Effective Auditing For Corporates

Key Developments in Practice and Procedures

Joe Oringel

• Publisher: Bloomsbury Information
• Year: 2012
• Print ISBN: 9781849300445
• eBook ISBN: 9781849300575
• Edition: 1
• Topic: Business
• Subtopic: Business General
• Index: Business

In the wake of the recent financial crisis, increasing the effectiveness of auditing has weighed heavily on the minds of those responsible for governance. When a business is profitable and paying healthy dividends to its stockholders, fraudulent activities and accounting irregularities can go unnoticed. However, when revenue and cash flow decline, internal costs and operations may be scrutinized more diligently, and discrepancies can emerge as a result. Effective Auditing for Corporates provides you with proactive advice-to help you safeguard core value within a corporation and to ensure that auditing processes and key personnel meet the expectations of management, compliance, and stockholders alike. Aimed primarily at auditors (both external and internal), risk managers, accountants, CFOs, and consultants, Effective Auditing for Corporates covers: * Compliance and the corporate audit
* Fraud detection
* Risk-based auditing
* The development of Sarbanes-Oxley
* Cultural changes in external auditing
* Auditing management information systems

New Horizons—
The Best Practices of Tomorrow

Auditor Sensitivity to Source Reliability

by Denise Cicchella and Stuart Gardner
Auspicium, Fair Lawn, New Jersey, USA

This Chapter Covers

The importance of understanding the source of information and the reliability of that source.

The challenges and constraints auditors face in current environments.

The importance of kinesics-based techniques, neurolingusitics, and professional skepticism.

The role of management in ensuring that audit staff and other resources have the skills necessary to assess reliability of information.

The importance of techniques necessary to select and interview “experts.”

Introduction

The auditor is always playing catch-up. Both external and internal auditors have to review the work of people who do the same job day-in, day-out and who, if competent, are usually intimately familiar with the processes, systems, and information that are under their control. Looking at the transactions on a historical basis further hampers the certified public accountant, chartered accountant, or other audit professional. These difficulties have been overcome by structured professional training, on-the-job training, and thorough review of audit work.

Auditors face numerous challenges in assessing the evidence behind the statements which they are auditing:

a constantly evolving landscape of technology that feeds service delivery, distribution, resource management, reporting, decision-making, and a host of other systems;

regulatory environments that change rapidly and are rarely consistent from jurisdiction to jurisdiction;

expanded reporting requirements (e.g. corporate social responsibility statements);

complex new financial products whose risks may not be completely understood;

assessing the work of nonfinancial staff, who often have an asymmetric advantage in their area of expertise.

What do these challenges have in common? Much of the risk from these areas stems from change, lack of experience, and the unknown. What else do these challenges have in common? Most will result from companywide projects and programs. The project that addresses a new regulatory requirement, product, system, service, or building, places organizations at substantial risk. Key vendors supporting change often possess greater knowledge and experience than internal staff, further increasing the risk of fraud or substandard delivery. Many projects are delivered late, fail to meet expectations, and exceed budget. Such projects need to be included within the audit universe of internal audit. High-risk projects must be audited. External audit, equally, must consider any project that impacts their client as a “going concern.”

Project audits provide an opportunity to ensure that appropriate governance is in place to report progress to senior management, ensure effective control of change, and provide quality assurance that, if absent, may well lead to adverse or even disastrous results. An audit of a project should also include an assessment of future audit trails for new products, services, and systems. This should be performed before completion of the project, when any changes or reengineering cost are likely to be far higher. It is at this stage that audit can most readily address the systemic reliability of evidence issues.

A fundamental skill is the ability to quickly assess the reliability of both people and information while applying appropriate “professional skepticism.” This chapter will explore the use, evaluation, and assessment of information—how auditors should consider reliability, and the red flags to consider when evaluating information sources in the context of a project audit.

The Institute of Internal Auditors (IIA) states: “Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement’s objectives” (Standard 2310). The Institute further clarifies this to mean: “Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor. Reliable information is the best attainable information through the use of appropriate engagement techniques. Relevant information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful information helps the organization meet its goals.”

It is often the case that the information obtained or given to an auditor is subject to interpretation. This is particularly true of project audits, where information may be presented as optimistically as possible to present the best possible case rather than the most realistic. There is often external “noise” that may cloud project reporting as various stakeholders interpret results to meet their own agendas, which may or may not be aligned with the goals of the project. Auditors are faced with constraints that may tempt them to jump to conclusions or misinterpret information—or simply to “go with the flow.” Audit management should work toward eliminating or mitigating these constraints through a proper structured review of projects and supervision of assignments. Some of the constraints faced by auditors are:

the time assigned to perform project audits;

understanding of project processes as written and as practiced, which are often not the same;

full comprehension of the subject matter being audited—products, lines of business, business constraints, system functions, etc.;

acceptance of issues with client management, who sometimes force issues to be negotiated for “softer” wording;

access or ability to get messages fully communicated to an audit committee or senior management with possibly limited time before a project becomes operational (the audit committee may read only the first few lines of an audit report and will not take the time to read all the evidence supporting an opinion).

Systems and Processes

As the range of activities that audit reports on is expanded (for example, to include social responsibility reporting) audit is examining many additional nonfinancial systems that historically would not have been subject to detailed audit review—if they were considered at all. Frequently such systems are not overly complex or difficult to understand in principle (e.g. facilities management, nonpayroll human resource systems, records management systems, sales databases, etc.) and should not present a major challenge for an experienced auditor. Areas to consider during review/audit of these systems should include the following.

The impact of additional resources.

Understanding and interpreting the source and reliability of the data.

Spreadsheets, end-user databases (e.g. Microsoft Access), internal Wikis, SharePoint, and other information repository/report software developed by end-users to solve project-specific needs may often be encountered. The auditor may have difficulties reconciling information back to reliable sources as these ad-hoc applications frequently lack audit trails or enforce strict accountability. The auditors should look for evidence to assess the sources of information, such as the formulae used for calculations programmed into the reports.

If the auditor is not an expert in the field of the project, this involves additional challenges.

When evaluating systems the auditor should test, or ask an expert to test, for questions such as the following.

Are “dummy” or test accounts active and, if so, can they be used to conduct “illicit” transactions?

Are safeguards in place to protect the confidentiality of data or to detect unauthorized access to information? I.e. are data and information held securely to prevent them being manipulated, copied, or stolen? Obviously, the more sensitive the data, the more important these questions become.

How sensitive are the data and information stored? A leak of customer data can be catastrophic, whereas a database of paint colors used to redecorate a bui...

Table of contents

• Cover
• Title Page
• Contents
• Introduction
• Contributors
• External Auditing—The Rise of the Integrated Audit
• Internal Auditing—Fundamentals and the Best Practices of Today
• New Horizons—The Best Practices of Tomorrow
• Imprint