How to Plan an Internal Audit Project
Thorough planning of an internal audit project ensures that scarce audit resources are focused on examining the riskiest areas of the business and minimizes interruptions to the business. Management should be involved in the process to ensure understanding of the business area is complete and to gain support for the audit.
Use the planning process to evaluate business risks, the current state of controls and to determine what audit procedures you will use to test each control.
Other People Are Reading
Things You'll Need
- Business organization chart
- Business income statement
- Policies and procedures for the areas being audited
- Most recent internal and external audit reports
Instructions
-
Background
-
1
Review the last internal and external audit reports to understand what issues were raised, the corrective actions management committed to take, and the status of those actions. If internal audit has not previously tested whether the actions were implemented, it will need to do so during the audit project.
-
2
Review a copy of the business's organization chart and its income statement to identify all areas of responsibility. Discuss any discrepancies between the two with business management.
-
-
3
Discuss changes in the business since the last audit with management and planned changes for the near future. Management may have added new products or processes, changed key personnel, be subject to new laws or regulations, modified systems, or sold or discontinued parts of the business.
Risk and Control Identification
-
4
Discuss key business objectives and risks to those objectives with business management. For example, management's objectives might include providing the most efficient customer service in the industry. Risks to that objective might be poor staff retention, high number of customer complaints, ineffective customer service systems and slow call answer times.
-
5
Discuss unusual operational losses and regulatory fines or censures to understand how they occurred and what control procedures have been put in place to prevent them in the future.
-
6
Focus on risk areas that are often neglected. Identify vendors and outsourcing companies, both domestic and international, used by management and gain an understanding of how control responsibilities are passed to and from the vendor and are monitored by management. Also determine whether management 'in-sources' any activities, acting as an outsourcer for other companies. Include discussions of business continuity plans and system access controls.
-
7
Review policies and procedures and job descriptions to identify key control points in business processes.
Audit Scope and Documents
-
8
Work with audit management to determine what type of audit skills you need to complete the internal audit and determine how much time is available from each auditor.
-
9
Use the risk and control information gathered above and the time your team has available to determine the audit's scope, those areas the audit will focus on and those it will exclude.
-
10
Prepare a planning memo for internal audit and business management that briefly describes the audit project's process and timing, areas included in the audit scope, and the report writing and response process.
-
11
Develop the internal audit program using the information obtained above, assigning audit steps and hours available to specific auditors.
-
1
