Audit Plans and Budgeting

Defining the audit universe

 OpCo Logo

• An audit universe represents the potential

range of all audit activities and is
comprised of a number of auditable
entities.

• These entities generally include a range of

programs, activities, functions, structures
and initiatives which collectively contribute
to the achievement of the department’s
strategic objectives.

3
Defining the audit universe

► What is the Purpose of the Audit Universe? Can these purposes be

achieved in other ways?
► What is the optimum structure of the Audit Universe? Business
decomposition, organisational unit, process or a matrix?
► How can an audit universe be properly maintained?
► How can business acceptance of the universe be achieved?

Page 4
Defining the audit universe

Internal Audit should have effective processes to identify all auditable entities
within the auditable universe. The number of auditable entities will depend
upon whether entities are captured at individual department or at other
aggregated organisational levels.

Factors to consider can include:

► Departments/ functions/ ► Major operating systems
geographies ► Major product lines
► Organisation charts ► Significant laws/regulation
► Management listings ► Key risks
► General ledger ► Other data points
► Cost centres
The audit universe should be documented and reviews periodically
(recommended annually, or as significant organisational, financial, risk or
product changes occur).
Federal
Reserve,
Page 5 2013-01
Internal Audit planning considerations

The annual plan should be developed with the ultimate objectives of internal
audit at its core. The plan must generate the overall outcome required of
internal audit – high impact reporting and sustainable improvements in the
organisation.
Clarity of purpose Substantive Importance of
and role outcomes independence

Shape of Audit Utilisation of Appropriate audit

Plan resources response

Improved impact
in reporting

Page 6
Dynamic audit planning

What is it?
 Dynamic = not static

 ‘Annual plan’ is a thing of the past

 Requires regular changes – weekly, monthly, quarterly

 Draws, systematically and regularly, on multiple feeders incl. stakeholders

views, risk analysis, strategy, external developments

Why?
 Audit Committees (should) expect it

 Circumstances and priorities change - sometimes very quickly

 Need to be ‘front of foot’ e.g. hot topics; themes

 Forward looking vs. ‘rear view’

IIA Seminar 7
April, 2014
 Optimise resource allocation
Developing a rolling audit plan

APPROACH

 Identify the main drivers of your plan

Strategy
 Identify and ensure access to key sources of
information
Business
• Strategic review / update performance
Risk analysis
• Board papers
• Committee papers e.g. Risk
• Attendance at meetings
• Investment & project proposals
• Project update reports / steer co.
minutes Change
Stakeholders
• Regular scheduled meetings with key management
stakeholders e.g. Audit Co Chair; CEO;
FD
• Performance reports (e.g. monthly
management accounts)
IIA Seminar 8
April, 2014
Developing a rolling audit plan cont.

Structure
Category
 Establish and agree a clear ‘cascade’ of
priorities which fits your organisation
• Change management support & reviews
 Populate quarter by quarter • Investigations and special projects
• Thematic reviews
 Clear focus on the current quarter • Process reviews

• Cyclical audits
 Planning should be ‘thinner’ as you move
• Ad hoc advice and support
further along the time horizon

IIA Seminar 9
April, 2014
Process and timing cont.

Communication

The quarterly rolling plan should be a ‘live’ document, communicated regularly

e.g. in meetings; Committee updates etc

Recommend showing prior two quarters (combined), current quarter and next
two quarters for context / reference

Audit Committee needs to understand the process, articulate its priorities and
allow leeway to the head of audit to exercise judgement and flex the plan
between Committee meetings

IIA Seminar 10
April, 2014
Final thoughts

Dynamic planning:

 requires and encourages greater engagement

 involves regular judgement and is more

professionally / intellectually challenging

 delivers more transparent and efficient resource

allocation

 works in tandem with other key Group

processes - e.g. strategic planning cycle; risk
reviews - and, therefore, will feel more relevant

 should not overlook the importance of routine,

cyclical reviews, including areas of ‘lower’ risk

IIA Seminar 11
April, 2014
 Internal Audit - Budgeting

12
Internal Audit Team

• Internal Audit Team

• Head of Internal Audit
• Audit Manager
• Auditors
• Consultants
• Secondees

• Functional reporting line to the Chair of the Audit Committee.

• Administrative reporting line to the Group CFO.

13
Developing a realistic budget

• What are the IA deliverables ?

• Articulated in a Strategic / Tactical Plan

• Approval of the Plan

• How are you going to achieve the Plan – Need for a BUDGET
• People / Skillsets
• Consultants
• Ad-hoc
• Fraud

14
Developing a realistic budget

• Other Cost Drivers ?

• Who owns the budget ? Accountability ?

15
Developing a realistic budget

• Other Cost Drivers ?

• Travel – Air, Train, Car, Hotel, Subsistence (Policy!)

• Recruitment (Agencies, In-house)
• Training
• IT Hardware
• IT Software
• Subscriptions And Publications
• Outsourced services
• Corporate recharges / Overheads / Fixed Costs
16
Incorporating “non-audit” activities

• What are “non-audit” activities ?

• What percentage of time do they take ?

• How can they be factored into the budget ?

17
Monitoring and Reporting
• Cost Capture

• Cost Allocation

• Cost Reporting

• Cost Monitoring

• Forecasting

• Monthly Cycle
18
Monitoring and Reporting

No Surprises !

Monitoring month by month :

19
Monitoring and Reporting

No Surprises !

Monitoring year to date:

20
Monitoring and Reporting

Underspend and Overspend :

Communicated Timely ?

Approved ?

Forecast adjusted ?

21
Common Pitfalls

1. Planning based on last year’s budget.

Rushing through the planning process by tweaking last

year’s budget instead of starting with this year’s goals and
objectives.

Action : Clarify what internal audit objectives are for

the coming year, and put in place a plan that supports
those objectives. Focus investment where it makes
sense in the coming year rather than spending in the
same budget ‘buckets’ as last year.
22
Common Pitfalls

2. Descending into Spreadsheet Chaos !

Use of massive spreadsheets or workbooks with multiple

tabs, unwieldy number of columns, macros and multiple
versions. Only the person that created the spreadsheet can
understand and navigate through the data.

Action : Adopt a disciplined approach with a

spreadsheet that is from a single source (version
control) and that is appropriately formatted with
explanations in the spreadsheet.
23
Common Pitfalls
3. Planning the internal audit budget
within the Finance framework

Issues can arise when finance assigns a couple of line items to

internal audit. Lack of correlation between IA plan and the overall
finance plan. Risk of mistakes being exposed and lack of
credibility.

Action : Boost confidence with the Finance team by having

a detailed budget that aligns to any summary numbers in
the overall Finance budget. Evidence that IA are budget
conscious and supports company’s objectives and goals.

24
Common Pitfalls

4. Hiding the Plan, restricting

optimal decisions

Lack of visibility and execution makes even the best plan

meaningless.

Action : Your IA plan needs to flow into the day-to-day

execution of the internal audit function, including all
activities granting relevant people visibility into their
parts of the plan and budget.

25
Common Pitfalls

5. Ignorance of current spend

Lack of reliable data of amount spent in the current month

and year-to-date.

Action : Obtain the granularity of data to be able to

understand current expenditure versus budget.

26
Common Pitfalls

6. Lack of communication of plan and progress against the

plan

Lack of grasp of budget by the various teams /groups

within the internal audit function.

Action : Communicate plan to the entire team in order

for all to execute the action items of the plan.

27
Common Pitfalls

7. Following the adage: “"Never base your budget requests on

realistic assumptions, as this could lead to a decrease in your
funding."

Excessive buffering and padding of the budget so as to minimize

any questions or interference by Finance.

Action : Internal Audit need to be ethical, evidence sound

judgment in behaviours and lead by example.

28