The anatomy of an audit part two

Understand the business

When going into the area to be audited it is important to understand the business landscape. Sometimes there are past audit files but, no matter, it is vital to flow-chart the current processes and activities in the area. This we call a process narrative whereby all process and activities, as well as the controls surrounding them are documented. In conjunction with the process narrative, a risk assessment is performed. At this stage it is easy to pick up gaps in controls, where a risk has been identified but there is no control associated with this risk. These should be immediately brought to management attention.

Follow the programme

Once all risks and the business landscape have been documented, the programme of tests to be performed is prepared. This should be focused on risk areas, as well as covering all compliance issues. Where time is a factor and some areas are not covered (or these were previously covered and are not high risk) then a limitation of scope is communicated to management. Up until this stage we have been planning the audit. The planning should not be confused or meshed in with the fieldwork itself. The failure to differentiate between planning and fieldwork is one of the key reasons why audits fail, over-runs occur and confusions result. Planning is a distinct cycle of action, separate from fieldwork. The audit must be structured is such a way that the entire audit team and the auditee is aware of this distinction.

Get to work

Now fieldwork can start. The audit team is delegated specific tests to perform and the fieldwork commences. The work should be performed in sequence as per the audit programme. This prevents stops and blockages in performing the audit. Unfortunately, in reality there is often kick-back from the employees being audited. These must be cleared up without delay. This is why planning is so important to ensure that all documents, reports, information and employees are available during the audit. If the auditee still does not cooperate then the auditor must immediately go to their superior to resolve this. Most delays come from waiting for the client or auditee and these delays must be nipped in the bud (immediately stopped from growing longer). If these delays are not stopped the auditor will start several cycles or tests without completing them. This creates a mass of incomplete cycles and makes the work go much slower.

The supervisor and manager need to monitor and review work on a daily basis and auditors must be given targets and deadlines in which to complete tests. The target includes deadline dates and hours taken on each task.

PLAN, TARGET, DELEGATE, DO, MONITOR AND REVIEW.

So, we come to the end of the first instalment on the anatomy of an audit. We will continue with wrapping up the audit, handling queries, reporting and finalisation in the next article.

Contact us if you need help with any audits of your business

#anatomyofanaudit #auditplanning #auditexecution #internalaudit