Larry’s Cheat Sheet – Auditing Techniques

The Professional Practices Framework (PPF) Internal Controls

Definition: Internal control is a process, effected by an entity's
The Professional Practices Framework includes the Standards and board of directors, management and other personnel, designed to
the Practice Advisories and other items. provide reasonable assurance regarding the achievement of
• The Definition objectives in the following categories:
• The Code of Ethics Effectiveness and efficiency of operations
• The Standards Reliability of financial reporting
• Practice Advisories Compliance with applicable laws and regulations
• Development and Practice Aids such as books and seminars
From Internal Control – Integrated Framework (COSO I/C).

Types of Audits and Auditing

The COSO Pyramid (I/C)

External Auditing – The responsibility of the external auditor is to Monitoring Information

report on the organization’s financial statements, and for publicly Control Activities
&
Communications
traded companies in the US, the internal controls over financial
reporting. They serve third parties who need reliable financial Risk Assessment

information. Internal Environment

Internal Auditing – See definition on back. They serve the needs
of the organization.
Financial Audit – Focuses on the accuracy of published financial
The COSO Cube (ERM):
statements in accordance with Generally Accepted Accounting
Principles. Internal controls are studied to determine the extent of
account balance testing to perform.
Operational Audits – Reviews of the functions of an organization,
focusing on the efficiency and economy of operations, and the
effectiveness with which those functions achieve their objectives.
Internal controls, which include policies and procedures, exist to
help ensure objectives are achieved.
Compliance Audit – Review of procedures, processes or transactions
to determine if they follow established laws, regulations, policies or
guidelines. Sometimes includes a review of the internal controls
management has established to ensure compliance.
IT Audit – Review of general and application controls to ensure
automated transactions are processed with CAATS (complete,
accurate, authorized, timely and safeguarded).
Phases of an Internal Audit
Business Process Audit – Review of the manual and automated steps Plan (2200) Execute (2300) Report (2400)
in a business process (series of sequential steps) to determine the
adequacy and effectiveness the controls management has “Preliminary Survey” “Fieldwork” “Reporting”
established in the process. Determine Identify Perform Prepare
Audit
Comprehensive Audit – Term used by General Accountability Office Scope and Internal Audit Tests
Report
Objectives Controls
in the US to encompass the audits of all the activities within a of Audit ---- Develop Audit Findings ----
government entity.
Design of Operation of
Program Audit – Review of plans and procedures established to Control Control
achieve the specific end-result of a program. This differs from Announcement Draft Final
Audit
reviews of continuing activities within an enterprise. Letter Programs Audit Audit
Assurance Auditing – Relates to auditing where the IA provides Audit Report Report
Engagement
information related to financial, operational, and compliance Plan
activities as well as other efforts such as controls and risk ------------------------ Audit Workpapers ------------------
management activities.
Consultative Auditing – Using of problem-solving methodologies to [17]

make direct improvements in the circumstances or conditions of the

client.
Control Self-Assessment – Involves employees directly involved in a
business activity in evaluating the risks, controls, efficiencies,
strength/weaknesses or other aspects of the activity. Copyright © 2007 Larry Hubbard
[email protected]
USA Mobile +1 (301) 529-8118

September, 2007 Page 1 of 2

 Larry’s Cheat Sheet – Auditing Techniques

The Standards 2310 Identifying Information. Information identified should be

sufficient, reliable, relevant, and useful in achieving the
Mandatory for IIA members and CIA’s since 1/1/2004
engagement’s objectives.
Code of Ethics – Principles and Rules of Conduct related to
2320 Analysis and Evaluation. Engagement results and
Integrity, Objectivity, Confidentiality, and Competency for
conclusions should be based on appropriately documented analyses
individuals and entities that provide internal auditing services.
and evaluations.
2330 Recording Information. Engagement results and
Definition - Internal auditing is an independent, objective assurance
conclusions should be adequately supported and documented by
and consulting activity designed to add value and improve an
relevant information in the workpapers.
organization’s operations. It helps an organization accomplish its
2340 Engagement Supervision. Engagements should be properly
objectives by bringing a systematic, disciplined approach to evaluate
supervised to ensure objectives are achieved, quality is assured, and
and improve the effectiveness of risk management, control, and
staff is developed. Evidence of supervision should be documented,
governance processes.
at a minimum, via the workpaper review process.

ATTRIBUTE STANDARDS – Organizations and Individuals 2400 COMMUNICATING RESULTS

1000 PURPOSE, AUTHORITY, AND RESPONSIBILITY Internal auditors should communicate the engagement results
(PAR) promptly.
1100 INDEPENDENCE AND 2410 Criteria for Communicating. Communications should include
1200 PROFICIENCY AND DUE PROFESSIONAL CARE the engagement’s objectives, scope, conclusions (as applicable),
1300 QUALITY ASSURANCE AND IMPROVEMENT recommendations and action plans. Satisfactory performance should
PROGRAM be acknowledged in engagement communications.
2420 Quality of Communications. Communications should be
PERFORMANCE STANDARDS – Nature of Services accurate, objective, clear, concise, constructive, complete and
2000 MANAGING THE INTERNAL AUDIT ACTIVITY timely.
2100 NATURE OF WORK 2421 Errors and Omissions. If a significant error/omission is
2200 ENGAGEMENT PLANNING found to be contained in a final engagement communication, the CAE
2300 PERFORMING THE ENGAGEMENT should communicate corrected information to all individuals who
2400 COMMUNICATING RESULTS received the original communication.
2500 MONITORING PROGRESS 2430 Engagement Disclosure of Noncompliance with the
2600 MANAGEMENT’S ACCEPTANCE OF RISKS
Standards. When noncompliance with the Standards impacts a
specific engagement, communication of the results should disclose:
2200 ENGAGEMENT PLANNING Standard(s) with which full compliance was not achieved; Reason(s)
2201 Planning Considerations. Planning considerations should for noncompliance; and Impact of noncompliance on the engagement.
include the following for the activity being reviewed: Objectives; 2440 Disseminating Results. The CAE should disseminate results
Significant risks; Adequacy and effectiveness of risk management to appropriate individuals who can ensure that the results are given
and control systems; and Opportunities for making significant due consideration.
improvements to risk management and control systems.
2210 Engagement Objectives. The engagement objectives Above text was extracted from The IIA’s Quality Assurance
should address the risks, controls, and governance processes Manual 5th Edition, Tool 19. The most recent Practice Advisories
associated with the activities under review. were issued May, 2007.
2220 Engagement Scope. The scope should be sufficient to .
satisfy the objectives of the engagement and include consideration Testing Techniques – to gather Sufficient, Competent, Relevant,
of relevant systems, records, personnel, and physical properties, Useful evidence:
including those under control of third parties. Observing
2230 Engagement Resource Allocation. Resources should be Questioning
allocated effectively to ensure achievement of engagement Analyzing
objectives. Staffing should include consideration of the nature and Verifying
complexity of each engagement, time constraints, and available Investigating
resources. Evaluating
2240 Engagement Work Program. Formal audit work programs Walk Through
should be developed to ensure engagement objectives are achieved. Audit Sampling
The formal programs should include the objectives, and procedures
to be performed and documented to achieve the objectives. Larry’s Other Tips:
Program should be approved in advance (prior to commencement of There is no such thing a good audit finding
work), and any changes to the program approved promptly. Everything auditors do should help reduce the need for after-
the-fact auditing
2300 PERFORMING THE ENGAGEMENT A recommendation does not add value – implementation does.
Internal auditors should identify, analyze, evaluate, and record Trust everyone, but verify
sufficient information to achieve the engagement’s objectives.

September, 2007 Page 2 of 2