SSA 330 – The Auditor’s Responses to Assessed Risks

SSA 330 Summary

The SSA concerns the auditor’s responsibility to design and implement responses to ROMM at the financial statement (FS) level.

There are two types of testing: substantive procedures (test of details and substantive analytical procedures) and test of controls.

In deciding whether to perform further audit procedures, the auditor should look at likelihood of MM and whether the risk assessment takes account of relevant controls.

Auditor should test controls if auditor’s assessment of ROMM at the assertion level includes expectation that controls are operating effectively. They should also look at consistency of the controls and who applied the controls.

Test of controls are performed only on those controls that the auditor determined are suitably designed to prevent, or detect and correct, a material misstatement in an assertion. Inquiry alone is not sufficient to test operating effectiveness of controls and must be combined with inspection/re-performance of control.

Audit evidence obtained during an interim period can be used, but there needs to understand what are significant changes to these controls during the finals. If auditor wishes to rely on audit evidence from previous audits, same issue. Retesting controls must be done at least in every third year.

Controls over significant risks like revenue must be tested yearly. If there are deviation in controls, they may be a need to test additional controls or potential ROMM need to be addressed using substantive procedures (including test of details). There may be a need to perform more test of details if test of controls are unsatisfactory as the auditor cannot rely on such controls.

Substantive procedures need to be designed for every material class of transactions, and consider the need for external confirmation procedures. Substantive procedures should be extended to year end period if they were only performed during interim period.

Material FS assertions must be obtained, or if not, a qualified opinion might be issued.

In order to respond to ROMM, the auditor may provide more supervision, assign more staff, change the nature, extent and timing of audit procedures etc.

If the control environment is strong, more controls can be tested during interims as compared to finals.

For IT processing, it may not be necessary to increase the extent of testing of an automated control, due to inherent consistency of IT processing. However, there is a need to ensure that there are no unauthorised changes to program change controls etc. SSA530 concerns audit sampling.

SSA 300 – Planning an Audit of Financial Statements

Good planning can really help to focus the audit and make it more efficient and effective.

The objective of the auditor is to plan the audit so that it will be performed in an effective manner.

Engagement partner and key members of the engagement shall plan and discuss the planning with the team.

The auditor needs to perform procedures on client relationship and engagement, evaluate compliance with ethical requirements and understand the terms of the engagement.

The audit plan shall include the nature, extent, timing of planned audit procedures and also the resources required to complete the audit. The audit strategy can be modified as the audit progresses. The extent of supervision also needs to be planned.

The audit plan and strategy must be part of audit documentation (can be memorandum form, checklists etc). Significant changes to the audit plan needs to be explained. Planning needs to consider things like analytical procedures, understanding of legal framework, materiality, involvement of experts etc.

SSA 265 – Communicating Deficiencies in Internal Control to those Charged with Governance and Management

SSA 265 Summary

The auditor is required to obtain an understanding of internal control relevant to the audit when identifying and assessing the risks of material misstatement. Auditor can consider internal control when developing audit procedures, but there is no need to express opinion on internal control effectiveness.

The auditor needs to communicate appropriately with those charged with governance (CWG) on any deficiencies (must explain potential effects) in internal control identified during the audit. This must be done in writing. However, it is okay if there is earlier communication orally. The level of detail in the communication depends on auditor’s professional judgment.

Auditor should clarify with appropriate level of management (one that has authority to evaluate deficiencies and take necessary remedial action) if one or more deficiencies in internal control are identified. If the finding calls into question management’s integrity/competence, it may not be appropriate to discuss it directly with management.

This SSA also indicates examples and indications of significant deficiencies in internal control.

If the significant deficiency is not rectified in prior years, the auditor can communicate the same deficiency in the current year.

The communication of other deficiencies (not significant) may be communicated to management orally only. Communication of this to those CWG is also optional and dependent on the auditor’s professional judgment.

 

SSA 240 Auditors’ Responsibilities Relating to Fraud

This SSA concerns auditor’s responsibilities relating to fraud in an audit of FS.

Misstatements can be either due to error or fraud. If it’s fraud, there are 2 kinds, namely, fraudulent financial reporting or misappropriation of assets.

Management and those charged with governance are responsible for the prevention and detection of fraud. There should be a strong culture of honesty and ethical behaviour.

The auditor is responsible for providing reasonable assurance that the FS as a whole is free of material misstatement, whether caused by fraud or error. Frauds are often concealed and hence, the inherent limitations are larger. It is difficult to determine whether misstatements are due to fraud or error. Management fraud is even harder to detect due to management override of controls.

Auditor needs to assess ROMM due to fraud and also to respond to fraud/suspected fraud during the audit. Auditors need to be aware of the fraud risk factors that can be perpetuated by management. They need to maintain professional scepticism throughout the audit.

There needs to be a discussion among engagement team on how the FS can be susceptible to ROMM due to fraud, and how fraud might occur.

The auditor should question the management on what is management’s assessment of fraud risks. They should understand management’s fraud risk assessment, and the escalation process. Auditor should ask whether management has knowledge about any suspected fraud etc. It is also possible to ask the IA team about it. It is also good to understand how those charged with governance maintain oversight of fraud risk management.

Unusual relationships using analytical procedures for revenue accounts should be identified and assessed. The auditor should also examine fraud risk indicators as these are potential ROMM.

There is a presumed risk of fraud in revenue recognition and the auditor needs to investigate further. The auditor should incorporate elements of unpredictability in the testing (use different sampling methods etc, surprise audit etc) and see whether the accounting policies are subject to subjective measurements etc.

There is also a presumed risk of management override of controls. As such, the auditor needs to test appropriateness of the journal entries in the GL and adjustments made. They need to select JE near the end of the reporting period and may test JE/adjustments throughout the audit period. There is a need to review estimates for biases and determine whether they are reasonable.

Analytical procedures should be performed and an assessment must be made on whether it is in line with normal business practices/trends.

If auditor is unable to carry on the engagement, he may withdraw or report to the relevant authorities.

The auditor needs to obtain written representations from management that they acknowledge the responsibility for the design, implementation and maintenance of internal controls to prevent and detect fraud. They also need to disclose potential fraud cases and management’s assessment of the risk of fraud.

If auditor suspects fraud, this must be disclosed to those charged with governance. The auditor can also consider reporting it to the regulatory authorities.

Auditor needs to keep documentation on the understanding of entity’s environment and assessment of ROMM.

The fraud triangle: incentive (eg earning management so that can get more bonus. The auditor should analyse incentives that relate to the entity’s environment); opportunity (poor internal controls); rationalisation (sufficient pressure, poor character etc)

The SSA also goes into detail about how fraud may be perpetuated in relation to financial reporting and misappropriation of assets.

Management is often in the best position to perpetuate fraud.  

There is a need to understand oversight exercised by those charged with governance. Fraud risks cannot be ranked easily.

It is possible to rebut the risk of fraud in revenue recognition if the revenue stream is simple and straightforward.

Management may not implement every control to combat fraud due to the cost-benefit analysis. Therefore, it is important for the auditor to understand which such controls are.

For accounting estimates, auditor needs to perform a retrospective review of management judgments and assumptions related to significant accounting estimates in the prior year. This is also required under SSA540. The auditor needs to look out and question complex transactions.

The SSA describes many other procedures the auditor can perform.

SSA 230 – Audit Documentation

SSA230 Summary (Nov 2015)

This SSA concerns the auditor’s responsibility to prepare audit documentation for an audit of financial statements.

The objective of documentation is to have a sufficient record of the basis of auditor’s report. Documentation serves as evidence that audit was planned in accordance with SSAs, applicable legal and regulatory requirements.

Audit documentation shall be prepared on a timely basis.

The documentation should be sufficient to enable an experienced auditor to understand. It shall include nature, timing and extent of audit procedures (including identifying characteristics of specific items tested, who performed the work and when, who reviewed the work and when), results of audit procedures, audit evidence obtained and significant matters arising during the audit.

Auditor should document discussions of significant matters with management and the nature of matters discussed, and the venue, personnel involved and timing of discussion.

Auditor shall assemble the audit documentation in an audit file and assemble the final audit file after date of audit report. Any modifications subsequently must be explained and by when/whom they were made.

Audit documentation should include things like audit program, analyses, issues memoranda, summaries of significant matters, letters of confirmation and representation, checklists, correspondences concerning significant matters.

Superseded/draft documents or audit reports need not be included in the audit file. It is not necessary to have a checklist for compliance with matters if compliance is already demonstrated by documents within the audit file.

Ultimately, the form/content/extent of audit documentation of significant matters is a matter of professional judgment.

There is no requirement per se to have every specific working paper to have evidence of review, but there needs to be documenting of what audit work was reviewed, who reviewed such work and when it was reviewed.

SSQC1 stipulates that the appropriate time limit to complete assembly of final audit file is not more than 60 days after date of auditor’s report. Companies need to establish P&P for retention of engagement documentation. Retention period is no shorter than 5 years from date of auditor’s report.

audit financial company tax investigation process business accounting

SSA 210 – Agreeing the Terms of Audit Engagement

This SSA is effective after periods ending 15 Dec 2016.

This SSA deals with auditor’s responsibilities in agreeing the terms of the audit engagement with management and those charged with governance.

The objective of the auditor is to accept or continue an audit engagement only when the basis upon which it is to be performed has been agreed:

1. a) Establish whether preconditions for an audit are present; and b) confirm whether there is a common understanding between auditor and management

Preconditions are firstly that the FR framework is acceptable. Next, management understands its responsibility to prepare FS in accordance with the FR framework and to have internal controls to enable the preparation of FS to be free from material misstatement, whether due to fraud or error (via a management representation to the auditor). Agreeing the terms of the audit engagement will help avoid misunderstanding about one another’s responsibilities.

Management should allow the auditor (i) access to information; (ii) any additional information; (iii) unrestricted access to persons for whom the auditor determines necessary to obtain audit evidence.

If the preconditions are not met, auditor shall discuss with management and auditor will consider not to accept the proposed engagement. If not possible due to law/regulations, auditor will need to explain to management the importance of these matters and implications for the auditor’s report.

Auditor needs to draft an engagement letter. Auditor should not agree to changes to the terms when there is no reasonable justification for doing so, for instance from changing from an audit engagement to a review engagement in order to avoid the qualified opinion that will be issued by the auditor. If there are changes, both parties will need to acknowledge them.

Assurance and audit engagements may only be accepted when the practitioner considers that relevant ethical requirements such as independence and professional competence will be satisfied, and when the engagement exhibits certain characteristics.

Some general purpose frameworks are the Financial Reporting Standards (FRS) promulgated by the Accounting Standards Council etc.

Please read the SSA for more details of what sections are required in the engagement letter.

For Singapore incorporated companies, the description of responsibilities for the financial statements is as follows:

Management is responsible for the preparation of FS that give a true and fair view in accordance with the provision of the Companies Act, Chapter 50 and Financial Reporting Standards in Singapore, and for devising and maintaining a system of internal accounting controls sufficient to provide a reasonable assurance that assets are safeguarded against loss from unauthorized use or disposition; and transactions are properly authorized and that they are recorded as necessary to permit the preparation of true and fair financial statements and to maintain accountability of assets.

IIA Magazine Feb 2016 Issue

This is the 75^th year of the anniversary of the IIA.

Capturing the Moment. Experts from around the globe provide a snapshot of the profession, discussing key issues impacting IA. In the past, IA was more focused on hindsight, it is now more about foresight too. Often, some IA staff may want to move to other departments. It is critical to find a clear path ahead for IA. Some of them might just want to stay in the profession forever. There has a clear shift from compliance to risk based audits. It is also good to volunteer for the profession. Combined assurance is also becoming more widely used. Students should try to contact the industries and ask for challenging assignments on IA. IA should set aside a portion of their paycheck every month to attend training etc. Work objectives should be clear and there must be clear communication. IA can also provide assurance on the management of strategy risks. IA can also add value to process effectiveness.

A Career on Point. There are many more women in this profession. IA has matured and many have viewed this function more positively now. To some, IA seems interesting and challenging. It is good as it helps you prepare for a leadership role.

Expanding the Foundation. Required audit competencies have changed considerably over the years, placing more and more emphasis on technology, business acumen and soft skills. IA is now a very respected profession. Effectiveness and efficiency are the hallmarks now. Information has increased over time and data analytics is being used more frequently nowadays. Soft skills and business acumen are very important too. Nowadays, it is good for IA to possess leadership capabilities and strategic thinking capabilities. There is a need for long-term adaptability, continuous learning etc.

Changing with the Profession. The IPPF has a history of adapting to meet stakeholder and member needs. They often listen to the needs of the profession. Now, the framework is more broad and flexible in its approach. The Standards are separated into attribute, performance and implementation types.

Twenty-first Century Milestones. Over the last 15 years, several watershed events helped define the practice of IA. IA is never dull. The first is flagrant financial reporting fraud, with cases like Enron etc. IA cannot ignore controls over financial reporting. The next is financial markets meltdown. The dotcom crash and the subprime crisis wreaked chaos throughout. ERM grew in stature as a result of all these meltdowns. The 3 lines of defence is all the more important in recent times. The next 2 big issues were cybersecurity and bribery and corruption.

The Perception of Value. A comparison of 2 IIA studies suggest internal audit may still have a long way to go in delivering stakeholder insight. Most IA are not meeting stakeholders’ expectations. Sometimes, there might be a lack of general management or operating insights within IA. Sometimes, IA also does not consult departments when developing audit plans.

Where We Are. Today’s IA enjoy greater stature within the organization and are working to meet ever-increasing expectations.

A Steady Progression. Audit professionals are in demand. IA needs to shape management’s expectations of them. IA should market themselves more. Cross-training and gaining exposure from other departments is the key. Auditors must be well-rounded and learn to take personal responsibility.

Conformance to the Standards. The top 10 non-conformance issues are: 1) Internal assessments; 2) reporting on the QAIP; 3) recognition of the definition of IA, code of ethics, standards in the IA charter; 4) external assessments; 5) QAIP; 6) requirements of the QAIP; 7) Engagement work program; 8) purpose, authority and responsibility; 9) co-ordination; 10) communication and approval

The ‘Anti-Fraud Moment’. Fighting fraud demands more than just awareness. There needs to be meaningful training when it comes to learning of skills. There is little training on red flag indicators. Create simple articles to share with employees. Record 5 minute training videos. Take advantage of live formal and informal skills training opportunities.

How Much Do Risks Really Change? The risk landscape shifts radically from 1 year to the next. It can changed a lot in 75 years. Global events can rock the market and commodity prices etc. Tech breakthroughs happen fast and world events disrupt things. Regulations change as well.

Internal Audit Fundamentals. The most basic skills remain largely unchanged. Critical thinking and communication are the key. Co-sourcing is an option when IA lacks certain technical skill sets.

Around the Globe. IA around the world are providing value to their organizations in a wide variety of ways and at different levels of complexity and sophistication. The role of IA may not be well-understood. Value demonstration is the key. Different auditors will be at different levels of proficiency and maturity.

Industry Roundup. The challenges IA face today are many and vary by sector. Public sector audit has moved beyond compliance or financial audits into performance auditing. There is also emphasis on effectiveness. There are sophisticated products in banking and safeguarding information is one of the key objectives. Money laundering is also a key area to watch. As for health care, there are issues like quality of service, compliance, data security are all big challenges.

A Different Perspective. IA’s business partners offer their views of the profession. Audit can identify opportunities for improvement throughout the organization. It is important to have a sharing environment. Technical skills matter a lot nowadays. IA should look at areas that management struggle with. IA should not hide or mask problems from management. Being able to understand IT etc would make IA more valuable.

Educating Auditors. Determining what IA students need to know now is a constant challenge. Being skilled in IA is a unique skill that is useful. It is possible to simulate real-world IA case studies for students. IA needs to be intellectually curious to learn more. One cannot speed up experience as time is required.

IA Future. IA allows one to understand the business. Do not miss the change to meet senior leaders.

‘I realized the role of IA aligned with many of my interests. I wanted to add value and bring a positive impact to a business while understanding how it operates, and IA presents opportunities not found in other roles within the company.’

IT Audit Trends and Foresight. Technology will continue to bring new risks for organizations. IA need to address the IOTs. We need to understand the inventory of devices and the type of data that is collected. One needs to understand the value of digital strategy.

The Changing Business World. Auditors can anticipate future developments by looking beyond their organization’s current business situation. Africa is going to grow fast in future. Businesses need to create space to think. IA needs to be able to anticipate new risks. IA can follow current affairs. Talk to customers to see how their needs are changing. IA is really looking to delight people.

Five Trends. Top global IA thinkers take a broad look at key issues that will shape the profession. The world is changing fast and risk are interdisciplinary. New risks must be understood and evaluated. IA can learn new ways of analysing and also develop strategic foresight. The compliance scope is continually expanding and making things more difficult. IA needs to link compliance activities to upstream processes and control improvements. It will be a challenge for lower the cost of compliance. Stakeholders are more demanding nowadays. IA must have knowledge of the various industries and any new business lines. Technology risk is getting more complicated. Data is becoming more prevalent and data analytics is getting more useful than ever before.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

IIA Magazine Apr 2016 issue

Soft skills seem to be lacking in some of the IA teams. There is the art of interviewing that must be executed properly. IA can set aside time to work with other parts of the business. Audit reports are not the only communication channel.

Time to Shift the Mindset. Pulse report urges IA to focus on culture and cybersecurity response. Board members should discuss with management to ensure that there is a common understanding. There is a risk of poor vendors and that firms could suffer from reputational damage. There needs to be strong third party risk practices.

Fraud Prevention. An effective control environment can deter or minimize the occurrence of fraudulent activities. Internal controls may not always be designed to prevent fraud. There must be a strong control environment for fraud prevention. Background checks and fraud related training can be useful indeed. Whistle-blowing hotlines can be set up. A certain level of anonymity must be ensured. No one person should complete control over a whole particular process, from start to end. Monitoring activities should take place on a frequent basis.

The Call no CAE wants to receive. A strong working relationship between IA and the CIO is essential to responding quickly to a cyber incident. This is important as cyber attacks can lead to reputational damage. One can verify the controls at the vendor and get them to fill up a data security risk assessment questionnaire. IA can be the trusted advisor that an organization needs.

Collaborative Risk Management. As organizations consolidate their risk processes, IA may not be able to continue to stand alone. Risk collaboration and organizing risks are more important nowadays. There is a need to be efficient about going about this. Risk needs to be organized neatly. ERM is one way to link everything together. Auditors should be open to other ideas on organizing and mitigating risk.

The Ticking Ethical Time Bomb. The financial loss from theft was secondary to the effect on company culture. Sometimes, the most obvious issue is no the more important one. Small frauds can lead to large ones. Reinforcing identity is also very smart sometimes, as it can help with ethical reinforcement. Increasing controls should not be done as a knee-jerk reaction sort of thing.

A Matter of Trust. Attention to detail and focused effort can help IA build the relationships required to be perceived as valued advisers. IA should be given time to innovate, gain an understanding of evolving challenges and talk to people in the business regularly about the issues they face. You help to build trust if you know what the regulators or other people are doing. Sometimes, top management might even tell CAE the problems that are upcoming. Relationship building and being part of the management team is crucial. However, there is still a need to be independent even if IA is like a trusted advisor. Try to leverage on technology.

‘IA can often be forgotten if it is not part of the core team, because it is less visible than those functions that meet and talk regularly.’

‘Auditors are there to make organizations better – it is a key part of the way they can add value. Not commenting when they see a better way to do something could show a certain lack of moral courage.’

Proactive Fraud Analysis. Integrating advanced forensic data analytics capabilities can help auditors mitigate fraud risks and demonstrate returns. IA can invest in such tools as it can help in the monitoring of risk. IA should ask ‘What are the high risk accounts?’; ‘When?’; ‘Where?’ etc. IA should focus on the low-hanging fruit first. The first project undertaken should be easy. Learn to go beyond the descriptive analytics. Learn to embrace both structured and unstructured data. Communication is the key. It would be good to automate the tests and involve the end-users. Also, learn to set a realistic timetable. Keep analytics simple and intuitive – don’t include too much information in one report so it isn’t easy to understand.

Getting More from Interviews. Instead of emphasizing formalities, IA should approach each interview like a conversation. You can gain insight into the way operations work and identify gaps etc. Plan your questions beforehand and be prepared. However, the less formal it is, the more information you can find out from the interview. Try to make it a conversation. Learning about the auditees’ life can help to build rapport and build the bond. Talk to others within the auditees’ same department. The interview’s purpose should be specific, attainable and outcome oriented. Preparing for the interview helps a lot. The location matters as well. Try to open in a way that makes the auditee at ease. Try to explain the purpose and the outcome of the interview. Learn to practise effective listening. One can ask thought provoking questions that will help to elicit information. Learn to practise active listening and show positive body language such as being attentive. You can prepare questions but there is no need to follow to a list strictly. It can be difficult to build rapport. Do not try to tell the interviewee that the interview must be done to complete the audit. Have lunch with auditees once in a while. People love to hear about themselves.

‘Auditors should be curious about the way processes work, the way the organization works, and perhaps most importantly, the people who make it work. Curiosity will lead to a better understanding of the organization, better ideas for improving the organization, and a better rapport with the individuals within the organization.’

On the Hunt for Payroll Fraud. Taking a close look at payroll risks can enable IA to help their organizations save money and identify wrongdoing. Payroll fraud is more common if there is irregular workforce patterns. Payroll is usually shrouded in secrecy. Overpayment is more common than underpayment. IA can also examine to seek actual cost savings/ productivity gains. IA can adopt a helicopter overview of payroll data and the payroll process. One can compare payroll costs with other organizations. Rosters should be designed to optimize the allocation of employees to operational needs. Management welcomes findings that reveal specific wrongdoing because they provide hard-to-dispute evidence. IA can look out for certain insights and then drill further. There are many common findings. The audit fieldwork needs to be well-researched and planned.

Guardians of Integrity. IA can provide insight into corporate identity and people-related risks. For instance, IA can evaluate the ethics and organizational integrity. IA must communicate with the board and management and be the corporate conscience. Testing the effectiveness of the ethics programs can be tough. It is important to understand how an organization defines success. It is important to uphold the code of ethics: integrity; objectivity; confidentiality; competence. IA should examine incident reports too. IA must be as wise as the board, as savvy as management, and as shrews as attorneys. Stakeholder surveys could be used to understand the management and employee ethics. IIA needs to exercise fair and ethical decision making.

audit financial company tax investigation process business accounting

IIA Magazine Aug 2017 issue

The Technology Issue

 A technology revolution. Tech is moving at a fast pace and some businesses may not be able to reap the benefits. IA needs to understand the evolving risk landscape related to the business. Tech will continue to disrupt the landscape and IA needs to reassess what data means to them going forward. Auditors help organizations avoid getting into trouble by identifying issues early and avoid them being surfaced by regulators or the media.

The Cyber Readiness Gap. Organizations may not be prepared for the attacks they are expecting. Ransomware is a big issue and thinks will get worse. Only half the organizations surveyed have a plan to address ransomware attacks. IA can help to scrutinize cybersecurity practices and plans. IT security governance needs to include the human factor in corporate risk analysis and assessment. IA can move from a supportive to front-seat role when building crisis-resilient culture.

More than Compliance with ‘A’. Transforming a compliance program into a value-adding activity starts with IA. Compliance with AML regulations are important. However, many managers do not see value in compliance work. IA needs to ensure compliance can provide real assurance. It is important to do the right thing and do things correctly. Ask yourself why there is a compliance requirement in the first place. IA needs to work with the first and second line of defence to ensure all risks are being addressed. IA should also question the need for, existence of, and adequacy of compliance with A. Sometimes, the original risks may not be present and hence the compliance requirement should not be relevant. One needs to examine the adequacy and effectiveness of the mitigating control. The audit needs to maximize the use of resources and analytics. One can use trend analysis to understand whether risk is increasing or decreasing. Effectiveness of controls can be tested with analytics.

‘But it should not be compliance simply for compliance sake. Internal audit should consider the overarching business objective and the controls that help mitigate risk to the achievement of the objective – even when examining compliance-related controls.’

Stop Clicking, Start Coding. SQL queries can enable internal auditors to uncover greater insights from organizational data. Data needs to be analysed etc. Some auditors are required to learn SQL. It is a language for managing data held in databases. To be good, logical thinking and reasoning are important and necessary for coding. SQL can be tailored for auditing needs and for ad-hoc queries. SQL and other audit software can form a powerful set of analytical tools.

Internal Audit needs risk management too. Managing its own risks can improve the audit function’s performance and demonstrate that it practices what it preaches. One key risk of IA is whether the department is strategically positioned within the organization its objectives. Other risks are whether the department has enough staff, on assurance etc. Reputation risks are important too, and so is compliance risks. Operational risks are like the resourcing problems, annual audit plan etc. If audits are behind schedule by about a month, it needs to be highlighted as a red flag. IA can also do a risk control self-assessment to evaluate internal controls in place.

The Cashier Cash Thief. Mounting family pressures and opportunity cause a trusted warranty clerk to pocket payments from customers. IA must emphasize the importance of SOD and monitor any exceptions. Trend analysis would allow organization to detect fraud more timely. Routine audits are vital for all cash processes. Mandatory vacations and rotation of duties should have prevented fraud from happening.

In Safe Hands. Organizations must grapple with a host of issues when determining how to best protect their data and manage the way it’s used. In Europe, there is a General Data Protection Regulation that goes into effect in spring 2018. It is a stricter regulation than ever before. Firms need to obtain consent for data collected from individuals. IA needs to go back to the drawing board to strike a balance. Respecting someone’s privacy rights is actually a soft skill and needs a soft approach. Privacy controls need to be engineered into business processes. Businesses must be clear about what they need the data for. Many companies do not know where their data comes from and how it is used. IA can be a role model in innovation etc.

Great tech expectations. As technology becomes more integrated with business processes, auditors must raise their IT skills. New auditors usually have better skills than older ones. People with expertise in IT will be in demand. Those with experience in DA will have an advantage over those who don’t. Experience with audit-specific software is also a plus. Auditors need to have an understanding of the infrastructure and applications being used. New authors are not usually well versed in soft skills. IA needs to have a good understanding of flow, controls and governance. Determine the specialty skills needed. Maintaining the right mix of generalists and specialists is a key IT challenge. IA needs to have a training plan for the IT risk and controls. Training hours need to be tracked and there needs to be information sharing at every meeting.

Building a data analytics program. Six strategies can facilitate progress when starting or furthering an analytics program. Many functions suffer from pitfalls/ setbacks. The six strategies are (1) create awareness rather than a silo; (2) understand the data before investing in a tool; (3) plan sufficiently; (4) think big picture; (5) Partner with IT; (6) Take advantage of visualization tools for inspired reporting.

#PurposeServiceImpact. The IIA’s 2017-2018 Global Chairman of the Board J Michael Peppers encourages IA to unify around the three concepts in his powerful hashtag. Purpose, Service and Impact are important words for our profession. It is about the why we do things. We should help enhance shareholder value through our work. Service is basically walking the talk. It is important to establish credibility with clients. We are both change agents and educators and need to do the right thing. Volunteering is important and internal auditors should strive to give back to the society. Always try to make a positive difference. We need to understand the purpose of the organization.

‘The best and most successful internal auditors I know understand that internal auditing is more than just a job: it is a sincere effort to improve the lot of others, whether organizations or individuals.’

The Root of the Matter. Performing root-cause analysis requires that auditors recognize common myths associated with the process. Addressing root cause will prevent the issue from recurring. Complex problems may be due a variety of factors. There may not be a single root cause at times. Use the 5 Why techniques. Sometimes, two root causes can lead to one problem. Some brainstorming is required to address all the root causes. One can use the fishbone diagram and identify problems in different categories like: Man, Machine, Measurements, Method, Materials, and Mother Nature. One can also use scatter diagrams to pair cause and effect and look for relationships. Good recommendations in the audit report should address the root causes of a problem. However, IA should understand that RCA requires time and resources and the organization must weigh the pros and cons of doing it.

Seven Steps to Transformation. IA can assist management throughout the many stages of business change. The first is pre-implementation review. It helps management to identify problems at the planning stage. Ask yourself what is the best ERP project model for ERP packages? The other steps are process/controls analysis, In-flight reviews, IT and User Acceptance Testing and Output/Results testing. The last 2 steps are post-implementation reviews and comparison to project management reviews.

It’s only one word. Excessive audit report wordsmithing is often a disservice to the client – and the audit function. Let those who did the work have a say in the changes. Never make a change unless you can explain why that change is necessary. Otherwise, you are just changing for personal preference. Always explain the reasons for any change to the person who wrote the original drafts. Do not be too anal about phrasing as this will result in rewriting and delays and frustrations.

‘Far too often, the lead, manager, chief audit executive doesn’t like what is written and starts editing the audit report. The process often results in a report the auditor no longer recognizes and, in the worst situations, it says something the auditor never intended it to say.’

The Data Analytics Strategy. Adding analytics to the audit methodology requires careful change management. Funding and resources needs to be provided. Integrate data analytics requirements into the audit methodology. Look for quick wins if possible. Use a champion to lead the strategy. CAE must emphasize that analytics is good as it improves audit efficiency. Analytics can add value not just to fieldwork, but also risk assessment and planning. Data is also evidence and that’s what sells well.

From ratings to Recommendations. Behavioural psychology suggests internal auditors’ approach could benefit from more carrot and less stick. Audit gradings are hated by auditees as it sends a signal that they did something wrong and that things are really bad. The SDT (self-determination theory) shows that human motivation is optimized when the following 3 are present: developing one’s skills (competency); exercising free will (autonomy); feeling connected with others (relatedness). Give your auditee the chance by sharing about common goals and building good relationships with them.

IIA Magazine June 2017 Issue

Courage under Fire. Public sector auditors need to have the courage to raise issues despite the political agenda in the public sector. Audits provide a cornerstone of good public sector governance. Targeted relationship building is very important. Courage is a pre-requisite of being an internal auditor.

Terrorism and Geopolitical risks. Violence and political uncertainty threaten business interests internationally. Overall, terrorism and political violence have been at high levels. Businesses need to have strategies to deal with the geopolitical climate.

SWIFT has improved their security standards via a customer security control framework, where banks must comply annually. SWIFT will report banks which don’t comply with the new standards.

Corruption usually happen because of a poor tone from the top. The younger generation seems to be more lax when it comes to ethics and to managing others. There needs to be strong leadership from the top to tackle bribery and corruption. The board has oversight of the company’s culture but management has the best position to shape culture. Firms can get insights from departments like HR, finance on the company’s culture. Companies that allow employees to store personal information in emails etc is asking for trouble.

Key stakeholder surveys. Internal auditors should look to get feedback from their most important customers. A QAIP is a requirement but surveys are rarely given to the AC and executive management. Audit should have the habit of surveying at the end of each assurance or advisory activity. The respondent should be able to make comments as well. If the scores are not satisfactory, the CAE should recommend some course of action. Survey results should be shared with AC etc. These results can enter the QAIP as well.

‘It is common for audits with satisfactory ratings to receive high opinion scores while audits with unsatisfactory ratings receive low survey scores despite efforts to adhere to department policies and the Standards.’

Application Control Testing. Control reviews can help ensure critical software applications function effectively and securely. To audit effectively, it is necessary to audit application controls too. This covers every feature and function of the application. Next, one needs to identify the key application processes and the application controls. If necessary, an integrated audit should be performed. One can use the GTAG 8 to help. Auditors can validate input and output controls. Are the processing controls accurate? Are there critical errors in computations? There is a need to examine interface controls as well. IA needs to examine: output controls, storage controls, monitoring controls, configuration management, change controls and patch management.

The Risk in the Control Environment. Auditors need to think beyond check boxes to provide assurance that control processes are addressing risks. The control environment is difficult to measure. IA should not cover up control weaknesses to management. Policies change over time and become less applicable, hence the control environment shifts. SOD is useful, but in cases where the firm is too small, alternative measures need to be made. When there are personnel change, there might be an urgent need to re-train.

‘IA needs to ensure they have authority to analyse and communicate the situation beyond just the existence of policies. Ensure management understands the difference between a control gap and a control failure. It is important to know whether the gap has created a failure, but just because it hasn’t failed to date should not minimize the impact of the gap.’

The ‘Free Trail’ Scam. Data analytics uncovers a sales force fraud using pre-paid credit cards to boost commissions. Be wary of pre-paid credit card usage among commissioned sales forces. There is a need to check credit card transactions against a BIN database. Understand how many customer accounts are associated with a single credit card number. Companies should request for customer credit scoring and upfront payment to prevent customer defaulting on payments.

Under Siege. Public sector auditors can face intimidation, isolation, retaliation, suspension – even termination – just for doing their job. For instance, if the audit conflict with an agency’s head’s political agenda, the agenda usually wins. CAEs might have to sue the government in the end. Targeted relationship building is important. Retaliation might reduce in a reduction of CAE’s duties. Sometimes, they are told to cease investigations. Sometimes, the CEO will tell you want to audit but you are not allowed to listen to the Board. Sometimes, the CAE has to supress facts in a report. The CAE needs to drive an open and ethical environment with the AC to prevent such things from happening. If you want to be the CAE, you need to establish clear reporting lines and ensure you have access to the Board right from the start. If you are not comfortable, walk away. Auditors should build relationships with those they work with. Start by winning over staff and explain your audit charter to them. Keep open lines of communication. Document and verify any disagreements and understand the root cause. Learn to create a paper trail for your findings. Sometimes, resigning is the only option. It is still better to do the right thing.

‘It’s very difficult to make a change if the organization is dysfunctional. Sometimes you can make renovations to a house that will improve the functionality, but sometimes you just have to declare the house condemned and start over.’

How to Audit Culture. Culture audits can help practitioners gain insight into the causes of poor organizational behaviour. Not enough firms are auditing culture. It can be challenging because it is subjective and complex. Culture is shaped by values that influence everyday behaviour within the organization. Management’s create sub-cultures among their teams. Different departments have different cultures and risk tolerances etc. There is no defined criteria for each aspect of the business too. One can start with a model to audit culture. Employees are the best source of information about the culture. Culture is largely perception based. The problem is that employees might be fully honest, they work in silos, they may like to complain etc. The Board and management need to believe that the IA team has what to takes to audit culture. Some of the questions to ask are ‘Do our HR and talent practices reinforce the desired behaviors throughout the organization?’; ‘Does your business manage risk appropriately and in line with our risk appetite?’; ‘What do our leaders communicate to us about risk, ethics, and how we should be doing our work?’; ‘Does the company’s environment promote accountability for desired risk behaviors?’ The audit report must be worded in not a sensitive manner. IA needs to obtain evidence via appropriate engagement techniques. Sometimes, soft evidence can work as well. Structured interviews can be conducted for auditees. It is good to gather evidence from many employees. It is possible to add questions on ethics and culture to the annual employee survey. IA could present a monthly dashboard etc on data like customer survey results, customer complaints, turnover statistics etc.

A smarter approach to third-party risks. Adopting a focused collaborative strategy can help improve management of outsourced service providers. Third-party risks are very real, especially functions which have been outsourced. Banks are to held responsible for their third-parties’ performance. Data breaches in recent times have made this even more important. It is important to manage the risk from third-party vendors. It is good to map a list of third-parties you work with and the risks to be assessed and monitored. It may be useful to develop key risk and KPIs for areas where risk is increasing. It could be useful to send questionnaires to the third party to understand their risk exposure and risk appetite. Some companies are looking at group intelligence as a means of sharing due diligence data. Some firms have already set up risk consortiums. Managing outsourcing risks is vital to protecting shareholder value.

The Innovative Internal Auditor. As businesses strive to find opportunities in a world driven by technological transformation, internal auditors need to continually innovate to stay ahead of the game. IA cannot be static if they want to survive in the environment. Change is part of modern life and IA needs to adapt to changing needs. There is a need for IA to be more forward looking. Because of this, IA needs to innovate in the areas like audit automation, data analytics etc. One needs to adopt a continuous improvement mindset. It takes courage to innovate, but the team will reap the rewards. Get someone on your team to be in charge of innovation. Robots might be able to perform routine control testing. We need to embrace technology to its fullest capacity.

The Dynamics of Interpersonal Behavior. To be successful, auditors need to cultivate their soft skills just as much as their technical abilities. Soft skills like listening, understanding, questioning etc are just as important as hard skills. Sometimes, audit reports are not in sync with what stakeholders want. IA people need to form effective interpersonal relationships. People-centric skills are not easy to master. Auditors need to build trust over a few days. IA needs to keep to promises on deadlines, listen to feedback and deliver their goals. Auditees might feel there is a big difference between themselves and auditors and tend to look down on auditors. IA must approach from the angle that you are trying to help. Having a good mentor will help. Ultimately, IA needs to meet stakeholders’ demands.

Opportunity from Disruption. IA should try to understand emerging risks. Be forward thinking, via a strategic planning process and have more internal audit’s risk assessment process. It is also important to create flexibility in the audit plan. Be inclusive and communicate with the other lines of defence. Be business minded and hire from a wide variety of sources and ensure they have different types of training. Be flexible by design. Evaluate the nature and timeliness of IA’s procedures. Be talent ready.

It is important for IA to issue audit reports and follow-up on corrective actions taken soon after. Although IA reports to the AC, it still has to administratively report to the CEO. Having no time is not an excuse.

audit financial company tax investigation process business accounting