Operational and other internal audit assignments

The managing director of a bottling company is worried. Purchases have grown by 30% but nobody can say whether the company is paying fair prices, whether suppliers are delivering on time, or whether some payments are going to suppliers that do not exist. She does not need a financial audit of the year's accounts.

She needs the internal audit team to look at how purchasing really works and tell her what to fix. That is an operational internal audit assignment, and it is one of several kinds of assignment an internal audit department performs.

This topic covers operational (management) audits and the approach to them, a full treatment of the procurement audit, value for money audits and the three Es, best value audits and the four Cs, financial audits, and information technology audits with information security. The previous two topics covered what internal audit is and how it differs from external audit. The next covers reports, regulation and outsourcing.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, introduction to assurance, legal and regulatory frameworks, and audit process (20% of marks). It covers:

• the role of internal audit in maintaining an effective internal control system
• the peculiarities of public sector audit and value for money
• the application of technology in audit

CAMA 2020 and internal audit assignments

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

Operational internal audit assignments

Management may ask internal audit to look at a particular part of the business, such as marketing or the human resources department. These assignments are audits of specific processes and operations and are called operational audits, management audits or efficiency audits.

Their purpose is to assess management's performance in the area audited, to make sure company policy and control procedures are followed, and to find where efficiency, performance and management can improve.

The general approach: adequacy and effectiveness

For each area the internal auditor assesses two things.

• Adequacy of the policies, procedures and controls: will they achieve their objectives? The auditor reviews them against the objectives they are meant to serve.
• Effectiveness: if the policies look adequate, are they applied properly and do the processes work in practice? The auditor tests them, with techniques like those used in tests of controls.

For any area the auditor also considers the risks, the controls that manage them and whether those controls are adequate, and how the controls can be tested. A useful planning sequence is: set the objective, understand the process, identify the risks, list the controls, test them, report weaknesses with recommendations, and follow up later.

Specific functions that may be audited

• Procurement: buying goods and services.
• Marketing: getting information on customer needs and trying to increase demand.
• Treasury: managing long-term and short-term financing, borrowing, investing surplus cash, managing cash and managing financial risks such as exchange rate and interest rate risk.
• Human resources: managing the employees.

Procurement audit in detail

Procurement is often the job of a buying or purchasing department. Centralising it helps to manage and control spending.

The sample test traces each order from the original requisition, through authorisation and placing of the order, to delivery, invoicing and payment. The auditor asks whether the procedure was followed, whether the purchase was properly authorised, whether the supplier was approved, whether the price was correct, whether the items arrived on time, whether the invoice was correct and whether it was paid within the credit period.

The auditor also reviews the reports to management about purchases that broke procedure and checks what action management took. The payments system itself is mainly a financial control, which the external audit also covers.

Value for money audits

Value for money (VFM) audits began in the public sector, where profit is not the main objective, and are now widely used in business as a broader measure of performance than profit. Value for money means getting good value from what is spent. It comes from the three Es.

So four variables are involved: the money spent, the inputs acquired and used, the output produced and the objectives achieved. VFM links money spent with objectives achieved. Good overall performance needs all three Es. Buying cheap materials (good economy) is no use if they break in production and are wasted (poor efficiency). Making more output is no use if it cannot be sold (poor effectiveness).

Example: payroll. A VFM audit asks whether the entity recruits staff with sufficient but not excessive competence, whether staff are trained, rewarded and motivated properly, and whether they are well supervised. It then asks whether employment costs are unnecessarily high, whether employees are productive enough and whether their work achieves the purposes for which they are employed.

Problems with VFM audits

• Measurement difficulties. Output of a factory is easy to measure, but output of a service department, such as human resources, training or even internal audit, is not. Some functions have no quantified objectives, so effectiveness cannot be measured.
• Over-emphasis on cost savings. Cutting cost can reduce quality, so that customers stop buying. Effectiveness may be forgotten.
• Comparability. Comparisons with other organisations or departments are useful only if measures are calculated the same way. Unlike profit, which accounting standards regulate, there are no rules for measuring the three Es.

Best value audits

Best value was introduced into local government in the United Kingdom, and some private companies now use it. Its core idea is continuous improvement, pursued through the four Cs:

1. Challenge: ask how and why a service is provided, and consider withdrawing it if there is no good answer.
2. Compare: compare with similar organisations to find ways to improve.
3. Consult: talk with the users to make sure the service meets their needs.
4. Compete: use fair competition, such as tendering, to get best value, which may not be the lowest price.

The internal auditor checks whether the organisation has best value procedures and whether they are achieving continuous improvement.

Financial audits

The traditional work of internal audit is the review of accounting and other records to support figures in the financial statements and management accounts. It overlaps with the external audit, so it is now a smaller part of internal audit work. It is still useful because it lets the internal auditor look at the controls that limit risk, find weaknesses and recommend improvements.

Information technology audits

An IT audit applies the internal audit role of assessing controls to the controls in the computer systems. These are manual controls, such as locking a room, and programmed controls, such as passwords. They fall into two groups.

• General controls cover the environment in which the system is designed, developed, run and maintained, for example formal authorisation of program changes, secure back-ups and restricted access to data files. They apply to most or all applications. If they are weak, processing is unlikely to be complete and accurate.
• Application controls are specific to each application and give assurance that transactions are authorised and processing is complete, accurate and timely, for example control totals and authorisation of data before input.

Information security. Data breaches and cyber-security events can cause loss or theft of data, loss of intellectual property, theft of funds, leaks of sensitive information, disruption of business, loss of timely access to information, damaged reputation and financial costs such as investigation, legal costs and fines. The internal auditor is well placed to spot these threats and report them to the board.

Assessing and monitoring controls that prevent and detect cyber events is a growing role, and departments may employ computer specialists for it.

Marketing, treasury and human resources audits

The same three questions apply to every function: what are the risks, what controls manage them, and how can the controls be tested?

Planning and following up an assignment

An assignment normally follows six stages. Terms of reference state the objective, scope and timing and are agreed with the sponsor, such as the audit committee. Understanding the process means walking through it and talking with the people who run it. Risk assessment lists what could go wrong and ranks the risks. Testing samples transactions and checks them against the controls.

Reporting sets out the weaknesses with their causes, effects and recommendations, and management's response. Follow-up checks later that the agreed actions were taken. Without follow-up the same weaknesses return in the next report, and the work of the department loses its value.

Worked examples

1. The policy is adequate: it would achieve its objective.
2. It is not effective: it is not applied.
3. The report recommends enforcement, for example the system blocks orders above ₦5 million without three quotes.

1. Economy is good, efficiency and effectiveness are poor.
2. Overall VFM is poor because all three are needed.

1. Challenge: why does it print in-house?
2. Compare: what do other agencies pay?
3. Consult: what do the users need?
4. Compete: invite printers to tender and award to the best value.

1. These are weak general controls: no authorisation of program changes and no secure back-ups.
2. Processing cannot be relied on to be complete and accurate until they are fixed.

How to score full marks

• Test both adequacy and effectiveness in any operational audit answer.
• Use risks, controls and tests as columns for a procurement-type question.
• Define the three Es with a measure for each, and warn of the problems.
• Split IT controls into general and application with an example of each.

Common mistakes in the exam

• Treating an operational audit as a financial audit of the year's accounts.
• Saying efficiency means spending less.
• Giving only cost cutting as the aim of VFM.
• Mixing up general controls and application controls.

Quick revision

• Operational audit: adequacy and effectiveness of a process.
• 3Es: economy, efficiency, effectiveness.
• 4Cs: challenge, compare, consult, compete.
• General controls v application controls.
• Procurement: requisition, authorise, approved supplier, match, pay on time.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.