3
Developing Operational
Review Programmes for
Managerial and Audit Use
SCOPE
In this chapter we start by introducing a practical method of documenting all the
elements of an operational audit review in a form which resembles the traditional
internal control questionnaire (ICQ). We have called this method Standard Audit
Programme Guides (SAPGs). The chapter concludes with a discussion on the
subject of risk in operational auditing and features a control matrix approach to
assessing risk and control effectiveness.
The original concept of SAPGs was built around their use within word processing software, where each discrete program was a separate document file that
could easily be updated and maintained using the facilities of the word processing
environment. This form of usage had the principal advantage of being a familiar
software environment supported by extensive functionality. However, printed blank
proformas can be used as an alternative.
In this chapter we shall discuss the format of the SAPG and how to use it.
The landscape format of the SAPG illustrated in this chapter is, of course, but one
possible layout, and users of this technique can create their own design within the
word processing system of their choice.
To save space, we will in subsequent chapters give listings of relevant control
objective and risk/control issues taken from some of the SAPG documents, but
not in the full SAPG landscape format. Our general aim is to highlight the salient
points of audit concern for the functions and activities rather than to emphasise any
particular SAPG document layout.
The full set of almost 200 SAPGs, in landscape Word format, is available on a
password protected website accompanying this Handbook. Those available in this
way when this Handbook went to print are listed in Appendix 1.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
41
PRACTICAL USE OF SAPGs
SAPGs are intended for use during management and audit reviews of activities
within an organisation.
Today an increasing amount of auditing is done in a self-audit context where
management, together with their staff, consider in quite a formalised though
participative way (a) the risks of not achieving their objectives now and into the
future, and (b) whether internal control is equal to the task of giving reasonable
assurance of achievement of objectives. We discuss control self assessment (or
control risk self-assessment as it is often called) fully in Chapter 10. SAPG
documents offer an ideal basis for control self assessment. They raise the right
questions and encourage management and staff to consider whether controls are
satisfactory to address the issues raised. They provide a self-documenting record of
the progress of the control self-assessment which is available for subsequent audit
or senior management review. The classification of SAPGs into a wide variety of
business activities means that a suitable SAPG is likely to be available for most
functional areas. Where the scope of the self assessment is a complete operating
unit, a high level review programme, which we discuss later in this chapter, is
likely to be appropriate.1 In other chapters of this Handbook we provide checklists
of control issues which are as relevant to managers for self-audits as for auditors
to use during their audits.
In the auditing context, there are obviously a number of ways that the organisation can be divided for the purposes of reviewing the effectiveness of internal
controls. For example, functionally based on the organisational structure, or operationally based on the prime activities of organisation. SAPGs can be used in a
variety of ways, and each SAPG can be suitably scoped to meet the method of
defining the discrete audit review projects. For example, an audit department could
choose to view the organisation as noted in the following listing, and accordingly
create a separate SAPG for each activity or system. This example structure is based
on the division of the audit universe of potential review projects into 12 main areas.
1.
Management and Administration
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
The control environment
Organisation (i.e. structure)
Management information
Planning
Risk management
Legal department
Quality management
Estates management and facilities
Environmental issues
Insurance
Security
Capital projects
Industry regulation and compliance
Media, public and external relations
Company secretarial department.
42
THE OPERATIONAL AUDITING HANDBOOK
2.
Financial and Accounting
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
3.
Personnel
•
•
•
•
•
•
•
•
•
•
•
4.
Treasury
Payroll
Accounts payable
Accounts receivable
General ledger/management accounts
Fixed assets (and capital charges)
Budgeting and monitoring
Bank accounts and banking arrangements
Sales tax (i.e. VAT) accounting
Taxation
Inventories
Product/project accounting
Petty cash and expenses
Financial information and reporting
Investments.
Human resources department (including policies)
Recruitment
Manpower and succession planning
Staff training and development
Welfare
Pension scheme (and other benefits)
Health insurance
Staff appraisal and disciplinary matters
Health and safety
Labour relations
Company vehicles.
Procurement
• Purchasing.
5.
Stock and Materials Handling
• Stock control
• Warehousing and storage
• Distribution, transport and logistics.
6.
Production/Manufacturing
•
•
•
•
•
•
•
Planning and production control
Facilities, plant and equipment
Personnel
Materials and energy
Quality control
Safety
Environmental issues
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
• Law and regulatory compliance
• Maintenance.
7.
Marketing and Sales
•
•
•
•
•
•
•
•
•
•
8.
Product development
Market research
Promotion and advertising
Pricing and discount policies
Sales management
Sales performance and monitoring
Distribution
Relationship with parent company (for overseas or subsidiary operations)
Agents
Order processing.
After Sales Support
• Warranty arrangements
• Maintenance and servicing
• Spare parts and supply.
9.
Research and Development
•
•
•
•
•
10.
Product development
Project appraisal and monitoring
Plant and equipment
Development project management
Legal and regulatory issues.
Information Technology
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
IT strategic planning
IT organisation
IT sites
Processing operations
Back-up and media
Systems/operating software
System access control
Personal computers
Software maintenance
Local area networks (LANs)
Databases
Data Protection
Facilities management
System development
Software selection
Contingency planning
Electronic data interchange (EDI)
Viruses
Electronic office
43
44
THE OPERATIONAL AUDITING HANDBOOK
•
•
•
•
11.
Contracting
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
12.
User support
Spreadsheet design
Expert systems
IT accounting.
Contract management environment
Project management framework
Project assessment and approval
Engaging, monitoring and paying consultants
Design
Assessing viability/competence of contractors
Maintaining an approved list of contractors
Tendering procedures
Contract and tender documentation
Insurance and bonding
Selection and letting of contracts
Management information and reporting
Performance monitoring
Sub-contractors and suppliers
Materials, plant and project assets
Valuing work for interim payments
Controlling price fluctuations
Monitoring and controlling variations
Extensions of time
Controlling contractual claims
Liquidations and bankruptcies
Contractor’s final account
Recovery of damages
Review of project outturn and performance
Maintenance obligations.
Governance, Risk Management, Internal Control
(Note that this group is numbered as Set 14 in Appendix 1 and in the
web-based SAPG resource.)
•
•
•
•
•
Internal governance processes
The board
External governance processes
Risk management processes
Issues for internal control.
During the course of an audit review there will be a number of common factors
to record and evaluate. For example, the control objectives for the activity being
reviewed, the risks or operational issues, the controls and measures in place to
address the risks and issues, the results of audit testing and the conclusions drawn.
The SAPG format illustrated later in this chapter will cater for all these factors
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
45
and we will subsequently describe how the SAPG can be completed and used to
document these key review elements.
Once they have been developed for use, the SAPGs can be used either singly
or in various combinations to provide detailed guidance and direction during audit
projects and field visits. They should aim to define the key and essential knowledge
about a given subject, and thus form a key part of the audit documentation.
The scope and nature of each audit project may be different. This variability
is driven by such practical aspects as availability of audit resources, the relative
scale of the target business operations, logistical considerations, areas of specific
management concern, etc. SAPGs can be used in combinations to match the audit
coverage to the specified business systems and activities. Although each SAPG can
be used in a “free-standing” context, they can also be linked in a number of ways
to support the objectives established by audit management:
• Most SAPGs will be designed to cover systems which have interfaces with other
systems (for example, there are logical linkages between purchasing, accounts
payable and stock control). It follows, therefore, that perceived weaknesses in
one system/activity may have implications for issues in another related system or
activity. Each SAPG can be provided with a table of such interrelationships so
that the user can promptly determine the knock-on effects of any noted concerns.
• The principal activities of an operating unit or overseas subsidiary can also be
flexibly related to a number of individual activity or system-based SAPGs.
• Away from the use of individual SAPGs to support the examination of discrete
activities, there is the alternative view of a business expressed in terms of business
processes (or alternatively cycles, although not every process is actually cyclic
in form). These business processes can be described as being a series of related
or interlinked economic events. The structure of individual SAPGs can also
be used as the basis of using them in combinations supporting auditing on a
business process basis. Appendix 2 shows how SAPGs can be combined to
cover fundamental business processes.
In any event, it is likely that most audit visits will be the subject of some
prior research and preparation so that the audit time spent on site is optimised for
efficiency and direction, and that the auditors are focused on the most worthwhile
investigations. In order to assist with such deliberations, special forms of SAPG can
be developed which support the gathering of such research information. For example,
users of the SAPG approach may choose to develop a “fact finding programme”1 or
a “high level review programme”2 to meet such requirements. (Refer to Chapter 13,
which discusses the use of such programmes in the context of auditing subsidiaries
and remote operating units.)
FORMAT OF SAPGs
In our proposed SAPG format, the critical contents of each SAPG are a number
of risk or control issues relevant to the specific system. These are expressed in
the form of questions which raise the issues in the context of what is being done
either to achieve a desired outcome or to avoid an unwanted one. Examples of such
questions would be:
46
THE OPERATIONAL AUDITING HANDBOOK
• How does management ensure that the business activities of the organisation
are conducted in accordance with all the prevailing and relevant legislation and
regulations?
• What processes would ensure that any failures to fully comply with current legal
requirements were promptly identified and resolved?
This form of question structure supports the use of the format in either the
traditional audit situation where the direction is set by “What can go wrong?”, or
where a management orientation is adopted where the emphasis is placed on “What
do we need to achieve?”
The risk and control issues are further divided into two groups, namely key
issues and detailed issues. The former are the more significant and crucial points
about the system under review and the aim should be always to take them into
account during the audit. The latter category of issues takes the user into more of
the underlying system considerations, and would be utilised only if there was a
potential weakness revealed as a consequence of considering the key issues. We
will return to the context of this division of issues later in this chapter.
The purpose of the SAPG is to guide the auditor through an examination of the
issues specific to the system or activity with the intention of recording the nature of
measures and controls in place to ensure either that business objectives are achieved,
or that risks and exposures are successfully avoided. The auditor will need not only
to record the nature of measures and controls in place, but also to consider their
effectiveness, and dependent upon that interpretation record the nature and results
of any audit testing applied to determine whether the situation needs to be reported
to management.
The suggested form of the SAPG is divided into three distinct sections:
• title page
• the risk/control issues
• system interfaces.
The format and use of each of these are described in following sections.
Note that in all the examples that follow, the text in italics relates to that entered
by the user during the course of the audit review, whereas the normal text relates
to the information entered at the initial design stage.
SAPG Title Page
The title page has three separate areas:
• an area which records the details of the subject matter covered by the SAPG and
a reference number (see Figure 3.1).
• an area used to record details about the specific audit project (see Figure 3.2).
• a section which describes the control objectives for the relevant system (see
Figure 3.3). In practical usage, the text in this last section of the page can be
edited and updated whenever necessary by the user.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
SAPG Ref.: 0102
Function: Management & Administration
Figure 3.1
Activity/System: Organisation
SAPG title page—subject matter covered
Company: Acme Corporation
Division: Orthopaedics
Country: USA
Site: New York
Audit Ref.: USA01-2007
Date: 3 January 2007
Completed by:
John Brown
Reviewed by:
G. V. Rand
Figure 3.2
47
SAPG title page—details about audit project
CONTROL OBJECTIVES
(a) To ensure that the organisational structure is appropriate to the business and the
achievement of strategic objectives; (b) To ensure that the organisational structure
is determined by the business and operational needs and avoids needless subdivisions and excessive levels; (c) To ensure that the structure enables the flow of key
information upwards and outwards within the organisation and across all the business
activities; (d) To ensure that relevant responsibilities, authorities and functional terms
of reference are defined and in place; (e) To ensure that responsibilities and authorities
are adequately segregated in order to avoid conflicts of interest and the potential for
fraudulent practices; (f) to ensure that the structure is periodically reviewed and
any changes are agreed and authorised at a senior level; (g) To ensure that each
manager’s span of control is optimised and avoids either over- or under-utilisation;
(h) To ensure that adequate staff resources are determined, authorised and provided
in order to achieve the functional and business objectives; (i) To ensure that the
prevailing organisational structure is suitably documented and communicated to all
relevant staff; and (j) To ensure that the organisational structure and the related
functional divisions of responsibility are accurately and adequately reflected in the
accounting and management information systems.
Figure 3.3
SAPG title page—control objectives
The Risk/Control Issues
This is the main part of the SAPG and consists of a table based on the headings
noted in Figure 3.4. If the table facilities within a word processor have been used to
develop this format, it should be possible for all the cells to expand down the page
as text is entered. On this and subsequent pages, the use of each column is discussed.
48
Seq.
THE OPERATIONAL AUDITING HANDBOOK
Risk/Control Issue
Current
WP
Effective
Compliance
Substantive
Weakness
Control/
Ref.
Yes/No
Testing
Testing
to Report
Measure
1
Key Issues
1.1
What measures are in
place to ensure that
management are kept
informed of production
activities as the basis
for their decision
making?
2
Detailed Issues
2.1
How can management
be assured that
production downtime
caused by plant
breakdown is
minimised?
Figure 3.4
SAPG—outline of risk/control issues
The Seq. column contains a sequential number used to identify each risk/control
issue. These issues are divided into two groups, Key Issues which are identified
by being both in the sequence starting 1.1 and printed in bold text, and Detailed
Issues which are in the sequence starting at 2.1. (Refer to Figure 3.4). The Key
Issues reflect the top level and critical aspects of the system/activity under review
and should always be considered by the auditor. There are normally between six and
ten key issues noted on each system/activity SAPG. The detailed issues examine the
relevant subject in greater elemental detail and should be addressed by the auditor
only if the responses obtained in relation to the key issues suggest that there could
be further inherent weaknesses in control. There can be any number of detailed
issues recorded within an SAPG dependent on the complexity and relevance of the
system/activity.
The Current Control/Measure column is used by the auditor to record a brief
description of any controls or measures that are in place to address the issues raised
in the Risk/Control Issue column. (Refer to Figure 3.5.) Try to avoid going into too
much detail in this column. This type of information can be obtained in a number of
ways, for example, as a result of discussion with departmental staff, from a review
of documented procedures, or from previous audit working papers. In practice there
may be more than one control or measure in place which has an effect on the issue
raised; any number of these can be noted in the Current Control/Measure cell.
The WP Ref. column can be used to note any working paper cross-reference,
such as a system flowchart or procedure manual.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
Seq.
49
Risk/Control
Current Control/
WP
Effective Compliance Substantive Weakness
Issue
Measure
Ref.
Yes/No
Regular management report (type
PRO78X)
produced and
circulated to unit
managers.
Contents are
reviewed,
discussed, and
signed off at
weekly team
meetings.
Flow
chart
PRD04
page 8
1
Key Issues
1.1
What measures
are in place to
ensure that
management
are kept
informed of
production
activities as the
basis for their
decision
making?
Figure 3.5
Testing
Testing
to Report
YES
SAPG—example of a partly completed risk/control issues
The Effective Yes/No column is used to note whether the recorded current
control or measure is likely to be effective in either supporting the required objective
or counteracting any underlying risk posed by the issue. This judgement, which
may need to be applied by the audit manager or supervisor, is an opinion on likely
effectiveness. The responses recorded in this column can be used to determine
those areas which should be subject to audit testing. The decision whether or not to
apply audit testing will, of course, be relative to the user’s own auditing standards,
but a number of logical tactics could apply. For example, the consideration that a
particular control or measure would be effective (i.e. a YES response), may obviate
the need for any testing; however, at this stage, the auditor does not know whether
the control is actually being applied correctly and/or consistently. This suggests that
some limited compliance testing is desirable to ascertain if the control is actually
being applied appropriately in every instance. In order to contain the amount of audit
time spent on compliance testing, it is often desirable to identify the key controls
and measures which represent the greatest potential and target these for compliance
tests. The Compliance Testing column can be used to record the test applied and
a summary outcome. (Refer to Figure 3.6.) Because space is limited, the user can
elect just to record a working paper cross-reference to the detailed testing schedules
rather than a full explanation.
In instances where either the compliance testing revealed an inadequate application of the measure or the control/measure was judged unlikely to be effective,
further substantive testing may be justified to evaluate if a potential weakness has
been exploited. Summary details of such substantive testing can be noted in the Substantive Testing column. By way of illustration, Figure 3.6 incorporates example
entries in the Compliance and Substantive Testing columns.
The last column (Weakness to Report) can be used to note any points of audit
concern arising from the audit review and testing which should either be discussed
50
Seq.
THE OPERATIONAL AUDITING HANDBOOK
Risk/Control
Current
WP
Effective
Compliance
Substantive
Weakness
Issue
Control/
Ref.
Yes/No
Testing
Testing
to Report
WP: Test 23
Reports for
November
2010
examined—no
evidence of
examination or
review
WP: Test 54
November and
December
2010 reports
examined in
detail—13
instances of
production
shortfall
reported with
no apparent
follow-up
action.
Recommend to
management that
they ensure that
this control is
applied as defined
in the procedures
manual and that all
reports are
monitored for
evidence of action
taken to address
reported problems.
Discussed with
Production
Manager
01.01.2010
Measure
1
Key Issues
1.1
What
measures are
in place to
ensure that
management
are kept
informed of
production
activities as the
basis for their
decision
making?
Regular
management
report (type
PRO78X)
produced and
circulated to
unit managers.
Contents are
reviewed,
discussed, and
signed off at
weekly team
meetings.
Figure 3.6
Flow
chart
PRD04
page 8
YES
SAPG—example of a completed risk/control issues
further with management or formally reported to them as a recommendation for
action. The contents of this column can be interfaced with the reporting processes
used by the audit function.
The completed SAPG file can be saved as a word processing document file and
printed out to form part of the audit working papers and permanent file.
System Interfaces
This page of the SAPG (as illustrated in Figure 3.7) is intended to alert auditors to the likely interfaces between the system or activity being addressed in the
SAPG and any others. Where weakness and control problems have been revealed
during the system review, there may be consequences or implications for other systems either “downstream” or “upstream” of the system under review. The System
Interfaces Table is intended to draw auditors’ attention to systems with input or
output connections. These connections may be based solely on data flow or have
additional operational implications. The example Systems Interface Table featured
in Figure 3.7 is provided for illustrative purposes and is related to an accounts
receivable system.
RISK IN OPERATIONAL AUDITING
Matters of risk have traditionally been of concern to auditors and although the
profession has also embraced other business oriented approaches, risk is likely to
remain a potent determinant in directing audit work.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
51
SYSTEM INTERFACES FOR ACCOUNTS RECEIVABLE
It is unlikely that any activity or system will operate in complete isolation, but will need to interact
with other data and systems in order to be fully effective. At a simple level, such interaction could
relate to the input of data from a source system and the generation of amended or enhanced
data which can be output to the next process. For example, taking coded transactions from an
accounts payable system into the general ledger as the basis for subsequently producing management
accounts information.
It is often at the point of interaction between systems where controls are critical. Auditors should
be satisfied that the data moving between systems is consistent, complete and accurate, in order that
the subsequent processes are undertaken upon a reliable basis.
The following table aims to plot, for the subject system of this Standard Audit Programme Guide,
the potential interfaces with other systems which may require audit attention. Indicators are provided
to differentiate between those interfaces which act as input sources to the subject system and those
which are potential output targets. The ‘‘SAPG Ref.’’ column records the reference number of the
Programme Guide which addresses the issues for the related system
System
SAPG Input Output
Ref. Source Target
Management
Information
0103
Stock Control
0501
Treasury
0201
Warehousing/Storage
0502
General Ledger &
Management A/Cs
0205
Sales Performance/
Monitoring
0706
Budgeting & Monitoring
0207
Warranty
Arrangements
0801
Bank Accounts/
Arrangements
0208
Maintenance and
Servicing
0802
VAT Accounting (where
applicable)
0209
Spare Parts and Supply
0803
Inventories
0211
Product/Project
Accounts
0212
Financial Information &
Reports
0214
Figure 3.7
System
SAPG Input
Ref. Source
Output
Target
SAPG—System Interfaces page and Systems Interfaces table
The internal auditor’s use of risk assessment can operate at different levels of
audit planning and activity:
At a tactical level the auditor may choose to apply risk assessment techniques
to the potential universe of possible audit projects as a means of setting relative
priorities, and thus determine those higher risk audit projects for inclusion into the
annual audit plan. This approach normally involves the development of an audit
risk formula.
52
THE OPERATIONAL AUDITING HANDBOOK
At the operational level (i.e. during the course of a specific audit project), risk
assessment linked to an evaluation of control effectiveness can focus the auditor’s
attention on aspects of the subject under review which are more deserving of his or
her attention. With audit resources under pressure, it is important that auditing efforts
are concentrated on the highly risky, poorly controlled aspects where management
action may be required.
Two proven risk assessment methods for audit planning, which can be computerised using spreadsheet software, were explored in Effective Internal Audits,3
in Auditing the IT Environment 4 and in Auditing Contracts.5 We shall, later in this
section, briefly explore an operational level risk and control assessment technique
using a control matrix methodology. However, before doing so, we shall consider
(in the next section) general matters of risk and control in operational auditing.
The Nature of Risk
In simplistic terms, risk can be defined as a function of what is at risk and how likely
is it to be at risk . In other words, the extent (or size) of the risk and the probability
of that risk actually occurring. An alternative term for the size dimension would
be inherent risk . An alternative term for the probability dimension would be the
control risk or the system risk .
Whereas the size of a given risk may be relatively easy to determine objectively,
for example the known value of stock held or the actual level of cash turnover at
a retail outlet, the probability element is generally a more subjective dimension. In
the auditing context, the probability of a given risk occurring is fundamentally seen
as a by-product of the effectiveness of the controls put in place by management.
Put simply, the poorer the level of control exercised over a process or function,
the greater the probability of risk exposure occurring. However, the interpretation
of the effectiveness of controls can be subjective and the subject of some debate
between auditors and their client managers. In all honesty it is very difficult, if
not impossible, to remove totally the subjectivity in risk assessment, especially
where matters of effectiveness, quality and opinion are involved. All parties to a
risk assessment process should recognise any such limitations and take practical
steps towards reducing and/or understanding the potentially subjective aspects of
the process.
The term “exposure” in relation to risk could be defined as “an unwanted event
or outcome that management would wish to avoid”. Although it is perhaps usual for
auditors to relate risks primarily to financial values (i.e. value of cash lost, extent of
additional costs, etc.), initial exposures can also be nonfinancial in nature, although
most exposures may have a related or ultimate financial impact. An example of
a primarily nonfinancial exposure, would be the loss of reputation and the impact
on the corporate image following a well-publicised breach of regulations (such as
unauthorised discharge of a harmful substance into the environment). It could be
said that any resultant loss of business will have a financial dimension, as will any
operational restrictions imposed by the regulatory authorities over and above any
fines or penalties. Auditors, when considering risk exposures during a project, should
take a broad view of the potential impacts on the organisation and not concentrate
solely on financial aspects.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
53
Each organisation may have specific sector or operational aspects which need
to be considered in risk terms; for example, the ability of a hospital trust to maintain
the required levels of contracted services could be affected by the public reputation
of the medical facilities offered, or the continuing operation of a chemical plant
will be governed by the continued adherence to the laid-down health, safety and
environmental regulations.
Measuring Risk
For any given system, process, activity or function there are likely to be a number
of possible risk exposures. However, when these exposure elements are compared
with each other, they may exhibit variable degrees of inherent (or size) risk for
the organisation, and we should aim to take account of this risk variability in our
determination of risk. So we need to identify ways of measuring the various aspects
of risk. For instance, in a review of the payroll function, the following two possible
risk exposures could, inter alia, apply:
1.
2.
Errors in the calculation and payment of net salaries due to the incorrect application of annual pay review data to the payroll records.
Payments made to unauthorised or invalid people set up on the payroll.
It may be considered that the impact of risk (1) might be potentially much
greater than that of risk (2). For instance, it is likely to affect a greater number
of employees (indeed, possibly all employees’ payroll records), whereas risk (2)
is more likely to be restricted to a relatively few fraudulent or erroneous payroll
records. Clearly risk (1) also has the potential for a wider range of exposure types
when compared to risk (2); for instance, beyond the financial impact of such a risk,
the following aspects may also apply, each with its own degree of relativity for the
organisation beyond the size extent:
• the reaction of the taxation authorities to such a large-scale error (i.e. casting
doubts over the accuracy and reliability of the other payroll processes);
• the cost and disruption involved in recovering from the error;
• the processing of overstated transactions through the company bank account and
the attendant effects on cash flow;
• the effects on staff morale given the scale of error in salary payments;
• the effect of adverse publicity on the organisation’s reputation and image.
In the control matrix we discuss later in this chapter, two elements of inherent
(or size) risk are accounted for. First, an expression of the type of exposure, on
a category scale of likely relative importance to the business; and secondly, the
likely extent (or the measure of the size) of the exposure. For example, the first
element could be related to a scale of type of effect for the company as follows,
using a category scale of 1 to 6, where a score of 6 represents the greater degree
of relative risk:
54
THE OPERATIONAL AUDITING HANDBOOK
6 (most serious)
5
4
3
2
1 (least serious)
Financial impact with implications for the achievement of
corporate objectives and financial targets.
Loss of cash or other asset, or increase in liability.
Political sensitivity or loss of reputation.
Loss or exaggeration of profit.
Distortion of the balance sheet.
Accounting error with no effects on profit and loss or balance
sheet.
We could term this measure as a type (of risk) score.
If, for instance, we had an exposure which reached point 5 on the above type
scale because there was a potential loss involved, we then have to give substance
to the likely extent of that loss should it occur, and we do this by allocating an
additional measure of the likely size of that loss. We could relate this size element
either to a scale of actual loss values or to a summary form of scale such as small,
medium and large degrees of actual impact represented on a three-point scale, where
3 is the largest potential loss. So, for our example, we could conclude that the likely
extent of our loss (Type score 5) would be high (Size score 3), and these may be
combined mathematically to produce a composite measure of the relative inherent
risk. One such method would be to multiply the two scores; i.e. 5 × 3 = 15 (as a
measure of inherent risk).
We shall return to this approach in our subsequent examination of the control
matrix method. However, we have dealt with only one part of the risk equation, i.e.
that part relating to inherent risk (or what is at risk ). We will now turn our attention
to the measurement of control effectiveness, which is a moderator of the real risk
position.
Measuring Control Effectiveness
In the same way that varying degrees of inherent risk will apply to the constituent
exposures for a given system, activity, process or function, control effectiveness
also has a variability. Overall control effectiveness can be said to be the product of
two dimensions, namely:
1.
the potential effectiveness of a control activity6 assuming that it is applied
correctly all the time by staff and management
combined with
2.
the actual extent it is complied with.
This viewpoint supports the premise that however potentially effective a control
may be, it becomes effective only when it is complied with; and even if a control is
complied with all the time it may not be 100 % effective in eliminating an exposure.
Just as there are varying degrees of inherent risk, there will, in the real world, be
differing extents of potential control effectiveness and variations in the way that
controls are complied with. Additionally, the effectiveness of a control will vary
between the exposures it impacts upon.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
55
It is possible to apply a simple mathematical approach to these related measures
of control effectiveness, by expressing each of the two aspects as percentages, i.e.:
• The potential effectiveness of the control (i.e. if applied correctly all the time)
can be expressed on a scale of 1 to 5, where a score of 5 equates to 100 %
effective (4 = 80 %, 3 = 60 %, 2 = 40 %, 1 = 20 %, and a score of zero means
no effect at all in addressing the related risks).
• The extent to which the control is actually complied with can be determined by
the auditor during initial compliance testing and scored using the same five-point
scale. For example, if the compliance test examination of a sample of transactions
suggested that the control was complied with for only 60 % of the time, the score
of 3 for compliance would be given.
The two scores can then be combined as a measure of the contribution made by
this control for reduction or eradication of the related risk exposures. For example,
if a control has an 80 % level of potential effectiveness but is only complied with
for 60 % of the time, this could be expressed as a resultant control contribution of
48 % (i.e. 60 % of 80).
Using such an approach it is a simple matter for the auditor (and management)
to conclude on the type of action required. If the potential effectiveness of a control
is high, but compliance is poor, the obvious solution is to improve the level of
compliance. Alternatively, if the potential effectiveness level is low, then irrespective
of the level of actual compliance, the related risk will remain unaddressed, thus
suggesting that alternative control action is required.
It is necessary to be aware of the subjectivity associated with these forms of
measurement, especially in respect of potential control effectiveness. It could be
said that this method facilitates the painting of a more precise picture of the control
situation when compared to the internal control questionnaire (ICQ) approach—in
shades of grey (or indeed in colour) as opposed to black and white. But, the down
side is that care is required in the determination of the relative scoring, otherwise the
conclusions can easily be challenged by auditee management. Although there is no
escaping fundamental subjectivity, a great deal can be achieved by prior discussion
of the technique with management and getting them to “buy into” the method. In
any event, the use of any method of risk assessment by the internal audit function
should ideally have the sanction of the audit committee.
Earlier in this chapter we considered the traditional use of ICQs by auditors as
means of evaluating control effectiveness against predefined control objectives for
a given system or function. When using an ICQ, the auditor is expected to evaluate
control effectiveness in a fairly restrictive way—i.e. normally by responding Yes or
No to the question “Is this control effective?” Presumably behind the answer to this
question, are a number of facts and findings which aid the auditor in responding to
the rather blunt answering parameters.
ICQs don’t cater especially well for the varying extents of inherent risk, potential
control effectiveness and control compliance. Additionally, in reality a particular
control process may address a number of different risk exposures—to different
degrees of effectiveness; and a particular risk exposure may be addressed by a
number of controls, all operating at different levels of potential effectiveness and
56
THE OPERATIONAL AUDITING HANDBOOK
compliance. However, the traditional ICQ format does not readily facilitate the
mapping of such interactions.
In the following section we shall introduce a control matrix method which incorporates some of the principles of risk and control measurement we have examined
so far.
A Control Matrix Approach to Risk and Control Evaluation
In this section we will outline the mechanics of the control matrix method using a
simple example and building up the required data in stages. The processes used are
based on the concepts of risk and control measurement noted in the earlier sections.
For a more comprehensive exploration of this and other risk-based audit planning
methods, see Effective Internal Audits.3 At the end of this section we provide two
examples of more realistic and comprehensive matrices.
The control matrix technique is ideally suited to the spreadsheet environment.
The control matrix can be used by auditors during any audit project or review. The
aim of the control matrix method is to bring together, in a mathematically sound
way, the dimensions of risk and control as a means of calculating a risk score for
each of the component risk exposures. This risk score can then be used to direct the
auditor’s attention to those aspects of the system under review which may, among
other things, require substantive testing, discussion with management, the agreement
of the required corrective action, etc.
Although our simple example matrix will focus on the previously discussed
risk and control approach to audit review, it should be noted that this method can
also equally be applied to reviews using an alternative, positive, approach (i.e.
“What do we need to achieve in respect of this system, function or process?”, and
“What measures have we put in place in order to ensure that achievement?”). This
form of the method aligns more readily with the view of the business adopted
by management, who see their role as primarily relating to the achievement of
objectives and not solely geared to countering risks. The comprehensive example
matrix shown in Figure 3.17 uses Objectives (as opposed to exposures) and measures
(as opposed to Controls) in order to illustrate this positive orientation of the control
matrix method.
The Development of an Example Control Matrix
For the purposes of our simplified example, we will consider a limited number
of risks and controls applicable to a management information system (MIS). The
items we have selected for our illustration of the method are not intended to be
comprehensive, and you will easily be able to define additional and alternative
examples that more realistically fit the prevailing scenario in your own organisation.
First, it is necessary to identify the likely risk exposures associated with an
MIS. Figure 3.8 lists five possible top level exposures. In practice there will be
others, but this reduced list serves to illustrate the technique.
The process of identifying the possible exposures for the system under review
will normally be undertaken early in the audit project as a basis for the work
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
57
EXPOSURES
A Unable to maintain/amend the MIS
B Inaccurate, incomplete, or out-of-date information
C Data corruption
D Inaccurate system parameters, variables and assumptions
E Leak of sensitive company data—competitive disadvantage, malpractice
Figure 3.8
Selected exposures for a management information system
that follows. In doing so, it is important to ensure that the identified items are
comprehensive, realistic and pitched at the appropriate level.
It is important when noting exposures that cause and effect are differentiated.
For example, a failure to ensure adequate segregation of duties is not essentially an
exposure, but the possibility of introducing false accounting transactions by taking
advantage of poor segregation is an exposure. Remember the earlier definition of
an exposure: an unwanted event or outcome that management would wish to avoid.
Although we have given only one-line descriptions of the exposures, further
implications can be assumed; for example, in respect of exposure B (which relates
to inaccurate information) we could also assume that the quality of management
decisions will be affected by the poor data quality.
The accurate identification of the risk exposures associated with the system
under review is a crucial stage as all that follows will be dependent on the foundation of possible risk components. In practical situations, the process of recording
the exposures may be undertaken under the auspices of audit management or in a
brainstorming session. Furthermore, the auditor may wish to involve management
from the area under review, so that the perceptions of inherent risk are accurate,
realistic and mutually agreed at the outset of the audit project. The prevailing management culture and the way in which internal audit is perceived will obviously
affect the decision to involve auditee managers in the risk assessment process.
The next stage would be to identify the controls in place for the system under
review. Details of these controls may be obtained from a number of possible sources,
for example:
• previous audit working papers (where they exist), updated with any amended or
additional practices;
• interviews with staff and management;
• review of official policies, procedures and/or operations manuals (subject to confirmation that they are correctly applied in practice).
Figure 3.9 lists five possible control activities relevant to an MIS. This is an
abbreviated listing and many other controls are likely to apply in practice.
58
THE OPERATIONAL AUDITING HANDBOOK
CONTROLS
1.
System specification is documented and any amendments are
updated and verified.
2.
90 % of data input is via feeder systems direct interfaces—thus
minimising keying errors.
3.
System access is controlled by user-ID and password. Access
system is maintained by the systems administrator.
4.
Standing data and parameters are entered and verified by the
financial accountant prior to the use of the MIS.
5.
Access to standing data and parameters is further protected by
the use of an additional (higher level) password control system.
Figure 3.9
Limited selection of example controls for a management information system
We have now gathered the basic elements for the construction of our control
matrix for the subject of the MIS. Figure 3.10 depicts the basic form of the matrix
incorporating the example exposures and controls taken from Figures 3.8 and 3.9.
Before moving on, we’ll look generally at the structure and purpose of the
matrix format of Figure 3.10.
The vertical columns of the matrix relate to the exposures. In our example, the
five exposures (as noted in Figure 3.8) are represented in the columns labelled A
to E. In the adjacent box at the top of the matrix, the exposure descriptions are
repeated.
The horizontal rows of the matrix represent the example controls which should
be in place (as noted in Figure 3.9).
There are a number of points of intersection between the vertical (exposures)
and horizontal (controls) elements. We will step through the completion of these
cells and provide, where necessary, a description of the underlying theory and simple
mathematics.
We need to apply the previously discussed measures of inherent risk to each
of the five noted exposures as a means of reflecting their relative significance. We
do this in the two rows near the top of the matrix columns labelled Type and Size.
First, the Type score, which accounts for the degree of significance of the risk
to the organisation, needs to be determined. In order to ensure consistency in the
application of such scores, an agreed scale is required, such as the six-point scale
shown in Figure 3.11.
Each of the noted exposures needs to be considered against this scale, which in
nature resembles a ladder to be climbed until the highest relevant point is reached
for the exposure under consideration—i.e. the most serious type or category of
unwanted outcome which this exposure represents. For example, when considering
exposure A (MIS not adequately documented—unable to maintain/amend) it might
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
Management Information System—
EXPOSURES
Abbreviated Example Matrix
A
B
Exposures:
A Unable to maintain/amend the MIS
B
Inaccurate, incomplete, or out of date information
C Data corruption
D Inaccurate system parameters, variables and assumptions
E
Leak of sensitive company data—competitive disadvantage,
malpractice
Calculated Risk Score
Risk
Scale 3 (6 is the most serious)
Type
Size (3 is the maximum)
Size
CONTROLS
1
System specification is documented and any
amendments are updated and verified
Best
Test
Both
2
90 % of data input is via feeder systems direct
interfaces—thus minimising keying errors
Best
Test
Both
3
4
5
System access is controlled by user-ID and
password. Access system is maintained by the
systems administrator
Best
Standing data and parameters are entered and
verified by the financial accountant prior to the
use of the MIS
Best
Access to standing data and parameters is
further protected by the use of an additional
(higher level) password control system
Best
Figure 3.10
59
Test
Both
Test
Both
Test
Both
Blank control matrix for a management information system
C
D
E
60
THE OPERATIONAL AUDITING HANDBOOK
Start climbing this ladder scale from the bottom until you reach the
highest relevant point for the exposure.
Point of
scale:
6
Failure to achieve business objectives, and/or loss of credibility.
5
Systems failure.
4
Loss of control of the corporate database.
3
Damaging delay.
2
Unnecessary financial costs.
1
Delay of no commercial significance.
Figure 3.11
Example exposures oriented category scale for determining the Type score
be relevant to climb the ladder scale (depicted in Figure 3.11) up to position 4; this
can then be entered into the Type score cell on the matrix corresponding to exposure
A. Refer to Figure 3.12, which depicts possible scores for the example exposures
A to E.
The second dimension of inherent risk is its Size ranking based (in our example)
on a simple three-point scale where the value chosen reflects the size extent of the
unwanted outcome (i.e. 1 = small, 2 = medium, 3 = large) which we selected from
the ladder scale. We have inserted in Figure 3.12 the possible Size scores for our
chosen exposures. You will note that values have now appeared in the Calculated
Risk Score row of the matrix in Figure 3.12. The formula used to generate these
scores is discussed later, but this Risk score is one of the key outputs of the matrix
process as it aims to reflect the residue risk of each exposure taking into account the
inherent risk dimensions (i.e. a combination of the Type and Size scores) and the
effects of the controls in place. Of course, at this stage of data entry into our matrix,
only the inherent risk values have been entered and the Risk score calculation is
incomplete. The Risk score is generated in the range 1 to 4, where a score of 1
means an insignificantly low degree of residue risk, whereas a score of 4 equates
to a high risk exposure which is poorly controlled and which therefore may require
additional audit investigation, etc. We shall subsequently return to consider the Risk
score after we have entered the score data for the controls in place.
We have concluded that control effectiveness consisted of two elements, namely:
(1) the potential effectiveness of a control assuming it was being followed by staff
and management as intended, and (2) the extent to which the control is actually
being complied with. Taken together, these two factors will give an indication of
the actual contribution made by the control in addressing the inherent risk. The
matrix technique facilitates the recording of these factors.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
Management Information System—
61
EXPOSURES
Abbreviated Example Matrix
A
B
C
D
E
Exposures:
A Unable to maintain/amend the MIS
B
Inaccurate, incomplete, or out of date information
C Data corruption
D Inaccurate system parameters, variables and assumptions
E
Leak of sensitive company data—competitive disadvantage,
malpractice
Calculated Risk Score
Risk
3
4
3
3
3
Scale 3 (6 is the most serious)
Type
4
6
5
4
6
Size (3 is the maximum)
Size
3
3
2
2
2
Figure 3.12 Entry of Type and Size scores to determine the inherent risks for the noted
exposures
Figure 3.13 shows some example Best scores inserted into the matrix. These
relate to a measure of potential control effectiveness based on a scale of 0 to 5, as
follows:
5
4
3
2
1
0
Would eliminate the risk if followed (i.e. 100 % effective)
80 % effective
60 % effective
40 % effective
20 % effective
No effect (or not applicable to this exposure)
Figure 3.13 reveals that a Best score of 5 for control 1 in addressing exposure
A suggests a very optimistic expectation for its effects, whereas a less optimistic
stance is taken with the application of a Best score of 2 for control 3 in relation
to exposure B. Also by looking at the mapping of the interactions of controls and
exposures as represented in Figure 3.13, we can see that:
• one control (i.e. number 3) is capable of addressing (to differing extents) a
number of exposures (i.e. references B, C and E);
• one exposure can be addressed by a number of controls to varying degrees of
potential effectiveness (i.e. exposure B is targeted by controls 2, 3, 4 and 5).
This mapping also aids the identification of the more significant (or key) controls
and their interaction with the underlying (or inherent) risks. If audit time is limited,
it may be more practical to concentrate on such key controls. This method also
graphically indicates where there may be redundant controls.
THE OPERATIONAL AUDITING HANDBOOK
62
Management Information System—
EXPOSURES
Abbreviated Example Matrix
A
B
C
D
E
Exposures:
A Unable to maintain/amend the MIS
B
Inaccurate, incomplete, or out of date information
C Data corruption
D Inaccurate system parameters, variables and assumptions
E
Leak of sensitive company data—competitive disadvantage,
malpractice
Calculated Risk Score
Risk
3
4
3
3
3
Scale 3 (6 is the most serious)
Type
4
6
5
4
6
Size (3 is the maximum)
Size
3
3
2
2
2
CONTROLS
1
System specification is documented and any
amendments are updated and verified
Best
Test
5
?
?
Both
2
90 % of data input is via feeder systems direct
interfaces—thus minimising keying errors
Best
Test
4
?
?
Both
3
4
5
System access is controlled by user-ID and
password. Access system is maintained by the
systems administrator
Best
Standing data and parameters are entered and
verified by the financial accountant prior to the
use of the MIS
Best
Access to standing data and parameters is
further protected by the use of an additional
(higher level) password control system
Best
Figure 3.13
Test
?
2
5
3
?
?
?
Both
Test
?
3
4
?
?
2
3
?
?
Both
Test
Both
Example control potential (Best ) scores
?
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
63
Wherever there is an interaction of an exposure with a control a question mark
is inserted in the Test score cells as a reminder that data concerning control compliance is required. The Test score aims to reflect the other dimension of control,
namely the degree to which each control is actually complied with, as determined
by normal compliance testing methods. The degree of compliance is measured using
the following 0 to 5 scale:
5
4
3
2
1
0
100 % compliance
80 % compliance
60 % compliance
40 % compliance
20 % compliance
No compliance
The degree of compliance for each of the featured controls is determined and
then entered into the matrix along the Test score row where a Best score has been
previously entered. Figure 3.14 shows the matrix after the entry of the required Test
scores.
The following important points should be noted from Figure 3.14:
1.
The insertion of the Test scores has resulted in the calculation of the Both
scores for each control in the cells below. The Both score is a mathematical
combination of the Best and Test scores with the intention of representing the
contribution made by the relevant control in addressing the inherent risk to
exposure. The Both score is calculated using the following formula where B
represents the Best score and T relates to the Test score:
B − (5 − T ) = Both
2.
The Calculated Risk Scores at the top of each Exposure column have also
changed and now take into account all the data in the column. The following
formula is used to compute the Risk scores and it takes account of the Type,
Size and all of the Both scores in the relevant columns, where B is the sum of
the cubes of the Both scores in the column:
Type × Size × [125 − B]
The output of this calculation is related to a Risk score scale of 1 to 4 as
follows:
Result
if greater than 1500
between 751 and 1500
between 1 and 750
if less than or equal to 0
Score
4
3
2
1
The Risk score is the key output of the matrix technique, in that it indicates
those exposure elements (and their related controls) which are more deserving
64
THE OPERATIONAL AUDITING HANDBOOK
of further audit attention. A Risk score of 4 suggests an important exposure
(due to its high inherent risk value) and the relative absence of effective control
exercised over it. Having completed the control matrix to the point depicted
in Figure 3.14, the auditor can allocate the remaining audit time in proportion
to the Risk scores for the component aspects of the system under review (i.e.
more time to those exposures with Risk scores of 4 and 3, and less (or none at
all) on those with Risk scores of 2 and 1).
Figure 3.15 again shows the completed matrix with the addition of some data
at the bottom in the form of overall inherent risk (size) and overall control scores.
The inherent risk score has been calculated from all the Type and Size scores in
the matrix as an indication of the overall level of risk for the system under review.
The overall control score is generated from all the Both score data as an indication
of the general level of control effectiveness. Both these scores can be useful as
overall ratings for the subject under review, especially where there is a requirement
to measure the output of the current audit examination against previous reviews.
So far we have deliberately used a limited range of exposures and controls
in our examples in order to illustrate the control matrix technique. However, in
practical use, the matrices created are likely to be much more comprehensive than
the one in Figure 3.15. Figures 3.16 and 3.17 are more typical examples of matrices.
Figure 3.16 is an exposures oriented matrix which, like our simplified examples
above, addresses the subject of a management information system. However, it
contains suggested exposures and controls.
Figure 3.17 addresses the subject of planning, and uses the alternative orientation of the matrix method which replaces exposures and controls with objectives
and measures. The objectives in the vertical columns relate to what needs to be
achieved in relation to planning; the measures represent the steps taken to aid the
achievement of the given objectives. In this context, the term “measures” is broader
in scope than the “controls” used in the former example, in that management will
implement a wide range of measures in order to achieve their objectives, which
although they may include control activities, are not restricted to only controls. For
example, staff will need to be trained in preparation for a new business venture or
computer software will be acquired/developed to address an operational requirement.
The objectives are assessed using a type scale which aims to reflect their relative
significance to the organisation and the size score reflects the level (or scale) of that
contribution (i.e. small, medium or large). Measures are given Best scores which
reflect the extent of the potential contribution to the achievement of the related
objective and the Test scores represent the extent to which they are followed and
applied. The Risk score indicates the extent to which the measures in place address
the driving objectives. The higher the generated Risk score, the more significant the
objective and the less likely it is that it will be achieved. The auditor’s attention
is therefore focused on those aspects of the subject under review that are worthy
of additional audit attention. Management can also use this technique to assess and
monitor their progress and the likelihood of achieving their objectives.
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
Management Information System—
65
EXPOSURES
Abbreviated Example Matrix
A
B
C
D
E
Exposures:
A Unable to maintain/amend the MIS
B
Inaccurate, incomplete, or out of date information
C Data corruption
D Inaccurate system parameters, variables and assumptions
E
Leak of sensitive company data—competitive disadvantage,
malpractice
Calculated Risk Score
Risk
1
4
2
3
3
Scale 3 (6 is the most serious)
Type
4
6
5
4
6
Size (3 is the maximum)
Size
3
3
2
2
2
Best
5
CONTROLS
1
System specification is documented and any
amendments are updated and verified
Test
5
Both
2
90 % of data input is via feeder systems direct
interfaces—thus minimising keying errors
5
Best
Test
4
3
Both
3
4
5
System access is controlled by user-ID and
password. Access system is maintained by the
systems administrator
Best
5
3
2
2
5
3
4
4
4
Both
1
4
2
Standing data and parameters are entered and
verified by the financial accountant prior to the
use of the MIS
Best
3
4
2
2
0
1
Access to standing data and parameters is
further protected by the use of an additional
(higher level) password control system
Best
Figure 3.14
Test
Test
4
2
Both
Test
Both
4
2
3
4
4
1
2
Control matrix after inserting the compliance (Test ) scores
THE OPERATIONAL AUDITING HANDBOOK
66
Management Information System—
EXPOSURES
Abbreviated Example Matrix
A
B
C
D
E
Exposures:
A Unable to maintain/amend the MIS
B
Inaccurate, incomplete, or out of date information
C Data corruption
D Inaccurate system parameters, variables and assumptions
E
Leak of sensitive company data—competitive disadvantage,
malpractice
Calculated Risk Score
Risk
1
4
2
3
3
Scale 3 (6 is the most serious)
Type
4
6
5
4
6
Size (3 is the maximum)
Size
3
3
2
2
2
CONTROLS
1
System specification is documented and any
amendments are updated and verified
Best
5
Test
5
Both
2
3
4
5
90 % of data input is via feeder systems direct
interfaces—thus minimising keying errors
5
5
Best
4
Test
3
3
Both
2
System access is controlled by user-ID and
password. Access system is maintained by the
systems administrator
Best
2
5
3
4
4
4
1
4
2
Standing data and parameters are entered and
verified by the financial accountant prior to the
use of the MIS
Best
Access to standing data and parameters is
further protected by the use of an additional
(higher level) password control system
Test
4
Both
3
4
2
2
Both
0
1
Best
2
3
4
4
1
2
Test
2
Test
4
Both
Inherent Risk (Size) Score [5 is worst risk; 1 best] −
3
Overall Control Score [5 is worst risk; 1 best] −
3
Figure 3.15
Completed Control Matrix with Overall Risk and Control scores
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
67
Management Information System—EXPOSURES
Exposures:
A
MIS not adequately documented—unable to maintain/amend
B
Inadequate operating instructions—error, system failure
C
Use of inaccurate, incomplete or out of date information
D
Re-keyed data contains errors—affect on decision making
E
Unable to trail/prove data to source(s)—affects decisions
F
Unauthorised access to/use of MIS—error, leakage, etc.
G
Inadequate specification & testing of MIS—credibility, etc.
H
I
J
K
L
M
N
Unable to recover use of MIS in event of system failure
Inadequate management reporting facilities—additional effort
Inaccurate system parameters, variables and assumptions
Failure to back-up MIS data—delay, cost, unable to recover
Leak of sensitive company data—competitive disadvantage
Insecure or poorly designed spreadsheets—logic errors, etc.
Absence of spreadsheet model documentation and/or testing
SCALE 3 (ABRIDGED)
6
Loss of information
5
Loss of cash or other asset, or increase in liability
4
Political sensitivity or loss of reputation
3
Loss or exaggeration of profit
2
Distortion of the balance sheet
1
Accounting error without P & L or balance sheet effect
(Exposures oriented scale)
Management Information System—
EXPOSURES
A
B
C
D
E
F
G
H
I
J
K
L
M
N
Calculated Risk Score
Risk
3
2
4
3
2
3
2
4
3
3
4
3
2
2
Scale 3 (6 is the most serious)
Type
6
6
6
6
6
6
6
6
6
6
6
6
6
6
Size (3 is the maximum)
Size
2
1
3
2
1
2
1
3
2
2
3
2
1
1
CONTROLS
1
2
3
System specification is documented and any amendments
are updated
Best
User & operating manuals
have been developed—
contents agreed with users &
IAD
Best
Analysis & reporting module
handbooks are available
Best
Test
4
?
?
Both
Test
?
4
4
?
?
4
4
?
?
Both
Test
?
Both
4
5
90 % of data input is via feed
system direct interfaces—
therefore no keying errors
Best
Input data is reconciled back
to source system(s)
Best
Test
Test
4
?
?
4
?
?
Both
(continued )
68
THE OPERATIONAL AUDITING HANDBOOK
Management Information System—
6
7
8
9
10
EXPOSURES
Calculated Risk Score
Risk
Update file headers validated
to prevent incorrect or duplicate loading of data
Best
Limited re-keying is
necessary—all such input is
reconciled to source control
values
Best
Operations log maintained
for all MIS processing &
activity—source file input
is recorded
Best
System reports on ‘‘missing’’
data input files to ensure MIS
update is complete
Best
System operates on restricted
access Novell network
located in Executive suite
Best
Test
A
B
C
D
E
F
G
H
I
J
K
L
M
N
3
2
4
3
2
3
2
4
3
3
4
3
2
2
4
?
?
Both
Test
5
?
?
Both
Test
4
?
?
Both
Test
?
3
3
?
?
Both
Test
?
4
4
?
?
5
4
?
?
Both
11
System access is controlled
by user-ID and password
Best
Test
?
Both
12
13
Network PC based MIS
was developed per user
management requirements
specification
Best
MIS was tested by users and
IT Dept. before live use—all
modifications also tested
Best
Test
4
?
?
Both
Test
Both
5
?
?
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
69
Management Information System—EXPOSURES (continued )
Exposures:
A
MIS not adequately documented—unable to maintain/amend
B
Inadequate operating instructions—error, system failure
C
Use of inaccurate, incomplete or out of date information
D
Re-keyed data contains errors—affect on decision making
E
Unable to trail/prove data to source(s)—affects decisions
F
Unauthorised access to/use of MIS—error, leakage, etc.
G
Inadequate specification & testing of MIS—credibility, etc.
H
I
J
K
L
M
N
Unable to recover use of MIS in event of system failure
Inadequate management reporting facilities—additional effort
Inaccurate system parameters, variables and assumptions
Failure to back-up MIS data—delay, cost, unable to recover
Leak of sensitive company data—competitive disadvantage
Insecure or poorly designed spreadsheets—logic errors, etc.
Absence of spreadsheet model documentation and/or testing
SCALE 3 (ABRIDGED)
6
Loss of information
5
Loss of cash or other asset, or increase in liability
4
Political sensitivity or loss of reputation
3
Loss or exaggeration of profit
2
Distortion of the balance sheet
1
Accounting error without P & L or balance sheet effect
(Exposures oriented scale)
Management Information System—
EXPOSURES
A
B
C
D
E
F
G
H
I
J
K
L
M
N
Calculated Risk Score
Risk
3
2
4
3
2
3
2
4
3
3
4
3
2
2
Scale 3 (6 is the most serious)
Type
6
6
6
6
6
6
6
6
6
6
6
6
6
6
Size (3 is the maximum)
Size
2
1
3
2
1
2
1
3
2
2
3
2
1
1
CONTROLS
14
15
Contingency plan allows for
emergency use of alternative
network
Best
Source files are backed-up to
tape in relevant department
Best
Test
4
?
?
Both
Test
?
4
4
?
?
4
4
?
?
Both
16
MIS data backed up to tape
streamer on a daily basis
Best
Test
?
Both
17
18
Flexible reporting, analysis
& query software interfaces
have been incorporated into
design
Best
Standing data & parameters
are verified by Financial
Accountant before system
use
Best
Test
5
?
?
Both
Test
4
?
?
Both
(continued )
70
THE OPERATIONAL AUDITING HANDBOOK
Management Information System—
19
EXPOSURES
Calculated Risk Score
Risk
Access to standing data and
parameters is protected by
additional password control
Best
Test
A
B
C
D
E
F
G
H
I
J
K
L
M
N
3
2
4
3
2
3
2
4
3
3
4
3
2
2
?
4
2
?
?
Both
20
Use of MIS facilities is
restricted on a ‘‘need to
know’’ basis
Best
Test
?
4
4
?
?
Both
21
Back-up media stored in
Financial Accounts Dept.
safe
Best
Test
4
?
?
Both
22
MIS hard copy circulated is
restricted and in sealed confidential packets
Best
Test
3
?
?
Both
23
24
25
26
IT Dept. develop all critical
company spreadsheets—
ICAEW best practical standards
Best
4
Test
?
User specifications produced for all spreadsheets—
delivered systems are signedoff by users
Best
IT Dept. and users conduct
testing of all spreadsheets—
results & amendments document
Best
Documentation is incorporated into spreadsheets
for ease of use—updated as
required
Best
Figure 3.16
Both
Test
?
3
4
?
?
Both
Test
4
?
?
Both
Test
4
?
Both
Management Information System
?
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
71
Planning—OBJECTIVES
A
B
C
D
E
F
G
Establish a suitable & robust Strategic Planning framework
Ensure planning processes & models are rigorously tested
Ensure company mission/objectives are clearly communicated
Ensure all plans (i.e. IT, Manpower, etc.) are co-ordinated
Ensure mechanism addresses sustained competitive advantage
Ensure that corporate goals are realistic & measurable
Provide accurate/reliable information for planning purposes
H
I
J
K
L
M
N
Ensure action plans & adequate resources are provided
Ensure actual progress is monitored against the plan(s)
Maintain awareness of organisations’ strengths & weaknesses
Ensure all planning activity remains realistic/objective
Ensure adequate staff involvement in planning process
Ensure senior management are committed to planning process
Ensure commercially sensitive data remains confidential
SCALE 3 (ABRIDGED)
6
Management must be able to understand what is happening at a strategic level
5
Medium to long term corporate objectives must be achieved
4
Budgets and profit targets must be achieved
3
Management must be taking appropriate action to correct performance
2
Management must understand what is happening at operational level
1
Motivation must be high
(Exposures oriented scale)
Planning
Objectives
A
B
C
D
E
F
G
H
I
J
K
L
M
N
Calculated Risk Score
Risk
4
2
4
4
4
4
3
3
2
2
3
3
3
3
Scale 1 (6 is the most serious)
Type
6
6
5
6
6
5
6
5
2
2
5
3
3
5
Size (3 is the maximum)
Size
3
1
3
3
3
3
2
2
3
3
2
3
3
2
Planning Dept. established
with the brief to develop &
implement a suitable planning method
Best
3
External consultants to assist
in initial process & provide
objectivity during reviews
Best
Planning method/procedures
are documented in
manual—copies are supplied
to affected staff
Best
Initial pilot exercise conducted for subsidiary X—
procedure amendments
incorporated
Best
Overview mission statement
& key objectives circulated
to all staff
Best
Measures
1
2
3
4
5
Test
?
?
Both
Test
?
4
4
?
?
Both
Test
?
4
3
2
?
?
?
Both
Test
5
?
?
Both
Test
?
5
2
?
?
Both
(continued )
THE OPERATIONAL AUDITING HANDBOOK
72
Planning
6
OBJECTIVES
Calculated Risk Score
Risk
Key senior managers involved
in the planning process
Best
Test
?
A
B
C
D
E
F
G
H
I
J
K
L
M
N
4
2
4
4
4
4
3
3
2
2
3
3
3
3
4
3
4
3
4
4
?
?
?
?
?
?
Both
7
8
9
Methodology links all aspects
of planning & ensures compatibility of goals, etc.
Best
Divisional plans are subject
to review to ensure compliance with Group plan
objectives, etc.
Best
All plans are ratified by the
board
Best
Test
4
?
?
Both
Test
4
?
?
Both
Test
?
4
3
?
?
Both
10
Each business activity is
analysed in respect of internal & external influences
Best
Test
3
?
?
Both
11
All potential projects are
subject to feasibility study
& assessment
Best
Test
?
4
3
?
?
Both
12
13
Measurable targets are
allocated to each goal—
monitored for progress,
achievement, etc.
Best
MIS established as source for
company planning data—
contents reconciled to
source(s)
Best
Test
?
4
3
?
?
Both
Test
Both
4
?
?
DEVELOPING OPERATIONAL REVIEW PROGRAMMES FOR MANAGERIAL AND AUDIT USE
73
Planning—OBJECTIVES (continued )
A
B
C
D
E
F
G
Establish a suitable & robust Strategic Planning framework
Ensure planning processes & models are rigorously tested
Ensure company mission/objectives are clearly communicated
Ensure all plans (i.e. IT, Manpower, etc.) are co-ordinated
Ensure mechanism addresses sustained competitive advantage
Ensure that corporate goals are realistic & measurable
Provide accurate/reliable information for planning purposes
H
I
J
K
L
M
N
Ensure action plans & adequate resources are provided
Ensure actual progress is monitored against the plan(s)
Maintain awareness of organisations’ strengths & weaknesses
Ensure all planning activity remains realistic/objective
Ensure adequate staff involvement in planning process
Ensure senior management are committed to planning process
Ensure commercially sensitive data remains confidential
SCALE 3 (ABRIDGED)
6
Management must be able to understand what is happening at a strategic level
5
Medium to long term corporate objectives must be achieved
4
Budgets and profit targets must be achieved
3
Management must be taking appropriate action to correct performance
2
Management must understand what is happening at operational level
1
Motivation must be high
(Exposures oriented scale)
Planning
Objectives
A
B
C
D
E
F
G
H
I
J
K
L
M
N
Calculated Risk Score
Risk
4
2
4
4
4
4
3
3
2
2
3
3
3
3
Scale 1 (6 is the most serious)
Type
6
6
5
6
6
5
6
5
2
2
5
3
3
5
Size (3 is the maximum)
Size
3
1
3
3
3
3
2
2
3
3
2
3
3
2
4
4
4
?
?
?
MEASURES
14
15
External information gathered from documented and
reliable official sources
Best
Specific expertise/research
data acquired as necessary
Best
Test
4
?
?
Both
Test
4
?
?
Both
16
17
18
Method requires production
of action plans & resource
requirements for Board
approval
Best
Divisional Managers agree
action plans & are held
responsible for implementation within deadlines
Best
Monthly progress reports are
presented to the board
Best
Test
4
?
?
Both
Test
?
Both
Test
5
?
?
Both
(continued )
THE OPERATIONAL AUDITING HANDBOOK
74
Planning
19
20
21
22
23
OBJECTIVES
Calculated Risk Score
Risk
Market Analyst canvasses customers, etc. for
external opinion of company/performance
Best
Key performance factors are
monitored & fed into the
planning process
Best
Cross-functional involvement in the planning process
provides broad basis for contents review
Best
Complete copies of interim
& final planning reports only
circulated to Board members
Best
All research data/reports
held on secure PC protected
by access control system
Best
Figure 3.17
Test
A
B
C
D
E
F
G
H
I
J
K
L
M
N
4
2
4
4
4
4
3
3
2
2
3
3
3
3
3
4
3
?
?
?
4
?
?
Both
Test
4
?
?
Both
Test
?
Both
Test
4
?
?
Both
Test
4
?
?
Both
Management Information System
NOTES
1.
2.
3.
4.
5.
6.
A suggested fact finding programme can be found in Chambers, A. D. (2009)
Tolley’s Internal Auditor’s Handbook . LexisNexis, pp. 480–483.
A suggested high level review programme can be found in Chambers, A. D.
(2009) Tolley’s Internal Auditor’s Handbook . LexisNexis, pp. 484–491.
Chambers, A. D. (1997) Effective Internal Audits—How to Plan and Implement.
Management Audit, www.management-audit.com.
Chambers, A. D. and Rand, G. (1997) Auditing the IT Environment—Assessing and
Measuring Risk and Control . Management Audit, www.management-audit.com.
Chambers, A. D. and Rand, G. (1997) Auditing Contracts. Management Audit,
www.management-audit.com.
We use the expression control activity loosely here in the sense that it might
refer to any element of internal control. The COSO Internal Control—Integrated
Framework identified five components of internal control of which they called
one “control activities”—see Chapter 6. Our use of the term here could refer to
a control element in any one of COSO’s five components of internal control.