3.
Compliance Issues
Objectives and
Phases of
Operational Audits
Operational Audit
− Involves a review of the activities performed
in a program or process in the pursuit of its
objectives by individuals.
Key Objectives of
Operational Audit
Without clearly defined, communicated, and
understood objectives, all involved are likely to drift
during the course of the review.
• Asking irrelevant documentation
• Interviewing people unnecessarily
• Examining transactions
• Analyzing process characteristics that are
alien to the priorities embraced by the
sponsors of the engagement.
The objectives for the review could
be driven by:
1. New Rules
o Rules can be established internally
or externally, or a combination.
o A reputation for ethical conduct by
organizations attracts customers,
employees, and investors, and builds
good relationship with government
regulators.
2. Poor Performance
o Inefficiencies, waste, rework, or
complaints from customers and
vendors may trigger management
involvement, resulting in their
request to have the matter reviewed
by internal audit.
o Can be the result of internal quality
control initiative that identify
anomalies.
o Internal audit department may
investigate conditions at their
organization to determine if a similar
problem exists at home
4. Anomalous revenues or expenses
o If sales appear dubious, internal
audit may review the related
transaction to verify they are
legitimate – have been recorded in
the correct amount, and posted
during the correct period.
o Similarly with questionable
expenses, they are likely to result in
the request for a thorough review.
Effective internal auditors examine the
organization’s infrastructure.
Infrastructure (Merriam-Webster)
− The underlying foundation or basic
framework of a system or organization.
− The resources, such as personnel, buildings,
or equipment required for an activity.
As such, the objectives of an operational audit
could include examining the collection of resources
allocated to a program or process for it to
accomplish its objectives.
− May include the entity’s planning, budget,
and technological systems
Infrastructure could also include management
reports because the extent, accuracy, proper
distribution, and amount of detail contained in it
weigh heavily on management’s ability to perform
its duties.
Infrastructure may also include the organizational
structure and the assignment of responsibility and
accountabilities.
May also influence the objectives of an operational
review are concerns over business risks, internal
and external changes and/or external
environment and dynamics. Among these
governance and compliance elements are:
• Concerns over ethics
• EHS (Environmental Health and Safety
Policy)
• Operational consistency in relation to
existing policies and procedures
• CSR (Corporate Social Responsibility)
expectations set by relevant stakeholders
In general:
− The focus is on assessing and reporting on
the efficiency, effectiveness, and economy
of operations, activities, and programs; and
conducting engagements on governance,
risk management, and control.
− Sometimes referred to as performance or
value for money auditing
− Technology may also influence the
definition of objectives.
PHASES OF THE OPERATIONAL
AUDIT
Planning
Includes:
• Scoping
• Budgeting
• Defining the population of interest
• How testing will be performed; and
• Announcing the audit
Poor planning leads to inefficient auditing practices
and results in poor scheduling of meetings with
process owners and other stakeholders.
What are some key steps for effective
planning?
❖ Performance of a risk assessment (starting
point)
o Allows the CAE (Chief Audit
Executive) to prepare an audit plan
based on the results of an analysis of
the organization’s audit universe.
o Audit Universe consists of all
auditable activities such as accounts,
processes, programs, and functions
within an organization, and the risks
associated with their ability to
achieve their objectives.
o Risk assessment is done at the
enterprise level.
▪ Done collaboratively with
senior management and the
BOD.
▪ This should then generate
two key outputs: (1) a
strategic plan impacting
company operations for
management use and (2) an
audit plan
o Audit Plan identifies what the
internal audit function will review
based on available resources and the
needs and priorities of the
organization.
What must go right for them to
succeed?
Organizations must also excel at delivering,
consistently, what the customer needs and wants.
Rather than merely focusing on what can go wrong,
management’s ability to achieve its objectives and
those of their stakeholders will be enhanced when
internal auditors help management determine
what needs to go right and identify critical success
factors, including the appropriate allocation of the
organization’s limited resources.
Risk assessments should not be limited to the The entire suite of procedures and action words
identification of risks, but should also help to used to denote audit program steps can be
identify opportunities, determine the organization’s summarized into one word: “verify”.
preparedness, and identify those responsible for
− Internal auditors’ duty is to verify that
appropriately responding to those events.
management, with the authority received
Risk Factors from the BOD, establish the structure,
policies, procedures, and metrics to achieve
− Plays an important role during planning, and
the vision, mission, and objectives of the
in particular, during risk assessments.
enterprise, and this should be done within
− These are conditions and other variables
the parameters of ethical behavior, legal
that in their present, or absence, as the case
requirements, and stakeholder
may be, either exacerbate or diminish the
expectations.
underlying risk.
Examples of risk factor:

• Extent of judgment that can be exercises

when performing relevant operational and
control activities.
• Number of transactions
• Time since the last audit was performed
• The geographical dispersion of the
operations
• Level of motivation of employees
• The ethical climate
• Complexity of operations
• Asset size
• Volume
• Liquidity; and
• Pressure to produce or achieve
organizational goals