Chapter2
Chapter2
Chapter2
1. List three reasons management may ask for an operational audit to be performed, and
explain how the audit program would be impacted by each of them.
2. Explain the importance of identifying risk factors and using them during the planning
phase.
Risk factors play an important role during planning, and in particular, during risk assessments.
Risk factors are conditions and other variables that in their present, or absence, as the case may
be, either exacerbate or diminish the underlying risk. The presence of some factors increases
the likelihood or impact of the underlying risks. On the other hand, the presence of some
factors actually decreases the likelihood or impact of the underlying risks.
Trace - This involves tracing a transaction from the source (e.g., a cash receipt, file
creation) to its destination, which could be a financial, operational, or regulatory report
Vouch - This involves the “reverse-trace” of a transaction from the destination (e.g.,
financial, operational, or regulatory report) to its source (e.g., sales order, purchase, and
time sheet)
Reconcile - Tie information from two separate sources to verify the accuracy or
expected discrepancies
Foot - Add the items in a column
Cross-foot - Add the items in a row
5. Give two examples where observation is a useful technique to examine operational risks
and related controls.
Observe the security measures to prevent unauthorized individuals from entering the
facility
Observe the customer service area layout to better understand the flow of customers
Policy statements
Procedures documentation
Although internal auditors are encouraged to use a conversational and participative approach
when conducting their reviews, they must also remember that they are tasked with verifying
the integrity of the information gathered and make sure their conclusions are sound. When
obtaining and using evidence, internal auditors should display healthy professional skepticism
and verify the quality of the information gathered and used. Internal auditors should be
sufficiently suspicious of data received and reasonably verify that the information is free from
manipulation or modification in ways that can compromise its quality. When there are doubts,
the auditor must determine if those conditions make the evidentiary matter too unreliable for
use. Similarly, internal auditors should approach interviews and meetings with sufficient
skepticism, always attempting to verify the information provided, corroborate the testimony
received, and observing behavioral changes that could indicate deceit.
8. Provide three benefits of drawing process maps (flowcharts or value stream maps, as some
would rather call them.
A teaching tool
Managerial tool for discussion and analysis
Errors may stand out and be obvious
9. What is an internal controls questionnaire and how can auditors use it during the planning
and fieldwork phases of audits?
An internal control questionnaire (ICQ) helps to evaluate internal controls in specific areas by
asking key questions. Internal auditors often use ICQs as a starting point and then supplement
them with other information gathering and control evaluation techniques such as flowcharts
and document reviews. They are used by process owners to help them assess their
operation.ICQs can also be very helpful when the auditor needs to collect large amounts of
information. This can be the case when the audit involves multiple locations, or there are many
individuals with information that the auditor needs, but interviewing each person individually
and sequentially will delay the completion of the audit. In those cases, preparing and sending a
questionnaire can be very helpful to collect large amounts of data quickly