Internal Audit and Operational Audit

8/6/2019 Internal Audit and Operational Audit

1/32

3 - 1

Internal Audit &Internal Audit &Operational AuditOperational Audit


2/32

3 - 2

Internal AuditingInternal Auditing

The Bursa Malaysia Stock ExchangeThe Bursa Malaysia Stock Exchange

best practice to havebest practice to havean internal audit function.an internal audit function.


3/32

3 - 3

Internal AuditingInternal Auditing

It is an independent, objective assurance andIt is an independent, objective assurance and

consulting activity designed to add valueconsulting activity designed to add valueand improve an organizations operations.and improve an organizations operations.

It helps an organization accomplish its objectivesIt helps an organization accomplish its objectivesby bringing a systematic, disciplined approach toby bringing a systematic, disciplined approach to

evaluate and improve the effectiveness of riskevaluate and improve the effectiveness of risk

management, control, and governance processes.management, control, and governance processes.


4/32

3 - 4

Evolution of Internal AuditingEvolution of Internal Auditing

--Highly professional activity, extends to nonHighly professional activity, extends to non--

financial areasfinancial areas

--Financial fraud at WorldCom were found byFinancial fraud at WorldCom were found by

internal auditorsinternal auditors

--Today many companies have an internal auditToday many companies have an internal audit

departmentdepartment


5/32

3 - 5

Professional bodiesProfessional bodies

In ala siaIn ala sia Instit te of Internal ditorsInstit te of Internal ditors

ala sia (II )ala sia (II )

WorldwideWorldwide -- Instit te of Internal ditors Inc.,Instit te of Internal ditors Inc.,

Florida, USFlorida, US

Certified Internal ditor (CI )Certified Internal ditor (CI ) examination +examination +3 ears experience as an internal a ditor3 ears experience as an internal a ditor

Global Partnership greement with CCGlobal Partnership greement with CC

follow Professional Practices Frameworkfollow Professional Practices Framework


6/32

3 - 6

Institute of Internal AuditorsInstitute of Internal Auditors

Code of Ethics & Rules of ConductCode of Ethics & Rules of Conduct

IntegrityIntegrity

ConfidentialityConfidentiality

ObjectivityObjectivity

CompetencyCompetency


7/32

3 - 7

Institute of Internal AuditorsInstitute of Internal Auditors

Professional Practice StandardsProfessional Practice Standards

Attri uteAttri ute

StandardsStandards

ImplementationImplementationStandardsStandards

PerformancePerformance

StandardsStandards


8/32

3 - 8

Relationship of InternalRelationship of Internal

and External Auditorsand External Auditors

TheThe externalexternalauditor is responsibleauditor is responsible

to financial statement users.to financial statement users.

TheThe internalinternalauditor is responsibleauditor is responsible

to management.to management.


9/32

3 - 9

Relationship of InternalRelationship of Internal

and External Auditorsand External Auditors

CompetencyCompetency

MethodologyMethodology

ObjectivityObjectivity

Audit risk model &Audit risk model &

materialitymateriality


10/32

3 - 10

Internal AuditorsInternal Auditors

serving 2 mastersserving 2 masters

enior managementenior management

OperationsOperations

Internal AuditInternal Audit

Audit CommitteeAudit Committee

IndependentIndependent

assuranceassurance


11/32

3 - 11

Operational AuditingOperational Auditing

The systematic process of evaluating anThe systematic process of evaluating an

organisations effectiveness, efficiency &organisations effectiveness, efficiency &

economy of operations under managementseconomy of operations under managements

control & reporting to appropriate personscontrol & reporting to appropriate persons

the results of the evaluation alongthe results of the evaluation along

with recommendations for improvements.with recommendations for improvements.


12/32

3 - 12

Differences between OperationalDifferences between Operational

and Financial Auditingand Financial Auditing

Distribution ofDistribution ofthe reportsthe reports

Inclusion ofInclusion ofnonnon--financial areasfinancial areas

Purpose ofPurpose of

the auditthe audit


13/32

3 - 13

EffectivenessEffectiveness refers to therefers to theaccomplishment of objectives.accomplishment of objectives.

EfficiencyEfficiency refers to the resources usedrefers to the resources usedto accomplish those objectives.to accomplish those objectives.

Effectiveness VersusEffectiveness Versus

EfficiencyEfficiency


14/32

3 - 14

Types ofTypes of

inefficiencyinefficiency ExampleExampleAcquisition of goods andAcquisition of goods and

services is excessively costly.services is excessively costly.Bids for purchases ofBids for purchases of

materials are not required.materials are not required.

Raw materials are notRaw materials are notavailable when needed.available when needed.

An assembly line was shutAn assembly line was shutdown for lack of materials.down for lack of materials.

A duplication of effort byA duplication of effort byemployees exists.employees exists.

Production and accountingProduction and accountingkeep identical records.keep identical records.

Effectiveness Versus

Efficiency


15/32

3 - 15

Relationship between OperationalRelationship between Operational

Auditing & Internal ControlsAuditing & Internal Controls

Internal control evaluationInternal control evaluation

to evaluate efficiency & effectiveness,to evaluate efficiency & effectiveness,

make recommendations to managementmake recommendations to management

ScopeScope concerns any control affectingconcerns any control affecting

efficiency & effectiveness,efficiency & effectiveness,e.g. policies, procedurese.g. policies, procedures


16/32

3 - 16

Types of Operational AuditsTypes of Operational Audits

FunctionalFunctional

OrganizationalOrganizational

Special assignmentsSpecial assignments


17/32

3 - 17

Another way of looking atAnother way of looking at

Operational AuditsOperational Audits

RiskRisk--based auditsbased audits

VFM auditsVFM audits

Process auditsProcess audits


18/32

3 - 18

PublicPublicaccountingaccounting

firmsfirms

GovernmentGovernment

auditorsauditors

InternalInternalauditorsauditors

Who PerformsWho Performs

Operational AuditsOperational Audits


19/32

3 - 19

The two most important qualities forThe two most important qualities foran operational auditor are:an operational auditor are:

Independence and CompetenceIndependence and Competence

of Operational Auditorsof Operational Auditors

IndependenceIndependence CompetenceCompetence


20/32

3 - 20

Specific Criteria for EvaluatingSpecific Criteria for Evaluating

Efficiency and EffectivenessEfficiency and Effectiveness

Were all plant layoutsWere all plant layouts approved by home officeapproved by home officeengineering at the time of original design?engineering at the time of original design?

Has home office engineering done a reevaluationHas home office engineering done a reevaluationstudy of plant layout in the past five years?study of plant layout in the past five years?


21/32

3 - 21



Is eac piece of e uip ent operatingIs eac piece of e uip ent operating

at % of capacity or ore forat % of capacity or ore forat least t ree ont s eac year?at least t ree ont s eac year?

Does layout facilitate t e ove ent ofDoes layout facilitate t e ove ent of

newnew aterials to t e production floor?aterials to t e production floor?

Does layout facilitate t e productionDoes layout facilitate t e production

of finis ed goods?of finis ed goods?


22/32

3 - 22



Does layout facilitate the movement ofDoes layout facilitate the movement of

finished goods to distribution centers?finished goods to distribution centers?

Does the plant layout effectively useDoes the plant layout effectively use

existing equipment?existing equipment?

Is the safety of employees endangeredIs the safety of employees endangered

by the plant layout?by the plant layout?


23/32

3 - 23

Sources of CriteriaSources of Criteria

Historical performanceHistorical performance

BenchmarkingBenchmarking

Engineered standardsEngineered standards

Discussion and agreementDiscussion and agreement


24/32

3 - 24

Phases in Operational AuditingPhases in Operational Auditing

PlanningPlanning

Evidence accumulation and evaluationEvidence accumulation and evaluation

Reporting and followReporting and follow--upup


25/32

3 - 25

PlanningPlanning

Scope of engagementScope of engagement StaffingStaffing

Background informationBackground information

Understand internal controlUnderstand internal control

Decide on appropriate evidenceDecide on appropriate evidence


26/32

3 - 26

Evidence AccumulationEvidence Accumulation

and Evaluationand Evaluation

DocumentationDocumentation

ClientClient

ObservationObservation


27/32

3 - 27

Reporting FollowReporting Follow--upup

Report usually sent to managementReport usually sent to management Tailored reportsTailored reports

FollowFollow--up on recommendationsup on recommendations

with management, see whether changeswith management, see whether changeswere madewere made


28/32

3 - 28

Examples of OperationalExamples of Operational

Audit FindingsAudit Findings

Inventory optimisation reviewInventory optimisation review

optimises cost savings:optimises cost savings:An industrial products manufacturerAn industrial products manufacturer

consolidated its multiple distributionconsolidated its multiple distribution

centers into one facility to reducecenters into one facility to reduce

overall freight and outside manufacturingoverall freight and outside manufacturingcostscosts to ensure the effectiveness ofto ensure the effectiveness of

implementation.implementation.


29/32

3 - 29

Examples of OperationalExamples of Operational

Audit FindingsAudit Findings

1.1. Find integration issues, recommend processFind integration issues, recommend process

improvementsimprovements

2.2. Physical inventory controls, effectiveness ofPhysical inventory controls, effectiveness of

systems at the facility, procedures in handlingsystems at the facility, procedures in handling

damaged products, interdamaged products, inter--plant transfers, physicalplant transfers, physical

security.security.

3.3. RecommendationsRecommendations monitor inventory levels,monitor inventory levels,

improve controls over physical storageimprove controls over physical storage

4.4. Fixed cost savingsFixed cost savings USD 7.9 millionUSD 7.9 million


30/32

3 - 30

The role of internal auditingThe role of internal auditing

in risk managementin risk management-- Business organisations face many risksBusiness organisations face many risks interest rate,interest rate,

FOREX, liquidity, labour market, skills, taxation, naturalFOREX, liquidity, labour market, skills, taxation, natural

disasters, processes, etcdisasters, processes, etc

-- Risk managementRisk management a proactive & ongoing processa proactive & ongoing process

involving the identification, assessment, control,involving the identification, assessment, control,

monitoring, & reporting of risk exposures.monitoring, & reporting of risk exposures.

-- Effective risk management meansEffective risk management means key stakeholders cankey stakeholders can

make informed decisions, daily business decisions aremake informed decisions, daily business decisions are

made within the orgns risk tolerance level, risks relating tomade within the orgns risk tolerance level, risks relating to

intangible assets are optimised, management is accountableintangible assets are optimised, management is accountable

for its decisions.for its decisions.


31/32

3 - 31


in risk management (Contd.)in risk management (Contd.)-- Role of internal auditors: To assist management &Role of internal auditors: To assist management &

Audit Committee by examining, evaluating, reportingAudit Committee by examining, evaluating, reporting

& recommending improvements on the adequacy && recommending improvements on the adequacy &

effectiveness of managements risk processeseffectiveness of managements risk processes

-- IAs should identify & evaluate significant riskIAs should identify & evaluate significant risk

exposures in the normal course of their dutiesexposures in the normal course of their duties

-- If mgt has not established a risk assessment process,If mgt has not established a risk assessment process,

then IA should bring this to the mgts attentionthen IA should bring this to the mgts attention maymay

play a proplay a pro--active role in the setting upactive role in the setting up


32/32

3 - 32


in risk management (Contd.)in risk management (Contd.)-- Test & check adequacy of risk management processes,Test & check adequacy of risk management processes,

models & systemsmodels & systems

-- Ensure accuracy of data used for risk mgt initiativesEnsure accuracy of data used for risk mgt initiatives

-- Act as inAct as in--house consultant by organising a workshop on riskhouse consultant by organising a workshop on risk

& control issues& control issues

-- Educate & create awareness among mgt & staff wrt internalEducate & create awareness among mgt & staff wrt internal

control issuescontrol issues

-- Champion the issues on soft controls (behaviours, attitudes,Champion the issues on soft controls (behaviours, attitudes,

values, integrity)values, integrity)

-- Encourage a knowledgeEncourage a knowledge--sharing culture, e.g. re: criticalsharing culture, e.g. re: criticalinformationinformation

Documents

Internal Audit and Operational Audit