Assurance on risk, performance, value for money, systems and e-commerce

Once you know how an assurance engagement works, the next step is to see where it is used. The syllabus names four areas that are likely to appear in an exam: risk assessment, business performance measurement, systems reliability and e-commerce. It adds value for money and continuous auditing. In each, a client wants an independent view of something other than the annual accounts.

In every case the same framework applies: the practitioner needs a subject matter, suitable criteria and evidence, and gives a conclusion. What changes is the subject. This topic gives the checklist for each one, so that when a scenario describes a client with a risk register, a set of performance targets or a web shop, you know what the engagement would cover and what could go wrong.

Engagements on risk assessment

Businesses identify and monitor their own risks. Management separates strategic, operating and information risks, analyses them for impact and probability, and chooses how to respond.

Large companies increasingly use enterprise-wide risk management, with an overall head of risk, instead of managing risk department by department.

Monitoring the risk assessment process is often done by internal audit, but an external party, such as the audit firm, can do it as an assurance engagement. The practitioner gives assurance on the risk assessment procedures, not on risk management generally. This distinction is often tested.

Engagements on performance measurement

All entities should have systems to measure and monitor performance. Reports compare results with a benchmark, such as a target or budget, past results or competitors’ results. Examples are sales against target, profit against target, cost variances, product quality, customer satisfaction, employee efficiency and capacity use. Many entities publish some or all of their measures, including non-financial ones, which are especially relevant to not-for-profit bodies.

In some countries government sets performance targets for departments and public bodies.

A client may ask a practitioner for assurance on how performance measures are calculated and presented. The practitioner considers whether the system operates as prescribed and intended. To do this, the practitioner:

1. understands the performance measurement system in use;
2. assesses and evaluates it; and
3. tests the effectiveness of its operation.

Engagements on value for money

Value for money means using resources in the best way to achieve intended objectives. It has three aspects, the 3 Es.

Efficiency is of little value if the output is not what the entity wants to achieve. An internal audit department may do value for money audits, or an external firm may be engaged.

The practitioner’s approach

1. For the operation under investigation, identify and develop measures of economy, efficiency and effectiveness.
2. Set a basis for comparison: previous periods, other entities, targets and possibly national averages.
3. Gather and analyse the measurements, and conclude whether the 3 Es are achieved.
4. If appropriate, identify weaknesses and recommend improvements.

Engagements on systems reliability

Most entities process much of their information by computer, and a major systems failure can stop them operating, especially with online systems. Management and other stakeholders may therefore ask a practitioner for assurance on the effective and secure operation of the systems.

The approach is like that for e-commerce below, but the work focuses on identifying, evaluating and testing controls within the information systems. The website aspects matter less. The practitioner is likely to use computer-assisted audit techniques such as audit software and test data, which the earlier topic on computers in auditing described.

Engagements on e-commerce

Entities use information technology to do business through:

• e-commerce, which is trading electronically at a distance, mostly over the internet through sellers’ websites; and
• electronic data interchange (EDI), which transfers documents between the computer systems of different entities. An extension called secure electronic transmission (SET) processes card payments electronically.

Users need to trust the integrity of the system. A buyer must be confident that the seller is genuine and will deliver, and a seller that the buyer is who he says and will pay. Both need to know that their transaction details, such as a card number, will stay confidential and cannot be intercepted.

Risks

• loss of transaction integrity;
• greater security risks than in face-to-face or paper trading;
• use of inappropriate accounting policies, for example for capitalising website development costs;
• legal and regulatory risks, such as breaking the law in some countries; and
• an inadequate audit trail, even if internal controls are efficient.

What management should do

1. Carry out risk assessments regularly.
2. Create a control environment that includes an information systems security policy.
3. Use internal audit to get assurance that the system works.
4. Keep adequate audit trails.
5. Keep up-to-date back-ups of data files.
6. Use encryption where appropriate, which converts data to a coded form so that it cannot be understood if intercepted.
7. Comply with recognised standards and register with a web trust organisation.

The Web Trust gives a seal of approval to websites. Specially licensed accountants grant the seal, which has to be renewed every three months, after confirming that the controls on the site comply with the Trust’s rules. A customer who sees the seal can be more confident that transactions are secure.

The e-commerce assurance engagement

A firm may be engaged to give assurance on the integrity of transactions on the client’s website and on whether the system is protected from risk. This brings extra challenges:

• the need for specialist knowledge of e-commerce systems;
• parts of the system, such as electronic payments, may be outsourced;
• the role of the client’s internal auditors in monitoring the system;
• the need for specialist general and application controls; and
• possible independence and conflict problems if the firm helped design or set up the system it now reports on.

The steps are:

• decide whether to accept
• plan the engagement, making sure that staff with e-commerce expertise are available
• get detailed knowledge of the client’s business
• consider liaison with internal audit if it has investigated the system
• identify and evaluate the risks
• evaluate the control environment and specific controls in operation
• where income depends mainly on e-commerce, consider a going concern review

Continuous auditing

Continuous auditing lets the auditor give assurance at the same time as, or shortly after, the events concerned, and so more often, using automated procedures. The procedures are embedded in the client’s system, so they need technical as well as audit skills. They also need strict controls and secure communication links to work well.

The rules in more depth

Same framework, different subject

Each engagement above fits the framework in the previous topic. In a risk engagement the criteria might be the entity’s own risk policy or a recognised risk framework. In a performance engagement they are the definitions of the measures. In value for money they are the benchmarks. In systems and e-commerce they are recognised control standards. If the criteria are not suitable, the practitioner cannot give reasonable assurance.

Why independence needs care in systems work

A firm that designs a client’s e-commerce system and then reports on its controls would be checking its own work. The safeguards in the earlier topics on non-audit services apply.

Value for money in the public sector

Value for money is especially important in public sector bodies and not-for-profit organisations, where there is no profit to show whether resources have been well used. The earlier topic on not-for-profit and public sector audits describes the context.

Worked example: a value for money engagement

Scenario. The State Transport Agency runs a fleet of 40 delivery vans for medical supplies. The practitioner is asked to report on the value for money of fleet operations in 2025. The agency’s targets are to deliver 95% of orders within 24 hours, to pay no more than the framework contract price for fuel and to achieve 8 kilometres per litre.

Economy. The framework contract price is ₦800 per litre and the agency paid an average of ₦880 per litre. The excess is (₦880 − ₦800) ÷ ₦800 = 10%. Fuel is being bought more expensively than it needs to be.

Efficiency. The vans averaged 6 kilometres per litre against the target of 8, which is 6 ÷ 8 = 75% of target. Fuel is used less efficiently than it should be. If the fleet drives 600,000 kilometres, it uses 600,000 ÷ 6 = 100,000 litres rather than 600,000 ÷ 8 = 75,000 litres. The extra 25,000 litres at ₦880 cost ₦22 million.

Effectiveness. 82% of orders were delivered within 24 hours against a target of 95%. The agency is not achieving its objective. It is 13 percentage points short.

Conclusion and recommendations. The practitioner concludes that none of the 3 Es is achieved. The recommendations are to buy fuel under the framework contract, to review driver training, routing and maintenance, and to set up regular reporting of kilometres per litre and delivery times. The report shows the comparisons used and the basis for the targets.

How to score full marks

• Name the 3 Es with the measure. Economy: money spent against inputs. Efficiency: inputs against output. Effectiveness: output against objectives.
• Give the basis of comparison. Previous periods, other entities, targets, national averages.
• For performance measures, give three steps. Understand, assess, test.
• For e-commerce, give risks, management actions and audit challenges. Examiners tend to ask for one of the three, so know them separately.
• Distinguish risk assessment from risk management. The assurance is on the assessment procedures.

Common mistakes in the exam

• Confusing efficiency with effectiveness. Efficiency is how well resources are used, and effectiveness is whether objectives are met.
• Saying risk assessment assurance covers the adequacy of risk management strategies.
• Forgetting the audit trail in e-commerce.
• Omitting independence where the firm helped build the system.
• Describing the web trust seal as a guarantee. It gives confidence that the controls comply with its rules.
• Forgetting the going concern review for entities that depend on e-commerce.

Quick revision

• Risk: assurance on the assessment process. Responses: accept, transfer, manage, avoid.
• Performance: understand the system, assess it, test its operation.
• Value for money: economy, efficiency, effectiveness, with a basis for comparison.
• Systems reliability: controls testing, computer-assisted audit techniques.
• E-commerce risks: transaction integrity, security, accounting policies, legal, audit trail.
• Web trust seal renewed every three months. Continuous auditing uses embedded automated procedures.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.