Operational Auditing The steps in the audit process usually are similar, regardless Of the type of audit. The differences among various types of audits tere | primarily to the objectives and scope of examination, which may result in different kinds of audit tests. This chapter examines song of the different types of audit applications: © Operational auditing. © Performance auditing. © Compliance auditing. © Auditing of financial controls. © Auditing of firancial statements. Operationa! audits examine and evaluate systems of internal contd and the quality of performance in carrying out assigned responsibil ities with respect to an organization's operating functions. Auditos examine-and evaluate a variety of activities related to such functions as marketing, facilities management, production, inventory manage | ment, security, electronic data processing, personnel management, financial management, and accounting. The key to understanding operational auditing is to undersuad, internal controls (discussed in Chapter 3). Most interral audits agree that the objectives, types, and methods of internat contd encompass all operations of an organization. Exhibit 16-1 illustrates relationships among the general methods types, and objectives of internal control. The exhibit also gives af examples of specific control methods employed by management #! examples of audit tests that may be used to examine those metho Specific applications of controls and audit methods differ amo’ organizations. As you study Exhibit 16-1, however, notict ® comprehensive nature of audit interests and how the audit acl ties directly to operations. For example, one important organisation” | control is the establishment of specified lines of authority, whet! only certain people are authorized to approve certain decisions. specific application of this control generally requires appt 677. Scanned with CamScanner‘wnnasigo jrucneruerso sam Aouarsjeue 20) aKING pus wanoaigo penoudde Jo voneujue ssp yUoU9A3} 2x2 (2) pue se3o0ud 23%pNG ponoidde (z) puw won surestosd poe JO Wopmuswnceg (1) -esedsad astpng feulieg (1) A2U3p>y9 pue A aanusndid Bunstipng sy208 pue saanaal Supsom BupreyS jo snnupa jo vopmjareg sBupsow Byjoumg —-tfod spye sourAwOD (1) sores Bujprensayee (2) Supyjen pur suopenios pure “am = 5 (2) pew swopdimp gol pus vopmuapio got (2) pus tunpesoad ‘roe ort 21 0 woneundas put soo Sram Jo uonrujwmeRg (1) FUORAHOMP gof usm (1) -lfod yam souMsWOD (1) -d1:m09p gof jo wopeiedaay ‘suapio ar0"s> ruopenson suorsop | * cand uo sirgsulje sauow pu ‘amey ‘eounpasoud ‘nud 499 10) sompoodstt uo -sBeurw 20 usuBuNhey | ‘S|SPTUd yyy sdurydwog eeowpan jo wouyT quay, Pur Gquowpns penpiaipur Jo Aayyqneuodses pee Asorpne ‘Souq saesdoxdde 40) aey> uey> {ROB pus sanp29fgo teuop Jo Sou, pus asnonae vopemueiio jo uoneuuedy vonenuetio ponjewog ——-eNBLO yo sUWANYDy aanuansig sequen Jo suswye (gear samayeuodies pun *Aayoypt cand euopezuesio Y auswoms jo -109 pt0q oy Aq PI vOpeyHen pus VoReUuiNKg —-oBMuvul Aq wwowiniUl sjp08 pus ssappoafgo pouo1s erruWiliy Jo wuDWIaAa IY anpuanseg —"aunland Jo 1 TABRTRNG SESHIGAIOUINGS fe on WXEL SIXL RVR SAORLET TOSINGS | SISAL DIGOY F1anvxG seo1 upay pus jos3u0D eee suopexsnity * 2 s TOT qr $678 Secon 1V__Types of Audit Applications Scanned with CamScannerssacoud woysyarsdne ays Spied 232 slusUIND0P auyUrEXa tss99 -oid uosaadns 9012390, I squesyjdde qof jo #294? punoadypeq Jo UNpeUSUIN -Dop pur asuewsoji0u Aj9,, seinp2s0sd pur 5912100 Peysqess yam soucysuios asm tsoanpoooad pue sp cHod szenjeaa pur suywexg sounds vopnemoYns 20) woR ~musuinsop jo wo eUpER {Hn sop}apoE AupsoysMay spusunscyod peisiipng spin sjness soueus ssoj204 yenaze Supredwos pur su0dsa vonpnpoad supsay, een SISAL LIGNV S1aNVxXa ceour satjdosdde yaym soueus sa9}29d JO Buporuou D1Po pad pue ssahojdws or vant suoponasul sreadoiddy mau wo sy9242 punosdy>eg, 01d yea 02 poyzomo uop -onpoad parsofaa yam syD2Y> 9 Pus ‘emul ‘E2uNpososd ‘euRyd Jonuo3-Ayjenb uopenporg wxiaq o1 jeaoudde pazjnboy ‘Daa ‘egupsaur JO soxnujuT smi0ds1 wopenposd *529108 au ‘eypayp ‘ex9ps0 sempING: suonejr ites pue ‘smey ‘saunpasoud ‘sued ‘sayonod tpim souenduie> soanoatgo aay IV saapizaiqo ony tiv. suope;nies ‘soyod tpi ozuuydwoD sennosigo ey Iv maovee Buypaenitoyes (Z) pus suopejazos pur “eme] ‘soinpoooad ‘surjd ‘53> -NOd Hpi souRsWED (1) 1808 pure ssapsoigo euon EqUeBIO Jo 1uSwIATYIE (€) put ‘sureioid pue sup -tiado jo Anuay>yjo pur wo ~uoss (Z) Aautiaauy pue = SEALIDEES, “IOULNOD AUVAY Fanoana> pur ‘oanomep tonpusanag, Banuraaig, oanuanad papacuo> pus ‘sapooiep ‘oanuanaig panuanaig oaposiep pus cApUanzag aapoaing, Baal AuvWiea uorstazedag |) ausuidopansp pue Murmeay ppuuossed 3q" ams Supsyjpe pue Bupa | seaToTRT | soanpasosd Rat ples Sea ON sopapse puc suojsep jo uonEoyINY S2AAPEs Jo voRIQUsWNDOG, susaasAs. wonewojuy pus Zununessy Scanned with CamScanner@ section IV Types of Audit Applications yusmdmbe pur sony go 2upsoa puz uopeuparexg, sujmexd Sau >UaIms [EUEU -y uo vonndo apne ourueg, fi0daa apne snojaid Buymurexs Aq sypne jeuseauy (JO souruLzEjI00 94 ANZA, seoynoa 1p, |, Buipacoea wopmysumoop oe. awowsdynbo aiqenpea uo aufene 92 portdyd pure ‘sSurpying PayBy-T9m “spiomseed 32) ondwioa *e420} sop ‘ss0u94 Yupypne jeussayy sp2kojdune Jo vo}eny stag soumBO A jenuuelUag ‘nase Surprengoyeg sounparcad ‘cued “#919 “Hod yay sousydurod (1) ruopojnsou pur ‘smey ‘sounpapoad ‘sued ‘oped ypu sundae, ‘anppeaio> pue aanroreg oappeop pus sanean, feinsrour Axpms09 2912-UG, Suan pT ssureaSood pus ‘sudaes> alo *ouanshs sn3ynaa [roast yp yo ma aahoydw> apis] rr | Scanned with CamScannerPerformance Auditing Effectiveness and Efficiency as. Performance Measures signatures or initials by the designated individuals. To examine and evaluate the effectiveness of this control, internal auditors (1) determine that authorization procedures, including approval signatures/initials, have been established, and (2) examine relevant . documents for the required approvals. Likewise, all operational audie tests generally are linked directly to some aspect of organizational operations. Operational auditing, however, is a generic term. Many people use it synonymously with “internal auditing.” For them, everything the internal auditor does is operational auditing. Other people subclassify internal auditing into either operational or financial auditing. Seill others subclassify this work into other categories, such as “manage. . ment auditing,” “performance auditing,” and "compliance auditing.” Obviously, there is no standardized use of these terms, but some differentiation among them is helpful — especially when it is important to clarify audit objectives. “Management auditing” typically means the auditing of manage- ment controls. Management auditing often is considered the same as operational auditing in general, since (1) management permeates the entire organuation and alt of its operat’ ons; (2) internal controls are established, maintained, and monitored by management; and (3) management should be subject to the established internal control systems. Some internal auditors, however, reserve the term “management auditing” for audits of spicific management activity, such as planning, budgeting, supervising, and reviewing. The inconsistent use of this term almost always requires a definition to clarify what is meant in specific situations. Tn contrast to the brief explanation of management auditing, “performance auditing,” “compliance auditing,” the auditing of financial controls, and the auditing of financial statements are givea more extensive treatment in the following sections. Performance, audits generally focus on efficiency and effectiveness and require that operating standards be established. These audits depend upon the availability of a set of accepted objectives and goals against which performance can be evaluated. ‘The internal auditor's examination and evaluation of effectiveness and efficiency does not substitute for management's performance evaluations, Rather, internal-auditing provides one source of information to assist management in its evaluation. A number factors may influence Tanagement'’s judgments, many of which may Scanned with CamScannerig_Setin IV_Trs of Ait Applications , ermining + fetiveness and * fidency be largely subjective. Internal auditors, however, require objective measures 10 conduct performance audits. Objectives need to be well defined:in terms of measurable goals which can be compared to actual results, Similarly, efficiency is defined in terms of operating standards against which to compare actual performance. Also. some auditors contend that performance audits relate almost exclusively to effectiveness, with far less emphasis on efficiency. Others believe that because efficiency is so closely related to effectiveness, internal auditors are able to anticipate many perfor- inance problems by identifying key inefficiencies before overall effectiveness is threatened, Effectiveness refers to the accomplishment of objectives. Efficiency refers to the resources consumed in achieving those objectives. Generally speaking, the consumption of fewer resources means greater efficiency. Internal auditing sometimes is criticized as lacking clear criteria, second-guessing management, and-placing auditors in judgment roles that exceed the support of available audit evidence. However, to set internal auditing aside because of its difficulty would suggest that the effectiveness of organizations cannot be evaluated. Yet performance evaluation programs, incentive packages, and market share studies have all developed under the prest:mption that effectiveness can be monitored and periodically assessed. Auditors need only to be given a set of criteris by which effectiveness is to be judged in order for them to obtain objective evidence capable of supporting audit conclusions. A common approach to evaluating effectiveness is to compare costs and benefits prior to certain activities to costs and benefits after these activities. The presumption is that any changes in costs or benefits are attributable to the introduction of these activities. Such changes thereby help in measuring program or operating effectiveness. Another approach is to compare performance to other similar operating units. For years, the efficiency of routine jobs, such as keypunching or piecework on production lines, has been evaluated through: time and motion studies using engineering techniques. Business analysis tools are available for evaluating capital-budgeting decisions, make-or-buy decisions, and return gn investment (ROI). To- effectively evaluate efficiency, the primary requirement is that information be collected on the costs and benefits of selected approaches, budgeted Scanned with CamScannerRene ald nc eee pe ee Examples of Effectiveness expectations, and available alternatives. In this manner, benchmars ate available for assessing efficiency. Productivity measures such cost-per-unit and revenues-per-unit are often emphasized in making efficiency assessments. An example of an internal performance audit would be a, assignment to assess whether a particular governmental agency his effectively met its assigned objective of achieving elevator safety. Well-Defined Objectives. For the internal auditor to reach conclusion about the agency's effectiveness, objectives need to te) defined at an appropriate level of detail. For example, is the objectin to see that all elevators in the city are inspected at least once 2 yea! Is the objective to ensure that no fatalities occur as a result of elevate, breakdowns, or that no breakdowns occur? The availability of detailed objectives provides criteria about which evidence can le collected for evaluation. Control Over Operations and the Implementation o Objectives. Assuming that the objective is to ensure that annud inspections are made of all elevators, the auditor must first assess te control setting and the means by which the agency attempts implement the objective. Information would need to be maintzine about the location of all elevators; which are in operation; when ind by whom they were last inspected; whether each elevator past inspection, and if not, whether corrective actions were taken. i addition, inspectors would have to be trained. They would need» file timely zeports and should be respon:ible for follow-up to ensst that exceptions are responded to appror riately. To ensure that these activities take place, adequate internal coats would be essential. In other words, competent employees who aware of the role of control procedures as well as operatii procedures, and who document operations in a responsible, thoroty and accurate manner, are essential to effective performance. Achievement of Desired Objectives. The internal auditor @ gather objective evidence that the operating objective was met sample of elevators can be drawn, evidence can be collected #5” when. they were last inspected, and an-inference can be drawn t0 of the elevators in the city. In addition, blueprints of city buildify can be examined and elevator locations traced ta the agency's list ness, Additional tests on newly constructed build ate to assess the timeliness with which the cent# listing is updated. Scanned with CamScannersim been e Less objective data may be available on inspectors’ qualifications or the propriety of past inspections; however, a review of resumes, training programs, competency exams, and performance reports, as well as reperformance of the inspection. procedutes for a sample of slevators, would: provide corroborating evidence of inconsistencies in reported and actual conditions. Again, more intensive testing should be done on those elevators thought to be problematic (e.g., older elevators) and on those for which follow-up reports were filed after exceptions were to have been corrected. The auditors also may investigate accident reports to determine the circumstances and what corrective measures were taken. Collection of evidence nay require a trained and independent elevator inspector. Hence, performance audits may occasionally require expert judgment beyond that of the auditor's in reaching conclu: ions, In conducting a performance audit, the auditor should investigate several questions, as summarized in Exhibit 16-2. Auditors sometimes Go not express an opinion on performance audits other than noting exactly what was examined and the number of instances in which the predefined criteria were or were not met. Exhibit 16-2 Key Questions Relevant to Performance Audits 1. Is the activity being conducted as intended by top management? 2. Ate prescribed policies being followed? 3. Is the function being performed necessary? 4. Ate administrative and financial controls effective? : 5. Are the costs of such controls in line with the function’s effectiveness and the risk involved in the activity? ‘Adapteo from Dan M. Guy, “Inclusion of Performance Auditing Concepts in the ‘Auditing Course,” The Jatermal Autor, March/April 1925, pp. 68-72. «als of Efficiency measures relate to resource use. Many efficiency “"iiney problems are detectable by gaining an understanding of how day-to: day activities are performed. Scanned with CamScannerNo Unwarranted Duplication of Efforts. One common flaw ig the duplication of efforts that may result from overlooking simple time-saving tools. As an example, raulti-copy forms can expedite authorization, shipping, receiving, and accounting functions by permitting some concurrent processing of documents. Data basé management systems in an EDP environment can help avoid some undesirable duplicate generation and maintenance of computerized data files. Another type of duplication occurs in what are called “shadow systems.” These systems are created informally by employees when the formal information system they are supposed to be using fails to meet their needs. The employees then create their own informa- tion, documents, logs, journals, reports, etc., and keep them separate from the formal system. The work required tor the formal system is thereby often duplicated with the work performed on the informat system. The need for shadaw systems can be eliminated in a variety of ways, depending upon the system. Sometimes training on the formal system can help the employee learn to utilize the system better. Sometimes the formal system can be changed to accommodate the employee's needs. Sometimes the employee may not understand his or her needs. Occasionally the employee's system is better than the formal system, in which case it should replace the formal system. Proper Staffing, A well-designed operacion can perform inefficiently if it is improperly staffed. Too few employees, too many, cr the lack of qualified personnel are all common reasons for inefficiencies. Authorized Use of Assets. Another factor that may contribute to ineificiency is the absence of appropriate authorization requite- ments for the use of assets. The absence of an approval process means that the location of equipment may be unknown and its use less than optimal. For example, assume that a company has one forklift and one truck, and an employee takes the forklift to do work which could have been done by the truck. In the meantime, the loading dock's activities come to a halt until the forklift is returned. Clearly, the wasted loading time is inefficient and directly attributable to the absence of a formal authorization procedure. By reviewing findings related to efficiency and economy. one can sense the types of issues about which evidence might be gathered. To illustrate, Exhibit 16-3 summarizes some efficiency and economy findings by the New York state comptroller's office when auditing state and city agencies, Scanned with CamScannerF Ssh of Ant Aplin Inadequate Personnel Utilization: Item Item em Tem Examples of Efficiency and Economy Findings Exhibit 16-3 The city’s public assistance case load contained an intoler- able number of people who were ineligible for such assist- ance. A quality control system designed to measure the level of ineligibility and to highlight procedural weak- nesses contributing to the problem was experiencing inor- dinate delays. Our audit showed that 2 major cause of this delay wes poor supervision and the absence of work standards for the quality-control employees. Thus, the fail- ure to efficiently implement a key managerial control was contributing to the continued waste of program funds. An audit of the Tax Department showed that, despite in- creasing backlogs of work, vacant tax-auditor positions were not being filled. Many of the filled positions were “on Ioan” to less productive units. ‘We concluded that the department was belng “penny-wise and pound-fool- ish,” since every dollar spent on tax enforcemen: pro- duced many additional dollars of tax revenue and since the potential for collecting delinquent taxes tended to de- crease with the rassage of time. ‘An audit of the junior high schools showed that many teachers had an unusually high number of administrative hours," performing nonteaching clerical tasks, There was 4 potential for using the teachers by reducing class ses (presumably increasing the effectiveness of the teaching program), or by replacing 2 portion ofthe teaching staff with lower-paid clerical personnel An audit of employee attendance and activities at various unannounced times during the day, evening, night, and weekend shifts disclosed many instances of employees sleeping on the job, congregating in offices, arriving late for work, and leaving early. This condition was a major factor in he poor ievel-of patient care at # state hospital: Scanned with CamScannerBasic Managerial Weaknesses: Item Trem Consolidations of Activities and ""Make-or-Buy" Analyses: Item Our comparative analysis of state and private schools for the treatment of juvenile offenders showed significant vari- ations in the portions of the schools’ budgets spent for e2-' ucation, treatment, and administration. Private schools were spending more funds on program activities such as education and psychiatric services, whereas the state schools were spending more on administrative costs. Agency management should have obtained such compara tive data and evaluated their implications. Drug addicts were treated at numerous facilities throvgh- out the state. Our audit showed that per diem costs ranged from $23 to $47. There was a need for manage ment to evaluate the program implications of this wide disparity in costs among the various facilities to maximize Program accomplishment and minimize the costs. A separate hospital with its own administrative staff occa pied three buildings on the grounds of another state hospi- tal. Our audit showed that the limited workload of admi- nistrative activities at this separate hospital, as well as iss proximity to the offices of the main hospital, would per- mit consolidation of the administrative functions of the two hospitels at a savings of $145,000 a year. A local school district exercised contrat over 29 facilities. Our audit showed that the unused classroom facilities amounted to about 28 percent (the equivalent of eight schools).and that enrollment was continuing to dedine. ‘We recommended consolidating and closing facilities to the extent feasible. Such action would not only reduce costs but also provide greater flexibility in class sies and course offerings. Inadequate Management of Assets: Tem The cutstending accounts receivable at a teaching hospital increased from $7 million to $11 million during a two- year period, An audit showed that this situation was caused in part by a lack of aggressive follow-up action, i sufficient supervision, and insufficient staff to keep up with an increasing workload. Scanned with CamScanneri @ Section IV 1NPi> MA an Appeals Compliance Auditing Compliance Audits of Laws More than $6 million in available federal funds were be- ing lost each year because of the failure to bill certain cue Patient services. An audit showed that the problem was caused by the inability of the state and local officials to agree upon a billing format. Source: Martin Ives, “Auultng for Efciency and Economy," The lneral Auditor, Jonuary/ February 1985, pp. 79-80: Internal auditors frequently perform “compliance audits.” The objective of these audits is to determine whether, and to what degree, an organization conforms to certain specific requirements of policy, procedures, standards, or laws and: governmental regulations. The nature of compliance auditing is more objective than cher internal auditing applications, especially management auditing. To perform a compliance audit, the auditor mist know precisely what policies, procedures, standards, etc., are required. Such requirements almost always are documented, as are the activities they govern. For example, job qualifications usually are specified for particular positions, especially for key positions in the organization. These qualifications usually are outlined in job descriptions. To determine if the organization's employees conform to these requirements, auditors can check the backgrounds and qualifications of employees. Infcemation on each employee should be contained in his or her personnel file, including job application form, resume, and references. Usually, compliance audits require relatively litele initial survey work or review of internal controls, except to outline precisely what requirements are being audited. The audit focuses almest exclusively upon detailed testing of conditions. The audit report usually outlines the degres of compliance observed and indicates the number of items conforming to requirements and the number of exceptions. The internal audi¢ report also may indicate reasons for noncompliance. Federal, state, county, and city governments have many laws, ordincnces, and regulations to- govern the activities of organizations. aad Governmental These governmental requirements affect almost every aspect of an \ Regulations ‘organization's operations. Scanned with CamScanner5 neue 0g HRP TEs” serena ET Compliance Auditing as a Profession Auditing of Financial Controls Jaternal auditors ate only one group of important players in this environment. Others also play important roles with respect to legal compliance. Organizations employ legal staffs for counsel on many issues of legal compliance, including real estate purchases, equal employment opportunity for minorities, pension: provisions, envitonmental codes, and operating safety. CPA firms specialize in financial reporting and in auditing for compliance with governmental reporting requirements, such as for the Securities and Exchange Commission (SEC} and the Internal Revenue Service. Various governments consider some legal- requirements so important that they employ their own auditors and inspectors to check compliance by individual organizations. In most cases, internat auditors examine arces of legal compliznce first, so tha: they can inform management early of potential problems. It is usually less expensive for the internal auditors to find the problems and. for management to correct them early than for outsive examiners to find them. If outsid: legat counsel, CPAs, ox governmental auditors discover provlems, they almost always investigate further than they would otherwise, taking more time at . the organization’s expense. Early detection and correction can also expel y help avoid legal sanctions, penalties, and fines. If internal auditors have already audited the activities, and management has taken action to correct observed problems, the outside examiners and auditors often can use documentation from the internal audit and management follow-up, which can help decrease costs, Compliance auditing has evolved into an important part of today's economy. Many auditors, especially those employed by the government, specialize in auditing for compliance. These auditors are trained extensively, often in highly technical, detailed areas. They must know and understand large badies of information and precisely how organizations should operate with respect to specific criteria and standards, They are skilled in specific audit techniques and how t0 work with management to encourage and. motivate proper com pliance, even when management may feel inconvenienced and imposed upon. Internal auditors examine two aspects of financial internal controls: (1) controls ‘over funds and (2) controls aver the accounting for funds. Audits of the management of the acquisition and. use of the organization's funds usually are considered operational or manage- ment audits. Audits of specific controls over the. flow. of funds and Scanned with CamScannerSion Tine of Ault Applications the accounting function are generally considered financial audits. In this section we shall examine financial control concepts, specific financial control systems, and the auditing of financial statemenes. Financial controls are primarily designed to accomplish three internal control objectives: (1) the safeguarding of the organization's financial assets, (2) the reliability and integrity of financial information, and (3) compliance with generally accepted accounting principles (GAAP) as established by the Financial Accounting Standards Board and other recognized entities, such as the Government Accounting Standards Board, the Cost Accounting Stando-ds Board, and: governmental taxing authorities. Safeguarding relates to the potential-risk of loss of an organization's funds and other assets. The emphasis of controls over safeguarding ced primarily on preventive controls, These controls are signed to help ensure: © That the organization receives all of the funds to which it is entied. ® Thar the funds are adequately secured and- maintained. © That the funds are appropriately spent for authorized purposes. emphasis of controls over the reliability and integrity of information is primarily on detective and corrective controls. ‘ancisl data provides management with accurate information ning to the acquisition, security, maintenance, and expenditure ial resources. This information aferts management to proble:+s arising in the funds-flow process, thereby assisting manage vent in correcting those problems and avoiding or minimizing any loseés. sive and corrective controls aze primarily used to help ensure ze with prescribed accounting procedures and guidelines. While particular controls related to these three internal control wgjecaves may emphasize different rypes and methods of establishing nal control, notice the integrative nature of not only the ves, but the controls themselves. Preventive, detective, and arrestive controls are coordinated within the organization's financial satagement function to ensure that the funds-flow process is properly. Because of the integration of these different 5 atnittors frequently encounter compensating controls — i.e., cnatrals aimed at one objective that fulfill another objective as well. There also may be directive controls related to financial ranagerert, bur these relate primarily to decisions on how funds ait Scanned with CamScanner