control, and governance
September 2012 Back to Basics Online Exclusive
Preparation for on-site engagements can ensure auditors use their time wisely and plan accordingly for client interviews.
Saurav B. Prasad, CIA, CFSA, CRMA
With limited time to interview clients and gather additional information during the on-site phase of an audit engagement, advance preparation and development of expectations can help internal auditors boost their efficiency. Before visiting the site, the auditors should critically review available information that can be confirmed while on site. Confirmation of any discrepancies will provide a complete picture of the engagement and lead to a thorough assessment.
To begin, the auditor can review policies and procedures and other criteria documents, as well as compare and review internal and external sources of information. Examining these information sources can help practitioners develop a well-researched set of questions for the interviews. Failure to prepare ahead of time and develop expectations means auditors run the risk of not gathering key information that will support potential findings and conclusions. As a result, auditors may have to re-perform work at a later stage of the engagement, which could jeopardize important milestone dates and associated deliverables.
Various internal and external sources of information are available for review, which can point to issues that warrant deeper review and further analysis. Accordingly, auditors will be able to prioritize the on-site review by focusing first on the higher risk areas.
Prior audit reports and workpapers. These sources can have substantial information that shows weaknesses that were determined to be minor at the time, but which could have compounded since then. They also may include some recommendations that were not implemented due to cost and benefit considerations. However, these recommendations could be more feasible during the current audit engagement, as the benefits may now outweigh the costs. Also, an auditor should expect progress in addressing any recommendations that management planned to implement. Furthermore, auditors during the prior review could have collected a significant volume of documents for their workpapers that can be a useful source of historical information to review and inquire about during the present audit.
Risk reports. Obtained from the client, risk reports can include financial indicators such as key risk metrics used to track emerging risks. These reports may contain information related to operational risk management and include emerging risks related to people, processes, technology, and external events. Additionally, risk reports can highlight areas of internal control weaknesses, and auditors can ask management relevant questions related to these weaknesses. Depending on the nature of the client’s operations, auditors also should expect that other significant risks are being monitored in these reports and are being addressed as appropriate.
Performance reports. Management also may prepare summary reports on its division’s performance, containing key performance metrics. For instance, management may track information on the collection of receivables. A slowing trend in receivables collection can raise a red flag for the auditor to dig deeper and obtain additional documents. If management has not implemented actions to improve the collection of receivables, the auditor should ask why.
Economic information. This external information can be obtained publicly through regulatory agencies and can be compared to the client’s internal performance. For example, if the housing market is not healthy, an auditor can expect that the financial operations of a bank specializing in mortgage lending would be impacted adversely. However, if the bank is growing and performing much better than the market, then this could be a red flag for the auditor to further investigate management’s strategies and obtain additional information to support the positive growth.
Industry journals. Trade and industry publicans also can help internal auditors benchmark their clients. These sources often discuss industry-specific financial performance measures, such as financial ratios related to accounts receivables and inventory and key operational performance measures such as gross and operating margins. Auditors can compare the internal performance metrics that management tracks to external data from these publications. The auditor should expect financial ratios and trends to be in line with industry data. If it is not, the auditor can investigate further and gather additional supporting documentation.
News articles. In some cases, news articles may be available on the client. These articles can contain information on the client’s operations and management, such as deteriorating financial trends and senior management changes that the auditor can expect to observe while on site. Generally speaking, information in news articles also should be corroborated to other sources of information, which can be obtained from the client or researched independently.
By reviewing and comparing internal and external sources of information, auditors can develop initial expectations about the engagement and better plan for interviews.
Any discrepancies can be further questioned, and additional information can be gathered to resolve these discrepancies during the on-site phase of the review, leading to a more thorough review of the client. As a result, auditors can use the limited time available on site effectively to help address the engagement’s objectives.
Saurav B. Prasad is an audit professional in Washington, D.C.
COMMENT ON THIS ARTICLE
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online, or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to edit/remove comments.