BY CPA Abdallah Mambo Dallu
Wouldn’t it be great if you knew exactly what a hiring manager would be asking you in the next interview? It’s so unfortunate that we cannot read minds. However, the question “Describe the Audit process for a new engagement” is a very common question for those intending to join the auditing profession. The question seems simple, so many people fail to prepare for it but it’s crucial. In most audit interviews, it is the central point of references as companies want to hire people who are passionate about the job, so you should have great answers.
I first encountered this question during my quest to shift departments; from Operations to the internal audit department where I was first employed. It looked so simple but I later learnt that it was the deciding question after landing the job. All the three candidates had the same qualifications academically, professionally, and experience-wise. It’s for this reason that I wrote this short article reflecting back on the interview. Though the internal processes may not be the same across organizations, most individual internal auditing engagements take the following steps.
Steps in an Individual Internal Auditing Engagement Most individual internal auditing
engagements have the following seven steps:
Step 1 – Set objectives for the audit.
Step 2 – Conduct a preliminary Survey
Step 3 – Develop an audit program and budget.
Step 4 – Conduct the fieldwork.
Step 5 – Determine findings and conclusions.
Step 6 – Communicate results to appropriate parties
Step 7 – Follow-up.
The first three steps constitute the “planning” phase of the audit. The fourth and fifth steps are commonly referred to as the “fieldwork” phase. Step 6 is commonly called “reporting” and Step 7 is referred to as “follow-up.”
Of these phases, most auditors recognize the importance of the “planning” phase because subsequent phases are dependent on its results. Many if not most of the audit findings will be discovered during the planning phase because auditors identify the areas of high risk during this phase for later investigation during the fieldwork phase. Poor planning cannot be overcome without a tremendous amount of wasted time and effort, of which internal auditing departments do not have a surplus.
STEP 1 – Set objectives for the audit .
The first step in conducting the individual audit engagement is to know the objective or purpose of the audit. This will depend on the type of audit to be conducted: operational audits will seek to determine if the auditee’s operations are being run effectively and efficiently, financial audits will seek to determine if the auditee’s financial records are accurate or fairly stated, and compliance audits will seek to determine if the auditee is in compliance with laws, regulations, policies and procedures, or contracts. Internal audits may be conducted with one, two or all three of these objectives.
The Chief Audit Executive’s (herein referred to as “CAE”) is responsible for determining the objectives for
the individual audit engagements. It is up to the auditors who will actually perform the audit to ensure the CAE communicates the objectives clearly to them.
In addition, the CAE should communicate other information that will make the auditor’s job of planning the audit easier. Examples of such information would include: a list of auditee personnel, a list of personnel who will receive the final report, and a description of the activities to be audited.
STEP 2 – Conduct a preliminary survey
Once the objectives of the audit are set, auditors can then begin the planning process. This entails
gathering relevant information (the preliminary survey) to determine areas of high risk (risk assessment),
and then developing an audit program and budget. The preliminary survey is usually comprised of the following steps:
1. initial study,
2. preliminary meeting,
3. detailed information gathering,
4. risk assessment.
The first step, “initial study” involves examining all information available to the auditors without contacting the auditee. In most cases this may involve organizational charts, policies and procedures manuals, and financial records. The information obtained should be used to develop a list of questions for the preliminary meeting or interview.
The first step in conducting the individual audit engagement is to know the objective or purpose of the audit. This will depend on the type of audit to be conducted: operational audits will seek to determine if the auditee’s operations are being run effectively and efficiently, financial audits will seek to determine if the auditee’s financial records are accurate or fairly stated, and compliance audits will seek to determine if the auditee is in compliance with laws, regulations, policies and procedures, or contracts. Internal audits may be conducted with one, two or all three of these objectives.
The preliminary meeting or interview takes place between auditee personnel and internal auditors, usually at the auditee’s location. The meeting is often the first time both parties have met. Much of the meeting is devoted to introductions.
It is very important during this meeting for the two parties to “hit it off correctly” to ensure the successful completion of the audit. Internal auditors need to ensure that they make a favorable professional impression with the auditee. Key auditee personnel should be noted to ensure the auditor consults the correct individual for information during the audit. In addition, the auditors should determine the auditee’s areas of greatest concern. After the preliminary meeting, the auditors will gather the remaining information necessary to plan the audit. This will entail examining documents, observing operations, and interviewing key personnel. The basic objective of this phase is to obtain an understanding of the auditee’s operations, financial statements, or applicable laws, regulations, policies and procedures, and contracts, and document that understanding in work papers. Once this is accomplished areas of risk can be assessed and the adequacy of controls assessed.
STEP 3 – Develop an audit program and budget.
The audit program and budget are the result of the risk assessment performed at the conclusion of the
preliminary survey. The audit program is a step by step description of the tests (audit procedures) to be conducted during the field- work phase of the audit.
To produce an audit program, the auditor relates the audit objectives to audit evidence to audit procedures. The budget is an estimate of the resources necessary for completing the audit. These may include the auditors’ time, travel costs, and supplies. It should be based on a sound estimate for completing the audit program and compared to preconceived estimates contained in the annual audit plan.
The budget developed after the preliminary survey will usually be more accurate than the one developed during the annual planning process. However, the CAE may decide to limit the amount of time spent. If this happens then the scope of the audit should be reduced and this decision should be fully documented in the working papers.
STEP 4 – Conduct the fieldwork
This phase should consist of completing the audit program developed during the planning phase of the audit. However, the auditors performing the fieldwork should be sensitive to conditions which may be uncovered that require a change in the audit plan. These should be brought to the attention of the supervisory auditor and the CAE. Of particular importance is the presence of factors indicating that fraud could be present (red flags). These should be investigated fully to determine if fraud is actually occurring.
STEP 5 – Determine findings and conclusions.
This phase consists of evaluating all the information gathered by the audit, identifying key findings, and
reaching an overall conclusion concerning the audit objectives.
STEP 6 – Communicate results to appropriate parties
The findings and conclusions reached in the previous step must be communicated to the auditee and members of management. Audit findings should first be discussed with auditee personnel as soon as they are identified during the audit. An open discussion of a finding will ensure both sides are aware of the issue and prevent erroneous finding from reaching the final report. At the completion of the audit, a draft report will be produced and presented to the auditee at an exit meeting. The auditee is then given a period of time to respond to the draft report. Their responses are evaluated and the revised audit report containing the auditee comments is then issued to upper management.
STEP 7 – Follow-up
The internal auditing organization should follow up with auditees to determine that appropriate action is
taken on reported audit findings. Internal auditing should determine that corrective action was taken and is achieving the desired results, or that management or the board has assumed the risk of not taking corrective action on reported findings. Statement of Internal Auditing Standards (SIAS) No. 13 states, “Follow-up is defined as a process by which internal auditors deter- mine the adequacy, effectiveness, and timeliness of actions taken by management on reported audit findings.” Such findings also include relevant findings made by external auditors and others. Responsibility for follow-up should be addressed in the internal auditing department’s charter.
Management is responsible for deciding the appropriate action to be taken in response to reported audit findings. The lead auditor is responsible for assessing such management action for the timely resolution of the matters reported as audit findings. In deciding the extent of follow-up, internal auditors should consider procedures of a follow-up nature performed by others in the organization.
Senior management may decide to assume the risk of not correcting the reported condition because of cost or other considerations. The board of directors should be informed of senior management’s decision on all significant audit findings. The nature, timing and extent of follow-up should be determined by the lead auditor. Factors which should be considered in determining appropriate follow-up procedures are:
1. the significance of the reported finding;
2. the degree of effort and cost needed to correct the reported condition;
3. the risks that may occur should the corrective action fail;
4. the complexity of the corrective action;
5. the time period involved.
Certain reported findings may be so significant as to require immediate action by management. These
conditions should be monitored by internal auditors until corrected because of the effect they may have
on the organization.
Senior management may decide to assume the risk of not correcting thereported condition because of cost or other considerations. The board ofdirectors should be informed of senior management’s decision on all significant audit findings.
There may also be instances where the lead auditor judges that management’s oral or written response
shows that action already taken is sufficient when weighed against relative importance of the audit
finding. On such occasions, follow-up may be performed as part of the next audit.
Conclusion
Knowing how to put together a strong answer to the most common interview question is obviously key
to landing a job. The art and science of creating great answers involves being strategic in crafting your
responses as well as being straight to the point.
Certain reported findings may be so significant as to require immediate action by management. These conditions should be monitored by internal auditors until corrected because of the effect they may have on the organization.
