a step by step guide - ebook publishing / self-publishing ... a step by step guide: ... facilatating...

A Step By Step Guide:How to Perform Risk Based

Internal Auditing for Internal Audit Beginners

byRAZLY ZAKARIA

Copyright 2014 RAZLY ZAKARIA,All rights reserved.

Published in eBook format by eBookIt.comhttp://www.eBookIt.com

ISBN-13: 978-1-4566-2165-0

No part of this book may be reproduced in any form or by any electronic or mechanical means including information storage and retrieval systems, without permission in writing from the author. The only exception is by a reviewer, who may quote short excerpts in a review.

http://www.eBookIt.com

http://www.eBookIt.com

TABLE OF CONTENTS

ABOUT THE AUTHOR

PREFACE

STEP 1: BUSINESS & PROCESS UNDERSTANDINGIntroduction How to Understand Auditee’s Business/ Process?

STEP 2: RISK ASSESSMENTIntroduction How to Perform Risk Assessment? RISK ASSESSMENT TEMPLATE

STEP 3: AUDIT PERFORMANCEIntroduction I. Setting up of the Engagement File II. Development of Internal Audit Program III. Preparation of Information Request List IV. Team Briefing V. Kick-off Meeting VI. Business Process Analysis (“BPA”) VII. Audit Testing VIII. Compliance to Laws & Regulations IX. Internal Audit Analysis And/ Or Benchmarking X. Documenting Working Papers XI. Exit Meeting

STEP 4: PREPARING INTERNAL AUDIT REPORTIntroduction Content of Internal Audit Report Issuance of Draft Report Finalisation of Internal Audit Report

STEP 5: FOLLOW-UP AUDITIntroduction How to perform follow-up audit

SUMMARYPre Fieldwork During Fieldwork Post Fieldwork

ABOUT THE AUTHOR

Razly Zakaria is actively involved in the provision of internal audit outsourcing services. He is also active in conducting risk awareness trainings, facilatating risk assesment workshops as well as handling many projects with regards to the establishment of enterprise risk management framework for public listed companies and government agencies. He has been leading many major assignments in Malaysia, Thailand, Singapore and Bahrain.

Razly’s certifications & professional memberships include the followings:• Association of Chartered Certified Accountants, UK (ACCA)• Certified Internal Auditor, USA (CIA)• Certification in Risk Management Assurance, USA (CRMA)• Malaysian Institute of Accountants (MIA)• Chartered Member of Institute of Internal Auditors Malaysia (CMIIA) He gained commercial & consulting experience during his employment with few public listed companies and private entities as well as international audit firms namely KPMG, BDO & Grant Thornton, before heading an Internal Audit & Risk Management Department in a utility company.

He is currently the Managing Director of a training company and a shareholder and Executive Director of a reputable consulting company, providing business advisory services which include Business Valuations, Financial Due Diligence for Mergers & Acquisitions, Enterprise Risk Management, Internal Audit Outsourcing and Governance Review.

During his employment with commercial organisations, he has been exposed to Corporate Planning, Securities Market Operations, Financial Management, Office Administration as well as Investment Analysis.

Besides commercial experience, he was exposed to consulting activities while serving the above-mentioned international audit & consulting firms. He has been involved in Corporate Recovery & Insolvencies, Internal Audit, Investigative Audit, Enterprise Risk Management, Development of SOPP, Financial Due Diligence and Business Valuation assignments covering private and public entities in various industries namely construction, property/ hotel management, utilities, manufacturing, plantation, heavy engineering, trading, food & beverages, transportation & logistics, investment holding and government-linked corporations.

PREFACE

I started my journey as an internal auditor in a big 4 international accounting firm. My very first assignment started on my second day at the firm. I was assigned to perform risk-based audit on Procurement, Finance and Strategic Management Departments. I was totally lost and the only reference that I had were working files from the previous audit which actually covering different processes.

I was flipping through the previous working files when my superior told me, “ In 15 minutes, we are going to see the Head of Procurement Department, get your Information Request List ready….”. I was never involved in auditing before, I was doing accounting, costing, administration and corporate planning in my previous employments. I remembered I scribbled few basic documents that I know and passed it to the Vice President of Procurement Department. Definitely I got tonnes of review points when my Manager review my working papers, because it is far from complete.

I took my own effort to go through the so called “advanced” and the best methodology in the firm’s database. If I look at the methodology now, yes, I would say that the methodology is good and comprehensive. But at that time, as a beginner, of course I would say that it is too complicated. I need to start my assignment immediately, so I need something simple and easy-to-follow as a guide to start my assignment. I don’t have a simple step by step guide which can assist me to immediately audit a process or a department. So, I have to struggle to complete my assignment and learnt through the hard ways.

Based on my past experience, I started drafting a simple step by step guide when I became Head of Internal Audit & Risk Management Services in one of a medium-sized consulting firm. This has been done in view to give a simple and understandable guide to my Internal Audit staff so that they can start to perform their job immediately at an acceptable standard.

This e-book is developed to serve the same purpose, to provide beginners in internal audit profession with a step by step guide to effectively carried out their risk-based audit without going through the hard ways as I did before.

I have developed 5 simple and easy-to-understand steps for readers to learn. By reading and learning from this guide, readers would be able not only to understand the internal audit process, but to deliver a better quality works from what would be expected from beginners.

SO, KEEP READING THE BOOK AND….ALL THE BEST!

Special thanks to my mother, wife and daughter, for being very supportive in whatever move that I made and for being there with me in all situations and challenges. I may not be what I am today without your support and patience. To my mother, my wife and my daughter….you’re my strength, you’re my motivation. THANK YOU!

STEP 1:BUSINESS & PROCESS

UNDERSTANDING

STEP 1: BUSINESS & PROCESS UNDERSTANDINGIntroduction

When you are given a task or an assignment, before you start doing anything, you MUST understand the nature of the business as well as processes that you are required to audit.

I always stressed to my team, please do your RESEARCH & READING! Why I include the word READING?! Because some people are very good in doing research, but they keep the research materials in their working file without reading and understanding the research materials.

This “RESEARCH & READING” step is what distinguished internal auditors from other professionals. Internal Auditors are forced to read and understand multiple business processes in multiple industries in a limited time frame. That requires your focus and commitment but it is worth it considering your bright future.

WHY should I do this? Is it necessary?

Some internal auditors did not perform this step, but GOOD internal auditors definitely would consider this step as necessary. This process gives you an overall understanding of the business and organisation structure. This process would be helpful as it creates the following advantages:

Understanding of environmental factors and business process

Information obtained through this step would assist you to perform a more complete and relevant risk assessment and process analysis (this will be discussed in detail in Step 2: Risk Assessment Process).

Enhance communication with auditee

It helps you to communicate well with your auditee. Remember, as an internal auditor, it is a norms to deal with head of departments and senior people within the organisation. Internal Auditors are no longer “Compliance Officer” who just tick and complete the checklist. We are a consultant. Therefore, basic knowledge on the organisation, the industry and current issues with regards to their business is important to illustrate that we are knowledgeable and fit to advise them. This would enhance the co-operation level of your auditee. FIRST IMPRESSION COUNTS!

Practical solutions & recommendation

One of the challenge to come out with an internal audit report which is considered as a good report, is to include a practical and suitable recommendation which not only to resolve the problem, but to effectively resolve the problem using the recommendation that suits your company/ client’s business nature, financial ability as well as organisational culture and behaviour.

SO what to do? Where shall I start?

How to Understand Auditee’s Business/ Process?

Business Understanding

At this stage, there is no particular focus area to stress on, unless you are focussing on certain specific issue under any ad-hoc or special assignment. Otherwise, it should be a general understanding process of your company/ client’s business and organisation structure. You may consider the following areas of understanding:

What is their business? What products they are selling or what type of services are they offering? Who are their customers? Their target group or market segmentation?Who are their competitors?Who are their suppliers?How large is their organisation? How many people do they have?Who is managing the organisation? How they structure the organisation? How many departments do they have?Where the company is heading? What does it want to achieve?The industry outlook of the auditee (if available). What would be current or future challenges to the industry?How much was their annual revenue for the previous year? Is it a profitable business? Any current issues/ latest news with regards to the organisation and/or its industry.

Process Understanding

Opposite to the business understanding step above where you only have to understand the overview of the business, this step requires you to study in-depth and really understand about the targeted processes. Targeted processes or auditable processes are the processes that you have plan to audit during the visit. The example of processes may be procurement process, manufacturing process, project management process or human resource management.

It is COMPULSORY for you to understand specific processes that you are going to audit. This is an important step that will affect your overall internal audit job from planning up to reporting. I would like to stress again here the importance of RESEARCH & READING!

Before you even meet your client and ask for any documents such as Standard Operating Procedures or Operational Manual, you need to be very clear on what you are going to audit. The following questions need to be addressed:

• What are the normal process flow? • What are the policies normally established?• What are the risks normally involved?• Is there any legislation governing particular area that you are going to audit?• What are best practices practiced in other organisations?• What are current issues with regards to that particular processes?

SO, where can you get all the above-mentioned information?

Documents Gathering Process

To address the questions mentioned above, you may want to obtain the following documents:

Relevant Documents HOW to Obtain the Documents

Understanding of business and environmentsUnderstanding of business and environmentsAnnual Report of the company. This d o c u m e n t p r o v i d e s g o o d b a s i c information on business activities of that particular company

I. Browsing through the company’s website,II. Off icial request from the Company’s

Documents Controller or other similar function of your company/ client (steps to prepare Information Request List is discussed in detail in Step 3: Audit Performance);

III. Local bourse website, if your company/ client is a public listed company;

IV. Research through business information database such as Bloomberg, Reuters etc. (if you have access to the databases);

V. Research through the search engine to identify any issues or recent news with regards to your company/ client; AND/OR

VI. Magazines or newspapers.

Business & Marketing Plan of the company. This document enable auditors to clearly understand the vision, mission, objectives and future plan of your company/ client.







Brochures, company profile, prospectus or any other similar documents.







Company’s organisation chart.






VI. Magazines or newspapers.Write-up or analysis on the company with regards to its performance and future outlook (if any).







Understanding of Auditable ProcessesUnderstanding of Auditable ProcessesS t a n d a r d O p e r a t i n g P o l i c i e s & Procedures for that particular processes.

I. Networking. You may want to ask the SOP/ Flow Chart from your friends who work in that particular area, if any;

II. If you have resources, purchase the books/ publications with regards to that particular processes;

III. Research through internet. You may want to search for key words like “Procurement SOP, Procurement Best Practices, Procurement Policy, and etc. The popular options to search the information may include but not limited the followings:- Search Engine such Google.com, Yahoo.com

etc.- www.auditnet.org- www.knowledgeleader.com

IV. Browse through your Department’s database and past working files to understand the processes.

V. You can get customised internal audit program, advice and personal coaching from experienced internal auditor who offered these services through the net.

Tips:

The most popular option is to do your own research through the net. PATIENCE is the secret to success! You may need to go through like 20 or 30 google search pages for every key word

Process flow documents, diagrams or videos with regards to that particular processes







Tips:


Best practices research document or best p rac t i ces imp lemen ted by l a rge corporations with regards to that particular processes.







Tips:


A r t i c l e s / j o u r n a l s / m a g a z i n e s / publications discussing on current issues related to that particular processes







Tips:


Internal Audit Report/ Findings for that particular processes







Tips:


Training materials of specific training related to that particular processes.







Tips:


Relevant Documents HOW to Obtain the Documents

Risk register of that particular processes

followings:- Search Engine such Google.com, Yahoo.com




Tips:

The most popular option is to do your own research through the net. PATIENCE is the secret to success! You may need to go through like 20 or 30 google search pages for every key word before you find the most relevant information. Believe me, it is time consuming but it’s worth it! GOOD LUCK!

“THERE IS NO SHORT CUT TO SUCCESS!!!”

“Patience, persistence and perspiration make an unbeatable combination for success.”

Napoleon Hill

Example of Analysing Auditable Process

Let me walk you through an example of how we study a process to get ourselves ready for our audit assignment. In this example, we will study Human Resource Management process.

First, we need to establish what is human resource management? How many sub-processes are involved?

Definition: Human resource management is the management process of an organisation’s human capital or normally known as staff of employees. It is responsible in managing the manpower planning, selection, recruitment, development & training, performance evaluation, resignation, payroll and employees’ records and information.

To understand the process, sub-processes involved and the standard policies for human resource management, you may want to do some research and obtain few samples of Standard Operating Policies & Procedures (“SOPP”) as well as process flows for the sub-processes of human resource management.

Human resource management SOPP normally include but not limited to the following areas:

HUMAN RESOURCE MANAGEMENT SOPP

SAMPLE OF TABLE OF CONTENT

HR MISSION, VISION & VALUESMission StatementVision StatementValues

YOUR EMPLOYMENTHours of WorkOvertime & Additional HoursReimbursement of ExpensesTravel

BUSINESS ENVIRONMENTWork AreasSecurityPantry UsageMeeting RoomsPrintingDisposal of Confidential Documents

CODE OF CONDUCT POLICYPurposePrinciplesPolicy

DRESS CODE POLICYOffice employeesWarehouse/ Operations Employees/ DriversGeneralProhibited ClothingSupply & Purchasing of uniformsExceptions

IT, INTERNET, EMAIL & SOCIAL MEDIA POLICIESInternet UseE-mail UseProfessional Use of Social MediaPrivate/ Personal Use of Social Media

RECRUITMENTJob Requisition ProceduresJob Advertisement & Selection

Job Offer/ContractPre-Employment Medical ExaminationLetter of AppointmentCommencement of Employment

PAYROLLPayroll ProcessingPayment of SalariesSalary SlipChanging Pay Details

TRAINING & DEVELOPMENTTraining Needs AnalysisTraining Master Plan & CalendarTraining Evaluation Process

PROBATIONPerformance Evaluation Employment Confirmation

RESIGNATIONNotice PeriodExit InterviewClearance & Asset Hand-over FormRelease of last salary

OCCUPATIONAL HEALTH & SAFETYOHS PolicySafety Manual Handling ProceduresWorkers' Compensation PolicyInjury ProcedureSmoking PolicyAlcohol & Drugs Policy

EQUAL EMPLOYMENT OPPORTUNITY (EEO) & ANTI BULLYINGPolicyDiscrimination, Sexual Harassment and BullyingReasonable Adjustments for Special NeedsProcedures: To make a complaint, To receive a complaint, Investigation

FLEXIBLE WORKING ARRANGEMENTSLEAVE

General Leave PolicyAnnual LeavePersonal (sick) leaveCompassionate LeaveEmergency LeaveUnpaid LeaveTime in lieu policy

PERFORMANCE MANAGEMENTFrequency and TimingEmployee Performance Appraisal FormRecommendations for Salary Increments/ PromotionFiling of Employee Performance Appraisal Form

PERFORMANCE IMPROVEMENT

GRIEVANCE COMPLAINTS

CONFLICT OF INTEREST

INTELLECTUAL PROPERTY & SECURITY

ENVIRONMENTAL BEST PRACTICE

Based on the sample SOPP that you had obtained through your research, you would be able to understand the sub-processes involved. By doing this, you would be able to visualise the function of human resource management in an organisation.

Below are few examples of sub-processes for human resource management process:

Manpower PlanningSelection & RecruitmentEmployees’ Development & TrainingPerformance EvaluationStaff ResignationPayroll Management

So now, we have an overview of human resource management. What’s next? We need to analyse further each sub-processes within human resource management function. How? We would need to study the process flow of each sub-processes.

As an example, below is a sample of recruitment process flow (the practice may differ depending on organisation’s requirement and structure):

By studying the SOPP and process flow for each sub-processes, you now should have a basic understanding of the followings:

What is the function/ objective of the process that you are going to audit? ;Why is it important to properly manage the human resource function? What is the consequences if human resource function is not properly managed? What are the risks?When each activity within the process would takes place? Is it cyclical? Or is it required when certain condition or event occurred;Where is the starting point and ending point of each activity within the process? ;How the process would be carried out (the procedures)? ;What are the policies involved?Who is responsible to undertake the activities within the process? ;Who is responsible to review and/or monitor the activities within the process? ;Who are given the authority to approve?

Look carefully at the questions above. These are types of questions that you need to ask yourself. As an internal auditor, you will need to train yourself to always ask this type of questions when analysing anything.

When you already have the basic understanding, you may want to extend the knowledge with regards to the auditable process by studying further on the followings:

Best Practices of Human Resource Management

You can start your research with regards to best practices of human resource management at large corporations or best practices issued by any human resource associations or experts.

Usually, you would need to find a reputable body or association related to that processes so that you can quote their name as the one who develop and/or identify the best practices for that particular process.

In this example, you may want to visit the website of International Public Management Association for Human Resources to refer to their suggested best practices based on their case study.

Not only best practices, you also can get reach of the following information to enhance your human resource knowledge in the website:

Samples HR PoliciesHR Survey & Successful PracticesHR Critical Issues

Best practices can be used as a benchmarking tool to improve your auditee processes. You must study and understand the reasons and/or benefits of the best practices so that you can decide whether the best practices suits your auditee requirements and situations.

If yes, then you can use the best practices as a guide to improve or enhance your company’s or clients human resource management processes.

In addition, it also minimise the risk of disputes with auditee(s). You have to bear in mind that your auditee(s) especially the Head of Department who may have been involved in and

managing the human resources function for more than 20 or 30 years. Your opinion as young auditor who is not a HR specialist, may not be acceptable to them. We need to admit that we are human being, they are human being as well, so the psychology and emotions must be managed as well.

So, if we write our internal audit report in a manner that HR specialist is suggesting something rather than we as young internal auditor is suggesting something, then the chances of them accepting and agreeing to your findings and recommendations are higher.

For example, you may write a sentence like….” International Public Management Association for Human Resources, based on its survey and feedback from members, suggested that this best practice should be implemented due to…”

Current issue(s) with regards to Human Resource Management

For example:

Everybody is talking about effective succession planning in an organisation. This is due to increasing awareness in having a good corporate governance amongst companies’ directors and higher level of management personnel.

Failure to develop an effective succession plan for key personnel of an organisation may lead to disruption or even discontinuity of business operations. As a results, it would not only affect the continuity and profitability of an organisation, but it may give an impact to other staff motivation and company’s reputation.

As an internal auditor, understanding current issues(s) illustrates your knowledge and understanding of the auditable process. Besides giving a good impression to your auditee, you can also prepare a god recommendation together with sample or template (if possible), so that your recommendation would be seen as “value adding” to the organisation.

Internal Audit Findings of Human Resource Management

For examples:

Training needs analysis not conducted and training schedule/ plan not preparedHigh staff turnoverDismissal of staff not carried out in accordance to Labour LawInaccurate calculations of wages and overtimeUnjustified performance rating and absence of pre-determined Key Performance Indicators

As an internal auditor using risk-based approach, it is important to understand what are normally the findings and/or weaknesses with regards to internal controls of the auditable areas.

Based on the findings that you have found, you have to analyse and understand two main components related to the findings:

Root causes to the findings; andRisks/ Potential Impacts of the findings.

These two components would enable you to understand what normally goes wrong in an organisation and what the consequences of the weaknesses identified are.

Understanding the root causes would let you to have a feel of what is important and where you should focus on when you audit your organisation or client. Of course you can develop the skills over time BUT, committing and spending extra time to study would expedite the learning process. Believe me, it’s not only good for your learning process, it expedite your career growth as well!

Risks or potential impacts would enable you to understand, what would happen to the organisation resulting from the findings. You must remember that it is important to convince your auditee that the findings would result in negative consequences to organisation. Only through this way they would see your audit as “value added” audit rather than just a compliance exercise. It would be good if you can show the consequences through quantified financial impact, impact to staff turnover, penalty or fine imposed by authorities, reduced sales or decreasing profitability due to internal audit findings that you have highlighted.