Operational Auditing The steps in the audit process usually are similar, regardless Of the type of audit. The differences among various types of audits tere | primarily to the objectives and scope of examination, which may result in different kinds of audit tests. This chapter examines song of the different types of audit applications: © Operational auditing. © Performance auditing. © Compliance auditing. © Auditing of financial controls. © Auditing of firancial statements. Operationa! audits examine and evaluate systems of internal contd and the quality of performance in carrying out assigned responsibil ities with respect to an organization's operating functions. Auditos examine-and evaluate a variety of activities related to such functions as marketing, facilities management, production, inventory manage | ment, security, electronic data processing, personnel management, financial management, and accounting. The key to understanding operational auditing is to undersuad, internal controls (discussed in Chapter 3). Most interral audits agree that the objectives, types, and methods of internat contd encompass all operations of an organization. Exhibit 16-1 illustrates relationships among the general methods types, and objectives of internal control. The exhibit also gives af examples of specific control methods employed by management #! examples of audit tests that may be used to examine those metho Specific applications of controls and audit methods differ amo’ organizations. As you study Exhibit 16-1, however, notict ® comprehensive nature of audit interests and how the audit acl ties directly to operations. For example, one important organisation” | control is the establishment of specified lines of authority, whet! only certain people are authorized to approve certain decisions. specific application of this control generally requires appt 677. Scanned with CamScanner‘wnnasigo jrucneruerso sam Aouarsjeue 20) aKING pus wanoaigo penoudde Jo voneujue ssp yUoU9A3} 2x2 (2) pue se3o0ud 23%pNG ponoidde (z) puw won surestosd poe JO Wopmuswnceg (1) -esedsad astpng feulieg (1) A2U3p>y9 pue A aanusndid Bunstipng sy208 pue saanaal Supsom BupreyS jo snnupa jo vopmjareg sBupsow Byjoumg —-tfod spye sourAwOD (1) sores Bujprensayee (2) Supyjen pur suopenios pure “am = 5 (2) pew swopdimp gol pus vopmuapio got (2) pus tunpesoad ‘roe ort 21 0 woneundas put soo Sram Jo uonrujwmeRg (1) FUORAHOMP gof usm (1) -lfod yam souMsWOD (1) -d1:m09p gof jo wopeiedaay ‘suapio ar0"s> ruopenson suorsop | * cand uo sirgsulje sauow pu ‘amey ‘eounpasoud ‘nud 499 10) sompoodstt uo -sBeurw 20 usuBuNhey | ‘S|SPTUd yyy sdurydwog eeowpan jo wouyT quay, Pur Gquowpns penpiaipur Jo Aayyqneuodses pee Asorpne ‘Souq saesdoxdde 40) aey> uey> {ROB pus sanp29fgo teuop Jo Sou, pus asnonae vopemueiio jo uoneuuedy vonenuetio ponjewog ——-eNBLO yo sUWANYDy aanuansig sequen Jo suswye (gear samayeuodies pun *Aayoypt cand euopezuesio Y auswoms jo -109 pt0q oy Aq PI vOpeyHen pus VoReUuiNKg —-oBMuvul Aq wwowiniUl sjp08 pus ssappoafgo pouo1s erruWiliy Jo wuDWIaAa IY anpuanseg —"aunland Jo 1 TABRTRNG SESHIGAIOUINGS fe on WXEL SIXL RVR SAORLET TOSINGS | SISAL DIGOY F1anvxG seo1 upay pus jos3u0D eee suopexsnity * 2 s TOT qr $678 Secon 1V__Types of Audit Applications Scanned with CamScannerssacoud woysyarsdne ays Spied 232 slusUIND0P auyUrEXa tss99 -oid uosaadns 9012390, I squesyjdde qof jo #294? punoadypeq Jo UNpeUSUIN -Dop pur asuewsoji0u Aj9,, seinp2s0sd pur 5912100 Peysqess yam soucysuios asm tsoanpoooad pue sp cHod szenjeaa pur suywexg sounds vopnemoYns 20) woR ~musuinsop jo wo eUpER {Hn sop}apoE AupsoysMay spusunscyod peisiipng spin sjness soueus ssoj204 yenaze Supredwos pur su0dsa vonpnpoad supsay, een SISAL LIGNV S1aNVxXa ceour satjdosdde yaym soueus sa9}29d JO Buporuou D1Po pad pue ssahojdws or vant suoponasul sreadoiddy mau wo sy9242 punosdy>eg, 01d yea 02 poyzomo uop -onpoad parsofaa yam syD2Y> 9 Pus ‘emul ‘E2uNpososd ‘euRyd Jonuo3-Ayjenb uopenporg wxiaq o1 jeaoudde pazjnboy ‘Daa ‘egupsaur JO soxnujuT smi0ds1 wopenposd *529108 au ‘eypayp ‘ex9ps0 sempING: suonejr ites pue ‘smey ‘saunpasoud ‘sued ‘sayonod tpim souenduie> soanoatgo aay IV saapizaiqo ony tiv. suope;nies ‘soyod tpi ozuuydwoD sennosigo ey Iv maovee Buypaenitoyes (Z) pus suopejazos pur “eme] ‘soinpoooad ‘surjd ‘53> -NOd Hpi souRsWED (1) 1808 pure ssapsoigo euon EqUeBIO Jo 1uSwIATYIE (€) put ‘sureioid pue sup -tiado jo Anuay>yjo pur wo ~uoss (Z) Aautiaauy pue = SEALIDEES, “IOULNOD AUVAY Fanoana> pur ‘oanomep tonpusanag, Banuraaig, oanuanad papacuo> pus ‘sapooiep ‘oanuanaig panuanaig oaposiep pus cApUanzag aapoaing, Baal AuvWiea uorstazedag |) ausuidopansp pue Murmeay ppuuossed 3q" ams Supsyjpe pue Bupa | seaToTRT | soanpasosd Rat ples Sea ON sopapse puc suojsep jo uonEoyINY S2AAPEs Jo voRIQUsWNDOG, susaasAs. wonewojuy pus Zununessy Scanned with CamScanner@ section IV Types of Audit Applications yusmdmbe pur sony go 2upsoa puz uopeuparexg, sujmexd Sau >UaIms [EUEU -y uo vonndo apne ourueg, fi0daa apne snojaid Buymurexs Aq sypne jeuseauy (JO souruLzEjI00 94 ANZA, seoynoa 1p, |, Buipacoea wopmysumoop oe. awowsdynbo aiqenpea uo aufene 92 portdyd pure ‘sSurpying PayBy-T9m “spiomseed 32) ondwioa *e420} sop ‘ss0u94 Yupypne jeussayy sp2kojdune Jo vo}eny stag soumBO A jenuuelUag ‘nase Surprengoyeg sounparcad ‘cued “#919 “Hod yay sousydurod (1) ruopojnsou pur ‘smey ‘sounpapoad ‘sued ‘oped ypu sundae, ‘anppeaio> pue aanroreg oappeop pus sanean, feinsrour Axpms09 2912-UG, Suan pT ssureaSood pus ‘sudaes> alo *ouanshs sn3ynaa [roast yp yo ma aahoydw> apis] rr | Scanned with CamScannerPerformance Auditing Effectiveness and Efficiency as. Performance Measures signatures or initials by the designated individuals. To examine and evaluate the effectiveness of this control, internal auditors (1) determine that authorization procedures, including approval signatures/initials, have been established, and (2) examine relevant . documents for the required approvals. Likewise, all operational audie tests generally are linked directly to some aspect of organizational operations. Operational auditing, however, is a generic term. Many people use it synonymously with “internal auditing.” For them, everything the internal auditor does is operational auditing. Other people subclassify internal auditing into either operational or financial auditing. Seill others subclassify this work into other categories, such as “manage. . ment auditing,” “performance auditing,” and "compliance auditing.” Obviously, there is no standardized use of these terms, but some differentiation among them is helpful — especially when it is important to clarify audit objectives. “Management auditing” typically means the auditing of manage- ment controls. Management auditing often is considered the same as operational auditing in general, since (1) management permeates the entire organuation and alt of its operat’ ons; (2) internal controls are established, maintained, and monitored by management; and (3) management should be subject to the established internal control systems. Some internal auditors, however, reserve the term “management auditing” for audits of spicific management activity, such as planning, budgeting, supervising, and reviewing. The inconsistent use of this term almost always requires a definition to clarify what is meant in specific situations. Tn contrast to the brief explanation of management auditing, “performance auditing,” “compliance auditing,” the auditing of financial controls, and the auditing of financial statements are givea more extensive treatment in the following sections. Performance, audits generally focus on efficiency and effectiveness and require that operating standards be established. These audits depend upon the availability of a set of accepted objectives and goals against which performance can be evaluated. ‘The internal auditor's examination and evaluation of effectiveness and efficiency does not substitute for management's performance evaluations, Rather, internal-auditing provides one source of information to assist management in its evaluation. A number factors may influence Tanagement'’s judgments, many of which may Scanned with CamScannerig_Setin IV_Trs of Ait Applications , ermining + fetiveness and * fidency be largely subjective. Internal auditors, however, require objective measures 10 conduct performance audits. Objectives need to be well defined:in terms of measurable goals which can be compared to actual results, Similarly, efficiency is defined in terms of operating standards against which to compare actual performance. Also. some auditors contend that performance audits relate almost exclusively to effectiveness, with far less emphasis on efficiency. Others believe that because efficiency is so closely related to effectiveness, internal auditors are able to anticipate many perfor- inance problems by identifying key inefficiencies before overall effectiveness is threatened, Effectiveness refers to the accomplishment of objectives. Efficiency refers to the resources consumed in achieving those objectives. Generally speaking, the consumption of fewer resources means greater efficiency. Internal auditing sometimes is criticized as lacking clear criteria, second-guessing management, and-placing auditors in judgment roles that exceed the support of available audit evidence. However, to set internal auditing aside because of its difficulty would suggest that the effectiveness of organizations cannot be evaluated. Yet performance evaluation programs, incentive packages, and market share studies have all developed under the prest:mption that effectiveness can be monitored and periodically assessed. Auditors need only to be given a set of criteris by which effectiveness is to be judged in order for them to obtain objective evidence capable of supporting audit conclusions. A common approach to evaluating effectiveness is to compare costs and benefits prior to certain activities to costs and benefits after these activities. The presumption is that any changes in costs or benefits are attributable to the introduction of these activities. Such changes thereby help in measuring program or operating effectiveness. Another approach is to compare performance to other similar operating units. For years, the efficiency of routine jobs, such as keypunching or piecework on production lines, has been evaluated through: time and motion studies using engineering techniques. Business analysis tools are available for evaluating capital-budgeting decisions, make-or-buy decisions, and return gn investment (ROI). To- effectively evaluate efficiency, the primary requirement is that information be collected on the costs and benefits of selected approaches, budgeted Scanned with CamScannerRene ald nc eee pe ee Examples of Effectiveness expectations, and available alternatives. In this manner, benchmars ate available for assessing efficiency. Productivity measures such cost-per-unit and revenues-per-unit are often emphasized in making efficiency assessments. An example of an internal performance audit would be a, assignment to assess whether a particular governmental agency his effectively met its assigned objective of achieving elevator safety. Well-Defined Objectives. For the internal auditor to reach conclusion about the agency's effectiveness, objectives need to te) defined at an appropriate level of detail. For example, is the objectin to see that all elevators in the city are inspected at least once 2 yea! Is the objective to ensure that no fatalities occur as a result of elevate, breakdowns, or that no breakdowns occur? The availability of detailed objectives provides criteria about which evidence can le collected for evaluation. Control Over Operations and the Implementation o Objectives. Assuming that the objective is to ensure that annud inspections are made of all elevators, the auditor must first assess te control setting and the means by which the agency attempts implement the objective. Information would need to be maintzine about the location of all elevators; which are in operation; when ind by whom they were last inspected; whether each elevator past inspection, and if not, whether corrective actions were taken. i addition, inspectors would have to be trained. They would need» file timely zeports and should be respon:ible for follow-up to ensst that exceptions are responded to appror riately. To ensure that these activities take place, adequate internal coats would be essential. In other words, competent employees who aware of the role of control procedures as well as operatii procedures, and who document operations in a responsible, thoroty and accurate manner, are essential to effective performance. Achievement of Desired Objectives. The internal auditor @ gather objective evidence that the operating objective was met sample of elevators can be drawn, evidence can be collected #5” when. they were last inspected, and an-inference can be drawn t0 of the elevators in the city. In addition, blueprints of city buildify can be examined and elevator locations traced ta the agency's list ness, Additional tests on newly constructed build ate to assess the timeliness with which the cent# listing is updated. Scanned with CamScanner