A Word on Audit Universe
I just responded to a LinkedIn question about Audit Universe.
Audit universe contain all the auditable areas. Is it defined anywhere in how many years the entire Audit universe should be covered i.e., all the areas should be audited at least once? Is it defined in any IIA standard or any other pronouncement? what is the best practice?
This is what I had to say:
The concept of "audit universe" is outdated.
Instead, internal audit should be focused on providing assurance on the organization's governance, risk management, and related controls. We do that by focusing our engagements on the more significant risks to the business — as a whole, not at a lower level.
We should be working with management to ensure there is a robust risk management program, and that should then be the driver for a risk-based (top-down) audit program.
Building the audit plan based on an audit universe instead of the top risks to the organization is likely to result in auditing risks that are not significant.
See "What is 'Risk-based' Auditing?", "Building the Audit Plan Around Assurance on Governance, Risk Management, and Related Controls", and "What Is Assurance? Does Your Department Provide It?"
Are you ready to leave this universe?
Posted on Jul 8, 2010 by Norman Marks
Share This Article:
Entries
I used to work for a company with $15b in revenue. Initially, we took an 'audit universe' approach. We listed all the auditable entities (>100 locations), corporate processes, and IT systems/centers. They were risk-ranked on a number of counts: revenue, margin, earnings volatility, time since last audit, severity of prior findings, management and staff stability, etc. That gave us a risk-prioritized list.
Each top risk areas was then subject to an audit, where we focused on the more significant risks to the objectives of that entity.
I switched to an approach where I worked with management and the board to identify the top risks to the company as a whole. We then took the top 10-20 risks and identified where in the business were the sources of greater risk. When it came to revenue, we identified the top locations and our related systems. When it came to supply chain, we identified regionalized activities.
We also identified some 'systemic' risks, such as certain aspects of compliance, the adequacy of information to run the business (e.g., on cash flow), IT strategy and network reliability, etc.
The individual engagements in the audit plan were designed to address the top risks to the organization and included audits at the major locations - but they focused on those aspects of corporate risks that were managed at the location; materiality was corporate materiality, not the local one.
We ended up doing about as many audits. However, the assurance we obtained was better and I believe (and they agreed) provided management and board with a higher quality level of service.
Did we end up providing assurance on lower risk areas, perhaps important to an individual entity? No - but, that's just fine. We provided assurance on what mattered.