Corporate Internal Audit Services
Internal Audit Phases
The planning stage answers these four basic questions:
- What will be looked at during the audit (the scope)?
- What questions will be answered (the objectives)?
- How will the objectives be answered (the criteria)?
- How the examination will be conducted (the approach)?
The scope of an audit is the activities, systems, business processes, financial affairs, documents, people and locations that will be looked at during the course of the internal audit. For example, the scope may be defined as ‘government offices providing direct services to Albertans’.
The objectives identify what is to be accomplished by looking at the scope items. Using the example above, an internal audit may look at the government office providing direct services to Albertans (the scope) to determine whether the office is accessible to the Albertans that it serves (the objective).
It is the job of the internal auditor to conclude on the objectives.
Criteria are the measures that an internal auditor will consider in concluding on performance relative to an audit objective. For example, concluding on the objective noted in the previous example, criteria may include:
- The office is located within 20 minutes travel time for 80% of the clients who use the office;
- The majority of clients served by the office feel it is conveniently located;
- Office hours of operation are appropriate to meet the needs of its clients; or
- The office is accessible to physically disabled people.
By responding to all the criteria underlying an objective, an internal auditor is able to reach an objective, factual and fair conclusion to the question posed by the audit objective.
As part of the planning process, Corporate Internal Audit Services develops a terms of reference, which is an agreement setting out the overall purpose, scope and objectives for the audit to be undertaken. The terms of reference is signed by Corporate Internal Audit Services and the appropriate person within the organization being audited.
To ensure the success of the internal audit, it is important that management at the organization being audited participates in the planning process. In particular it is key that the organization provide input into the development of the audit terms of reference.
The audit approach includes determining how the examination will be conducted. This includes identifying the type and nature of evidence to be collected. It also entails determining the techniques used and resources required to collect evidence. Timelines for the examination must also be developed in the planning phase, in consultation with the audit client.
During the fieldwork phase, auditors gather sufficient, relevant and reliable evidence of actual performance and compare this against expected performance. The intent of internal auditing is to identify gaps between actual and expected performance. While all differences are noted, only significant ones are identified in the reporting phase.
For example if the expected performance is that sensitive documents are kept in a locked safe and the actual performance, based upon fieldwork, shows that sensitive documents are kept in an unlocked desk drawer, the auditor would note this difference. In determining the significance of the difference between actual and expected performance, the internal auditor will consider a number of factors. In drawing a conclusion, the internal auditor will rely upon their independence from the process being audited, their objectivity as a person disinterested in the outcome of the audit and on their professional judgment gained through training and experience.
Internal auditors may conduct interviews, surveys, run focus groups, review documentation, analyze reports, prepare calculations, consult experts and employ any number of other techniques that help them to obtain sufficient, relevant and reliable information.
The conclusions reached by Corporate Internal Audit Services are their professional opinions, based on the evidence collected and the analysis performed, as to how closely actual performance compares to expected performance.
Internal audit recommendations are intended to assist management in moving actual performance closer to expected performance.
Although the product of any internal audit is the report, the reporting process starts at the beginning of the internal audit and continues throughout the course of the audit.
The contents and structure of the report are considered during the planning phase and modified as necessary during fieldwork. Like the planning and fieldwork phases, the internal audit report continues to evolve and change over the course of the audit as new information and new perspectives are revealed.
Progress reports are provided to management throughout the internal audit. By working closely with the management and staff of the organization being audited, Corporate Internal Audit Services can ensure that the report contains no surprises. All significant issues and the related recommendations will have been fully discussed with the organization prior to the issuance of the draft report.
A first draft of the report is issued to management in order to achieve agreement on the accuracy of the information contained in the report, the suitability of the recommendations and the validity of the conclusions.
A second draft is issued as appropriate, at which time an action plan is developed by management that addresses the audit issues. The recommendations contained in an audit report suggest what needs to be done. How the recommendation is implemented is the responsibility of management.
A final report is issued that includes the action plan.
With the release of the final internal audit report, there is an expectation that management will follow up and report on the actions set out in the action plan. To encourage that outcome, Corporate Internal Audit Services follows up on the status of significant issues and trends and may decide to conduct a follow-up audit, usually within two years of the issuance of the final report. During a follow-up audit, internal auditors assess the extent to which the management action plans have been implemented.