AUP Advisory Engagements - Formally Advising Senior Management as an Internal Audit Methodology

Internal auditors are often approached for their advice during regular audit activities. This may occur during continuous monitoring or through verbal or written communications. In time of the Global Internal Audit Standards (GIAS) implementation, Sony Financial Group has formally introduced “Advisory Engagements” in addition to traditional Assurance Engagements. These Advisory Engagements are established as a formal methodology and are included in the annual/quarterly audit plan approved by the Board of Directors (Audit Committee).

Our audit methodology specifies that auditors may plan, execute, and report on Advisory Engagements as part of the audit plan. These engagements follow the Agreed-Upon Procedures (AUP) approach, commonly adopted by the external auditors, which ensures auditors’ independence and objectivity while delivering advisory services. GIAS underscores the importance of not only assurance but also advisory activities, as they offer additional value to senior management such as the Board.

This AUP Advisory Engagement begins with a dialogue with senior management. From time to time, senior management may identify and articulate specific concerns, seeking independent perspectives from internal auditors. Traditional Assurance Engagements may not fully address these concerns, depending on the nature of the issue. Advisory Engagements enable internal auditors to have deeper discussions with senior management, understand their specific needs, and agree in advance on tailored procedures. This process facilitates a more focused and in-depth exchange, even extending to specific procedures requested by senior management. Internal auditors then execute the agreed-upon procedures and report the outcomes.

Advisory Engagements push the boundaries of traditional Assurance Engagements by offering greater flexibility and fostering enhanced communication. While traditional audits typically involve the review of risks and controls, including the development of a Risk and Control Matrix (RCM) to evaluate control design and effectiveness, Advisory Engagements are not constrained by the need to utilize the RCM. Instead, they adapt to meet the unique needs of senior management.

Further details will be discussed at the following conference in Tokyo. We welcome your participation:

Business Research Institute (BRI)

6th Future Management Audit Research Session

Date: January 9, 2025 (Thursday), 13:30-

Location: Hamamatsu-cho, Tokyo

Website: https://www.bri.or.jp/keieikansa

(Language: Japanese)

#advisory, #engagement, #internal audit; #advise; #agreed-upon procedures; #GIAS; #continous monitoring;