Understand the Operations of Auditee Auditee Analysis Framework (AAF)

1. Understand the Operations of Auditee Auditee Analysis Framework (AAF)

2. Understand the Operations of the Auditee Where are we now? Co-Develop Expectations

3. Co-Develop Expectations Understand the Auditee’s Mandate, Strategies, Operations andEnvironment Understand the Financial andOperating Processes and Performance Assess Control Environment Understand the Relevant Operational Processes

4. Understand the Auditee’s Mandate, Strategies, Operations and Environment Why Understand the Auditee’s Operational Environment? • To identify strategic and operational success factors and related potential auditee risks • To identify changes in the auditee conditions and operations that give rise to existing or emerging risks focus

5. Auditee Analysis Framework (AAF) • AAF provides a common organizing framework for understanding the key elements affecting the auditee’s success or failure and the dynamic interrelationships between them. Auditee Analysis Framework

6. As International Standards on Auditing (ISA) 315 states: • The auditor should obtain an understanding of the entity’s objectives and strategies, and the related business risks that may result in material misstatement of the financial statements. This standard also requires the auditor to obtain an understanding of the entity’s process for identifying business risks relevant to financial reporting objectives and deciding about actions to address those risks.

7. MEF Audit Standards – Performance of Audit Work • Planning should be documented and should include: • Establishing audit objectives and scope of work • Obtaining background information about the activities to be audited • Determining the resources necessary to perform the audit • Communicating with all who need to know about the audit • Performing, as appropriate, an on site survey to become familiar with the activities and controls to be audited, to identify areas for audit emphasis and to invite auditee comments and suggestions

8. Auditee Analysis Framework Components: • Value • Management • Operational Processes • Environment • Information • Suppliers • Public • Users

9. Auditee Analysis Framework Environment Economic trends Political and regulatory factors Demographic patterns Technological advances Social/Cultural changes Ecological concerns

10. Auditee Analysis Framework Information Essential for: • Establishing and communicating an effective strategy • Monitoring operations • Monitoring public satisfaction • Reporting to stakeholders and other agencies

11. Auditee Analysis Framework Information Criteria: • Is it the right information? Is it relevant to the decisions management needs to make? • Is the information right? Is it accurate, complete, truthful, and timely? • Is it used right? Is it applied in a proper way to the correct circumstances to help management formulate wise decisions and take effective actions?

12. Auditee Analysis Framework Information from Operations Information from External Forces INFORMATION Information fromFinancial Results

13. Auditee Analysis Framework Suppliers Provide inputs: • Materials / Services • Human Resources • Funds • Technology

14. Auditee Analysis Framework Public Key questions: • What do the public want? • How do we satisfy these wants?

15. Auditee Analysis Framework Users May consist of: • Taxpayers or, • The Public • They provide a large portion of the capital needed to finance the operation or elect the members of the management of the auditee • Principal recipients of the auditee's services

16. Auditee Analysis Framework Value • The Public/Constituents • Employees • Suppliers • Community at large

17. Auditee Analysis Framework Management Includes the following activities: • Monitoring and responding to changes in the environment and other external forces • Establishing an operational strategy • Establishing an internal control structure • Allocating resources for greatest results • Directing operations and motivating people • Monitoring results • Taking corrective action as necessary

18. Auditee Analysis Framework Management • Leadership • Unifying ingredient that brings all the other elements together in a harmonious way • Provides the vision and creativity • Requires communicating the vision and inspiring the organization's people to give their best

19. Auditee Analysis Framework Management • Strategy “The operating purpose served by the auditee today and its aspirations for the future” • Must consider the strategic forces acting upon the operation, including environmental forces, the availability and quality of resources, and expectations of the public • Requires creativity and vision, qualities that differentiate the auditee from other auditees • Requires the resources and dedication to convert the vision into a workable action plan

20. Auditee Analysis Framework Public’s Expectation Creativity and Vision Strategic focus • Environment • Public’s needs • Available Resources PURPOSE Auditee’s Capabilities ACTIONS

21. Auditee Analysis Framework Operational Processes • People • Activities • Technology

22. Auditee Analysis Framework Operational Processes • People • Auditee's most important assets • Also includes the attitudes, values, and other characteristics often referred to as "culture" • Requires an environment of teamwork and trust • Activities • Represent a "pipeline," involving a flow of inputs, processes and outputs directed toward satisfying the public • Processes necessary for the delivery of the auditee's products and services

23. Auditee Analysis Framework Operational Processes • Technology • Improvements in processes that increase productivity of machines and eliminate manual operations or operations done by older machines • Can impact virtually all elements of an auditee and should be considered in all aspects of analyzing the auditee’s operation • Can be considered from two different perspectives: • The technology that the auditee creates or takes advantage of for its own operations, • The technology being created and implemented outside of the auditee that is impacting them beyond their control

24. Auditee Analysis Framework Key Procedures Summarize key success factors and points of strategic focus Communicate AAF’s significant points Identify auditee risks Summarize auditee’s key success factors and points of strategic focus Communicate the AAF’s significant points with senior management and call the attention of the division chief concerned or heads of the auditee. Identify failure risksrelated to key strategic and operating success factors, and current events and transactions.

25. Auditee Analysis Framework Summarize auditee’s key success factors and points of strategic focus Document audit team’s understanding using 4 views: Auditee Environment State of the environment where the auditee operates Entity Interrelationships among the auditee’s key success factors and its key strengths and weaknesses Strategic Auditee’s operations (at a high level) Process Core operation processes

26. Auditee Analysis Framework Summarize auditee’s key success factors and points of strategic focus • After the initial year of implementation, subsequent reviews of the Directors, Deputy, and TL will primarily focus on the identification of significant changes on key strategies and operations. • Inquiry will focus on current events and transactions and possible effects of any recent changes in the auditee’s operations and environment, strategy, processes and other operating factors (since the last review) that might be of relevance to the current year audit.

27. Auditee Analysis Framework Communicate the AAF’s significant points with senior management and summon the attention of the division chief concerned. • The Director and/or TL discuss the significant points of the AAF with senior management to confirm the understanding of critical success factors, points of strategic focus, significant events and plans and potential risks. • The audit team may deliver to senior management a written summary organized around the elements of the AAF together with the results of its discussion with management.

28. Auditee Analysis Framework Identify failure risks related to key strategic and operating success factors, and current events and transactions. • Identify possible failure risks by considering the impact of changes in auditee’s operations and environment, strategy, processes and other operating conditions to the auditee’s key success and operational success factors. • Failure risks identified should be considered for inclusion in the Auditee Risk Control Document (ARCD).

29. Auditee Analysis Framework Audit Template AUDITEE ANALYSIS FRAMEWORK PRACTICE AID Part I – Introduction Part II – Blank Form Part III – Probing Questions The audit team shall document its understanding of the auditee operations and the risks identified during the performance of AAF activities in the form provided Contains suggested probing questions to support planning, organization, and information gathering for effective discussions with key operational personnel to improve our understanding of the auditee’s operations

30. Auditee Analysis Framework Audit Template Content of each sheet in Part II: Component Introduction Name of the AAF component being analyzed Auditee Analysis Framework Diagram Brief description of the component Does auditee perform this key activity in relation to the other eight key activities being assessed? Analysis Key Success Factors and Changes What can the auditee do to improve the effectiveness for this activity?

31. Auditee Analysis Framework The AAF is most powerful when considering: • The relationship and interaction between its individual components • Its alignment with other operation analysis models and frameworks such as PR, Fraud Risk Assessment, Process Analysis, and Risk Model

32. Auditee Analysis Framework • Alignment with the Performance Reviews The AAF supports analyzing current and future operational performance for failure risk in the PR. In particular, the AAF supports: • Understanding operations reality • Assessing the relevance of selected performance measures • Evaluating the objectivity of senior management’s performance expectations and developing performance expectations

33. Auditee Analysis Framework • Alignment with the Information Processes When understanding information processes to identify auditee risks using Process Analysis, the AAF supports: • Determining the elements of the auditee’s information flow (significant information processes) that will be further analyzed to identify error risks, and • Identifying problems or changes in operations that may indicate increased error risk

34. Auditee Analysis Framework • Alignment with the Fraud Risk Assessment • The AAF supports the assessment of pressures and opportunities for fraud. • The audit team can consider the AAF elements individually and collectively. Some elements acting together may have a multiplying effect on the fraud risk

35. Auditee Analysis Framework • Alignment with the Auditee Risk Model The Auditee Risk Model (ARM) supports the AAF by providing a lexicon for describing and communicating failure risk and opportunities for operation improvement, and a checklist of potential risks.

36. Auditee Analysis Framework • Alignment with the Auditee Risk Model (Con’t.) Strategy: The vertical axis within the AAF focuses on auditee management’s strategies to maximize constituents’ value/social outcomes for the public considering outsourcing providers (suppliers/contractors) and other environment risks Operations: The left side of the horizontal axis within the AAF focuses on how resources are obtained and converted to develop social services to public or taxpayers. The right side of the horizontal axis focuses on marketing, selling and delivery of those social services to address taxpayer’s needs. Environment: The environment in which the auditee operates is reflected in the outer ring and the related risk, particularly failure risks, are illustrated in the “Environment Risk” component of the ARM.

37. Auditee Analysis Framework • Alignment with the Auditee Risk Model (Con’t.) Process: The AAF supports identification of the processes that are most integral to the auditee’s success in meeting its operating objective. These processes are further analyzed using the IPF. The related agency risks are identified in the Process Risk component of the ARM. Information: The information required to monitor changes in the environment and process performance and to report to public and other third parties is represented by the ring that separates the environment and other elements of the AAF. The related agency risks are identified in the “Information for Decision Making Risk” component of the ARM.

38. What is done? Why is it done? Where is it done? Why there? When is it done? Why then? Who does it? Why that person? How is it done? Why that way? What happens next? Why that? Auditee Analysis Framework • Some useful probing questions to get the right information: