Internal & Performance Auditing

by David R. Hancox, CIA, CGFM

Developing Audit Findings – Week 6 ©

Summary of Issues

• Good communication must exist between the audit team members and the organization being audited.
• Issues must be identified properly in the audit planning stages.
• Audit must be focused to deal with significant issues. – Avoid “nickel & dime issues” – it affects your credibility.
• Audit Risk must be assessed properly – important to meet the audit standards concerning errors, irregularities and illegal acts.
• Audit testing is based on an assessment of audit risk.
• Audit Risk=Inherent Risk + Control Risk + Detection Risk
  • (Qualitative vs. Quantitative Assessment)
• Audit Risk
  • The risk that the auditor will not detect a significant problem in the area under review because of incorrect assessments of the other risks.
• Inherent Risk
  • The risk that naturally exists in the area under review assuming no controls. Cash has a high inherent risk, your textbook may have a low inherent risk – who wants to take it??
• Control Risk
  • The risk that errors, irregularities or illegal acts will not be prevented or detected by the internal control structure within a timely period.
• Detection Risk
  • The risk that a significant problem will go undetected because of errors on the part of the auditor in carrying out the audit program.
• Substantive issues must be pursued in enough detail to assess their impact.
  • (One indicator is the extent of significant cost savings)
• Proper audit emphasis is important to meet the audit standards:
  • Independence
  • Objectivity
  • Due Professional Care
  • Proper Planning
  • Fraud
  • Sufficient, Competent, Relevant Evidence
  • Good Workpapers
  • Concise well written reports
• Attributes of an Audit Finding:
  • Criteria
    • The standards, measures, or expectations used in making an evaluation or verification.
      • what should exist
      • Written requirements (laws, regulations, instructions, manuals, directives, etc.)
      • Overall objectives of agency or organization
      • Auditor’s experience
      • Common Sense, Prudent Business Practice
        • Credit Card Audit
      • Verbal instructions
      • Independent opinion of experts
        • Use medical experts in prisoner medical care
      • Generally accepted standards of the industry
        • Audit of linen in prisons
  • Condition
    • The factual evidence that the auditor found during the audit which shows what actually exists.
      • what does exist
      • What it is
      • What is defective
      • What is deficient
      • What is in error
      • Is it isolated or widespread?
  • Effect
    • The risk or exposure to the organization being audited because the condition is not the same as the criteria.
      • difference between criteria & condition
      • Dollar loss
      • Uneconomical or inefficient use of resources
        • police manning dispatchers desk
      • Loss of potential income
      • Violation of law
        • PSC siting power plants in excess of peak demand
      • Ineffectiveness (job not being done as well as it could be)
      • Funds improperly spent
      • Information, records or reports are not useful, meaningful, or accurate.
      • Inadequate control or loss of control over resources
      • Job not being done properly
      • lowered morale
  • Cause
    • The reason for the difference between the criteria and condition.
      • why the difference exists
      • Lack of qualifications to do job
      • Management not doing its job
      • Lack of training
      • Lack of communication
      • Negligence or carelessness
      • Instructions are faulty
      • Lack of resources
      • Dishonesty
      • Insufficient effort or interest
      • Unwillingness to change
      • Faulty or ineffective organizational arrangement
  • Recommendation
    • The action necessary to bring the condition in line with the criteria.
      • Should be specific and helpful
      • Should pinpoint accountability and responsibility
      • Should not supersede management’s responsibility to manage
• Two elements that are missing most frequently are cause and effect
  • (When these elements are missing – the finding is usually not convincing. Also, without the cause – you can not make a good recommendation)

Homework

1. Print out the State Police Deployment Case Study and bring it to the next class.