ACCA F8 (INT) Audit & Assurance - 2010 - Study text

Подождите немного. Документ загружается.

Chapter 5: Internal audit

External audit Internal audit

Role and work To express an opinion on

the truth and fairness of the

annual financial statements.

The external auditor will

therefore carry out

whatever work he deems

necessary to reach that

opinoin.

To examine systems and controls

and assess risks in order to make

recommendations to management

for improvement. The internal

auditor’s work programme will

therefore to a large extent be

dictated by management.

Qualification to

act

Set out by statute. This

ensures that the external

autitor is independent of

the entity and suitably

qualified.

No statutory requirements –

management select a suitably

competent person to act as

internal auditor. It is therefore

possible that the internal auditor

may not be as competent as the

external auditor, depending on

management’s recruitment

criteria.

Appointed by The shareholders. This

ensures independence.

Management. In order to give as

much independence as possible

the internal auditor should

therefore report to the highest

level of management.

Duties set out

Statute. (See above under

role and work.)

Management (See above under

role and work.)

Report to The shareholders. (See

above, under appointed by.)

Management. (See above under

appointed by.)

You should also bear in mind that the external auditor has no specific responsibility

for fraud and error, other than to report whether or not the financial statements give

a true and fair view; the external auditor will be concerned that there has been no

material undetected fraud or error during the period. This is covered in a later

chapter.

The internal auditor may be given specific responsibility for investigating suspected

fraud or error by management, and he is likely to have much lower materiality

thresholds.

Paper F8: Audit and assurance (International)

86 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

Operational internal audit assignments

 Definition of an operational internal audit assignment

 General approach

 Specific processes

 Procurement operations

 Marketing operations

 Treasury operations

 Human resources

2 Operational internal audit assignments

2.1 Definition of an operational internal audit assignment

Operational internal audit assignments involve the internal auditor being asked by

management to look at a particular aspect of the entity’s operations, such as

marketing activities or the human resources department.

Operational internal audit assignments are therefore defined as audits of specific

processes and operations performed by an organisation. They are also known as

management audits, or efficiency audits.

The purpose of an operational internal audit assignment is to assess management’s

performance in the specific area of operations that is subject to the audit, and to

ensure that company policy and control procedures are adhered to.

The audit will identify areas for improvement in efficiency and performance, and

improvements in management.

2.2 General approach

The general approach to an operational internal audit assignment will be

determined by the purpose of the audit. For each area of operations that is subject to

an operational internal audit assignment, the internal auditor should assess:

 the adequacy of the policies, procedures and controls adopted, and

 the effectiveness of the policies, procedures and controls.

Adequacy of policies and procedures

The internal auditor should assess whether the policies and procedures are

adequate for their purpose. The key question that needs to be answered is:

Will the policies achieve the relevant objectives?

The policies, procedures and controls should therefore be reviewed by the internal

auditor in the context of the objectives which they are designed to achieve.

Chapter 5: Internal audit

Effectiveness of policies and procedures

If policies and procedures seem to be adequate, the internal auditor should then ask

whether they are being applied properly. The key question that needs to be

answered is:

Are the processes operating effectively?

This will involve the internal auditor testing the processes, using techniques similar

to those used in tests of control (covered in a later chapter).

2.3 Specific processes

For your examination, knowledge is required of four specific processes:

 Procurement: operations concerned with purchasing.

 Marketing: operations associated with obtaining information about customer

needs and trying to increase sales demand.

 Treasury: Treasury operations are concerned with management of the entity’s

short-term and long-term financing. A Treasury department may be responsible

for managing the long-term and short-term borrowing of the entity, the

investment of short-term surplus cash, the management of the entity’s cash, and

managing financial risks such as exchange rate risks and interest rate risks.

 Human resources management: operations concerned with managing people –

the employees of the entity.

For any area of operations subject to an operational internal audit assignment, the

internal auditor needs to consider:

 the risks

 the control procedures for managing and limiting the risk, and whether these are

adequate

 how the control procedures can be tested, to make sure that they are working

effectively.

Each of the four areas of operations is considered in turn below.

2.4 Procurement operations

In many organisations, procurement is the specific responsibility of a buying

department or purchasing department. Organising this activity in a centralised

department should help to ensure that spending is managed and controlled.

The main risks with procurement are as follows:

 The entity may buy items that it does not really need or cannot afford.

 It may pay prices that are higher than necessary. Items might be available at a

lower price.

 Some payments to suppliers may be fraudulent; for example, some suppliers

may receive payments for items they have not supplied.

 The entity might pay suppliers the wrong amount.

Paper F8: Audit and assurance (International)

88 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

 The entity may take too long to pay (longer than the time agreed in the terms of

credit with the supplier). This could have an adverse effect on the business

reputation of the entity.

Various controls can be applied to manage these risks:

 The entity might establish an authorised list of suppliers, and (as a matter of

policy) goods and services can be purchased only from suppliers on the list.

(There may be exceptions to the policy guidelines. For example, a company

policy may be that a supplier must be on the authorised list if more than one

purchase order is ever placed with the supplier, but for one-off purchases, a

supplier does not need to be on the list.)

 There should be procedures for the requisition of goods and services, and

procedures for the authorisation and approval of purchase orders. For example,

requisitions to purchase store items may be generated by the store department’s

inventory control system, and the authorisation for the purchase and the placing

of the purchase order should be made by individuals at a suitable level of

seniority, depending on the size and value of the order.

 There should be established policies and procedures in the buying department

for negotiating favourable prices with suppliers.

 For very large purchase contracts, it may be a policy requirement that a system

of tendering should be used, and more than one supplier should be asked to

tender for the contract.

 Supplier performance should be monitored. Have they delivered goods on time

and to the specified quality?

 The payments system should be subject to suitable controls. (These are largely

financial controls and so should be subject to the annual external audit.)

 There should be a control reporting system that reports to management on

supplier performance and any breach of purchasing policy guidelines and

procedures.

To test the effectiveness of these policies, procedures and controls, the internal

auditor should carry out a number of checks:

 He may carry out a check on a sample of purchase orders, tracing the order from

the original purchase requisition, through authorisation and placing the order, to

delivery, invoicing and payment. Were the correct procedures followed? Was

the purchase authorised properly? Was the order placed with a supplier on the

approved list? Was the pricing correct? Were the items delivered on time? Was

the invoice correct? Was it paid within the allowed credit period?

 The internal auditor should also review the controls applied by management. If

reports are provided to management about purchases that did not follow the

approved procedures, what action did management take?

2.5 Marketing operations

Marketing can be a difficult area of operations for an operational internal audit

assignment. This is partly because it is difficult to establish the effectiveness of some

activities, such as advertising and branding; and some marketing activities may

Chapter 5: Internal audit

have a long-term impact but may not be effective in the short-term (such as using

marketing to build a corporate image).

Marketing activities differ widely between different types of business. Some entities

rely heavily on direct selling by sales representatives. Others rely more heavily on

advertising. All entities should be trying to find out as much information as they

can about what customers (and potential customers) are buying, and what they

would like to buy.

However, marketing is much more than just selling and advertising and obtaining

market research information. It is useful to think of marketing activities in terms of

the ‘four Ps’:

 Product. The product itself (or service) is an aspect of marketing. Does it meet

the needs of customers as effectively as it could? Product design and product

quality have an important influence on the buying decisions of customers for

many items. The ‘product’ also includes related services such as after-sales

service (repairs and maintenance).

 Place. The delivery of the product to customers is an element of marketing. How

does the product get to the customer? Where does the customer have to go to

buy it? For example, consumer items may be sold by shops, supermarkets and

general stores, or by specialised retail outlets. Some items can be purchased on

the internet.

 Price. The price of the product is a key element of marketing, because customers

will often make their buying decisions on the basis of price. Discounts and

special price offers, for example, are a common feature of marketing consumer

products in retail stores.

 Promotion. These are the activities that are probably most associated with

marketing, such as market research activities, advertising, sales promotion, and

direct selling.

The main risks in marketing operations are as follows:

 Market research is inadequate, and the entity fails to obtain enough information

about what its customers want and what its competitors are doing.

 Marketing activities are ineffective because the four Ps of marketing are not

planned in a co-ordinated way.

 Too much marketing spending achieves too few positive results.

 Marketing initiatives are not properly co-ordinated with other operations of the

entity. For example, there is a risk that marketing campaigns to sell a particular

product may fail because there is insufficient production capacity and inventory

to meet the anticipated increase in demand.

 In some cases, there may be the risk of adverse publicity, which could affect the

reputation of the company and customer demand for its products.

Controls applied to the marketing operations are largely management controls, and

there is a need to plan and co-ordinate marketing activities and to monitor and

review their effectiveness. The key controls may therefore be as follows:

Paper F8: Audit and assurance (International)

90 Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides © EWP

 There should be a marketing strategy, fully documented and approved at senior

management level.

 There should be a system for preparing detailed and co-ordinated marketing

plans, and for reviewing and updating plans.

 There should be systems in place for gathering market research information, and

learning about customers’ opinions.

 Planning should include procedures for assessing the cost-effectiveness of

marketing activities.

 There should be procedures for inter-departmental co-ordination. For example,

there should be procedures for co-ordinating marketing activities with the

activities of other departments, such as production and warehousing.

 There should be a reporting system for monitoring the performance of

marketing operations (including a system for reporting marketing spending and

comparing this with budgeted spending levels) and for taking control action

where performance is unsatisfactory.

 Marketing staff should be trained sufficiently to carry out their tasks efficiently

and effectively.

Tests of these controls over marketing operations will consist mainly of reviewing

the management systems:

 Is there a documented marketing strategy? How often is it reviewed? Does the

strategy appear reasonable?

 Is there a system for preparing marketing plans over the short-term and the

longer-term? Is planning well co-ordinated between different marketing

activities, and between the marketing department and other departments?

 Do the systems for obtaining market research information provide the quality

and amount of information required?

 Do the procedures for monitoring and controlling marketing performance

appear to operate effectively?

 Are the programmes for training marketing staff adequate?

2.6 Treasury operations

Operational internal audits of Treasury operations can be difficult for internal

auditors because of the specialised nature of some Treasury activities, such as

trading in the financial markets, including trading in financial derivatives

instruments.

The main risks in Treasury operations, for a large Treasury department, may be as

follows:

 There is a risk that the Treasury department will raise finance for the entity in an

inefficient or inappropriate way. For example, interest rates on borrowing may

be higher than necessary. There may be too much short-term borrowing and not

enough longer-term borrowing (or not enough short-term borrowing and too

much long-term borrowing). The balance between equity finance and debt may

be inappropriate, resulting in a high cost of capital for the entity.

Chapter 5: Internal audit

 The Treasury department may fail to manage the financial risks of the entity

sufficiently. For example, it might make insufficient use of forward contracts (for

foreign exchange) and may fail to manage interest rate risk using derivatives

such as swaps.

 The Treasury department may employ ‘dealers’ for foreign exchange or

investing surplus funds. Dealers may exceed their trading limits. They may

make mistakes when dealing, such as buying when they ought to sell, or making

a mistake when agreeing the price or the quantity for a transaction. Dealers may

also fail to record/document their transactions properly.

 The Treasury department may earn only a low return on their investment of

surplus funds.

Controls over Treasury activities may therefore include the following:

 There should be a Treasury policy, set at the highest management level, about

the capital structure of the entity. Treasury activities should be carried out

within the overall financing policy guidelines.

 There should be regular reports from the Treasury department to a senior

financial manager (such as the finance director) on the activities of the

department, including the costs of its borrowing and the returns on investment

of surplus cash.

 There should be Treasury policy guidelines on the use of financial instruments

(such as forward contracts and financial derivatives) for hedging exposures to

financial risks.

 There should be controls over dealers, such as dealing limits. The activities of

dealers should be closely supervised and monitored. Regular audits of dealers’

transactions may be an appropriate form of control. There should be a

segregation of duties between dealing (buying and selling in the financial

markets) and settlement (payments and receipts of money in relation to deals).

An operational internal audit should check the effectiveness of these controls:

 The internal auditor may look at the performance of the Treasury department,

and analyse the effectiveness of its borrowing (the cost of borrowing) and its

investment activities.

 The internal auditor should also look at the finance raised by the Treasury

department for the entity, and check that it is consistent with the entity’s policy

guidelines.

 The use of financial instruments to hedge exposures to financial risk should also

be checked. The internal auditor should assess whether the Treasury department

has obtained sufficient protection against financial risks, or whether the entity

has been over-exposed to the risks.

 The controls over dealing should be checked through normal auditing

techniques of observing and:

− checking samples of transactions (the size and nature of the transactions, the

price for the transaction, documentation and settlement), and

− making checks on dealers’ trading positions and whether these have been

properly supervised and have remained within limits

Paper F8: Audit and assurance (International)

2.7 Human resources management

There are several aspects to the management of human resources. These include:

 Recruitment and selection

 Pay and terms and conditions of employment

 Training and development

 Disciplinary and grievance procedures

 The management of redundancy arrangements and other leaving arrangements

 Maintaining employee records

The main risks associated with human resources are as follows:

 Not having enough employees to achieve the objectives of the entity.

 Failing to recruit employees with the required skills

 Failing to train employees to the required standards and failing to develop

individuals for advancement to more senior positions within the organisation

 Failing to comply with employment legislation

 Paying more for employees, in terms of salaries and other benefits, than the

entity can or should afford

 Failure to monitor the performance of employees, and failing to get efficient and

effective performance from employees.

For each of these aspects of human relations management, there should be systems

and controls:

 There should be a human resources strategy, linked to the overall strategy of the

entity. There should also be a detailed human resources plan, setting out the

required numbers and skills of employees, and policies for making sure that

these staffing levels are achieved.

 Within the overall human relations plan, there should be plans for recruitment

and for training and development.

 There should be formal procedures for dealing with disciplinary matters and for

dealing with grievances from employees. These must conform to the

requirements of national laws and regulations.

 Similarly, there must be established procedures for dealing with redundancies,

that must comply with national legislation.

 There should be a system for the regular monitoring of employee performance,

and for maintaining records of performance reviews.

 Labour costs should be monitored at appropriate levels of management (by the

board of directors, and also by managers at departmental level).

An operational internal audit into human relations activities will seek to establish

whether these controls are efficient and effective, and so whether they achieve their

objectives.

Chapter 5: Internal audit

 The internal auditor may carry out some analytical procedures (covered in a

later chapter), to assess:

− the level of spending on employment costs (for example, have there been any

significant changes in the ratio of employment costs to total expenditure?), or

− the level of labour turnover, and whether the entity is failing to retain

sufficient staff with the skills and experience that the entity needs

− where analytical procedures indicate something unusual, such as steeply-

rising labour costs or a high rate of labour turnover, the auditor should

investigate the reasons.

 The internal auditor should also review the various human resources plans (the

overall plan, and plans for recruitment and for training and development).

 Some tests can be carried out into the effectiveness of implementing plans.

− For example, the internal auditor can look at a sample of recruitment

activities, to find out whether the attempt to recruit a new employee was

successful, how long it took and how much it cost, and whether the entity

was able to recruit its first-choice applicant.

− Similarly, the internal auditor could look at a sample of training

programmes, and assess their purpose and whether each programme

achieved this purpose, in terms of the numbers trained, the cost of the

training and the resulting improvement in skills.

 The internal auditor can also look at a sample of cases involving disciplinary

procedures, grievance procedures or redundancies, to make sure that the correct

procedures were followed.

 The internal auditor could also check a sample of employee records, to make

sure that these are being properly maintained and are up-to-date.

Paper F8: Audit and assurance (International)

Nature and purpose of other internal audit assignments

 Introduction

 Value for money audits

 Problems with VFM audits

 Best value audits

 Financial audits

 Information technology (IT) audits

3 Nature and purpose of other internal audit

assignments

3.1 Introduction

The internal auditors work on behalf of management and report to management.

The type of work they do will therefore be dictated by what management wants

them to do. However, it is possible to list the other work that might be done by

internal auditors under the following broad headings:

 Value for money audits

 Best value audits

 Financial audits

 Information technology (IT) audits.

3.2 Value for money audits

The value for money (VFM) audit originated in public sector organisations as a way

of assessing financial performance. In public sector organisations, conventional

profit-based measures are not appropriate because the objectives of these

organisations are not usually to make a profit. The concept of value for money and

the VFM audit has now been widely adopted by commercial organisations as a

means of assessing performance on a broader basis than just profit.

Value for money, as the term suggests, means getting good value from the money

that an entity spends. Value for money is obtained from a combination of the ‘3 Es’:

 economy

 efficiency

 effectiveness.

Economy means not spending more than is necessary to obtain the required

resources. At a very basic level, it means buying supplies from the cheapest

suppliers of materials of the desired quality, avoiding excessive salary payments to

employees and avoiding unnecessary spending on other items of cost.

ACCA F8 (INT) Audit &amp; Assurance - 2010 - Study text - Emile Woolf Publishing

Подождите немного. Документ загружается.

ACCA F8 (INT) Audit & Assurance - 2010 - Study text - Emile Woolf Publishing