Group 8

Marsha Diana (2110532033)

Zakya (2110531034)

CH 8 Performing Effective Internal Audits

8.1 INITIATING AND LAUNCHING AN INTERNAL AUDIT
The justifications for initiating and launching an internal audit are:
1. Corporate reorganizations, including legal or physical threat events.
Acquiring or selling a business unit often requires immediate internal audit attention.
Similarly, major legal issues demand a shift in focus, even if it means pausing regular
activities.
2. Audit committee formal requests
The board audit committee oversees the internal audit function and approves an
annual plan, which guides internal audit activities.
3. A request to schedule an audit by senior management or the external auditors.
Internal audit may deviate from the approved plan if requested by a board member,
senior management, or external audit firm, accommodating additional reviews as
needed.
4. Need for a follow‐up audit based on the results of a prior audit
Follow-up audits may be necessary based on previous audit findings. If initial audits
uncover deeper issues, special audits should be scheduled to investigate further when
resources permit.
5. A special audit performed at the request of local or unit management.
Should be vetted by the Chief Audit Executive (CAE). These audits can be
incorporated into the current schedule or considered for the next year's plan.
6. Other auditable areas identified in the audit universe as described in Chapter 15 but
not in the regular, approved annual internal audit plan.
Auditable areas identified in the audit universe but not in the approved annual plan
can be considered for internal audits if there is available time.

8.2 ORGANIZING AND PLANNING INTERNAL AUDITS

Internal auditing involves a wide range of interconnected areas of expertise and knowledge,
and cannot be reduced to a sequential set of action steps. It encompasses various related
activities that must be consistently and professionally executed by all members of the internal
audit staff to create effective resources for the company.

8.3 INTERNAL AUDIT PREPARATORY ACTIVITIES

Each internal audit project must be carefully planned before commencement, starting as part
of the annual planning and risk assessment process. Approved by the audit committee and
regularly updated, internal audit planning is crucial for effective audits that can respond to
unexpected changes.

Determine the Audit Objectives

Internal audit should have a yearly activity plan based on management and audit committee
requests, staff capabilities, prior audit work, available resources, and company risks. Changes
in business operations, the economy, or other audit issues can affect this plan. Therefore, the
audit plan should include high-level objectives for each audit and an understanding of
associated risks.

Audit Schedule and Time Estimates

The approved annual internal audit plan provides guidance for the audits to be conducted.
Involvement of key staff and audit managers is crucial for adjusting the plan. Plan revisions
may occur due to additional resource requirements, changes in audit scope, personnel
changes, and management priorities. Individual audit schedules should align with the plan
and be regularly monitored. Evaluating auditor capabilities is important for assigning audit
project tasks.

Internal Audit Preliminary Surveys

The long-term risk-based audit plan should be developed with knowledge of the areas to be
audited. Often, an initial survey is needed before starting the actual audit, especially for
reviews that have been conducted previously. This survey is typically conducted by audit
management or the designated in-charge auditor. The following are items that should be
reviewed, if available, during an internal audit preliminary survey:
● Review of prior workpapers.
● Knowing the amount of time from the prior audit.
● Review of prior audit reports
● Significant recommended corrective actions.
● Organization of the entity
● Other related audit materials.

8.4 STARTING THE INTERNAL AUDIT

The first step in initiating an internal audit is to inform the auditee that the internal audit has
been scheduled via an engagement letter. This letter includes the audit schedule, objectives
and scope, personnel responsible for the review, initial preparations required, and copies
distributed to relevant stakeholders within the company.
Internal Audit Field Surveys
The initial survey is crucial for determining the direction and scope of the audit. It allows
auditors to understand key processes and evaluate control structures and control risks. When
the audit team is unfamiliar with the audit location, the initial survey is the appropriate time
to introduce themselves, address questions from the engagement letter, and plan interviews
and audit schedules. The following information elements should be assembled by the
in‐charge auditor and other members of the team during a typical field survey:
● Organization: During the field survey, auditors should verify the accuracy of
organization charts and become familiar with key personnel and their responsibilities.
If necessary, request formal position descriptions.

● Manuals and directives: Obtain copies of policy and procedure manuals and relevant
data from online systems. Study applicable laws, regulations, and management
directives. Screen correspondence files for relevant materials.
● Reports: Analyze relevant management reports and meeting minutes for insights into
budgeting, operations, cost studies, personnel matters, and external inspections or
reviews. These reports may provide leads for the audit and summarize problems,
recommendations, and progress.
● Personal observations: Conduct a tour or walk-through of the activity to familiarize
auditors with the entity, its operations, personnel, and space utilization. Document
impressions and observe compliance with company procedures.
● Discussions with key personnel: Engage in discussions with key personnel to identify
known problems, current operational results, and planned changes or reorganizations.
Ask questions based on preliminary data or tour observations
Documenting the Internal Audit Field Survey
Field survey is the initial stage of an audit, conducted over one or two days at the audit site.
The findings are documented in audit workpapers, including key reports, interview
summaries, and the creation of flowcharts for relevant systems or processes. Flowcharts are
crucial for illustrating system complexity and control points, supporting internal control
documentation for compliance, such as SOx Section 404. Proficiency in using software tools
to create flowcharts should be mastered by every internal auditor.

Field Survey Auditor Conclusions

The field survey in internal auditing aims to confirm assumptions from initial planning and
develop an understanding of key systems. The audit team should adjust the scope and
objectives as needed. Audit management should review survey results and make scope
changes if necessary. Survey findings must be documented and communicated to
management before proceeding. If adjustments are needed, a field survey report should be
prepared and shared with relevant parties.

8.5 DEVELOPING AND PREPARING AUDIT PROGRAMS

Audit Program Formats and Their Preparation

An audit programme is a process that outlines the actions and examinations the auditor must do when
conducting fieldwork.Prior to beginning the real audit, the programme should be completed after the
preliminary and field surveys are finished. It should be built with a number of considerations, the
primary being that the programme should pinpoint the areas that need further investigation and the
sensitive regions that demand audit focus.

An audit program's ability to mentor both inexperienced and seasoned internal auditors is a second
key goal. Management might, for instance, ask internal audit to watch as a physical inventory is taken
once a year.

The most popular internal audit format in the past was the checklist style audit programme. An audit
programme consisting of a lengthy list of questions with "yes," "no," or "not applicable" responses is
frequently presented to a less experienced internal auditor. The internal auditor would then finish the
programme stages by looking through documents or by conducting interviews. The audit program's
questionnaire format also has a tendency to make the auditor forget to look through pertinent evidence
when posing the questions.

Types of Audit Evidence

All of the data that an internal auditor examines or witnesses is included in this data, which is known
as audit evidence. To support their assessment, the internal auditor should collect audit evidence, or
what internal audit standards refer to as adequate, knowledgeable, pertinent, and helpful audit
evidence.

8.6 PERFORMING THE INTERNAL AUDIT

Internal Audit Fieldwork Initial Procedures

In the event that a crucial element of the audit schedule is absent, like a data file, audit management
have to design an updated plan of action to circumvent the issue. This could involve:

● Changing audit protocols to run extra tests in different domains. But this kind of adjustment
should only be done carefully. It might be required to reconstruct the missing balances if there
was a compelling reason to choose the now-lost file, such as the requirement to link it to
additional data.
● Finishing the audit in the absence of the missing data file. The incapacity of internal audit to
carry out the scheduled tests would be revealed by the workpapers and the final report.
Internal audit management should always give their approval before using this strategy,
according to the in-charge auditor.
● Rearranging a later visit to conduct tests and finishing up the remaining aspects of the audit.
(This is the only choice available if it is not possible to reconstruct the missing data file or if
another data cycle would suffice.) Naturally, management needs to be made aware of audit
budget overruns resulting from this issue.

For many field audits, issues of this kind or ones comparable to them may arise. It is crucial that these
issues are found and fixed as soon as feasible throughout the audit. Management should be notified at
the proper levels if the internal audit team encounters complete noncooperation in order to address the
issue. It is important for both internal auditors and auditees to never forget that they are both parts of
the same larger organisation with similar ultimate objectives and interests.

Audit Fieldwork Technical Assistance

The lead auditor should get help as quickly as feasible if the audit team is unfamiliar with a technical
issue. To provide an answer, an internal audit supervisor or specialist might need to investigate the
audit or technical problem. In other cases, it could be required to send an internal audit specialist with
relevant experience to the field site in order to address the issue. But most internal audit departments
don't have resident experts on hand to fly out to the field site and fix problems; instead, problems are
usually resolved over the phone, via email, or through the sharing of documents.

Audit Management Fieldwork Monitoring

Internal audit management should assess the audit's progress and offer technical guidance through
visits and communications if the audit covers a large amount of ground or requires a high level of
resources. These evaluations are an addition to the field staff member who is in-charge of the auditing
process. The scale of the review, the experience of the designated staff, and the criticality of the
review will all influence how frequently and in what ways these visits occur. If communication
channels are good, a medium-sized assessment overseen by an experienced in-charge auditor covering
known regions might not need a management review. However, an experienced member of audit
management should periodically visit the fieldwork project if the audit covers a vital area, if a new
programme or new procedures are utilised, or if the assigned in-charge auditor has insufficient
experience in the area evaluated.

Potential Audit Findings

An internal auditor should prepare a brief explanation of the conditions encountered, prospective findings, and
recommendations if they find a potential audit defect.
Although a preliminary audit finding's contents can change based on the requirements of the specific internal
audit, they usually include the following components:

● Determination of the results. This is merely an audit identification number and an explanation of the
possible results.
● The audit's completion conditions. Although the description is typically brief, it is adequate to let local
management comprehend the conditions that have been observed.
● Allusions to the audit work that is documented. Cross-references to the audit programme step that
prompted the comment and the audit workpapers' documentation of it should be included in the audit
point sheet.
● Initial recommendations from the auditor. The nature of the possible audit finding and the errors should
be documented in the audit report space. This could serve as the foundation for a future audit report
conclusion. Here could be some notes on possible remedial actions suggested by the auditors.
● The outcomes of the management discussion of the findings. All possible results should be discussed
informally between the management immediately in charge of the matter and the in-charge auditor.
This is the place to record the discussion's outcomes.
● Proposed resolution of the issue. The in-charge auditor should provide feedback on the suggested
handling of the findings based on their discussion with management.

Audit Program and Schedule Modifications

Modifications to audit programmes are most often required when internal audit has created a standard audit
programme that can be applied to evaluations of units that are comparable but not identical. For instance, if a
company had several autonomous production units, each with its own purchasing department, an audit
programme might have been created to address controls over the purchasing function. The overall internal
control principles and organisation policy should be reflected in those purchasing function audit programmes.
However, because of regional variations, some of the procedures in this audit programme might not apply to a
particular purchasing area that is being examined. Any such measures that are omitted from the specific audit
programme ought to be authorised and the rationale for doing so should be recorded.

Reporting Preliminary Audit Findings to Management

During the audit, unit management should analyse potential audit findings to make sure they are accurate and
seem serious. These possible results should be examined at various stages during the review, depending on the
size and breadth of the audit. When an audit is planned over several weeks, the lead auditor may arrange a
meeting with the unit management at the conclusion of each week to go over all the findings that came to light
during that week. If the results are only procedural in nature, management can act immediately to make the
required corrections. In the audit report's final draft, they can then be downplayed or removed. The lead auditor
should examine any additional findings to ensure that they are related to operational effectiveness and that cost
savings are identified and appropriately reported.

8.7 WRAPPING UP THE FIELD ENGAGEMENT INTERNAL AUDIT

To identify and address any notable deviations, the audit's actual performance should be tracked and compared
to time- and cost-based budgets that have been set. Plans should also be used to monitor important project
milestones like the completion of fieldwork or the draft audit report. The formal audit report, complete with its
conclusions and recommendations, is, of course, the most significant internal audit work product. It is sent to the
audit committee and the auditee upon completion of the review. Internal audit management should further
summarise the time spent on each particular audit project in order to give a comprehensive overview of all
scheduled or ongoing audits. Budgets for audit time should be closely watched for increases, and any variances
should be explained with a plan for remedial action.
8.8 PERFORMING AN INDIVIDUAL INTERNAL AUDIT

The reported findings of the in-depth audits carried out in the field or as part of general operations are the most
significant values that the internal audit process offers to the audit committee and management. This internal
audit process includes gathering preliminary evidence, conducting the audit, and presenting preliminary results
to management.