How much do the IT auditors on your audit team understand the client’s business processes? How much do financial auditors on your audit team understand systems and IT considerations? Too often, financial auditors and IT auditors, or specialists perform their procedures in a silo, often with too little communication. The question is if neither understands the full picture of the business process how can you ensure all the risks in the business processes are addressed? The following integrated activities will make an immediate impact on the audit team’s integration and help amplify audit quality.
1. Integrated Walkthroughs
Integrated walkthroughs include all the audit team participants, including IT auditors, specialists, experts, contractors, or other resources that support the audit of a specific business process. An integrated walkthrough will help audit teams:
When walking through a process to identify "what could go wrongs", work as a team to identify the controls that address each likely source of misstatement. Performing the walkthrough as an integrated team can help to identify design deficiencies, missing controls, redundant controls, or automated controls that address risks that may eliminate the need to test certain manual controls.
Note: Taking a fresh look at each process is an important step that drives audit quality.
In other words, do all the audit team participants, including IT auditors, Tax team members, specialists, experts, contractors, or other resources that support the audit of a specific business process understand all the components listed in Figure 1- Components of the Business Process below within the business process and how they all fit together?
Figure 1 Components of the Business Process
Common audit deficiencies this integration practice addresses: |
---|
• Failure to identify key controls that address “what could go wrongs” and related assertions; |
• Failure to understand and test the design and operating effectiveness of the manual and automated components of controls; |
• Failure of an IT auditor or other specialist to sufficiently test the control attributes that address the “what could go wrongs” in the business process; |
• Failure to identify key reports, data or other IPE used in the operation of a control; and the |
• Failure to identify key applications or tools that are the source of key reports, data, or other IPE used in the operation of a control. |
2. Integrated Key Business Process Discussions
An integrated walkthrough is a strongly recommended process for higher risk or complex business processes (see activity 1 above). If the financial auditors already performed the walkthroughs on their own the team should schedule and integrated team discussion of the key business processes. The walkthrough of the business process with the client is a key step, but we have found an integrated team discussion where the team discusses the processes, risks, and controls is even more impactful on audit quality. Again, this doesn’t necessarily have to be held for every process. The integrated walkthrough should include all the audit team participants including IT auditors, specialists, experts, contractors, or other resources that support the audit of a specific business process. This allows the team to really dig into the process and determine where the critical risks and controls exist, identify potential control gaps, and strategize how the design and operating effectiveness of controls should be tested.
These discussions can occur naturally as part of the audit fieldwork procedures. Set the expectation that team members should be prepared for the discussion by reviewing available information and documentation. Then plan a common meeting place: audit room, virtual room, or office conference room are some common logistical ideas. During the discussion use whiteboards and projectors to share information and collaborate on individual understandings. We have found individual audit team members know unique aspects of the business processes and these collaborative discussions bring together all these unique understandings
Common audit deficiencies this integration practice addresses: |
---|
• Failure to sufficiently test the design or operating effectiveness of controls |
• Failure to identify deficiencies when testing the design or operating effectiveness of controls; |
• Failure to identify key reports, data, or other IPE used by the audit team to test the design or operating effectiveness of controls; and |
• Even though it is not an audit deficiency, an audit team may test controls that are redundant or otherwise not needed; or perform unnecessary procedures that aren’t needed to address the “what could go wrongs” in the business process. |
3. Integrated Application scoping
Once we identify the controls in the integrated walkthroughs and integrated business process discussions, the integrated team can work together to identify or finalize the scoping of the following IT components:
In more complex environments with multiple systems, the audit team should whiteboard or draw the system data flow, which can help scope the items above, as well as help trace key data through the applicable systems. When we discuss potential root causes of why key controls or systems were missed, it’s often a result of not understanding the data flow. For example, the data may flow through an intermediate system that extracts the data from the source and transforms it to load into the destination system, or the true source data used in a control may be generated from a data warehouse or other reporting database the team may not have previously identified. We commonly see companies use a mix of on premises and hosted IT environments, and these system components may not be properly identified and tested unless the data flow is understood.
When finalizing decisions on scoping of systems, consider:
Other Considerations:
Refer to the Figure 1- Components of the Business Process diagram above, and work from the top down and ensure that the team has a complete understanding of how the traditional IT Audit procedures support the traditional financial statement audit procedures that address the business processes. This is a helpful tool to maximize the understanding of the business process and the associated audit strategy.
Common audit deficiencies this integration practice addresses: |
---|
• Failure to identify or test controls for interfaces between IT systems and data; |
• Failure to identify key reports, data or other IPE used in the operation of a control; and the |
• Failure to identify key applications or tools that are the source of key reports, data, or other IPE used in the operation of a control. |
4. Integrated IT environment understanding & risk assessment
Multiple applications, data warehouses, report writers, and layers of supporting IT infrastructure (database, operating system, and network) are likely involved in the business process, from initiation of a transaction to its recording in the general ledger. Such transactions ultimately lead to reporting in the financial statements, and therefore, these systems and IT infrastructure layers are likely relevant to the audit.
To complete your understanding of the IT environment, refer to the Figure 1-Components of the Business Process diagram above, and include the following activities to address risks in the IT environment:
Common audit deficiencies this integration practice addresses: |
---|
• Failure to perform sufficient testing procedures resulting from an improper system risk assessment; |
• Failure to appropriately test an embedded, configured, or custom developed IT application control; |
• Failure to identify and test SOC reports that support controls outsourced to a service provider; |
• Failure to scope in (or out) ITGC components that support the design and operation of ITGC controls; and the |
• Failure to scope in (or out) infrastructure components that support the design and operation of ITGC controls; |
5. Communication….Communication…Communication
What is your communication plan with the integrated team? Is the discussion focused on hours and status, or does it include current issues, challenges, and results as an integrated team? We see audit teams get stuck in various stages of teaming model – Forming, Storming, Norming, and Performing (see “Developmental Sequence in Small Group” by Bruce Tuckman). Engagement teams should have a manager or partner monitoring how the team is working together to maximize effective performance of the team.
Schedule a regular weekly, bi-monthly, or monthly meeting as in integrated team and make it more than just a status and budget meeting. What are you seeing? Where are the challenges? Remember your responsibility of professional skepticism and challenge each other to identify shortcomings and address them as a team.
Common audit deficiencies this integration practice addresses: |
---|
Failure to identify deficiencies timely and sufficiently consider the necessary adjustments to the audit strategy; |
• Failure to identify deficiencies timely that may impair or eliminate the opportunity for the client to remediate the deficiency and test that the remediated (or compensating) control is operating effectively; |
• Failure of the team to sufficiently test controls or perform substantive testing due to a lack of communication about key issues or new information impacting a business process; and the |
• Failure to meet budgeted audit hours due to rework or additional procedures that could have been eliminated with better communication. |
As you work through this year’s audits keep these five items in mind and deploy them as necessary to break down silos within your audit. This is not a set it and forget it exercise rather integration of all team members takes regular maintenance and attention. A key aspect of audit quality is gaining a cohesive understanding of the business.
Johnson Global Advisory
1717 K Street NW, Suite 902
Washington, D.C. 20006
USA
+1 (702) 848-7084