Chapter 8: Preliminary Survey & Internal Control Review

ACCT620: Internal Auditing

Otto Chang

Professor of Accounting

Steps for Preliminary Survey

• The opening conference

• On-site tour

• Study of documents on site.

• Written description of the auditee

• Analytical procedures

The Opening Conference

• Objectives of the opening conference:– Elicit a spirit of cooperation– Convey information that will help the audit– Obtain information needed for the audit– Promote a feeling of credibility

Planning the Opening Conference

• Preparing a written agenda:– Introduction of those present at the conference– An outline of the audit assignment– Addressing any audit concerns– Coordination of the audit with auditee

operations– Discussion of the kind of information needed

for the audit and the extent of assistance– Timing and form of the audit report

Establishing an Appropriate Conference Climate

• Foster a professional courtesy– Setting a specific time and place – Conducting it in a quiet setting– Distributing a written agenda before meeting– Taking a confident but respectful manner– Maintaining a relaxed tone of conversation– Projecting an open and cooperative attitude– Keeping the meeting within reasonable time

Building a Feeling of Credibility

• Auditor gains credibility from– being associated with the IA profession– their reporting line within the organization – their own demonstration of professionalism

• Personal sources of credibility– appropriate dress and grooming, manners– composure, preparation, respect for auditee

• Documenting the opening conference

On-site Tour

• The objective of the tour is to obtain an overview of operations

• Scan operations for unusual activities, indication of inefficiency, unused facilities, idle workers, poor maintenance of machines

• Observe the employees’ attitudes toward their jobs and how they relate to each other and to management

Study of Documents

• On-site perusal provides updated information that indicates changes in the organizational structure, responsibilities, and operations

• Documents studied: description of current policies and procedures, organizational charts, operational flow-charts, job descriptions, performance reports

Written Description of the Auditee

• The descriptions should include:– Objectives of auditee operations– Environmental restrictions such as corporate

policy imposed by top management– Functional components of the organization– Resources (# and classification of employees,

cash flow, PPE, information systems etc..)– Management

Analytical Procedures

• Compare current totals with previous period

• Compare operating results with budgets

• Compare with industry average

• Relate financial information to operating data

• Compare with similar divisions or department

• Compare performance to economic data

• Scan for unusual items

Review of Internal Control

The review of internal control includes

• A description and analysis

• An evaluation

• A risk assessment

Description of Control System

• Internal Control Questionnaire (ICQ)– Pros: less likely to omit important questions– Cons: tiring, lengthy, response bias toward

“yes” answer, indirect evidence

• Flow charts with narrative descriptions– Two types: horizontal and vertical flowcharts– Running narrative usually included in vertical

flowcharts to describe the other related controls

Procedural Walk-Through

• An auditor “walks” through a process by– Listing the steps to be performed in the process– Providing a check-off column indicating

whether each step has been performed– commenting on what’s observed

• Advantage of walking through is to obtain firsthand, comprehensive knowledge of how a particular process is performed

Documentation Walk-Through

• An auditor follows particular operation or transaction from beginning to end through documentation

• It is one form of vouching transactions to check whether specific controls are present in a system

• usually limited to only one or two transactions

Limited Testing of the System

• Purpose: to understand how well the system is operating and if controls are functioning at various parts of the system

• Select a few items (25-30) for examination

• Maybe combined with a walk-through

• The results are written up as a “Memo to the File” and included in the working paper

Extended Testing of the Information System

• If an auditor has any reason to suspect problems with the information system, extended testing is justified

• Some auditors prefer to prove the integrity of the system before going further

• Normally involves with statistical sampling so that a certain level of confidence (e.g.., 95%) can be achieved.

Preliminary Evaluation of Internal Control System

• Auditors use internal control matrices to organize audit results up to this point. It contains the following columns:– Specific audit objectives– Important results from preliminary survey and

review of internal control– The risks associated with each result– Appropriate controls relevant to each result– Auditor’s evaluation

Risk Assessment

• After internal control evaluation, auditors reassess the level of risk associated with the auditee’s operation. Three things are likely:– The revised risk is low. Auditors should write a

report and go on to higher-risk areas.– Little to gain from further audit. Wrap up and

go to next audit project.– The risk remain high. Expand test of controls.