- Does your audit organization have any specific internal procedures in place to deal with ethical dilemmas?
- What can internal audit do to support your organizations cyber and IT risk management program and objectives?
- Do you feel that your risk, compliance, and audit processes need to be improved in order to address critical risk management challenges?
- How does your audit organization begin to take advantage of the new technologies and techniques?
- How would management know if your organization level controls provide a strong control environment?
- How can management and directors be assured that risk and risk process information is being effectively communicated?
- How does your organization know that it has the right arrangement in place at the front end?
- What percentage of time does the IT audit function spend on assurance, compliance and consulting activities?
- Why do the reasons that brought about the change to a new business risk audit approach matter?
- How does outsourcing of various functions change the risk environment and expose your organization to new risks?
- Does a third party audit process audit promote cost savings within your organization?
- What controls should management have in place to mitigate the risks associated with revenue transactions?
- Should an internal audit function coordinate its efforts with your organizations Chief Risk Officer?
- How does your organization track and monitor training requirements for all team members?
- Does the audit trail need to support scheduled system maintenance and archival procedures?
- Does your organization have content that is kept in different clouds, folders and other ways all over the place?
- Does your organization have operational capabilities that are consistent with what it claims to be the scope of its business?
- Do your facilities have a preventative maintenance program and are logs kept for ordered maintenance work or repairs, which are signed off when the work is completed?
- Is your risk management process coordinated and consistent across the entire enterprise?
- Is the frequency of process monitoring carried out as per control plan / work instruction?
- What procedures do you carry out in order to ascertain whether the audit was effective?
- What should the role of internal audit be in evaluating your organizations use of outsourced services?
- Has your organization stabilized the work program to ensure the timely and systematic completion of projects?
- How does your organization want employees, the general public, and key stakeholders to perceive it?
- Is there a documented system for dealing with complaints/feedback from consumers and buyers and organization responses, including corrective actions?
- Do you have a method or plan for ensuring customer requirements are determined and met?
- How do you assess risk and gather audit evidence in a way that is valuable and transformative to traditional approaches?
- What are the problems or complaints you have heard from your back office staff regarding the receipt & processing of customer orders?
- Is there evidence that quality objectives and targets affected by this process are being achieved?
- What IT processes/functions does your organization outsource/use a third party provider for?
- Do you have strong controls in place to ensure contracts receive the right approvals?
- Do you feel comfortable that the senior management and the auditors have an open dialogue?
- What combination of audit types and what audit information is needed to meet an audit objective?
- How important is it for an auditor to meet standards related to post audit activities?
- Do process control and monitoring records indicate that the process were controlled within the specified process parameter?
- Do you have mechanisms in place to validate the effectiveness of transaction monitoring detection scenarios?
- Do all process audits contain procedures that evaluate application configuration settings for the applications that automate the processes?
- Do you have mechanisms in place to monitor compliance with applicable record keeping regulations?
- Is the level of experience required to undertake the agreed audit plan reflected in the cost?
- Who conducts process audits to verify and certify that certain standards or regulatory requirements comply with the processes?
- How does the program consider and implement security requirements throughout the development?
- Which challenges have you experienced in gaining access to data within your organization?
- Do your auditors have the right skills to effectively evaluate digitalization risks and controls?
- Have process improvement opportunities been identified based on process performance data?
- Are there defined work routines and patterns of interaction for your process personnel?
- Should your organization enter, expand, contract or withdraw from any business segments?
- Do you measure and monitor activity by key manufacturers and products your organization needs to focus on?
- Does the supplier provide material with major impacts on product safety or customer satisfaction?
- Is there a product coding system that can identify products and can the system track products back to the source?
- Who in your organization has responsibility and accountability for managing the changes?
- Has it been demonstrated that actions taken have no adverse effects on products or services?
- What mechanisms are in place to complicate attacks your organization is concerned about?
- What standard should be used for process audits and what competencies should an auditor have?
- Are monitoring and verification information reviewed and considered at management level meetings?
- Are layered audit results incorporated into the layered audit countermeasure process?
- Have alternative risk management strategies been identified for all of the identified the top risk areas?
- What is the process to disseminate updates and/or changes to all personnel?
- Has your business impact assessment been conducted for the services moving to the cloud?
- Are procedures documented and implemented to ensure contract terms can and will be met?
- Do you have a designated safety officer that manages periodic safety inspections/audits and corrections?
- Does your organization impose upon employees a continuing affirmative duty to disclose any misconduct?
- Are desired auditing outcomes clearly defined, understood, and aligned with organization objectives?
- Is your organization tracking its performance in assessing and collecting financial assurances?
- What do you see as the appropriate trade off between audit effectiveness and audit efficiency?
- Will the audit seek to assess the suitability and competence of individuals within the leadership team?
- Have there been significant changes in the process recently or since the previous audit?
- Which staffing vendors are providing services to your organization, and do you have an active contract?
- Do reviewers have the enough time, space and expertise to conduct the systematic review?
- Are there analytical methods used to demonstrate that process outputs meet requirements?
- Is receiving inspection performed per documented procedures and detailed work instructions?
- Does the team member know the quality standards of the job, key points & reasons for major steps?
- Is a product safety policy documented and communicated to all levels of your organization?
- Are there instances when change orders are approved after the initial work has been started or completed?
- Who cares if you followed all your procedures if your customers are unhappy or your product is unsafe?
- Is pricing accurate and does order routing and execution meet best execution requirements?
- Are the operating models across your organization aligned in addressing resilience risks?
- Has your organization developed an effective positioning and marketing mix for each target segment?
- Has management implemented monitoring to detect strategic risks before a disaster hits?
- Has your management team provided time, funding and resources to support the innovation program?
- Has improvement of one process caused conflict in the achievement of other objectives?
- Is your organizations work concentrated in areas of high risk, judgment and sensitivity?
- What competencies and process advantages must the client possess to create targeted value?
- Are regulatory inspection procedures documented and are inspection records available for review?
- Does the board receive adequate information about the internal risk assessment process?
- Are customers notified of low yield production lots or issues that affect product reliability?
- What organizational structure do you need to put in place to support your analytics strategy?
- Are there processes in place to ensure internal consistency between the source code components?
- Is there a system in place for the proper handling, segregation, and storage of raw materials?
- Is there an effective preventive maintenance program in place for all significant equipment?
- Is the quality assurance department adequately staffed to perform product evaluations?
- What are the key elements of a holistic maintenance and reliability management system?
- What other teams / processes would be impacted by changes to the current process, and how?
- Is material properly identified in the work area with suspect/non conforming material isolated?
- Do possible external environment changes threaten achievement of your organizations strategy objectives?
- Is the use of nonconforming material is documented under a formal waiver or concession system?
- Is the reporting mechanism adequate to provide management with reliable and timely information?
- Does the supplier understand and follow the quality control instructions for cleanliness?
- Is there clear linkage of technology risks to IT processes/services and business services/processes?
- What functional areas of the business are involved either directly or in a supporting function?
- Should risk measures be formally incorporated into planning performance measurement and compensation?
Bachelor of Commerce - BCom from Nizam College at Hyderabad Public School
3 年????
Senior Documentation Specialist
3 年100 questions. Guess how many will be answered at all or with any useful information? You ask excellent questions, but your approach would be difficult for the client to be successful in answering. 100 yes / no answers? Is that all that you are hoping the client's SMEs will supply? Or are you hoping that the client's SMEs will be moved to have meaningful discussions at some point. Just my two cents opinion.