Is operational audit and management audit same?

Download 19 Internal Audit, Management and Operational Audit...

Nội dung chính Show

What is management and operational audit?
Which audit is also known as operational audit?
What are the three types of operational audits?
What is meant by management audit?

19 Internal Audit, Management and Operational Audit 19.1 Internal Audit Many modern enterprises have become huge and sophisticated. This has resulted in decentralisation of their activities and consequently the top management is remotely concerned with the day-to-day activities of the concern. In this context internal auditing has acquired a great deal of significance. Considering the increasing importance of internal auditing, the Institute of Chartered Accountants of India has constituted a Committee on Internal Audit (CIA) as a non-standing committee on February 5, 2004. The CIA was constituted with the object of formulating Standards and Guidance Notes on Internal Audit. As defined in scope of the standards on Internal Audit, Internal Audit means “An independent management function, which involves a continuous and critical appraisal of the functioning of an entity with a view to suggest improvements thereto and add value to and strengthen the overall governance mechanism of the entity, including the entity’s strategic risk management and internal control system. Traditionally internal auditing has been viewed as confined merely to ensure that the accounting and allied records have been properly maintained; that the assets of the enterprise have been properly safeguarded and that the policies and procedures laid down by the management have been complied with. The modern concept suggests that internal auditing need not be confined to financial transactions and that its scope may be extended to the task of reviewing whether the resource utilisation of the enterprise is efficient and economical. This would necessitate a review of all operations of the enterprise as also an evaluation of the effectiveness of management. We should not however lose sight of the fact that internal auditing is basically a service activity. The internal auditor has to review and report; he is not expected to take upon himself functions of the operational managers. The Research Committee of the Institute of Chartered Accountants of India has brought out “General Guidelines on Internal auditing”. The following discussion is based upon the above publication.

19.2 Management Functions and Scope of Internal Auditing Management is a process by which the affairs of an enterprise are conducted in such a manner that its goals and objectives are attained through optimum utilisation of all available resources, within the legal, social, economic and environmental constraints. To achieve optimum utilisation of resources management should determine the goals and objectives of

Internal Audit, Management and Operational Audit

19.2

the concern, quantify them to the extent possible, develop major policies and plans, implement them and exercise control over such implementation. Each of the managerial functions should constantly be viewed by the internal auditor. Translated into more concrete terms, the scope of internal auditor’s work should include a review of (i)

internal control system and procedures.

(ii)

system regarding the custodianship and safeguarding of assets - monetary and nonmonetary of enterprise.

(iii) compliance by the various segments with the policies, plans and procedures of the enterprise as well as with the relevant regulations and laws. (iv) system of collecting data both monetary and non-monetary - to ensure that the information given to management and to external agencies is relevant and reliable. (v) organisational structure of the enterprise and its congruence with its objectives. (vi) efficient and economical use of available resources tangible as well as intangible. (vii) various operations. On the basis of such review, the internal auditor should in his report, highlight the weaknesses observed and give suggestions for improvement. We may now have a brief description on each of the above areas of review: (i)

Review of internal control system and procedures (a) The internal auditor should determine whether the internal control system is in consonance with the organisational structure. As far as possible, controls should be inbuilt in the operating functions, if they are to be cost effective. For example, the establishment of a separate credit control department would not be justified if the objective of reducing credit risk and minimising debt recovery period could be met through controls in-built in the accounting and sales systems especially in smaller and medium sized concerns. (b) Each control should be reviewed and analysed in terms of its costs and benefits. It should also be seen whether the internal controls were in use throughout the period of intended reliance. A break-down in internal controls for a specific portion of intended reliance would need special attention.

(ii) Review of custodianship and safeguarding of assets - The internal auditor should review the control systems to ensure that all assets are accounted for fully. He should review the means used for safeguarding assets against losses e.g. fire, improper or negligent activity, theft and illegal acts etc. He should review the control systems for intangible assets e.g. the procedures relating to credit control. Where an enterprise uses electronic data processing equipment, the physical and systems control on processing facilities as well as on data storage should be examined and tested fire should review the adequacy of the insurance cover for the various risks involved. He should also verify the existence of the assets.

19.3

Advanced Auditing and Professional Ethics

(iii) Review of compliance with policies, plans, procedures and regulations - It is essential that the various functional segments of an enterprise comply with the relevant policies, plans, procedures, laws and regulations so that the operations are carried out in coordinated manner. The internal auditor should examine whether the management has a system by which its policies, plans and procedures are communicated to all concerned. He should examine whether management formulates the major accounting policies after due regard to their effect on the financial statements both present and future. He should also examine the system of periodical review of existing policies particularly when there is a change in the method and nature of operations of the enterprise. By combining the results of his review of the adequacy of the systems with the result of his compliance tests, the internal auditor should be able to evaluate the effectiveness of the former. He should point out specific weaknesses and suggest remedial action. (iv) Review of relevance and reliability of information - The internal auditor should review the information systems to evaluate the reliability and integrity of financial and operating information given to management and to external agencies such as governmental bodies, trade organisations and labour unions. For the purpose the internal auditor should review the means used for measuring, classifying and reporting information including the records from which the information is extracted. He should examine the accuracy and reliability of financial and operational records. He should review the frequency and timeliness of reports keeping in view the statutory time limits in the case of reports to governmental agencies. He should examine whether the information contained in the reports is meaningful to the users. The usefulness of the reports as well as of the records should be evaluated with reference to their costs. The internal auditor should examine whether the reporting is by exception i.e. the reports highlight the significant and distinctive features. (v) Review of the organisation structure - The internal auditor should conduct an appraisal of the organisation structure to ascertain whether it is in harmony with the objectives of the enterprise and whether the assignment of responsibilities is in consonance therewith. For this purpose he should review the manner in which the activities of the enterprise are grouped for managerial control. It is also important to review whether responsibility and authority are in harmony with the grouping pattern. The internal auditor should examine the organisation chart to find out whether the structure is simple and economical and that no function enjoys an undue dominance over the others. He should see whether the lines of authority and responsibility are clearly defined and communicated to all the organisational levels. He should particularly see that the responsibilities of managerial staff at headquarters do not overlap with those of chief executives at operating units. This situation often results in organisational confusion. He should examine whether there is a satisfactory balance between authority and responsibility of important executives i.e., the authority of each executive should be commensurate with the responsibility assigned to him. This can be evaluated by discussing the problems of operations and implementation what various executives. The internal auditor should examine the reasonableness of the span of control of each executive (the number of sub-ordinates that an executive controls). There should be a proper balance between the span of

Internal Audit, Management and Operational Audit

19.4

control of different executives at different levels. He should examine whether there is a unity of command i.e., whether each person reports only to one superior. Where dual responsibilities cannot be avoided, the primary one should be specified and the specific responsibility to each senior fixed. This must be made known to all concerned. He should examine whether there is a sufficient flexibility in the day to day working of the organisation and that initiative is not being stifled by a strict adherence to rules. One way of reducing organisational rigidity without sacrificing control is to have a quick and free flow of information within the enterprise. Finally he should evaluate the process of managerial development in the enterprise. This is a vital aspect in a fast growing enterprise. Unless executives are properly groomed to take over positions of responsibilities when senior people retire, there is bound to be organisational chaos. (vi) Review of utilisation of resources - The internal auditor should check whether proper operating standards and norms have been established for measuring economical and efficient use of resources. They should be detailed enough to be identifiable with specific operating responsibilities and should be capable of being used by operating personnel for monitoring and evaluating their performance. The internal auditor should review the methods of establishing the operating standards and norms. He should carefully examine the assumptions made while setting the standards to ensure that they are appropriate and necessary. The variances should be examined to evaluate whether or not the standards and norms are practical. Where there is a wide divergence between actual performance and the corresponding standards, reasons may be looked into. The system of identification and analysis of deviations from standards should be examined. The internal auditor should examine whether analysis of variances is communicated to those concerned in time. He should also examine whether in communicating the variances serious matters are high lighted and whether exceptional variances are communicated more expeditiously than is done in the normal course. As a part of evaluating resources utilisation, identifying the facilities which are under-utilized is an important function of the internal auditor. Such instances may consist of under-utilized machines, unoccupied storage space, huge cash or bank balances, idle man power etc. The internal auditor may also identify under-staffing and overstaffing in various areas as these prevent optimum use of resources. While commenting on staffing, the internal auditor should pay special attention to non-productive work being performed. This would require an enquiry into the job descriptions of employees combined with an intelligent observation of the work being done. Finally the internal auditor should review all procedures with reference to their costs and benefits. One of the factors resulting in inefficiency is that in many cases procedures become hindrance to operations. (vii) Review of accomplishment of goals and objectives - The internal auditor should review the overall objectives of the enterprise to evaluate whether they are clearly stated and are attainable. The translation of such overall objectives into specific objectives for each department and programme should be reviewed. It should be examined whether the objectives are revised periodically in the light of changes in internal and external environment. The internal auditor should examine whether to the extent possible, objectives are expressed in precise quantifiable terms (both monetary and non-monetary)

19.5

Advanced Auditing and Professional Ethics to facilitate detailed planning to be made for achieving them. Budgeting forms an important part of such planning. Line managers who are to implement the plans should fully participate in framing them. This will ensure that plans anticipate the problem areas. There should also be sufficient flexibility in the plans to permit such improvements in their implementation, as would benefit the enterprises as a whole. The responsibility for achieving specific facets of a plan should be clearly identified with the concerned person or department. Apart from these, the internal auditor should examine whether departmental plans are supported by top management. The departmental plan summaries should be sent to concerned managers. These should be discussed and communicated at meetings at which all managers participate.

19.3 Integrity, Objectivity and Independence of Internal Auditor As per Standard on Internal Audit (SIA) 2, Basic Principles Governing Internal Audit, issued by the Council of the Institute of Chartered Accountants of India, The internal auditor should be straightforward, honest and sincere in his approach to his professional work. He must be fair and must not allow prejudice or bias to override his objectivity. He should maintain an impartial attitude. He should not only be independent in fact but also appear to be independent. The internal auditor should not, therefore, to the extent possible, undertake activities, which are or might appear to be incompatible with his independence and objectivity. For example, to avoid any conflict of interest, the internal auditor should not review an activity for which he was previously responsible. It is also expected from the management to take steps necessary for providing an environment conducive to enable the internal auditor to discharge his responsibilities independently and also report his findings without any management interference. For example, in case of a listed company, the internal auditor may be required to report directly to those charged with governance, such as the Audit Committee instead of the Chief Executive Officer or the Chief Financial Officer. The internal auditor should immediately bring any actual or apparent conflict of interest to the attention of the appropriate level of management so that necessary corrective action may be taken.

19.4 Qualifications of Internal Auditor The internal auditor should have the special expertise necessary for evaluating management control systems, especially financial and accounting controls. Accounting and finance function continue to be of importance to an internal auditor because they evaluate the activities of the enterprise in terms of a common denominator. Ultimately the success or failure of each function or operation and of the enterprise as a whole is dependent on its ability to maintain its financial viability in the long run. Accounting and finance functions provide basic data for management control of an enterprise. Therefore the internal auditor must have accounting and financial expertise to be able to discharge his duties. The internal auditor is also expected to evaluate operational performance and non-monetary, operational controls. This requires a basic knowledge of the technology and commercial practices of the enterprise. He should also have a basic knowledge of commerce, laws, taxation, cost accounting, economics, quantitative methods and EDP systems. An

Internal Audit, Management and Operational Audit

19.6

understanding of management principles and techniques is another essential qualification of an internal auditor as also the ability to deal with people. He should be able to put across criticism in such a manner as would make it acceptable even to the person being criticised. Above all, the internal auditor should have the integrity and detachment of a professional. He often comes across confidential and sensitive information. By his conduct the internal auditor should provide an assurance to the management that confidentiality of such information would be maintained.

19.5 Internal Audit Report As per Standard on Internal Audit (SIA) 2, Basic Principles Governing Internal Audit, issued by the Council of the Institute of Chartered Accountants of India, the internal auditor should carefully review and assess the conclusions drawn from the audit evidence obtained, as the basis for his findings contained in his report and suggest remedial action. However, in case the internal auditor comes across any actual or suspected fraud or any other misappropriation of assets, it would be more appropriate for him to bring the same immediately to the attention of the management. Basic Elements of the Internal Audit Report: Basic elements of the internal audit report as per Standard on Internal Audit (SIA) 4, on Reporting issued by the Council of the Institute of Chartered Accountants of India, The internal auditor’s report includes the following basic elements, ordinarily, in the following layout: (a) Title; (b) Addressee; (c) Report Distribution List; (d) Period of coverage of the Report; (e) Opening or introductory paragraph;

(f)

(i)

identification of the processes/functions and items of financial statements audited; and

(ii)

a statement of the responsibility of the entity’s management and the responsibility of the internal auditor;

Objectives paragraph - statement of the objectives and scope of the internal audit engagement;

(g) Scope paragraph (describing the nature of an internal audit): (i)

a reference to the generally accepted audit procedures in India, as applicable;

(ii)

a description of the engagement background and the methodology of the internal audit together with procedures performed by the internal auditor; and

(iii) a description of the population and the sampling technique used. (h) Executive Summary, highlighting the key material issues, observations, control weaknesses and exceptions;

19.7

Advanced Auditing and Professional Ethics

(i)

Observations, findings and recommendations made by the internal auditor;

(j)

Comments from the local management;

(k) Action Taken Report – Action taken/ not taken pursuant to the observations made in the previous internal audit reports; (l)

Date of the report;

(m) Place of signature; and (n) Internal auditor’s signature with Membership Number. A measure of uniformity in the form and content of the internal auditor’s report is desirable because it helps to promote the reader’s understanding of the internal auditor’s report and to identify unusual circumstances when they occur. (1) Title: The internal auditor’s report should have an appropriate title expressing the nature of the Report. (2) Addressee: The internal auditor’s report should be appropriately addressed as required by the circumstances of the engagement. Ordinarily, the internal auditor’s report is addressed to the appointing authority or such other person as directed. (3) Report Distribution List, Coverage and Opening or Introductory Paragraph: There should be a mention of the recipients of the report in the section on Report Distribution List. The internal auditor’s report should identify the systems, processes, functional lines or other items of the entity that have been audited, including the date of and period covered. The report should include a statement that the operation of systems, procedures and controls are the responsibility of the entity’s management and a statement that the responsibility of the internal auditor is to express an opinion on the weaknesses in internal controls, risk management and governance (entity level controls) framework, highlighting any exceptions and cases of noncompliance and suggest or recommend improvements in the design and operations of controls based on the internal audit. (4) Scope Paragraph: The internal auditor’s report should describe the scope of the internal audit by stating that the internal audit was conducted in accordance with generally accepted audit procedures as applicable. The management needs this as an assurance that the audit has been carried out in accordance with established Standards. “Scope” refers to the internal auditor’s ability to perform internal audit procedures deemed necessary in the circumstances. The report should include a statement that the internal audit was planned and performed to obtain reasonable assurance whether the systems, processes and controls operate efficiently and effectively and financial information is free of material misstatement. The internal auditor’s report, in line with the terms of the engagement, should describe the internal audit as including: (i)

examining, on a test basis, evidence to support the amounts and disclosures in financial statements;

Internal Audit, Management and Operational Audit (ii)

19.8

assessing the strength, design and operating effectiveness of internal controls at process level and identifying areas of control weakness, business risks and vulnerability in the system and procedures adopted by the entity

(iii) assessing the accounting principles and estimates used in the preparation of the financial statements; and (iv) evaluating the overall entity-wide risk management and governance framework. The Report should include a description of the engagement background, internal audit methodology used and procedures performed by the internal auditor mentioning further that the internal audit provides a reasonable basis for his comments. (5) Executive Summary Paragraph: The Executive Summary paragraph of the internal auditor’s report should clearly indicate the highlights of the internal audit findings, key issues and observations of concern, significant controls lapses, failures or weaknesses in the systems or processes. (6) Observations (Main Report) Paragraph: The Observations paragraph should clearly mention the process name, significant observations, findings, analysis and comments of the internal auditor. (7) Comments from Local Management: The Comments from Local Management Paragraph should contain the observations and comments from the local management of the entity provided after giving due cognizance to the internal auditor’s comments. This should also include local management’s action plan for resolution of the issues and compliance to the internal auditor’s recommendations and suggestions on the areas of process and control weakness/ deficiency. The management action plan, should contain, inter alia: (i)

the timeframe for taking appropriate corrective action;

(ii)

the person responsible; and

(iii) resource requirements, if any, for ensuring such compliance. Further comments from the internal auditor, in response to the auditee feedback, are to be clearly mentioned. This paragraph should also contain the internal auditor’s suggestions and recommendations to mitigate risks, strengthen controls and streamline processes with respect to each of the observations and comments made. (8) Action Taken Report Paragraph: The Action Taken Report paragraph should be appended after the observations and findings and should include: (i)

Status of compliance / corrective action already taken / being taken by the auditee with respect to previous internal audit observations;

(ii)

Status of compliance / corrective action not taken by the auditee with respect to previous internal audit observations and the reasons for non-compliance thereof; and

(iii) Revised timelines for compliance of all open items in (b) above and fixation of the responsibility of the concerned process owner.

19.9

Advanced Auditing and Professional Ethics

(9) Date: The date of an internal auditor’s report is the date on which the internal auditor signs the report expressing his comments and observations. (10) Place of Signature: The report should name the specific location, which is ordinarily the city where the internal audit report is signed. (11) Internal Auditor’s Signature: The report should be signed by the internal auditor in his personal name. The internal auditor should also mention the membership number assigned by the Institute of Chartered Accountants of India in the report so issued by him. Further, the internal auditor should exercise due professional care to ensure that the internal audit report, inter alia, is: (i)

clear

(ii)

factual – presents all significant matters with disclosure of material facts

(iii) specific (iv) concise (v) unambiguous (vi) timely (vii) complies with generally accepted audit procedures in India, as applicable. 19.5.1 Essential features of a good internal audit report: The contents of an internal audit report are influenced by various factors such as the nature of internal auditing function in the organisation, level of reporting, degree of management support and capabilities of internal audit staff. However, for preparing a good internal audit report, the following general rules may be observed. (i)

Objectivity - To maintain the credibility of internal audit function the comments and opinions expressed in the report should be as objective and unbiased as possible.

(ii) Clarity - The language used should be simple and straight-forward. As far as practicable use of technical terms and jargon should be avoided. Each draft of the report should be reviewed by a senior who should attempt to read it from the point of view of the users of the report. (iii) Accuracy - The information contained in the report, whether quantified or otherwise, should be accurate. Where approximation or assumptions have been made the fact should be clearly stated along with reasons, if material. (iv) Conciseness - Brevity is vital subject, of course, to the condition that important information should not be omitted. (v) Constructiveness - Destructive criticism should carefully be avoided in the report. The report should clearly demonstrate that the internal auditor is trying to assist the auditor in an effective discharge of his responsibilities. (vi) Readability - The reader’s interest should be captured and retained throughout. For this, appropriate paragraph heading may be used.

Internal Audit, Management and Operational Audit

19.10

(vii) Timeliness - The report should be submitted promptly because if the time lag between the occurrence of an event and its reporting is considerable, the opportunity for taking action may be lost or a wrong decision may be taken in the absence of the information. (viii) Findings and conclusions - These may be given either department-wise or in the order of importance. All the facts and data pertaining to the situation should be assembled, classified and analysed. Each conclusion and opinion should normally follow the findings. Tables or graphs may be used for the presentation of statistical data in appendices; (ix) Recommendations - An internal audit report usually includes recommendations for potential improvements. In order to enable the management to accept and implement the recommendations, the internal auditor should be able to convince the management that the conclusions are logical and valid and the recommendations represent effective and feasible ways of taking action. (x) Auditee’s views - The auditee’s views about audit conclusions or recommendations may also be included in the audit report in appropriate circumstances. (xi) Summary - A summary of conclusions and recommendations may be given at the end. This is particularly useful in long reports. (xii) Supporting information - The internal auditor should supplement his report by such documents and data which adequately and convincingly support the conclusions. Supporting information may include the relevant standards or regulations. (xiii) Draft Report - Before writing the final report, the internal auditor should prepare a draft report. This would help him in finding out the most effective manner of presenting his reports. It would also indicate whether there is any superfluous information or a gap in reasoning. (xiv) Writing and issuing the Final Report - The final report should be written only when the auditor is completely satisfied with the draft report. The head of the internal auditing department, may review and approve the final report. Before issuing the final report, the auditor should discuss conclusions and recommendations at appropriate levels of management. The report should be duly signed. 19.5.2 Follow-up: The internal auditor should review whether follow-up action is taken by the management on the basis of his report. If no action is taken within a reasonable time he should draw the management’s attention to it. Where the management has not acted upon his suggestions or not implemented his recommendations, the internal auditor should ascertain the reasons therefor. In cases where he finds that non-implementation is due to a gap in communication, he should initiate further discussion in the matter. Where the management has accepted his recommendations and initiated the necessary action, the internal auditor should periodically review the manner and the extent of implementation of the recommendations and report to the management highlighting the recommendations which have not been implemented fully or partly.

19.11

Advanced Auditing and Professional Ethics

19.6 Relationship between Internal and External Auditors According to SA 610, the scope and objective of internal audit are dependent upon the size and structure of the entity and the requirements of its management. As stated earlier the internal auditor operates in various areas such as review of accounting system and internal control; examination of financial and operating information for the benefit of management, examination of the economy, efficiency and effectiveness of operations including non-financial controls of various tangible assets of the entity. While operating in these areas, there is lot of overlapping between the work of internal auditor and external auditor. The work done by internal auditor has an important bearing on the work performed by the statutory auditor as evaluation done by the internal auditor in respect of internal controls, reliability of financial information, verification of assets etc. is also required to be done by the external auditor. The statutory auditor appointed under the Companies Act, 1956, is also required to examine in specified cases of companies, whether the internal audit is commensurate with the size and nature of its business in terms of CARO, 2003 issued under Section 227-4A of the Companies Act, 1956. It should, however, be remembered that while external auditor holds responsibility for his report and for the determination of the nature, timing and instant of the audit procedures, much of the work of the internal audit function may be useful to him in his examination of financial information. SA 610 “Using the work of an Internal Auditor” deals with the relationship between internal and external auditors which is discussed in following paragraphs. The role of the internal audit function within an entity is determined by management and its prime objective differs from that of the external auditor who is appointed to report independently on financial information. Nevertheless, some of the means of achieving their respective objectives are often similar and thus much of the work of the internal auditor may be useful to the external auditor in determining the nature, timing and extent of his procedures. The external auditor should, as part of his audit, evaluate the internal audit function to the extent he considers that it will be relevant in determining the nature, timing and extent of his compliance and substantive procedures. Depending upon such evaluation, the external auditor may be able to adopt less extensive procedures than would otherwise be required. By its very nature, the internal audit function cannot be expected to have the same degree of independence as is essential when the external auditor expresses his opinion of the financial information. The report of the external auditor is his sole responsibility, and that responsibility is not by any means reduced because of the reliance he places on the internal auditor’s work. 19.6.1 General evaluation of internal audit function: The external auditor’s general evaluation of the internal audit function will assist him in determining the extent to which he can place reliance upon the work of the internal auditor. The external auditor should document his evaluation and conclusions in this respect. The important aspects to be considered in this context are : (a) Organisational Status - Whether internal audit is undertaken by an outside agency or by an internal audit department within the entity itself, the internal auditor reports to the

Internal Audit, Management and Operational Audit

19.12

management. In an ideal situation he reports to the highest level of management and is free of any other operating responsibility. Any constraints or restrictions placed upon his work by management should be carefully evaluated. In particular, the internal auditor should be free to communicate fully with the external auditor. (b) Scope of Function - The external auditor should ascertain the nature and depth of coverage of the assignment which the internal auditor discharges for management. He should also ascertain to what extent the management considers, and where appropriate, acts upon internal audit recommendations. (c) Technical Competence - The external auditor should ascertain that internal audit work is performed by persons having adequate technical training and proficiency. This may be accomplished by reviewing the experience and professional qualifications of the persons undertaking the internal audit work. (d) Due Professional Care - The external auditor should ascertain whether internal audit work appears to be properly planned, supervised, reviewed and documented. An example of the exercise of due professional care by the internal auditor is the existence of adequate audit manuals, audit programmes and working papers. 19.6.2 Co-ordination: Having decided in principle that he intends to rely upon the work of the internal auditor, it is desirable that the external auditor ascertains the internal auditor’s tentative plan for the year and discusses it with him at as early a stage as possible to determine areas where he considers that he could rely upon the internal auditor’s work. Where internal audit work is to be a factor in determining the nature, timing and extent of the external auditor’s procedures, it is desirable to plan in advance the timing of such work, the extent of audit coverage, test levels and proposed methods of sample selection, documentation of the work performed, and review and reporting procedures. Co-ordination with the internal auditor is usually more effective when meetings are held at appropriate intervals during the year. It is desirable that the external auditor is advised of, and has access to relevant internal audit reports and in addition is kept informed, along with management of any significant matter that comes to the internal auditor’s attention and which he believes may affect the work of the external auditor. Similarly, the external auditor should ordinarily inform the internal auditor of any significant matters which may affect his work. 19.6.3 Evaluation of specific internal audit work: Where, following the general evaluation as described above, the external auditor intends to rely upon specific internal audit work as a basis for modifying the nature, timing and extent of his procedures, he should review the internal auditor’s work, taking into account the following factors: (a) The scope of work and related audit programme are adequate for the external auditor’s purpose. (b) The work is properly planned and the work of assistants is properly supervised, reviewed, and documented. (c) Sufficient appropriate evidence is obtained to afford a reasonable basis for conclusions reached.

19.13

Advanced Auditing and Professional Ethics

(d) Conclusions reached are appropriate in the circumstances and any reports prepared are consistent with the results of the work performed. (e) Any exceptions or unusual matters are disclosed by the internal auditor’s procedures. The external auditor should document his conclusions in respect of the specific work which he has reviewed. The external auditor should also test the work of the internal auditor on which he intends to rely. The nature, timing and extent of the external auditor’s tests will depend upon his judgement as to the materiality of the area concerned to the financial statements taken as a whole and the results of his evaluation of the internal audit function and of the specific internal audit work. His tests may include examination of items already examined by the internal auditor, examination of other similar items, and observation of the internal auditor’s procedure. Finally, in India even the statute has now recognised that internal audit is necessary for efficient running of companies. The order under Section 227 (4A) now requires the statutory auditor to state in case of listed companies and/or other companies with a paid-up capital and reserves exceeding ` 50 lakhs or having an average annual turnover exceeding ` 5 crores, whether the company has an internal audit system commensurate with its size and nature of business. Thus a review of the internal audit function in large companies has become a statutory responsibility for the statutory auditor.

19.7 Management Audit There have been many calls in recent years for a more pluralistic approach to financial reporting to incorporate comments on the efficiency with which the company has conducted its affairs. As directors’ comments on the company efficiency are not likely to be entirely objective, this task, it is proposed will fall on the company auditors; or on additional auditors appointed specially for this purpose. Proposals for such audits have been made under various titles like, ‘management audit’, ‘management efficiency audit’, efficiency audit or ‘operations audit’. The authors of these proposals often try to draw subtle distinction between these terms. This is largely semantic; however the only practical distinction is whether the audit should be confined to the efficiency of the management team in pushing through the company objectives, or whether it should intend to include the objectives themselves, and hence the effectiveness of directors. Not surprisingly most directors concur with the former view. But a review of the efficiency of the management team would have to be both ongoing and in considerable detail to be meaningful, and it is therefore much more suited to a internal audit function. Indeed many companies already have management audit as part of their internal audit procedures. But such audits are for the directors’ information. So they are a far cry from an evaluation of the efficiency of directors themselves such as is currently being demanded. 19.7.1 Evolution: Auditing like any other social discipline is basically evolutionary in character and shapes itself according to the needs of the time and the occasion. The influences that have left their mark on the evolutionary development of auditing can be ascribed to a number of factors, like development of accounting principles, industrialisation, corporate form of business, separation of business ownership and management, laws, rules and regulations

Internal Audit, Management and Operational Audit

19.14

framed by the legislatures and government, formation and development of accounting professional bodies throughout the world and their pronouncements and the judgements of various courts in cases involving accountants and auditors duties, responsibilities, rights, and privileges. In recent years, the world has witnessed a rather new type of revolution viz. managerial revolution. Management of enterprises is itself a science and techniques and principles have been formulated for practising this science; a proper practice of this science will ensure an objective and efficient management of the affairs of any economic activity. This revolution has considerably changed the composition and outlook of management. Auditing has come to be viewed as an essential management tool, among others, for the efficient running of business and other economic activities. When we speak of auditing as a management tool, we give an extended coverage to the term auditing without, however, altering its basic concept. This extended concept of auditing includes operational auditing. Auditing is generally associated with accounting activities or events. These activities or events are expressed in monetary terms. For this reason, we sometime try to take a narrow view of matters, that auditing is concerned with only the monetary accounting data. When we take this narrow view we lose sight of the fact that auditing basically and conceptually concerns itself with collection and appraisal of evidence underlying transactions that are quantifiable and not necessarily expressed in monetary figures. Auditing naturally looks to fields far more extensive than merely monetary accounts. Traditionally, auditing has been financially oriented, focusing on the correctness of accounting records and the propriety of activities contained in the records. However, its emphasis has been changing over the years. It is now responding to a demand for more useful information that cannot be found solely in financial statements. In the late 1940’s, for example, financial analysts and bankers showed a desire for information suitable for managerial appraisal. Today, stock holders, investors, government bodies, and the general public are seeking information by which the “quality of management” can be judged. As a result of this awakened interest of outsiders in judging the merits of organisations, there has arisen a similar movement from within organisations to judge the results of operations and their managers. However, one fact must be accepted in extending the field of auditing. The attitude and approach of the auditor and his mental training have to undergo a change so as to be able to understand, become familiar with and appraise data and events that are not expressed in rupees. In other words, auditors have to acquire management attitudes and should be able to view matters as management may view them. 19.7.2 Management and Operational Audit: The concept of operational audit is discussed in detail later in the chapter. Operational audit is an audit for the management; it is undertaken at the instance of the management for providing it with information and appraisal of operations and activities. A parallel development in auditing is getting shaped as management audit. In fact some of the authors do not see any difference between operational auditing and management auditing. They probably see that both these audits are for the management and cover operational areas that do not come under the review of the traditional audit. They are correct also to this extent. But they miss one important aspect of management audit, which has made it distinct from operational audit, i.e., management audit is an “audit of the

19.15

Advanced Auditing and Professional Ethics

management” also. According to T.G. Rose, “The management audit would therefore concern itself with the whole field of activities of the concern, from top to bottom, starting, as always where management control is concerned, from the top, because we are primarily concerned with whether the general management is functioning smoothly and satisfactorily. If it is not, it may be due to the functional management being faulty and, therefore, we pass on to examine that in its turn, in order to find the missing or faulty link which is causing the trouble.” From the very able conceptualisation contained in the above quoted passage, it is somewhat clear what should be the scope and content of management audit. It should definitely cover everything that we know as operational audit and, in addition it should also include review of the adequacy and competence of the objectives, plans, policies and decisions of the top management. However, as has been indicated above, unanimity is lacking on this aspect and management audit has become a subject of debate. John C. Burton, in the article “Management Auditing” (The Journal of Accountancy, May 1968) commented as follows: “In a management audit, the auditor will look to see whether management is getting information relevant to the decisions and actions which it must take. This will require a much more intensive analysis of information needs and the efficiency of the existing system in meeting them. The auditor will not have to decide whether management is making the right strategic and operative decisions but rather whether management has available to it and is using the relevant information and techniques necessary to evaluate rationally the various alternatives that exist”. Management audits are concerned with appraising management’s accomplishment of organisational objectives; the management functions of planning, organising, directing, and controlling; and the adequacy of management’s decisions and actions in moving towards its stated objectives. Hence, the accent is on evaluating managers’ ability to manage. 19.7.3 Scope: From the authorities quoted above, it seems that the preponderant view about management audit is that it is wider in scope compared to operational audit. However, a distinction should be made between management audit and operational audit. Management audit is concerned with the quality of managing, whereas operational audit centres on the quality of operations. The basic difference between the two audits, then, is not in method, but in the level of appraisal. The two audits are complementary and supplementary to one another. In management audit, the auditor is to make his tests to the level of top management, its formulation of objectives, plans and policies and its decision making. It is not that he just verifies the operations of control and procedures and fulfilment of plans in conformity with the prescribed policies. He is to reach the root i.e., the functions of top management which lay down objectives and policies, provide means and procedures of implementation and control and which actually engage in direction and control on a continuous basis. In addition to what would normally be covered in an operational audit, management audit would also encompass the relevance and effectiveness of the aims, duties and decisions of management at various levels. Every aspect of the functions of Board of Directors should be in conformity with the objects set out in the constituting document. Similarly the managing director, if any, should act not only in accordance with the mandate he has received but he should ensure that the decisions he takes are in conformity with the objects of the company and the policies formulated by the Board. The effectiveness of management under the control of managing

Internal Audit, Management and Operational Audit

19.16

director and the various members of the Board including those incharge of finance, production, sales etc., should be subject to review of the management auditor. From the point of view of the management auditor, knowledge about the following is essential: (i)

Purpose for which the organisation has been created. For example, purpose of a steel mill in the state sector may include: (a) production of steel to reduce imports of steel. (b) creation of reasonable employment opportunities. (c) development of backward areas. (d) providing staff welfare consistent with the needs for a proper living. It should not be understood that such steel mill will not work for profit. Profit being one of the objects, should be properly balanced with other objects so that the purposes for which the organisation was created can be achieved.

(ii)

Management structure including delegation of authority, planning and budgeting.

(iii) Reports required for a proper management and the reports actually received. (iv) Internal controls. (v) Nature of production of the business concerned in the broad way so that he can understand the flow and content of work leading to production and their mutual relationships. Some ideas about the techniques, formulas, raw materials and personnel requirement would be of direct assistance to the management auditor. (vi) Production planning (vii) Factory layout, design and installed capacity (viii) Personnel policy and personnel management including requirements, training, welfare, incentives and disincentives. (ix) Materials management including sources of important raw materials, receipt of materials of the quality and quantity needed, storage, supervision and safe custody, insurance and the procedure for issue of materials. (x) Sales management and sales planning including advertisement policy. (xi) Decision making process. (xii) Books and records including cost accounting records, cost accounting system and financial accounting policies. (xiii) Financial management of the organisation. In view of the analysis made above which recognises management audit and operational audit as two identifiable exercises having a large area of overlapping jurisdiction, it may be convenient to consider them together to avoid duplication; and for this purpose the expression “management and operational audit” may be acceptable as a management audit which includes within its scope all the elements of operational auditing.

19.17

Advanced Auditing and Professional Ethics

19.7.4 Desirability of Management Audit: Management Audit is a tool to improve management performance by recognising facts and information about management presented after appropriate examination, verification and evaluation, by professionally qualified and competent people. Naturally, any organisation of a reasonable size may be able to derive benefit from this form of audit which is distinctly different from annual statutory financial auditing and deeper and broader than the conventional internal auditing. Management audit focuses attention on a comprehensive and constructive examination of the organisational structure, its components such as, divisions, departments, ventures, plans, policies, its financial control system, its method of operation, its appropriate use of human, physical and financial resources. The principal reason for undertaking a management audit is the need for detecting and overcoming current managerial deficiencies (and resulting operational problems) in ongoing operations. Unlike the annual review by outside accountants, which focuses on financial results of the past year and thus is backward-looking, a management audit represents a more positive, forward-looking approach that evaluates how well management accomplishes its stated organisational objectives; how effective management is in planning, organising, directing, and controlling the organisation’s activities; and how appropriate management’s decisions are for reaching stated organisation objectives. This evaluation of managerial performance is achieved with the aid of a management audit questionnaire. Whether management evaluation through use of the questionnaire is performed by an outside auditing or consulting firm, the consulting staff within the organisation, or selected members of the organisation is immaterial. The important point is that some group is charged with the responsibility to undertake this evaluation process periodically. One benefit of the management audit, then, is that managerial problems and related operational difficulties can be spotted before the fact rather than after the fact as with a financial audit. This forwardlooking approach is analogous to the preventive maintenance concept found in production; that is, periodic management audits can pinpoint problems as they are developing from a small scale. In comparison, detecting the same problem at a later time, when they have generally increased in scope, results in higher costs to the organisation. A second important benefit of management auditing is that it represents another management tool to assist the organisation in accomplishing desired objectives. The capability of the management audit questionnaire to pinpoint important problem areas that are related to managing an organisation is a real plus factor for its use. Business failures are caused largely by poor management. What better way can this important problem be overcome than by employing management audit in an objective manner? If certain managers are ineffective in their present positions, appropriate corrective action should be taken. Obviously, management auditing would be clearly helpful in the case of ailing industries, to isolate the problems and account for their ailments. It is especially important if such industries are either to be taken over by the government or to be heavily financed by financial institutions with a view to bring back vigor in them. Before committing public funds, like government funds or the institutional funds, it is important to properly diagnose the financial health and possibilities of a business undertaking and know the specific reasons that have caused or contributed to the decline of the business. Given bad management, any amount of money pumped in may go waste; similarly, without proper knowledge of the causes of sickness,

Internal Audit, Management and Operational Audit

19.18

government takeover may not cure the ills. Even a sound entity may also benefit from a periodical management audit; further improvement in its operations can be effected, the brewing or latent problems may be detected and analysed and opportunities or difficulties created by changing circumstances can be known. 19.7.5 Organising the Management Audit : The establishment of a general programme for management audit requires management’s approval to the plan. Unless the management’s full support is available for the proposal, there may be lot of difficulties at later stages. Therefore, it is imperative to give consideration to a statement of policy which indicates therein the objectives and which reflects a definite plan to achieve the objectives while organising for management audit. The plan should also include the statement on personnel requirements, establishment of staff training programmes to improve the effectiveness of work and the basis of control over time and cost. These, being the basic features are discussed below at length with related matters. Devising the statement of policy - The management’s support must be reflected clearly and categorically in the company’s highest policy statement. The policy statement should be quite specific. It should spell out clearly the scope and status of the management/operational auditing within the enterprise, its authority to carry out audits, issue reports, make recommendations, and evaluate corrective action. The statement of policy should lay down in clear terms the scope of activities to be performed by the management auditor. The scope of activities is the most basic requirement for building up a successful management audit programme both for small as well as a large organisation. Thus, a comprehensive statement of policy provides definite understanding to management concerning the nature of audit to be performed and the scope and details of audit work to be carried out. This then will become the charter under which the management auditor should operate. In this charter, will be set forth, for the rest of the company to see, how executive management regards the purpose, mission and authority of the function of management auditor within the company. The statement must afford the auditor all the authority he needs yet does not assign responsibility which he cannot conceivably carry out. The statement must categorically say that the management auditor is capable of reviewing administrative and management controls over any activity within the company. However, he should not be expected to extend his activities to the evaluation of performance of professional and technical activities calling for specialised knowledge and skills and suggest remedies unaided by people competent to undertake such evaluation. Location of audit function within the organisation - Some organisations depending upon their size and nature have established a separate department of audit specialists where the head of the department reports directly to the top executive. In certain cases, the audit group may be a part of the activities of management services department, administrative control department or some other unit of organisation. The more important question, however, is that the function should be as entirely independent as possible of pressure from various groups in the enterprise. The greater the independence, greater is the freedom to work effectively. Therefore, it is better to place the auditing function quite high in the organisation. The minimum requirement for the auditing organisation is to report to an officer whose status is such that he can command prompt and proper consideration of the auditor’s opinion and recommendations. Preferably that officer should be a member of the Board. One of the

19.19

Advanced Auditing and Professional Ethics

controversies that is usually raised is whether the management auditor should report to the finance director, to whom he may be administratively responsible or to the managing director where he has no administrative responsibility. A third opinion would like the auditor to report to an audit committee, comprising of senior executives of the company who are preferably Board members. A different school of thought would like auditors to report to both the finance director and the audit committee. Though the controversy rages and no definite solution can be arrived at, it is felt that the controversy regarding which of these persons the management auditor should report to is not much substance where independence exists. Independence of the management auditor is not necessarily related to the person/persons he reports. His independence is entirely dependent on the management’s attitude towards audit, the credibility the management auditor has with the management and the management’s positive will to listen to criticism for self betterment. Allocation of personnel - Whatever be the size of the enterprise, it is important that all persons selected and assigned to audit possess a good understanding of auditing theory, a thorough knowledge of the fundamentals of both organisation and management, the principles and effective methods of control, and the requirements for conducting scientific appraisal. “General Guidelines on Internal Auditing” issued by the Institute also emphasizes these qualifications for an auditor whose area extends beyond the review of financial controls. As the management auditor is expected to evaluate operational performance and non-monetary operational controls, he should possess basic knowledge of the technology and commercial practices of the enterprise, an enquiring, analytical, pragmatic and imaginative approach and a thorough understanding of the control system. The management auditor should also have a basic knowledge of commerce, law, taxation, cost accounting, economics, quantitative methods and EDP systems. Knowledge in these areas would be adequate for him to identify problems and to determine steps to be taken when a problem is identified. It does not mean that management audit should be assigned to engineers, computer experts and others. Rather persons having sound accounting background alongwith general knowledge of other relevant disciplines are best suited to perform this job. Because the profession of accountancy basically teaches a systematic and analytical approach to a problem, it is this methodical approach which is the guiding note to an audit function of review of controls. In personal characteristics individuals assigned to the job should have an inclination towards analysis, a high degree of imagination and an ability to write and express themselves clearly and logically. Staff training programme - A continuous training programme is necessary to achieve quality in performing audit assignments because the management auditor must keep of new ways to improve auditing standards. An effective training programme enables staff to assume additional responsibilities and advancements in the organisation. Thus the programme acts as an incentive for drawing capable people into the department and keeping them. Time and other aspects - The time required to carry out a management audit will vary, depending upon the extent and nature of assignment. For example, the time required to perform an audit of the entire activities of an organisation’s purchasing department might take a few weeks, while an audit of the entire business could take several months. Much depends upon the size of the activity. An appraisal of a plant’s standard cost system might also simultaneously include an appraisal of the departmental budgetary control system. In a study

Internal Audit, Management and Operational Audit

19.20

of the results of sales contacts and selling efforts in the field, one might find it feasible to study the expense reports and other costs incurred in making contacts. In the evaluation of the method of scheduling production in a plant, one might well take a good look at the sales department’s method of compiling and preparing the sales forecast. The time and cost will vary for each assignment, depending upon the nature of the assignment, the number of auditors assigned to perform the work, and whether or not more specialists in a particular field are required. An audit of a production planning and control department, for example because of its size and other factors, could require an audit staff of several persons and, in addition, a specialist in production planning and one in production control. If an assignment is one which requires technical assistance of a nature unavailable within the audit group, it might be advisable to seek a qualified outside consultant to perform the work. Frequency - Having specified various approaches to management audit, including its scope and its staffing requirements the last item that should be considered before undertaking such an audit is its frequency. Prime consideration should be given to the nature of the organisation. Is the company in a fast-changing industry where there is great accent on the latest technology in the company’s products and/or services? When the organisation is subject to rapid change or the total resources utilised are expensive, the frequency of management auditing should be greater than when it does not undergo rapid changes or the resources employed are not high in value. In essence, management audits should be made often enough to provide protection against growing problems. On the other hand, they should not be so frequent as to lead to repetitious results of questionable value. To get an idea of the optimum frequency of such an audit, it might be worthwhile to look at financial audits. Customarily, financial audits are conducted annually. They are highly programmed, since an internal control questionnaire is utilised to attest to accounting methods and procedures. By contrast, a management audit should be considered from a longer time frame. For an organisation, that is subject to rapid changes or consumes a great amount of high-cost resources, a two-years basis might be adequate to protect it from managerial and operational problems becoming entrenched or too large. For those organisations in a relatively stable industry, the frequency of audit can be every three years. In no case should the interval be allowed to exceed three years. 19.7.6 Conducting a Management Audit : Once top management has decided on the scope, the staffing, and the frequency of the management audit, the next phase is the undertaking of actual audit. This involves investigating and analysing the present facts through interviews as well as completing a management questionnaire so as to determine the problems confronting the organisation. Getting the facts through interviews - To avoid waste of time and effort, adequate preparation is necessary in management auditing just as in financial auditing. The management auditors should know what information is desired, and they should be prepared to ask a number of direct questions to get the desired information. Reference can be made to the management audit questionnaire for specific questions. Care must be taken in selecting the proper managers to interview so as to obtain pertinent information.

19.21

Advanced Auditing and Professional Ethics

In the interview itself, the auditors should begin by stating the purpose of the audit. Emphasis should be placed on getting the facts that are essential to review and appraise the functional area(s) under study. The exchange between auditor and manager should be friendly and conducted in an open atmosphere so as to encourage a free exchange of ideas. It is always wise to listen to tentative solutions set forth by the manager for problems that confront him or her. Many times these solutions can be made an integral part of final recommendations, and when the manager sees that his or her solutions are included in the final report, the individual is more apt to support the recommendations. Thus, management auditors will experience less opposition at the end of the engagement by utilising this approach. Also, during the interview, management auditors should not commit themselves, nor should any recommendations be set forth at this time. Once all pertinent information has been extracted from the interview, it is advisable to verify the accuracy of information by requesting the person interviewed to read the notes taken and place his or her initials thereon. This extra step makes the individual feel an important part of management audit. Measuring performance through the Management Audit Questionnaire - During the interview, the management auditors make a careful inquiry into important facts. The next step is to analyse this information, with the aim of measuring current performance. The best way to perform such an analysis is to utilise the sections of the management audit questionnaire that apply to the areas under study. By way of review, a management audit questionnaire aims at a comprehensive and constructive examination of an organisation’s management and its assigned tasks. Overall, the questionnaire is concerned with the appraisal of management actions in accomplishing organisation objectives. Its primary objective is to highlight weaknesses and deficiencies of the organisation for possible improvements. More specifically, it includes a review of how well or badly the management functions of planning, organising, directing, and controlling are being performed. In addition, it evaluates how effective the decision-making process is in accomplishing stated organisation objectives. Within this framework, the questionnaire provides a means for evaluating an organisation’s ongoing operations by examining its major functional areas. The questionnaire is designed to evaluate management practices. There are three possible answers to the management audit questions: “yes”, “no”, and “N.A.” (not applicable). A “yes” answer indicates that the specific area, function, or aspect under study is functioning in an acceptable manner; no written explanation is needed in that case. On the other hand, a “no” answer indicates unacceptable performance and should be explained in writing. Questionnaire comments on negative answers not only provide documentation for future reference, but, more important, provide background information for undertaking remedial action. Those questions that are not applicable and should be ignored in the audit are checked in the “N.A.” column. In any case, these questions are designed to help an individual evaluate real world situations. As such, the questions should be approached from a research-oriented frame of reference. If all questions are answered with a ‘yes’, operations are proceeding as desired. On the other hand if there are one or more ‘no’ answers, difficulties are being experienced and must be explained in writing. If the question does not apply, the N.A. (not applicable) column is checked. Thus management audit questionnaire for this part of the audit not only serves as a management tool to analyse the current situation; more importantly, it enables the

Internal Audit, Management and Operational Audit

19.22

management auditors to synthesis those elements that are causing organisational difficulties and deficiencies. To state it another way, a synthesis (a process of combining separate elements) can be used for determining the problem. The capability to assess all negative answers goes a long way towards defining the real problem-not just stating its symptoms. 19.7.7 Concluding a Management Audit: The preparation of the management audit report that covers the details of the management auditor’s findings and recommendations represents an important part of concluding an audit assignment. To assist in the preparation of the final report, the management auditors normally meet with management and other concerned personnel for the purpose of discussing freely any aspect or finding of the audit. This approach assists the independent third party in bringing together the important elements of audit as well as determining appropriate recommendations. Also, it will disclose any “hangups” that organisation personnel may have towards a particular solution. It is far better to discuss alternative recommendations and feel out the possible consequences of recommended action. In this way, when corrective actions are undertaken, the resulting consequences can be predicted, thereby avoiding unworkable solutions. Because of the importance of the oral presentation of recommendations and the final report to management, these areas are covered in some depth below. However, it should be noted that the type of report required varies with the level of investigation. Thus, a comprehensive investigation involves a report that is very broad in scope, while a smaller-scale investigation of one or two functional areas will result in a less comprehensive report. Oral recommendations for improvement - From the management viewpoint, the main focus of audit is recommendations. Generally, there is an oral presentation of specific recommendations to members of the top management team who approved the audit. In some cases, the approval may have come from the board of directors, which then becomes the recipient of the auditors’ oral recommendations. Upon completion of the presentation, oral recommendations become an integral part of the final report- the subject matter for the next section. In the oral presentation, recommendations representing feasible solutions that will be accepted without too much difficulty are discussed initially. This gives the management auditors an opportunity to establish their credibility. The auditors should back these recommendations with a cost/benefit analysis that indicates the expected return to the organisation from implementing them. The interchange of ideas among management and the auditors allows for a logical development of appropriate dates for implementation. Additionally, it assists management auditors in drawing up an implementation time-table for inclusion in their final report. 19.7.8 Management Audit Reports: The written report is the medium by which the comments, criticisms and recommendations of a management audit department are conveyed to the Board, to functional directors and to management in general. It follows, therefore, that audit reports crystallise the work of the management auditor and merit the closest consideration of all audit staff engaged in their preparation. Reports must be written with very great care after full consideration of the subject matter and with full regard to the fact that it is imperative that the report conveys exactly the right impressions on the reader. Management

19.23

Advanced Auditing and Professional Ethics

audit reports will inevitably cover a wide variety of subjects, reflecting the many and ever increasing ramifications of management audit departments. Broadly, however, reports may be divided into four main categories: 1.

Reports prepared by the management audit staff after their visits to a unit.

Periodical reports prepared by senior members of management audit department which summarise the main audit findings and recommendations for the period under consideration and which afford a concise review of the department’s activities for that period.

Reports on the results of special investigations and inquiries.

An annual audit report.

The right of the management auditor to report to the highest level is now well established in many organisations but in all cases responsible officials of the different units which have been subjected to audit should be afforded the opportunity of discussing matters in the report concerning their departments before this is passed in final form to a higher level. Types of Reports - The reporting of results covers a wide spectrum of types. We can describe the more important ones as follows: Oral reports - In many situations, the reporting of results will be on an oral basis. To some extent, this is inevitable since a part of the actual audit effort is carried on in conjunction with company personnel. In other cases, it is a result of emergency action needs. It may also be a prelude to more formal written reports. To some extent, there will always be oral reporting as a means of later supplementing written reports, especially when individuals being served have special needs. Oral reporting therefore, serves a useful and legitimate purpose. It is recognised that it has a major limitation that there is no permanent record. As a result there are more likely to be later misunderstandings. What is important, therefore, is that this type of reporting be used carefully and for all significant matters, specially the matters covered by emergency oral reporting, should be followed up immediately by a written report giving reference to oral reporting. For example, a management auditor, if he has come across any embezzlement, should immediately inform the concerned management orally, so that steps may be immediately taken to prevent further embezzlement. Interim written reports - In situations where it is deemed advisable to inform management of significant developments during the course of the audit, or at least preceding the release of the regular report, there may be some kind of interim written report. This report may pertain to especially significant problems where there is a need for early consideration. or the report may be of a progress nature. In either case, they may be quite formal in nature or of the more informal type of current memoranda. They can be reserved for very exceptional developments, or issued on a more extensive basis. Often, their distribution is limited to this auditee management, but this is not necessarily the case. All in all, interim reports represent a type of reporting which, when used with judgement, can be a good device to improve the total reporting process. Regular written reports - In the typical situation, the particular audit assignment will include the preparation of a formal written report. The form and content of such written reports will

Internal Audit, Management and Operational Audit

19.24

vary widely, both as between individual audit assignments and individual companies. They may be short or long. They may be presented in many different ways, including the extent to which quantitative or financial data are re-included. We will in the later pages discuss in more detail the organisation and planning of this type of report. Summary written reports - These summary reports are also referred to as ‘flash’ reports. In a number of companies the practice has developed of issuing an annual (or sometimes more frequent) report summarising the various individual reports issued, and describing the range of their content. These summary reports in some cases are primarily for audit committees of Boards of Directors, but in other cases for higher level management. They are especially useful to top level managers who do not actively review the individual reports. They are also useful to the general auditor in seeing his total reporting effort with more perspective and on an integrated basis. Organisation of the written report Format - Though it is difficult to lay down a format applicable to all situations, yet the following general guidelines may be observed: (i)

Title - The management audit report should have a short but descriptive title so that its subject matter can be easily identified.

(ii) Objectives - The management auditor may describe the objectives of the audit assignment. (iii) Scope - The management auditor may give a brief description of the activities audited by him. (iv) Findings, conclusions and opinions - These may be given either department wise or in the order of importance. All the facts and data pertaining to the, situation should be assembled, classified and analysed. Each finding should be discussed comprehensively and correlated with other findings. Conclusions and opinions should normally follow the findings. Tables or graphs may be used for the presentation of statistical data in appendices. (v) Recommendations - A management audit report may include recommendations for potential improvements. However, care should be taken in making recommendations in order that the auditor’s own objectivity may not become subject matter of question. He may point out defects and make recommendations in a broad manner on how to overcome them. He should avoid providing detailed procedures in the capacity of an auditor. Normally specifying procedures etc. should rest with consultants. (vi) Auditee’s views - The auditee’s views about audit conclusions or recommendations may also be included in the audit report in appropriate circumstances. (vii) Summary - A summary of conclusions and recommendations may be given at the end. This is particularly useful in long reports. Planning the Audit Report - Before starting the report, the auditor should ask himself, “What do I want to tell the reader about this audit? The answer will enable him to communicate effectively.

19.25

Advanced Auditing and Professional Ethics

Supporting information - The management auditor should supplement his report by such documents and data which adequately and convincingly support the conclusions. Supporting information may include the relevant standards or regulations. Preparing draft report - Before writing the final report, the auditor should prepare a draft report. This would help him in finding out the most effective manner of presenting his report. It would also indicate whether there is any superfluous information or a gap in reasoning. Writing and issuing the final report - The final report should be written only when the auditor is completely satisfied with the draft report. The head of the management auditing department may review and approve the final report. Before issuing the final report, the auditor should discuss conclusions and recommendations at appropriate levels of management. The report should be duly signed and dated. Follow-up of the audit report - The management auditor should review whether follow-up action is taken by management on the basis of his report. If no action is taken within a reasonable time, he should draw management’s attention to it. Where management has not acted upon his suggestions or not implemented his recommendations, the auditor should ascertain the reasons therefor. In cases where he finds that non-implementation is due to a gap in communication, he should initiate further discussions in that matter. Where management has accepted his recommendations and initiated the necessary action, the management auditor should periodically review the manner and the extent of implementation of the recommendations and report to the management highlighting the recommendations which have not been implemented fully or partly. Any nonimplementation of the management auditor’s report in continuing assignments, after having convinced that the communication of the report was complete should be earnestly taken up because on this the credibility and usefulness of the audit function largely depends. It also reflects management’s attitude to audit. In any case, the auditor to retain the usefulness of audit function should ascertain from the management, preferably in writing, the reasons for non- implementation. It is possible that because of change in circumstances, the audit observation did not require any action on the part of the management. 19.7.9 Behavioural aspects encountered in a Management Audit : It has been experienced that one of the biggest difficulties involved during the course of management audit is that people working in the organisation do not wish to accept any change. While at the time of conducting interviews, it seems that people working in the organisation are amenable to change but at the time of actual implementation they come up with stiff resistance to proposals on account of various behavioural problems arising on this account. Such an unfortunate situation can be avoided by building up a positive approach to management audit and involving the various organisation personnel right from the initiation of the management audit. Another fear which haunts executives working in the organisation is that the management auditors’ recommendations may lead to their removal or reshuffling in the process. This problem may also be overcome by explaining to these executives that the management auditor is there to help them in achieving the results rather acting against their interests. Various problems arising on account of behavioural attitudes and solutions to overcome them during the process of management audit are discussed in the following paragraphs.

Internal Audit, Management and Operational Audit

19.26

Financial auditors deal mainly with figures. Management auditors deal mainly with people. Management auditors in the normal discharge of their duty will come into contact with the following: (a) Colleagues in their own department, (b) Staff of the department whose functioning they audit. (c) “Top management” who authorise them to perform audits. Therefore, management auditors must develop and maintain good relations with auditees to gain information and to ensure corrective action on audit findings. Yet, the general image that the auditor seemed to create is that he is a critic, fault finder or private spying authority of the top management. It is an ‘occupational risk’ of management auditor to come across very often ruffled feelings, hostile relationship and unwelcome atmosphere. While the position of management auditor is not of any recent origin, it is still true that the behavioural problems connected with a management auditor’s role have existed for a long time and continue to exist. There are many causes for behavioural problems arising in the review function of management/ operational audit. Particularly, when management/operational auditors performs comprehensive audit of operations, they cannot be as well informed about such operations as a financial auditor in a financial department. Operating processes may be unfamiliar and complex. The operating people may be speaking a language and using terms that are foreign to the auditor’s experience. However it must be emphasised that other departments which have only staff function to perform do have similar behavioural problems. Any suggestions made by them either may not be accepted or if forcibly implemented attempts are like to be made to make them a failure. In the following paragraphs, the nature and causes of behavioural problems that the management auditor is likely to face in the discharge of the review function that is expected of him and possible solutions to overcome these problems are discussed. (1) Staff/line conflict - The staff/line relationship is inherently prone to conflict. Management auditors are staff. And line people in the sense all members of other departments of the organisation are likely to regard the management auditor the same way as they regard other staff people. Management auditors being specialists in their field may think that their approach and solutions are the only answers. They tend to discount the difficulty people may face if called on to act on their ideas. And they may feel that they must point out defects to prove themselves to top management. Line personnel, under such circumstance, will most likely regard staff with antagonism. (2) Control - As the management auditor is expected to evaluate the effectiveness of controls, there is an instinctive reaction from the auditee to have certain amount of fear that his actions when reported are likely to cause adverse effect on those who receive the auditor’s report, viz., top management. There is a certain amount of justified fear that top management’s opinion of their performance or implementation of control procedures is likely to be affected by the auditor’s report. Therefore, the management auditor, being the part of control system and thorough evaluation of controls, leads to breeding of antagonism on the part of the auditees. According to a research study, the causes of antagonism are as follows: ♦

Fear of criticism stemming from adverse audit findings.

19.27

Advanced Auditing and Professional Ethics

♦

Fear of changes in day-today working habits because of changes resulting from audit recommendations.

♦

Punitive action by superiors prompted by reported deficiencies.

♦

Insensitive audit practices - reports which are overly critical, reports which focus on deficiencies only, the air of mystery cloaking some audits, and the perception that auditors gain personally from reporting deficiencies.

♦

Hostile audit style - a cold and distant aspect is a lack of understanding of the auditee’s problems, an absence of empathy, an air of smugness or superiority, an excessive concentration on insignificant errors, a prosecutional tone when asking questions, and a greater concern with parading defects than helping constructively to improve conditions.

The other significant cause is that auditor’s study of existing systems and procedures may give room for recommendations for changes of such systems, There is a certain built-in resistance to change. When a change is recommended by the auditor the resistance to change is transferred to the auditor’s recommendations and the auditor. The auditor is looked upon as a likely instrument for recommending changes and auditees do not welcome the visits of auditors and much less their studies and their reports thereafter. In view of the above, the fear of evaluation of their performance and the possibility of changes suggested in the existing familiar systems form the major causes for behavioural problems between the auditor and the auditee. It should not, however, be overlooked that in addition to the above cause the auditor’s general approach to his role and his behaviour add yet another dimension to the nature of behavioural problems. Solution to behavioural problems - The auditors, if they were to adopt the role of accuser or secret agency of the management to try upon the happenings of the auditee division, they would be unwelcome. Their presence will give rise to problems of personal relationship. Relations between the auditor and the auditee may improve if the auditor acts and is perceived as a professional advisor and consultant. In any event, there is a need to demonstrate to the extent possible that: 1.

the audit is part of an overall programme mandated by higher- level authority to meet higher-level organisational needs for both protection and maximum constructive benefit.

the objective of the review is to provide maximum service in all feasible managerial dimensions.

the review will be conducted with minimum interference with regular operations of the operating personnel.

the responsible officers will be kept fully informed and have an opportunity to review findings and recommendations before any audit report is formally released.

It is essential to create an atmosphere of trust and friendliness so that audit reports will be understood in their proper perspective. Davis and Scott in their book on “Human Relations and Organisational Behaviour” had suggested that being effective does not merely consist of being extremely polite.

Internal Audit, Management and Operational Audit

19.28

“Effectiveness is a difficult task requiring the highest mental ability and sound framework for analysing human situations”. In view of the delicate role of the auditor, it is inevitable that he has to face complex situations. The skill that is needed is of a high order warranting “sophisticated understanding based on sound philosophy”. Constructive criticism - It is essential that the auditor should concentrate only on constructive criticism. He should also make obvious in his report the value of his comments in tangible terms. Only then would suggestions carry weight with the auditees and they will feel convinced that the auditor has been objective in his remarks in the report. T.J. Krien in his article on “People assets that talk back” has strongly advocated the view that once the auditor is able to convince the auditees that his approach is one of mutual problem solving rather than one of fault finding, then it would produce positive results and the chances of auditors’ recommendations being considered in an objective fashion would be better. If the auditors were to adopt a “fault finding role”, the auditees would be constrained to become defensive and would bend backwards to justify their position. A few other authors also have strongly advocated the view that the success of the auditor’s role would to a great extent depend upon whether the auditee were made to feel convinced that the auditor’s role was one of being helpful rather than that of a fault finder. Reporting methods - To achieve this objective, the auditor has to make a concerted effort to convey effectively his role by adopting a friendly but firm tone in his report. It is always possible to disagree without being disagreeable, to criticise without being critical. The reports should concentrate on areas which need improvement rather than listing inefficiencies and deficiencies in performance of the auditee. The mistaken notion that the greater the number of deficiencies reported the higher would be the rating of his performance should be erased or given up. This is an outdated notion and does not in any way contribute to the effectiveness of the auditor. Participative approach - It is well established that auditor’s reports have better acceptability if the improvements suggested are discussed with those who have to implement them and made to feel that they have participated in the recommendations made for improvements. Harmeyer W.J. in his article on “Operational audit: You too can be a Consultant” has reasoned that by adopting a participative approach the chances of improvements being accepted and implemented successfully with conviction area very good. In his work, he has effectively described the concept as follows. “By utilising this participation you end up with coordinated suggestions for improvement not with the auditor’s recommendations”. W.T.Jerome also voiced the same view in his article in Harward Business Review long back. He very correctly pointed out that “auditors must candidly recognise that they are appraising many deficiencies from the distorting vantage point of hindsight. If they recognise this limitation by soliciting the views of operating personnel, internal auditing becomes a co-operative enterprise ......... it will not then be regarded as the “secret police” of the home office.” Instances are not uncommon where when auditors recognising the state of conflict between themselves and the auditees adopted a positive approach and in most of the organisations auditors play the role of trouble shooters and are expected to play an important role on very many occasions, If the auditors were to straightaway reject all proposals, whether good or not, made by departmental heads without appreciating the auditee’s contribution and accomplishments an atmosphere of hatred and hostility created. On the other hand, it has been observed that either oral or written

19.29

Advanced Auditing and Professional Ethics

appreciation of the auditee’s achievements not only encourages the auditees to develop a friendly attitude towards the auditors but look forward to their guidance in a more receptive fashion. The participative approach to the internal audit process has proved to be success. Well-known authorities in the field have proved by means of research they have conducted that resistance to change is absent if not minimal when participative method is adopted. Feelings of hostility disappear giving room to feelings of mutual trust. Team spirit is developed and the auditors and the auditee endeavour to achieve the common goal. Proposed recommendations are discussed with the auditee and such modifications as may be mutually agreed upon are incorporated. With this attitude of the auditors and auditees, it becomes absolutely easy to implement the proposed suggestions as the auditees themselves take initiative for implementation and auditors do not have to force any changes on the auditees. Finally, it needs hardly any emphasis that there should be right management culture, enlightened auditees and auditors of the right calibre. May be to expect a combination at all times of all the three is asking for the impossible. But, a concerted effort by the management, auditors and auditees to achieve a more acceptable climate would go a long way to achieve the goal. Three cases are given hereunder to illustrate the practical aspects of behavioural problems. Case-1: Auditor objective: Auditee offensive: Management’s apathy - In Professional Organisation Ltd., the Management Auditor as part of his duty was expected to perform the audit function of the Consultancy Division of the organisation. The auditor in the normal functioning discovered lack of control and a further study revealed suppression of information regarding illegal procedures being followed by the department. His further in-depth examination of the books revealed that the division has been overstating profits, to justify its existence. These facts which had been in existence with the knowledge of manager of the Division had been left undetected. The auditor was totally professional. His attitude was not one of “policing”. He had discussed the contents of his proposed report with the auditee. The auditee had to be defensive and hence decided to be offensive. Management had to face the predicament of appreciating the good job done by the management audit department without openly decrying the Divisional Manager. There was open “cold war” of hatred and hostility declared by the divisional Manager. The behavioural problems arose in spite of auditor’s professional role. The auditee’s reaction was instinctive as a corollary to being self-defensive. The management had a tough time. The problem was sorted out and the atmosphere of illfeeling and hatred generated by the auditee could be smoothened. Case-2 Auditee progressive: Auditor cantankerous: Management indifferent - In a large organisation, there was a long-standing problem of lack of coordination between marketing and production. The pressures of day-to-day problem, made the situation worse. Production and Marketing Managers were happy to have the services of the management, auditor to streamline procedures and monitor the implementation. It would have been ideal for the auditor to evolve a good system after a detailed study of the problems, have the key personnel of production and marketing departments participate in the discussion and to have introduced the proposed system with their co-operation. Instead the auditor took on his duty as a mission for fault finding and started submitting secret reports on the malfunctioning of the Production

Internal Audit, Management and Operational Audit

19.30

and Marketing departments. Management, having already the heavy load of coordination would seek explanations from Production and Marketing departments. The auditor’s cantankerous behaviour and management’s indifferent attitude inspite of auditee’s very cooperative approach gave room for a series of behavioural problems. A participative approach, with the total curtailment of “policing” reports, with the correct guidance from the management would have avoided all behavioural problems. Case-3 Auditor progressive- Auditee appreciative: Management objective - In a large organisation with operations spread all over the country the management faced sudden problems of lack of financial control, inspite of high levels of production and remarkable market demand. The organisation had an efficient and progressive management auditor with a good team. The auditees were individuals with professional attitude. Management was progressive and dynamic. Management called for meetings, explained the special assignment being given to management auditor of aiding management to get a grip over the situation. The auditee welcomed the auditor as an expert consultant. The auditor adopted an attitude of friendliness without descending to levels of too much familiarity. There was coordinated effort between the auditor and auditee. Management was kept informed of the problems and solutions being jointly worked out by the auditors and the auditees. Within a very reasonable time, what seemed an “out of control” situation was streamlined and the management got back the grip over the entire organisation.

19.8 Operational Audit Operational auditing is a systematic process involving logical, structured and organized series of procedures. 19.8.1 Internal Auditing and Operational Auditing: To understand what operational auditing is, it would be better if we first understand internal auditing. It may be recalled that internal auditing is an activity carried on by the internal staff of an organisation to meet the management requirements of information. The definition of internal auditing given by the Institute of Internal Auditors, New York, in fact equals internal auditing with operational auditing. According to this definition, internal auditing is an independent appraisal activity within an organisation for the review of operations as a service to organisation. Naturally, when an auditor is concerned with the appraisal of operations, he be comes an operational auditor. Another important point that this definition throws up is that operational auditing is essentially a function of internal auditing staff. According to the Institute of Internal Auditors, “the overall objective of internal auditing is to assist all members of management in the objective discharge of their responsibilities, by furnishing them with objective analysis, appraisals, recommendations and pertinent comments, concerning the activities reviewed. The internal auditor, therefore, should be concerned with any phase of business activity wherein he can be of service to managements.” IIA publication defines operational auditing as - Operational auditing is a systematic process of evaluating an organisation’s effectiveness, efficiency and economy of operations under management’s control and reporting to appropriate persons the results of the evaluation

19.31

Advanced Auditing and Professional Ethics

along with recommendations for improvement1. On the basis of above definition operational auditing is a systematic process involving logical, structured and organized series of procedures. Operational auditing concentrates on effectiveness, efficiency and economy of operations and therefore it is future oriented. It does not end with the reporting of the findings but also recommends the steps for improvement in future. At this stage it must be conceded that operational auditing is a newly emerged term and therefore liable to be understood according to individual perceptions about what it is or should be. It may, therefore, take some time to have a generally accepted conceptualisation on this. However there probably may not be much of difference in viewing operational audit as a review and appraisal of operations of an organisation carried on by a competent independent person. The question of competence is implicit in any auditing situation; unless one is wellconversant with the philosophy, techniques and procedures of audit, one cannot do justice to the work of audit. Similarly auditing whether carried on by an internal staff or by an external person, should necessarily be an independent activity to maintain its objectivity and usefulness. According to Cadmus “Operational Auditing is not different from internal auditing, it is merely an extension of internal auditing into operational areas. And it is characterised in both financial and operational areas - by the auditor’s approach and state of mind”. The difference in the approach of both these audits is illustrated below: Perception - Traditionally, internal auditors have been engaged in a sort of protective function, deriving their authority from the management. They view and examine internal controls in the financial and accounting areas to ensure that possibilities of loss, wastage and fraud are not there; they check the accounting books and records to see, whether the internal checks are properly working and the resulting accounting data are reliable. They also look into the aspect of safety of the assets and properties of the company. Some element of operational auditing can be found even in these traditional functions of internal auditors, specially in the context of fraud, wastage and loss. Internal auditors emboldened by their ability to appraise financial and accounting control, gradually started extending their field to cover non-accounting control as well. They, however, had to condition their mind and approach so as to examine the results from the management point of view. This is a sort of expertise which they also utilise in appraising financial data from the management point of view. To a traditional internal auditor, a loss of ` 1,000 caused by a wrong totalling of invoice is important and this is that he looks for. But for an auditor engaged in the review of operations, carrying out of a proper maintenance programme of the machines is of greater importance because considerable production loss due to machine breaks down can thus be prevented. In both the cases, the auditor’s objective is to see that the business and its profitability do not suffer from avoidable loss, but, nevertheless, there is a distinct difference in approach. Take another instance - when the auditor looks into the vouchers to see whether they corroborate the entries in the cash book or physically examines the cash in hand he is doing his traditional protective function. The moment be concerns himself to see whether customers’ complaints are duly attended to or whether cash balance is excessive to the need, he comes to the operational field. It should not be assumed, that, since an operational auditor is concerned with the audit of 1 Darwin J. Casler and James R. Crockett, operational Auditing. An Introduction (Altamonte Springs, FL: The Institute of Internal Auditors, Inc., 1982). P 14.

Internal Audit, Management and Operational Audit

19.32

operations and review of operating conditions, he is not concerned with the financial aspects of transaction and controls. A point has already been made that the special expertise acquired by the operational auditor, that enables him to view the controls and operations from the management point of view, can be carried back to his review of the financial areas. In the matter of cash transactions, the operational auditor will look into such aspects as the quantum of cash in hand (by relating it to the requirement of cash to be held) carried generally or the use of cash not immediately required. Also he will review the operational control on cash to determine whether maximum possible protection has been given to cash. Similarly, in the audit of stocks, he would be interested in such matters as reorder policy, obsolescence policy and the overall inventory management policy. In pure administrative areas on stock, he will see whether adequate security and insurance arrangements exist for protection of stocks. Issues - According to Lindberg and Cohn, two facts about operational audit must be understood - the area of operational audit is young and it is still, uncertain of direction. As has been indicated earlier these authors confirm that there exist two opposing views about the nature and role of operation audit. One view holds that operational auditing is only a fact gathering tool that will help management appraise performance and identify areas in which additional investigations may yield improvement. The other view seems to extend the scope of operational audit further to recommendation of specific changes intended to correct the short comings observed by the auditor. It may be observed here that Lindberg and Cohn prefer to use the expression “Operations Audit” instead of the more common practice of denoting it as “operational auditing” with a view to distinguishing the former from the latter, which according to the authors, is generally understood to convey the second type of meaning associated with the expression. These authors have defined “operations auditing” as a technique for regularly and systematically, appraising unit or function effectiveness against corporate and industry standards by utilising personnel who are not specialists in the area of study with the objective of assuring a given management that its aims are being carried out and in identifying conditions capable of being improved. It seems that the basic difference that exists in conceptualisation of the technique of operational auditing is in the auditor’s role in recommending corrections or in installing systems and controls. According to Lindberg and Cohn, such a situation would be in conflict with the role of operational auditor. One cannot objectively review an operation, control or a system recommended by him and in fact this should be left to be dealt by methods and procedures people. In this connection, the views of the Institute of Internal Auditors, in the context of internal audit are relevant. According to that Institute, “the internal auditor should be free to review and appraise policies, plans, procedures and records; but his review and appraisal does not in any way relieve other persons in the organisation of the responsibilities assigned to them. The Institute has further held that “since complete objectivity is essential to the audit function, internal auditors should not develop and install procedures and systems, prepare records or engage in any other activity which they normally would be expected to review and appraise”. It may be remembered that the definition of internal auditing given by this Institute is same as operational auditing. Therefore, the views quoted above equally apply to operational audit per se and Lindberg and Cohn’s views are not different from these in this respect. Also there does not appear to be much conflict of views in understanding operational auditing as an extension of internal auditing with a definite work content which stretches

19.33

Advanced Auditing and Professional Ethics

beyond the traditional field of internal auditors i.e. financial accounting. However, a further distinction should be observed between traditional internal auditing and operational auditing this lies in the attitude and approach to the whole auditing proposition. Every aspect of operational auditing programme should be geared to management policies, management objectives and management goals. Objectives - The main objective of operational auditing is to verify the fulfilment of plans and sound business requirements as also to focus on objectives and their achievement objectives; the operational auditor should not only have a proper business sense, he should also be equipped with a thorough knowledge of policies, procedures, systems and controls, he should be intimately familiar with the business, its nature and problems and prospects and its environment. Above all, his mind should be open and active so as to be able to perceive problems and prospects and grasp technical matters. In carrying out his work probably at every step he will have to exercise judgement to evaluate evidence in connection with the situations and issues; he will have to get the assistance of norms and standards in every operating field to be able to objectively judge a situation. The norms and standards should be such as are generally acceptable or developed by the company itself. Performance yardsticks can be found in the management objectives, goals and plans, budgets, records of past performance, policies and procedures. Industry standards can be obtained from the statistics provided by industry, associations and government sources. It should be appreciated that the standards may be relative depending upon the situation and circumstances; the operational auditor may have to apply them with suitable adjustments. For example, the standards relating to objectives for a government company are quite different from those of a private sector company. Similarly standards of performance of a well equipped company which also adequately looks after the well-being of employees may be significantly different from a company which offers scanty welfare facilities or is ill-equipped. Today, however, the concept of modern internal auditing suggests that there is no difference in internal and operational auditing. In fact, the scope of internal auditing is broad enough to embrace the areas covered by operational auditing as well. The modern internal auditing performs both protective as well as constructive functions. 19.8.2 Qualities of Operational Auditor: The operational auditor should possess some very essential personal qualities to be effective in his work. In areas beyond accounting and finance, his knowledge ordinarily would be rather scanty and this is a reason which should make him even more inquisitive. He should ask the who, why, how of everything. He should try to visualise whether simpler alternative means are available to do a particular work. He should try to see every thing as to whether that properly fits in the business frame and organisational policy. He should be persistent and should possess an attitude of skepticism. He should not give up or feel satisfied easily. He should imbibe a constructive approach rather than a faultfinding approach and should give a feeling that his efforts are to help attaining an improved operation and not merely fault finding. He should consider a fault or mistake found in the course of audit more as a guide to effect improvement than to treat the fault as a sort of crime. If the auditor succeeds in giving a feeling of help and assistance through constructive criticism, he will be able to obtain co-operation of the persons who are involved in the operations. This will itself be a tremendous achievement of the operational auditor. He should

Internal Audit, Management and Operational Audit

19.34

also be equipped with business sense in good measure. He should view every action or operation in relation to the profit objective or other objectives, if any of the organisation. He should be able to view every action in its segmental relevance as also its relevance to the interrelated operations. He should not be obsessed by narrow protective view point that may naturally come to him. His attitude should be to encourage and appreciate good work and to extend a helping hand to those found deficient. The operational auditor should try to develop a team comprised of people of different backgrounds. Involvement of technical people in operational auditing is generally helpful. 19.8.3 Why Operational Audit? The need for operational auditing has arisen due to the inadequacy of traditional sources of information for an effective management of the company where the management is at a distance from actual operations due to layers of delegation of responsibility, separating it from actualities in the organisation. Specifically, operational auditing arose from the need of managers responsible for areas beyond their direct observation to be fully, objectively and currently informed about conditions in the units under control. Operational audit is considered as a specialised management information tool to fill the void that conventional information sources fail to fill. Conventional sources of management information are departmental managers, routine performance report, internal audit reports, and periodic special investigation and survey. These conventional sources fail to provide information for the best direction of the departments all of whose activities do not come under direct observation of managers. The shortcomings of these sources can be stated as under: (i)

Executives and managers are too preoccupied with implementation of plans and achieving of targets. They are left with very little time to collect information and locate problems. They may come across problems that have come to surface but they are hardly aware of problems that are brewing and potential. Even when a department is working well and smoothly, one cannot rule out some crack or gap in operations or in controls, which is not interrupting the work now but will assume big proportions and seriously hinder the working at some future date.

(ii)

Managers or their aides are generally relied upon for transmitting information than for booking for information or for analysing situations.

(iii) The information that is transmitted by managers is not necessarily objective - often it may be biased for various reasons. (iv) Conventional internal audit reports are often routine and mechanical in character and have a definite leaning towards accounting and financial information. They are also historical in nature. (v) Other performance reports contained in the annual audited accounts and the routine reports prepared by the operating departments have their own limitations. The annual audited accounts are good insofar as an overall evaluation is concerned in monetary terms. But they may not bring to light specific problems in different operational areas so readily. Sales may be shown at a higher monetary value compared to the previous year and this may apparently suggest that the functioning of the sales department is satisfactory. But this may have been caused by a number of factors inspite of a really bad performance on

19.35

Advanced Auditing and Professional Ethics

the sales front. This fact may not be readily known unless one cares to analyse the sales data by reference to notes and explanations to the accounts and other related accounting data. Even a study of this nature may not fully reveal the weakness. It is quite possible that the established market for sales has been lost partly while some fortuitous sales have compensated the loss. The other routine departmental reports definitely serve a purpose of more or less currently informing the management about the departmental performance. But the reports are not always objective and have a definite tendency to colour the departmental performance favourably. For example, the routine weekly production report may include production ‘that is subsequently rejected by the quality control staff, or to avoid showing a bad production performance; even the partly produced goods may also be included. Remember, all this can happen inspite of specific management instructions about the basis on which the production report is to be made out. Another important point may be noticed in the matter of routine departmental reports. The despatch section, to show a good performance, may show goods handed over to the transport section which, even within its knowledge, may not be really despatched within the next several days, because of accumulation of goods at the transport shed or because of non-availability of wagons or shipping space. It may be appreciated that those reports may or may not contain a falsehood; but, definitely, they do not show performance in the proper light in relation to allied activities and thereby the problems of one area are merely shifted to the next. They fail to provide insight into particular problems that may be growing elsewhere in the organisation. The busy management people, who can afford time only to glance over the performance reports, cannot be expected to make an integrated reading of several reports or to undertake an analysis of such reports. What they need is reliable, unmanipulated and objective report which they would like to look into to understand the situation. (vi) Operations of controls in a satisfactory manner cannot be relied upon to bring to light the environmental conditions. Controls are specific and their satisfactory operation is related to the specific situation under control. Also monitoring of the breakdown or non-operation of controls is a periodic phenomenon. (vii) Surveys and special investigations no doubt are very useful but these are at the best occasional in character. Also, they are costly, time consuming and keep the departmental key personnel busy during the period they are on. They are undertaken mostly to find causes of certain state of affairs or to fix responsibility for certain undesirable happenings. These are basically an attempt to carry out a post-mortem rather than to enlighten the management about the ways on improvement or for better performance or to give a signal for dangers and disasters to come. Operational auditing has filled a very significant vacuum; it has come to provide the management with inexpensive, continuous and objective appraisal of activities, operations and controls to inform the management about achievement of standards and, if otherwise, to inform the management about what has gone wrong and how it has gone wrong. Also, it enlightens the management about possible dangers, constraints and opportunities that may be of immense value to the management.

Internal Audit, Management and Operational Audit

19.36

19.8.4 Type of Operational Audits2: There are three broad categories of operational auditors: functional, organizational, and special assignments. In case, part of the audit is likely to concern evaluating internal controls for efficiency and effectiveness. Functional Audits - Functions are a means of categorizing the activities of a business, such as the billing function or production function. There are many different ways to categorize and subdivide functions. For example, there is an accounting function, but there are also cash disbursements, cash receipt, and payroll disbursement functions. There is a payroll function, but there are also hiring, timekeeping, and payroll disbursement functions. As the name implies, a functional audit deals with one or more functions in an organization. It could concern, for example, the payroll function for a division or for the company as a whole. A functional audit has the advantage of permitting specialization by auditors. Certain auditors within an internal audit staff can develop considerable expertise in an area, such as production engineering. They can more efficiently spend all their time auditing in that area. A disadvantage of functional auditing is the failure to evaluate interrelated functions. The production engineering function interacts with manufacturing and other functions in an organization. Organizational Audits - An operational audit of an organization deals with an entire organizational units, such as a department, branch, or subsidiary. An organizational audit emphasizes how efficiently and effectively functions interact. The plan of organization and the methods to coordinate activities are especially important in this type of audit. Special Assignments - In operational auditing, special assignments arise at the request of management. There are a wide variety of such audits. Examples include determining the cause of an ineffective IT system, investigating the possibility of fraud in a division, and making recommendations for reducing the cost of a manufactured product. 19.8.5 Objectives of Operational Audit: Like internal auditing, the scope and quality of operational auditing is predominantly dependent upon management attitudes. An open minded management with broad vision can appreciate the need of operational auditing and to give it the necessary freedom and sanction to perform what it is capable of performing. Also, the qualities and the sense of perspectives of the operational auditor can mould operational audit in the right shape. Without a combination of these two, operational auditing may not be able to show its distinctively and advantages to the organisation. Therefore, there is a possibility of operational auditing having different objectives to fulfil in different organisations. Generally, operational audit objectives include: (i)

Appraisal of controls.

(ii)

Evaluation of performance.

(iii) Appraisal of objectives and plans, and (iv) Appraisal of organisational structure. The most significant gain an organisation can derive from operational auditing is probably in 2

Auditing and Assurance Services by Arens, Elder & Beasley; prentice hall publication, 2003 edition, page 740.

19.37

Advanced Auditing and Professional Ethics

the area of appraisal of controls. Internal controls, because of their unobtrusive omnipresence in the organisation, provide the essential hinges to ensure proper performance in each functional or organisational area for accomplishing the desired organisational objective. If the hinge of a machine is weak or broken however costly or good that machine may be, it will not perform with any degree of efficiency. Similarly, if controls are weak or breaking down, however well equipped or well-manned the organisation may be, it will fail to operate effectively. Operations and the results in which management is interested are largely a matter of control. If controls are effective in design and are faithfully adhered to, the result that can be attained will be subject to the other limiting constraints in the organisation. According to Lawrence B. Sawyer, “One widely accepted view of operational auditing holds that it is directed toward control rather than performance and hence avoids technical involvement”. This view suggests that operational auditing deals with administrative controls exercised over all phases of the business and its purpose is to determine whether the controls are adequate and are proving effective in accomplishing management’s objectives or plans or operations. It seems there is considerable validity in the views stated above. It is also to be conceded that appraisal of performance necessarily requires an appropriate technical background. In the task of performance evaluation, an operational auditor is heavily dependent upon availability of acceptable standards. Apart from this, the operational auditor cannot be expected to possess technical background in so many diverse technical fields obtaining even in one enterprise. Even when examining or appraising performance or reports of performance, the operational auditor’s mind is invariably fixed on control aspects. For example when he walks through the factory floor, amongst others, he observes whether machines are idle or workmen not present in the post assigned to them or the accumulation of stores on the floors All these have a bearing on the operation of controls. He can then go into the reasons of the failure of controls and bring these to the attention of the management for verification in the interest of proper working in future. He reviews internal control reports to ascertain whether they bring the performance, qualitatively and quantitatively to the notice of the management; also whether the organisation’s policies and plans are being carried out. In performance appraisal, the operational auditor is basically concerned not so much with how well technically the operations are going on, but with accumulating information and evidence to measure the effectiveness, efficiency and economy with which the operations are being carried on. He prepares his evaluation programme in such a manner that it will show how well or how poorly the department has fared by reference to applicable standards, procedures, rules, policies and plans. The principal basis of performance evaluation can be productivity, personnel, workload, cost and quality. In the area of productivity, the operational auditor can undertake such tests as input-output ratios for materials and labour in quantitative terms. Alternatively or in conjunction with the above, the auditor may also study the extent of labour and material expended per unit of output in physical terms. In the sphere of physical production the auditor will, in most cases, get the advantage of having some acceptable norms or standards. He also has to review the aspects of production loss and rejections in appraising performance, For other spheres, such measures as man-hours per customer or

Internal Audit, Management and Operational Audit

19.38

man- hours per application processed can be adopted. What measure is appropriate on what occasion is a matter to be judged by the auditor and he can evaluate performance by reference to the selected measure. Apart from these, the auditor has to consider the following broader aspects also in performance evaluation: (i)

How does productivity compare with the prior period?

(ii)

At what level should productivity be to meet the target?

(iii) What are the factors affecting productivity? (iv) Is the level of production commensurate with the flow of orders received? (v) Is unsatisfactory production performance the result of : (a) (b) (c) (d) (e) (f) (g) (h) (i) (j)

non-availability of raw materials? inadequate or unskilled personnel? lack of proper supervision? lack of proper machine maintenance? strikes and/or lockout? problem of power supply? non-availability of essential machine spares? poor quality of raw materials? other causes like, fire, earthquake? lack of proper quality control?

(vi) Can the work methods be improved? (vii) Are the machines utilised to their capacity? (viii) Can the work be further mechanised with advantage? Personnel is perhaps the most important factor in performance evaluation. Unless the organisation has a sound personnel policy consistent with its requirements, the facilities, materials and equipment that are available in the organisation may not be utilised properly to obtain optimum performance. There may even be clearly negative factors like excessive overtime or excessive spoilage of materials, sub-standard production, indiscipline amongst workers, etc. that may retard the performance qualitatively and quantitatively. The operational auditor in his appraisal of personnel can make use of the quantitative data readily available to him like number of employees, personnel turnover, total regular and overtime hours worked ratio of direct employees to indirect employees and so on. He should also take into account the undernoted broad aspects involving personnel: (i)

Whether the organisation has properly qualified and experienced personnel for the various levels of work?

(ii)

Is the number of people employed at various work centres adequate, excessive or inadequate?

19.39

Advanced Auditing and Professional Ethics

(iii) Does the organisation provide facilities for staff training so that employees and workers keep themselves abreast of current techniques and practices? (iii) Is the organisation unable to obtain staff possessing requisite qualifications? (iv) If yes, what are the reasons: (a) Low wages? (b) Bad working conditions? (c) Management attitude? (d) Status of the organisation in the industry? (v) Is the rate of staff turnover high? If yes, what are the causes? (vi) Is the ratio of overtime to regular man-hours excessive or normal? (vii) Why is the need for overtime? (viii) If the ratio of overtime is high, what is being done to reduce it? ‘Work load measurement can be another significant area where operational auditor can be of use because of ready availability of quantitative data. There can be measures like volume or quantity of work handled and/or performed volume of new work, backlog of work, etc. The propositions that would usually arise in this area may be as follows: (i)

Is there any backlog of work? If yes, is it due to increasing volume of new work on the existing work itself is heavy by reference to the staff and facilities available?

(ii)

Is the new work volume increasing or decreasing?

(iii) How to meet the increasing work load? Would it be worthwhile to employ more staff or get the work done by overtime? (iv) Is the current work done in time? (v) Is the backlog increasing or decreasing? Quality of work is a matter which is not directly amenable to operational audit scrutiny Nevertheless, it is an important aspect of performance of an organisation. Therefore, some quantitative measures are often devised to judge the quality of work. These can be number of customers’ complaints, rejections by quality control department, number of workers’ grievances, number of errors in invoicing or recording transactions, quantity of scrap and wastages, etc. The auditor may comprehend the quality aspect by reference to certain objective questions like: (i)

Is the present work quality satisfactory in so far as customers, suppliers, bankers, workers and the quality standards followed are concerned?

(ii)

If not, what are the factors that account for unsatisfactory quality? Is it the workload, lack of equipment, bad quality of raw materials or other materials in use, unsatisfactory working conditions giving rise to workers’ grievances or the methods?

(iii) Is the quality of work getting better or worse? (iv) Is the quality of work responsive to training imparted to workers?

Internal Audit, Management and Operational Audit

19.40

(v) How can the quality be improved whether by changing the work methods or boosting the workers’ morale by adding more technical facilities, by improving supervision or by enforcing stricter control on quality of materials that go into the work? Cost is perhaps the most cogent indicator of performance. Costs are classified and recorded for a proper assimilation of their implications on performance. The operational auditor may be concerned with such matters as: (i)

Is the cost break-up realistic so as to serve as a basis for performance evaluation?

(ii)

Are the costs collected under various heads and sub- heads showing an increasing trend per unit of output?

(iii) Do costs conform to forecasts? If not on what count? (iv) Are the costs of various departments or divisions justified? (v) Are all the activities necessary? (vi) Would it be better if the company buys some of the components or output from outside instead of producing them? (vii) Are the people cost conscious? Though controversial, a school of thought holds that operational auditing can be stretched to evaluate management objectives and plans. This view stems from the fact that everything in an organisation is the product of basic plans and objectives set by the management. If the management policy favours installation of controls or specifies the extent of controls whether satisfactory or not, controls would have to stay within the policy frame. Therefore, the basic thing that should be evaluated is management policies, plans and objectives. However, it should be noted that there exists considerable opposition to the aforesaid view. The other viewpoint holds that operational auditing by its nature should be confined to operations and related controls. The aim of operational auditing is to appraise operations and controls and their adherence to prescribed or laid-down policies and not to go into the question of appropriateness of plans and objectives. However, the operational auditor may look into the aspects like whether objectives are clearly spelt out and properly communicated to the personnel responsible for implementation and whether the personnel have understood the objectives in the sense meant by the management. Also, he can take note of any apparent conflict in the objectives for its effect on operations. Organisational structure provides the line of relationships and delegation of authority and tasks. This is an important element of the internal control design. Therefore, this is also another important area for appraisal by the operational auditor. In evaluating organisational structure, the aspects that may be considered by the operational auditor may be as follows: (i)

Is the organisational structure in conformity with management objectives?

(ii)

Whether the organisational structure is drawn up on the basis of matching of responsibility and authority?

(iii) Whether the line of responsibility from the top to the bottom is clearly discernible from the structure?

19.41

Advanced Auditing and Professional Ethics

(iv) Whether the delegation of responsibility and authority at each stage is clear and overlapping are avoided?

19.9 Review of Systems and Procedures 19.9.1 Systems: Systems are so fundamental to an understanding of responsibilities of managers and the environment in which they operate that management auditors should get a clear understanding of what systems are and how they operate. The word system is commonly defined as “a set of objects, together with relationships between the objects and their attributes, connected or related to each other and to their environment in such a manner as to form an entire or integral whole.” The definition can be better understood with reference to a complex biological system of human beings which consists of various sub-systems, e.g. nervous system, digestive system, respiratory system, blood circulation system, reproductive system, etc. The physical objective of human life is to live and grow. Each sub-system contributes to this overall objective by performing specific functions. Each sub-system in turn, may be treated as a complete system in itself. For instance, digestive system consists of various organs, say stomach, esophagus, intestines, etc. which are interdependent and interrelated, so that failure of any part will lead to failure of the digestive system. Thus, the essence of a system lies in the inter- relationship and inter-dependence of various parts and processes. Unrelated and independent parts can never constitute a system. Similarly, it can be said that a business organisation also does not operate in a vacuum. Its various operations - manufacturing, purchasing, marketing, accounting and finance, research and development, personnel - comprise a system. All of these functional departments are combined into a complex unified, whole. The overall system i.e. a business organisation is made up of many interacting and related sub-systems, e.g. the various functional departments. These operation have to take into account and needs and operating modes of all the people, enterprises and governments that make up the environments in which it operates. It is essential that managers accept this hard fact that their organisational units do not operate in a vacuum. Each unit is dependent upon/related with some other unit in the organisation. Thus, the production department does not go ahead and produce articles for which the marketing department does not see a market. Conversely, the marketing department does not take orders for sales which the production department is not geared to produce. In another business function, we see that operations of a purchasing department must satisfy the needs of departments requesting materials. To accomplish an objective by means of a system entails three main steps: 1.

Design a system to achieve the main objectives.

Operate the system.

Check that the system is operating and producing as intended by its design, i.e. that the stated objective is being achieved.

19.9.2 Procedures: Procedures are the means by which policies are implemented. Most often, procedures entail the use of documents in accordance with precise instructions or methods to be used. At lower levels in an organisation, formalised and authorised procedures become more numerous and of specific nature because of following factors:

Internal Audit, Management and Operational Audit

19.42

There exists economic advantage of specifying precise uniform action to be taken by a large number of people and for repetitive jobs.

The need for more precise control over employees’ activities which can only be achieved if there are detailed prescriptions of how things are to be done.

The element of discretion has to be reduced as far as possible.

Standard procedures go a long way towards making sure that pertinent information flows to the people who need it and that each person understands what he is to do with it. In addition, standard procedures, when expressive of policy guidelines established by management, facilitate control of business operations. The purpose of establishing procedures is also to ensure consistent interpretation of policies. That eliminates the need to make the same decisions over and over and leaves more time for creative planning, thoughtful analysis and productive effort. 19.9.3 Review of Systems and Procedures: The purpose of systems and procedures is to help management in the planning and accomplishment of organisational purpose, in communicating their requirements, and in assisting the personnel in carrying out the requirements. The review of systems and procedures is to improve the methods, to get away from the old ways and traditional routines and to reduce the cost in completing and processing the paper work - eliminating waste, duplication and inefficiencies. In reviewing any system or procedure, the management auditor must concern himself with its purpose as well as its design and then he must decide on its merits as the best serving the interests of the enterprise. A poor system or procedure may prevent the carrying out of the policy for which it was intended. A system may have outgrown its usefulness. The end result of a system or a procedure may be loose and may require improvement. In the study of the systems and procedural functions, the auditor should ask himself: 1.

Is the function properly located in the organisation?

Do the staff personnel have the necessary training and experience to perform the work?

Has a definite programme been established and has been taken for its attentive accomplishment?

Is productivity satisfactory?

The evaluation of a system or a procedure actually includes three separate considerations. First, is the system or procedure meeting all of the current requirements? Second, is it operating effectively? And third, what is the degree of effectiveness? To determine whether system or procedure is meeting current requirements, the following among other things, should be considered: 1.

Is the system or procedure designed to promote achievement of the company’s objectives, and is it accomplished effectively?

Does the system or procedure operate within the framework of the organisational structure?

Does the system or procedure adequately provide methods of control in order to obtain maximum performance with the least expenditure of time and effort?

19.43

Advanced Auditing and Professional Ethics

Do the routines designated in the system or procedures indicate performance in logical sequence?

Does the system or procedure provide the means for effective coordination between one department and another?

Have all required functions been established?

Has the necessary authority been designated to carry out responsibilities?

Can any changes be made to improve effectiveness?

The important thing is to make sure that the system or procedure is designed to meet the desired results. One must determine what is actually done, as well as where, how, when, and by whom. Each individual step in the process must be studied and its effectiveness considered. At the same time, one must be constantly alert for possible improvements. While it may be difficult to determine a precise measurement of how effectively a system or procedure operates, the degree of effectiveness can be somewhat ascertained by checking on the activities from the standpoint of speed, accuracy and orderly flow of paper work. Do bottlenecks and delays occur from time to time the schedules, reports, or end results promptly completed and furnished on time? Are operations proceeding well or better than expected? What is the relationship between the volume of work and the number of employees performing the work, and how does it compare from month to month? The auditor must always be on the alert for possible defects and irregularities. He must check the activities with the instructions, to see if the instructions are properly complied with. All deviations must be called to the attention of the supervisor who is responsible for the proper adherence to instructions, and necessary corrective action taken. On occasions, due to some unusual circumstances, the auditor may find that good judgement often dictates some deviation from an instruction possibly to better achieve a desired objective. Management must be constantly alerted to the importance of systems and procedural function as an element of good organisation and management. No business can continuously achieve success without considering the maintenance of systems of control and of current, written procedures to guide all concerned in performing their work assignments. Systems and procedural work render aid and constructive service to management in order to assist them in the planning and accomplishment of desired results. The basic objective of the systems person is to develop the most ideal system that will meet the organisation’s specific requirements or needs, coordinating the essential managerial functions, eliminating the unnecessary, preserving the important and incorporating modern, practical and efficient methods and equipment. Differences between Financial and Operational Auditing - The major differences between financial and operational auditing can be described as follows: (i) Purpose - The financial auditing is basically concerned with the opinion that whether the historical information recorded is correct or not, whereas the operational auditing emphasizes on effectiveness and efficiency of operations for future performance.

Internal Audit, Management and Operational Audit

19.44

(ii) Area - Financial audits are restricted to the matters directly affecting the appropriateness of the presented financial statements but the operational auditing covers all the activities that are related to efficiency and effectiveness of operations directed towards accomplishment of objectives of organization. (iii) Reporting -The financial audit report is sent to all stock holders, bankers and other persons having stake in the Organisation. However the operational audit report is primarily for the management. (iv) End Task - The financial audit has reporting the findings to the persons getting the report as its end objective, however, the operational auditing is not limited to reporting only but includes suggestions for improvement also.

19.10 Management Audit Questionnaire A management audit questionnaire is an important tool for conducting the management audit. It is through these questionnaires that the auditors make an inquiry into important facts by measuring current performance. Such questionnaires aim at a comprehensive and constructive examination of an organisation’s management and its assigned tasks. Overall it is concerned with the appraisal of management actions in accomplishing the organisation’s objectives. Its primary objective is to highlight weaknesses and deficiencies of the organisation. It includes a review of how well or badly the management functions of planning, organising, directing and controlling are being performed. In addition it evaluates how effective the decision-making process is accomplishing the stated organisation objectives. Within this framework, the questionnaire provides a means for evaluating an organisation’s ongoing operations by examining its major functional areas. There are three possible answers to the management audit questions: “Yes”, “No” and “N.A.”, (not applicable). A “Yes” answer indicates that the specific area, function, or aspect under study is functioning in an acceptable manner; no written explanation is needed in that case. On the other hand, a “no” answer indicates unacceptable performance and should be explained in writing. Questionnaire comments on negative answers not only provide documentation for future reference, but, more important, provide background information for undertaking remedial action. Those questions that are not applicable and should be ignored in the audit are checked in the “N.A.” column. The management audit questionnaire does not give answers, but simply asks questions. If all questions are answered with a ‘yes’, operations are proceeding as desired. On the other hand, if there are one or more ‘no’ answers, difficulties are being experienced and must be explained in writing. If the question does not apply, the N.A. (not applicable) column is checked. Thus, management audit questionnaire for this part of the audit not only serves as a management tool to analyse the current situation; more importantly, it enables the management auditors to synthesis those elements that are causing organisational difficulties and deficiencies.

19.45

Advanced Auditing and Professional Ethics

Appendix The following Standards on Internal Audit are recommendatory in nature. The Standards shall become mandatory from such date as notified by the council : SIA 1 : Planning an Internal Audit SIA 2 : Basic Principles Governing Internal Audit SIA 3 : Documentation. SIA 4 : Reporting SIA 5 : Sampling SIA 6 : Analytical Procedures SIA 7 : Quality Assurance in Internal Audit SIA 8 : Terms of Internal Audit Engagement. SIA 9 : Communication with Management SIA 10 : Internal Audit Evidence SIA 11 : Consideration of Fraud in an Internal Audit. SIA 12 : Internal Control Evaluation SIA 13 : Enterprise Risk Management SIA 14 : Internal Audit in an Information Technology Environment SIA 15 : Knowledge of the Entity and its Environment. SIA 16 : Using the Work of an Expert. SIA 17 : Consideration of Laws and Regulations in an Internal Audit. SIA 18 Related Parties

What is management and operational audit?

This type of audit looks beyond the organization's financial circumstances and examines its management practices. An operational audit aims to find areas in need of improvement to make the organization's operations more efficient, productive and effective.

Which audit is also known as operational audit?

Operational Audit is a systematic review of effectiveness, efficiencies and economy of business operations. This includes the management audit and internal audit.

What are the three types of operational audits?

The three primary types of audits include compliance audits, operational audits, and financial statement audits. Although all audits involve an investigation of supporting information, each type of audit has a different purpose.

What is meant by management audit?

A management audit is an independent and systematic analysis and evaluation of a company's overall activities and performances. It is a valuable tool used to determine the efficiency, functions, accomplishments and achievements of the company.

Is operational audit and management audit same?

What is management and operational audit?

Which audit is also known as operational audit?

What are the three types of operational audits?

What is meant by management audit?

Bài Viết Liên Quan

Quảng Cáo

Có thể bạn quan tâm

Toplist được quan tâm

Quảng cáo

Xem Nhiều

Quảng cáo

Chúng tôi

Điều khoản

Trợ giúp

Mạng xã hội