OMB) is authorized to adjust the
threshold amount every 2 years.

In addition, the Single Audit Act adds to the requirements contained in GAGAS, with
special emphasis on defined major federal financial assistance programs.

K8: Know the components of a single audit and the procedures and reports associated with
each.

Figure 21-7 (page 1008) summarizes the auditor’s responsibilities under the single audit
act. These responsibilities are divided into two components: (1) financial statement
audits and (2) audits of federal financial assistance.

Students should note that under the reports issued under the single audit act, the auditor
issues four reports as part of a financial statement audit. These are:
o An opinion on the financial statements.
o A report on a supplementary schedule of federal financial assistance.
o A report on internal control based on the audit. Students should note that this
conclusion is based on the financial statement audit and is not a separate audit of
internal controls over financial reporting.
o A report on compliance with laws and regulations that may have a material effect
on the financial statements.

In an audit of federal financial assistance the procedures are stepped up. Addition
procedures include:
o Procedures to obtain understanding of the internal control over federal financial
assistance test of controls, and to support an assessment of control risk at a low level.

o Tests of compliance with general requirements applicable to all federal financial

assistance programs and specific requirements applicable to major federal financial
assistance programs.

o Perform procedures to asses the reasonableness of summary schedule of prior

findings and current follow up.

In an audit of federal financial assistance the reporting requirements are also stepped up.
An auditor needs to report on:
o Internal controls over federal financial assistance.
o Compliance with general requirements applicable to federal financial assistance
programs.
o Compliance with specific requirements applicable to each major federal financial
assistance program.

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-8
 o A schedule of findings and questioned costs.
o Current year findings, when the auditor concludes that the summary of prior
findings materially misstates their status.

Key Questions for Students

Following is a list of common questions for students that instructors might want to weave into
class discussion of Chapter 21 topics.

Auditor Knowledge
K1: Know the definition of internal auditing and the IIA professional practices framework.

o Is internal auditing a management or an accounting function?

o What is the objective of internal auditing?
o What are the elements of the IIA professional practices framework?

K2: Know the IIA code of ethics, attribute standards, and performance standards.

o What are the principles of the IIA code of ethics?

o How does the independence of an internal auditor differ from that of an external
auditor?
o Identify the basic categories of the attribute and performance standards.
o Briefly describe the purpose of each set of standards.

K3 Know the definition of operational auditing and describe the phases of an operational
audit.

o What is the IIA definition of operational auditing?

o What steps are performed in an operational audit?
o Assume that you were auditing the efficiency and effectiveness of a private college.
How would you apply each step associated with an operational audit?

K4: Know the standards that independent public accountants should follow in performing
operational audits.

o What professional standards guide an independent CPA in the performance of an

operational audit?

K5: Know the three types of governmental audits.

o What are the three types of governmental audits?

o Explain the purpose of each.

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-9
K6: Know the general standards, additional fieldwork standards, and additional reporting
standards associated with generally accepted governmental auditing standards (GAGAS)
for financial audits and performance audits.

o What are the four general standards associated with GAGAS?

o What are the five fieldwork standards for financial audits associated with GAGAS?
o What are the six reporting standards for financial audits associated with GAGAS?
o What are the four fieldwork standards for performance audits associated with
GAGAS?
o What are the four reporting standards for performance audits associated with
GAGAS?

K7: Know the objectives and applicability of the Single Audit Act.

o What are the four stated objectives of the Single Audit Act?
o What organizations need to be concerned about complying with the single audit act?
o What is the monetary threshold of federal financial assistance in any fiscal year, for
the single audit act to apply?

K8: Know the components of a single audit and the procedures and reports associated with
each.

o What are the two major components of auditor responsibilities under the single audit
act?
o As part of a financial statement audit, what four reports should be issued by an
auditor as part of a financial statement audit?
o In an audit of federal financial assistance the procedures are stepped up. What three
types of additional procedures should be performed?
o In an audit of federal financial assistance the reporting requirements are also stepped
up? What five additional reporting requirements are part of an audit of federal
financial assistance?

Instructor’s Manual to Modern Auditing: Copyright © 2005, John Wiley and Sons, Inc. 21-10