WEEK 14 REPORT

Presented by:

Aileen M. Manangan
Joebert S. Roderos
 TOPIC OUTLINE

Ascertaining the System

Evaluation
Testing Strategies
Evidence and Working Papers
ASCERTAINING THE SYSTEM
 Systems-based auditing relies on evaluating the whole system
of risk management and internal control, which ensures operational
objectives will be achieved. This task can only be performed where
the systems that are being considered
Alternative Methods
are properly understood, which in
turn relies on the auditor’s ability to 1. narrative notes
document the system efficiently. 2. block diagrams
There are several alternative 3. flowcharts
methods, each with its own 4. internal control
advantages. questionnaire
 NARRATIVE NOTES

Systems are set out by straightforward narrative where the main parts
of the system are noted in point format. The processes are described from start
to finish to convey the required information on which to base an evaluation.
The bulk of these systems notes may be taken direct from the interview with
the operations manager. For simple systems that do not involve much document
flows, this may be sufficient. For more complicated systems it may be necessary
to go on to draft a block diagram and/or a detailed flowchart. Narrative
provides a useful short-cut to systems documentation and as long as it conveys
the right information clearly, it is a valid technique.
 BLOCK DIAGRAMS
Block diagrams fall in
between detailed flowcharts and
narrative. They consist of a
series of boxes each representing
an operation or control. The
main advantage is that this
technique is quick and simple,
and sample diagrams can be
incorporated within the audit
report to aid understanding by
outlining the system. BLOCK DIAGRAM
FLOWCHARTS

TYPES OF FLOWCHART
BASIC FLOWCHARTING RULES
The Rules of Flowcharting

Provide clear Look for Test the Distinguish Number

headings and exception flowchart between the events
dates so that routines against the operations/ in
the system dealt and note client’s processes sequential
with is clearly these so understand and controls order as
identified. Do that a -ing of the so that the they may
not make them complete system. flowchart be
unnecessarily picture is can feed referred
complicated as provided. 3 directly into to in
this consumes the control other
time and may 2 evaluation audit
not aid the procedures. working
audit process. papers.
4
1 5
The Rules of Flowcharting

6 7 8 9 10
Keep the Show Distinguish Use a Apply
narrative destination between convention of standardized
brief to of all information moving symbols and
avoid documents and through the keys that are
making by not documentation system – top fully agreed
the leaving flow. to bottom and and detailed
schedule loose ends. from left to in the audit
appear right. manual.
cramped.
STANDARD FLOWCHART SYMBOLS
Evaluation
 Evaluation may be seen as the most important stage in any audit
review since this provides an opportunity for auditors to apply professional
creativity to the fullest. The audit opinion and recommendations should flow
from the systems weaknesses identified during the systems evaluation. Audit
testing routines are carried out to confirm the original evaluation in terms of
the application of controls and the effects of control weaknesses. If the
evaluation is flawed then all the remaining audit work will suffer. Audit
recommendations will provide substandard solutions to risk exposures.
Evaluation Techniques
2
Transactions testing. By testing
1 transactions one might pick up systems
Flowcharts. These malfunctions that cause error conditions
help identify systems identified by the tests. Where we are
blockages, duplication able to manipulate large amounts of
of effort and data, the ability to carry out a limited
segregation of duties range of tests quickly arises. This
along with controls cannot be seen as a systematic
that depend on evaluation since it does not rely on a full
documentation flows understanding of the operation under
and the way work is review, but leaves matters to chance as
organized. samples are selected and examined.
 3
Directed representations. One
cannot deny the usefulness of
information provided by persons who
have knowledge of the system. If
management states that there are
defined systems weaknesses at the
outset of an audit, one would be ill-
advised to ignore this source of
information. Complaints from users,
operatives, middle management and
third parties can provide a short-cut to
the evaluation process. One would look
for bias in these comments as they
could not be taken without some
degree of substantiating evidence.
4
Internal Control Questionnaires.
ICQs are widely used to assist the
control evaluation process and there
are many standard packages. They
consist of a series of questions
applied to a particular operation and
designed so that a ‘no’ answer
indicates a potential control
weakness.
 5
Internal Control Evaluation System
The ICES is partly a conceptual model linked
directly to the systems-based approach and
partly a mechanism for setting out the
evaluation process in matrix format. Unlike
ICQs it involves setting out the components of
good evaluation in a schedule (or matrix) format
so that a systematic series of steps can be
undertaken before testing, conclusions and
recommendation are made.
TESTING STRATEGIES
 Testing is the act of securing suitable evidence to support
an audit. It confirms the auditor’s initial opinion on the state of
internal controls. It is a step in control evaluation, although many
auditors test for the sole purpose of highlighting errors or non-
adherence with laid down procedure. It depends on the audit
objective. The IIA Practice Advisory 2240-1 requires audit
procedures to be in place to ensure the required evidence can be
gathered.
 The auditor should gather
sufficient evidence to support audit
findings. This means the information
should be factual, adequate and
convincing so that a prudent, informed
person would reach the same conclusions
as the auditor. Competent information is
reliable and the best attainable through
the use of appropriate engagement
techniques. Relevant information supports
engagement observations and
recommendations and is consistent with The Testing Process
the objectives for the engagement. Useful
information helps the organization meet
its goals.
The Four Types of Tests Substantive

Walk-through Substantive tests seek to

determine whether control
objectives are being achieved.
Walk-through tests seek to
determine how the system’s
objectives are achieved.
Compliance
Dual purpose
Compliance tests seek
to determine whether
Dual purpose tests check for both
control mechanisms are
compliance and actual error, abuse
being applied.
or inefficiency.
Comparing Compliance and Substantive Tests
Evidence
and
Working
Papers
 Audit testing results in much material that should support the
reported audit opinion and associated recommendations. The test results
along with other material gathered throughout the audit process will
constitute audit evidence and this will be held in suitable audit working
papers. Standards of working papers and documentary evidence are a
topic that all auditors come across in the course of their work and
generally there is a view that good standards are a prerequisite to good
control.
Practice Advisory 2330-1 covers documenting information,
based on standard 2330:

“Internal auditors prepare working papers. Working

papers document the information obtained, the analyses
made, and the support for the conclusions and
engagement results. Internal audit management reviews
the prepared working papers.”
 SUFFICIENT. Sufficient means enough, which depends on circumstances. It
should be enough to satisfy the auditor’s judgement or persuade management
to make any changes advocated by audit. Evidence is adequate when it meets
Evidence Attributes
the desired purpose.

RELEVANT. Relevance means that the evidence is associated to the key

concerns and that it is material to them.

RELIABLE. The information should be accurate, without bias and if

possible produced by a third party or obtained directly by the auditor. The
term ‘reliable’ stimulates images of the evidence being ‘dependable, honest,
sound and true’.

PRACTICAL. One would weigh up the evidence required, the cost and time
taken to obtain it and sensitivity.
Types of Evidence

Documents
Re-performance by audit
Analysis of figures
Reconciliations
Third-party confirmation
Reports Vouching checks
Verification
Testimonials
Physical material, eg. photographs
Interview records
Working Papers
Set out the objectives of the
work. The entire documentation
is prepared or secured for a
reason and this reason should be
defined at the outset.
Support the audit
decisions/opinion. Working
papers are secured primarily to
ensure that audit findings can
be justified.
Be indexed. This should
indicate where documents can
be found and what each one
contains.
Show clarity. The working papers
should be laid out clearly to
promote their use during report
writing and review of work.
Papers should be set out in a neat
and orderly fashion that is logical
and simple.
 Be headed up.
Be cross-referenced. In an audit each stage leads All documents
naturally to the next. Findings from one piece of research should contain
will impact on work done on other areas as the flow and headers with the
direction of the audit changes with new findings. These name of the
links and associations should be reflected in the working audit, date,
papers by a suitable system for cross-referencing. relevant officers
and other
Use pro forma. One way to details. Any
promote the use of audit Be economically used. document
standards in working papers The papers should not prepared by the
is to use standardized be prepared for their internal audit
documents. own sake but must unit should be
relate to specific audit able to be
objectives. identified by the
headings.
 Clearly show any impact on the audit report. Some documents have a
profound impact on the audit report while others provide background. The
status of working papers should be clear in that items that feature in the report
should be indicated.

Be signed by the auditor and the reviewer.
It is practice to place at the bottom of each
document, boxes for ‘prepared by’ and
‘reviewed by’ along with spaces for the dates.
Show the source of information/data.
The origins of information in working
papers should be clearly defined.
Show the work carried out.
Documents support the audit
opinion and contain matters
that may be referred to in the
audit report. While this gives a
bottom-line use for the working
papers it is equally important
that the underlying work
completed be fully identified.
 Indicate which matters are outstanding. A working paper will say
what has been done and the results of this work. For the record it
should make clear what work has not been undertaken as this may arise
as an issue. Where parts of the system have not been addressed this
should be made clear, particularly where a different level of work would
have been required. Where samples have not been fully tested because
of various practical difficulties this point should appear on the working
paper to explain why certain items have no results listed against them.

Show any impact on the next audit. The working paper indicates what
has been left for later consideration. The nature of audit work means
that not all matters are addressed in any one operation and two audits
can be carried out in the same area dealing with different aspects.
Be complete.
Files should Be consistent. Working papers should be wholly consistent.
be complete,
in that all
they purport Include summaries wherever possible. It is one
to cover is thing to obtain and file vast volumes of reports,
dealt with. printouts and documentation in that they impact on
the audit. What is more important is to digest,
analyse, and then summarize the material
components of this information so as to avoid re-
reading bulky material. So a consultant’s report on an
operation should be read by the auditor and then key
points extracted and summarized.
Thank you.