Operational Auditing

1. Operational Auditing Spring 2012 Professor Bill O’Brien Operational Auditing--Spring 2012

2. Workpaper Usage • Planning and execution • Supervision and review • Objective tracking • Conclusion support • Supports quality assurance • Professional development • IIA standards’ compliance Operational Auditing--Spring 2012

3. Workpaper Guidelines • Cross-referencing system • Consistent layouts • Standardized symbols or “tick marks” • Standardization for permanent files • Unique indexing • Description of purpose • Initialed by preparer and reviewer • Source of information indicated • Clear explanations of symbols • Legibly written and easy to understand • Must stand alone • Must relate to the engagement objectives Operational Auditing--Spring 2012

4. Sample Work Paper Ref. Heading Purpose: Conclusions T/M Legend: Review Source Operational Auditing--Spring 2012

5. Generalized Audit Software (GAS) • Two most popular applications • ACL (ACL) • IDEA (CaseWare) • Typical uses • File examination • Recalculations • Sample selection • File comparison • Reformatting • Pivot tables • Benford’s Law analysis • Reporting • Data analysis log Operational Auditing--Spring 2012

6. GAS, continued • Benefits • Minimizes customization • Independent of company IT • Efficient • Facilitates 100% testing • Frees BPP for analytical work • Obstacles • Data access • Physical access • Format knowledge • Downloading issues to BPP’s computer • Importing data in usable format Operational Auditing--Spring 2012

7. Control Self Assessment (CSA) • Methodology • Review and Identification • Key business objectives • Related risks • Mitigating controls Operational Auditing--Spring 2012

8. CSA-History • Introduced by Gulf Canada in 1987 • Gulf used facilitated meetings Operational Auditing--Spring 2012

9. Facilitated Meetings • Management and staff participate through interviews and polling • Objectives • Risks • Processes • Soft and/or informal controls Operational Auditing--Spring 2012

10. General Methodology • Shared process • Assessment of internal controls • Evaluation of risks • Development of action plans • Assess the likelihood of achieving objectives • SJSU simulation Operational Auditing--Spring 2012

11. General Approaches • Facilitated meetings--group workshops • Questionnaires--yes/no answers • Management analysis--self studies Operational Auditing--Spring 2012

12. Uses • Self analysis for risk* • Selection of audit areas* • Internal control review* • Special projects • Soft control analysis * alternatives to the traditional approach to the I/A process Operational Auditing--Spring 2012

13. Benefits • Increases I/A scope • Target review of high risk areas • Increases the effectiveness of corrective action • Builds team-oriented relationships Operational Auditing--Spring 2012

14. Engagement Process • Planning: • Selecting the BPO • Pre-site planning • Performing: • Conducting the preliminary survey • Review internal controls • Expanding tests as necessary • Generating findings • Communicating: • Reporting the results • Conducting follow-up • Assessing the process Operational Auditing--Spring 2012

15. Audit Evidence • Healthy skepticism • Attributes • Relevant: consistent with objectives • Reliable: credible • Sufficient: convincing Operational Auditing--Spring 2012

16. Business Processes • Basic entity for I/A services • Understanding business processes is key Operational Auditing--Spring 2012

17. Process Documentation • Flow charts • Storyboarding • Identifying business risks • What gets in the way of objective achievement Operational Auditing--Spring 2012

18. Flowcharting Begin or End File Activity Decide Document Operational Auditing--Spring 2012

19. What Is Storyboard Flowcharting? • New method for documenting a process. • Clean and simple flowcharting method. • Allows for clients and auditors to clearly understand process under review. • Simple technique that requires a good graphics package and a little imagination. • Can use Microsoft PowerPoint, Harvard Graphics, Corel Draw, etc. • Does not replace IS flowcharting. Operational Auditing--Spring 2012

20. The Basics of Storyboard • Meet with client and document process. • Use your imagination to choose/draw picture. • Under picture write narrative for each step represented. • Be creative - good control narrative in green; poor controls in red. • Completed storyboard must be reviewed with client. • Make any changes necessary. • Final copy should be in color for most effective presentation. • Different process may require different approach. Operational Auditing--Spring 2012

21. A • Print out story board - • black and white draft and • color for final. • Review storyboard • with client and obtain • sign off. How to Storyboard A • Meet with client and document process. • From client interview • create storyboard. Operational Auditing--Spring 2012

22. Start Company XYZ Order-fulfillment process Customer Service Rep Receives Order Customer Service Rep Researches And Corrects Information NO Approved By Manager? By Phone? Customer Service Rep. Key Enters Data on-Line Print Three-Part Shipper YES YES NO Yellow and Green To Shipping Department On Standard Order Form? By Mail or Fax? Pink to Accounts Receivable Department Scan Form Into System YES YES NO Shipping Pulls And Packs Orders Send to Special Order Department ShippingFiles Yellow Shipping Sends Order and Green Copy (Invoice) End Operational Auditing--Spring 2012

23. Company XYZ Order-fulfillment process A Receives orders by fax or mail. Standard orders are scanned into system. Customer Representative A three-part packing slip is printed per order. Receives orders by phone. Customer Representative enters order data on-line. Pink copy sent to accounts receivable department. A Green copy sent with order. Packing slip approved by Manager. If not approved, returned to Customer Representative for correction Packing slip Yellow and green copy go to shipping department. Shipping pulls and packs orders. Yellow copy filed in shipping department. Operational Auditing--Spring 2012

24. Mapping Risk to Processes • Identify risks • Link risks to the processes • Evaluate risks in terms of likelihood and impact (exposure) • Determine risk responses • Avoidance, reduction, sharing, acceptance Operational Auditing--Spring 2012