rbi a manual

8/20/2019 Rbi a Manual

1/343

A Risk Based

Internal AuditManual

This spreadsheet shows the data for an a risk basedinternal audit of accounts payable (number 205! It

re"uires modifyin# for your or#ani$ation!

%etails for usin# this risk based audit spreadsheetare included in Book & 'Audit Manual ' aailable on

www!internalaudit!bi$

) %aid *ri+ths,!0


2/343

205 Accounts Payable AuditIntroduction

Objective of this spreadsheet

Worksheets are:

Letters on worksheet tabs refer to the relevant audit manual section

This spreadsheet represents the audit working papers on which the AuditManual (Book 4 is based!

The contents are similar to that used for the audit working papers in Book "# An introduction$ e%cept the Word documents are included in the manual$ notas separate documents! Worksheets are included for these documents$ inorder to provide a complete file

A Audit details: The primar& function being audited and where it stands inthe organi'ation (see the )*) +cube+

A Milestones: ,mportant target dates in the audit

A Audit plan: -ail& outline plan covering the period of the audit

A Audit diary: -etails of the work done each da&

B Functions: *ome t&pical functions which might be in a charit&! .isks arelinked to these!

B Processes: *ome t&pical processes which might be in a retail compan&!.isks are linked to these$ which helps group risks together which can bechecked b& the same audit!

!cope: Links to scopes

" Meetin#s: Links to notes of meetings

$ %is& Maturity: hecklist which assists in determining the risk maturit& ofthe organi'ation!

F Objectives' %is&s and ontrols %e#ister: The foundation of risk basedinternal auditing! The audit is based around this!

F Process ris&s: -iagram of processes and associated risks

( )ests: Links to test schedules

* Potential "eficiencies: /otential deficiencies noted as the& arise

* "eficiencies for discussion: -eficiencies to be discussed withmanagement

I "raft report: Links to draft reports and follow#up memos

+ Final %eport: Links to final report and associated memos

, -uality control: Links to review notes and staff targets and appraisals

. Follo/ up: Links to follow up reports

!uary: Table showing numbers of risks in each assessment categor&!0sed for the report!

!corin# ris&s: 1ives e%amples of risk scoring

1ersion control: *hows changes made for this version and date of issue

.isk based internal auditing b& -avid 1riffiths is licensed under a reative o

http://creativecommons.org/licenses/by-nc/3.0/http://creativecommons.org/licenses/by-nc/3.0/


3/343


4/343


5/343

,ncont


6/343

205 Accounts Payable AuditAudit details

Audit (roup Accounts pa&able

)his audit nuber 56.ast audit nuber (This is the first audit

Audit nae Accounts pa&able

"epartent Accounts /a&able

Function Accounting *ervices

Operatin# unit 7inance

"ivision n8a

$ntity The .etail ompan&


7/343

205 Accounts Payable AuditMilestones

Milestones %esp )ar#et Achieved

Set up audit on quarterly plan CAE 1-Nov-X0 2-Nov-X0Set up computer directories Auditor 16-Dec-X0 16-Dec-X0

Set up meetings Auditor 16-Dec-X0 16-Dec-X0

ssue dra!t scope Auditor 1"-Dec-X0 1#-Dec-X0

$ %ones CAE 12-%an-X1 12-%an-X1

&inal scope issued Auditor 1'-%an-X1 1'-%an-X1

(is) maturity con!irmed Auditor 2-&e*-X1 2-&e*-X1

$rocesses mapped Auditor '-&e*-X1 '-&e*-X1

n+erent ris)s agreed Auditor ,-&e*-X1 -&e*-X1

Controls tested Auditor 12-&e*-X1 12-&e*-X1

(esidual ris)s scored and agreed Auditor 12-&e*-X1 12-&e*-X1

De!iciencies entered into t+e data*ase Auditor 1'-&e*-X1 1'-&e*-X1

.id-audit !ile revie/ CAE 16-&e*-X1 1"-&e*-X1

De!iciencies agreed /it+ *usiness Auditor 1-&e*-X1 1-&e*-X1

Dra!t report issued Auditor 20-&e*-X1 2'-&e*-X1

$ %ones CAE -.ar-X1 #-.ar-X1

&inal report circulated Auditor #-.ar-X1 #-.ar-X1

Auditor #-.ar-X1 #-.ar-X1

End audit !ile revie/ CAE 12-.ar-X1 12-.ar-X1

All sta!! appraised CAE 1#-.ar-X1 1-.ar-X1

$aper !iles stored in arc+ives Auditor 1-.ar-X1 1-.ar-X1

&eed*ac) to *e o*tained !rom date

Accounts $aya*le .anager .i)e 3+an4 1-.ar-X1

5ead o! Accounting Services Anita Smit+4 16-.ar-X1

t+er Comments

&inal scope signed o!!7Aut+ori8ing signature

&inal report signed o!!7Aut+ori8ing signature

CS de!iciencies reportcompleted4


8/343

205 Accounts Payable AuditAudit tietable

This audit # 56

-ate M -avis 7 *aw&er / 9ones (A"6#-ec#;Monda& 56 Briefing from A

"#-ec#;Thursda& 54 Testing 5 Testing

"?#-ec#;7rida& 54 Testing 5 Testing

6#9an#;" Monda& 54 Testing 5 Testing @olida&

#9an#;" Thursda& 54 Testing 5 Testing @olida&?#9an#;" 7rida& 54 Testing 5 Testing @olida&

"5#9an#;" Monda& 56 A approves scope

"3#9an#;" Tuesda& 56 ,ssue final scope

"4#9an#;" Wednesda54 Testing 5 Testing )ut of office

"6#9an#;" Thursda& 54 Testing 5 Testing )ut of office

"#9an#;" Wednesda54 Write report 5 Write report

5?#9an#;" Thursda& 54 Write report 5 Write report

3#9an#;" 7rida& 54 Write report 5 Write report

3"#9an#;" *aturda&"#7eb#;" *unda&

5#7eb#;" Monda& 56 Testing 56 Testing

3#7eb#;" Tuesda& 56 Testing 56 Testing

4#7eb#;" Wednesda56 Testing 56 Testing

6#7eb#;" Thursda& 56 Testing 56 Testing

#7eb#;" *unda&

?#7eb#;" Monda& 56 Testing 56 Testing

"#7eb#;" Tuesda& 56 Testing 56 Testing""#7eb#;" Wednesda56 Testing 56 Testing

"5#7eb#;" Thursda& 56 Testing 56 Testing


9/343

"3#7eb#;" 7rida& 56 Testing 56 Testing

"4#7eb#;" *aturda&

"6#7eb#;" *unda&

"#7eb#;" Wednesda56 lose#down meeting Write draft report

"?#7eb#;" Thursda& 56 Write draft report5#7eb#;" 7rida& 56 Write draft report

5"#7eb#;" *aturda&

55#7eb#;" *unda&

53#7eb#;" Monda& 56 ,ssue draft report

54#7eb#;" Tuesda& 5" Briefing from A

56#7eb#;" Wednesda5" *et up files8scope

5


10/343

M han

@olida&

@olida&

@olida&

@olida&@olida&

,n office

,n office

,n office

,n office

,n office

,n office

,n office,n office

,n office


11/343

,n office

,n office

)ut of office

)ut of office


12/343

205 Accounts Payable AuditAudit diary

o3 )itle

20 Accounts $aya*le!taff 4 !taff 2

.a9 Davis &ran) Sa/yer

"ate et action

1'-Nov

1-Dec

1#-Dec $repare !or %an 6 meeting

6-%an

%an-12*tained CAE approval7 ssue !inal scope7

%an-1'&inal scope issued

&e*-0'

&e*-0, :est operation o! controls

;rie!ing !rom CAE7 Auditdue early &e*7

ectives and (is)(egister and accounts paya*lemanuals7 $repare dra!t scope

;rie!ing !rom CAE7 Dra!tscope agreed /it+ CAE

Set up directories anddocumentation7 Dra!t scope to *e

issued 1" Dec

ssued dra!t scope7Additional /or) on audit20' delayed t+e issue4and agenda !or %an 6meeting7

.et 5ead o! AccountingServices and A$ .anager

?pdate dra!t scope7 *tainapproval7 Arrange meeting /it+

.on &e*2

.eeting /it+ A$ .anagerand Supervisors7Assessment ris) maturity

@rite up notes !rom meeting7&inis+ assessment ris) maturity

Assessment ris) maturity7Dra/ diagrams o! !unctionsand processes7 Decided onaudit approac+

Assess ris) scores7 :estoperation o! controls7

&ollo/ up %; Associates

invoices7C+ec)ed invoices /it+ noorder7 .ostly legal and properly approved *ut one!ound !or % ; Associates7$roperly approved *ut /+yno order No report produced7


13/343

&e*-0 @rite up all details

&e*-06 @rite up notes

&e*-0Continued tests

&e*-1' Complete !ile7 @rite dra!t report

&e*-1" Dra!t report

&e*-1 Dra!t report

2'-&e* Dra!t report issued ssue !inal report

'-.ar Bet CAE approval

#-.ar A?D: C.$


14/343

)iin#

1 20X1

Man

$at %ones

)ar#et date

1,-Dec

1"-Dec

6-%an

%an-0

%an-1'

%an-1'

&e*-02

&e*-1'

&e*-0


15/343

&e*-06

&e*-0

&e*-1'

16-&e*

20-&e*

20-&e*

#-.ar

-.ar


16/343

205 Accounts Payable Auditopany or#ani6ation chart for Accountin# !ervices


17/343

205 Accounts Payable Auditopany processes for Accounts Payable(*ee .isk and Audit 0niverse spreadsheet for top#level processes


18/343

205 Accounts Payable Audit!cope

(@&perlinks to scope documents

%ef "ocuent *yperlin&

Word

,n manual

,n manual

7inal scope ,n manual

2ote with final scope (not included)

-raft scope

2ote with draft scope

http://var/www/apps/conversion/tmp/scratch_5/http://var/www/apps/conversion/tmp/scratch_5/http://var/www/apps/conversion/tmp/scratch_5/http://var/www/apps/conversion/tmp/scratch_5/


19/343

205 Accounts Payable AuditMeetin#s

-ate ontents @&perlink

,n manual


20/343


21/343


22/343


23/343

205 Accounts Payable AuditAssessent of ris& aturity7rom +An approach to implementing .isk Based ,nternal Auditing+ (,,A#0 and ,reland # ma& no

Modified b& a checklist in 1uide to ,*) 3"! @&perlink:

)bective Level " Maintain pro-t of e.istin# business

.isk Level " /rocesses do not support the business

)bective Level 5

.isk Level 5 osses result from inade"uate controls

ontrols

ontrol I!O74000 ontrol O!O 8attribute9

%is& Architecture

/ay suppliers the correct amount at thetime a#reed

1stablish a risk mana#ement frameworkto identify risks threatenin# theobecties and responses re"uired tomana#e the risks! 3ee below for details!

*tatement produced that sets outrisk responsibilities and lists therisk#based matters reserved for theboard

stablishes .esponsibilit& and Accountabilit& for%ecuting /olicies and /rocedures C managementestablishes responsibilit& and accountabilit& for controlactivities with management (or other designatedpersonnel of the operating unit or function in which therelevant risks reside

*tatement produced that sets outrisk responsibilities and lists therisk#based matters reserved for theboard

stablishes .esponsibilit& and Accountabilit& for%ecuting /olicies and /rocedures C managementestablishes responsibilit& and accountabilit& for controlactivities with management (or other designatedpersonnel of the operating unit or function in which the

relevant risks reside

.isk management responsibilitiesallocated to an appropriatemanagement committee

Monitoring activities#Assessing and overseeing thenature and scope of monitoring activities and themanagement+s evaluation and remediation ofdeficiencies


24/343

%is& !trate#y

Arrangements are in place toensure the availabilit& ofappropriate competent advice onrisks and controls

Attracts$ -evelops$ and .etains ,ndividualsCtheorgani'ation provides the mentoring and trainingneeded to attract$ develop$ and retain sufficient andcompetent personnel and outsourced service providersto support the achievement of obectives

.isk aware culture e%ists within theorgani'ation and actions are inhand to enhance the level of riskmaturit&

valuates /erformance Measures$ ,ncentives$ and.ewards for )ngoing relevanceCmanagement and theboard of directors align incentives and rewards with thefulfillment of internal control responsibilities in theachievement of obectives

*ources of risk assurance for theBoard have been identified andvalidated

-efines$ assigns and limits authorities and.esponsibilitiesC management and the board ofdirectors delegate authorit&$ define responsibilities$ useappropriate process and technolog& to assignresponsibilities and segregate duties as necessar& atthe various levels of the organi'ation

.isk management polic& producedthat describes risk appetite$ riskculture and philosoph&

Considers tolerances for risk- Management consider the acceptable

levels of variation relative to the achievement of operationsobjectives

e& dependencies for successidentified$ together with the mattersthat should be avoided

Business obectives validated andthe assumptions underpinningthose obectives tested

Reflects Management’s Choices—The operations objectives reflectmanagement’s choices about structure, industry considerations, and

performance of the entity

Business obectives validated andthe assumptions underpinningthose obectives tested

Reflects Management’s Choices—The operations objectives reflectmanagement’s choices about structure, industry considerations, andperformance of the entity

*ignificant risks faced b& theorgani'ation identified$ togetherwith the critical controls reDuired

ncludes !ntity, "ubsidiary, #ivision, $perating %nit, and &unctional'evels—the organi(ation identifies and assesses risks at the entity,subsidiary, division, operating unit, and functional levels relevant tothe achievement of objectives

.isk management action planestablished that includes the useof ke& risk indicators$ asappropriate

!stimates "ignificance of Risks dentified—management ensures

that identified risks are analy(ed through a process that includesestimating the potential significance of the risk

2ecessar& resources identifiedand provided to support the risk

management activities

!valuates )erformance and Re*ards or #isciplines ndividuals—management and the board of directors evaluate performance of

internal control responsibilities, including adherence to standards ofconduct and e+pected levels of competence and provide re*ards ore+ercise disciplinary action as appropriate


25/343

%is& Protocols

2o eDuivalent

Appropriate risk managementframework identified and adopted$with modifications as appropriate

!stimates "ignificance of Risks dentified—management ensures

that identified risks are analy(ed through a process that includesestimating the potential significance of the risk

*uitable and sufficient riskassessments completed and theresults recorded in an appropriatemanner

/rocedures to include risk as partof business decision#makingestablished and implemented

ssesses Changes in the usiness Model—the organi(ationconsiders the potential impacts of ne* business lines, dramaticallyaltered compositions of e+isting business lines, ac.uired or divestedbusiness operations on the system of internal control, rapid gro*th,changing reliance on foreign geographies and ne* technologies

/rocedures to include risk as partof business decision#makingestablished and implemented

ssesses Changes in the !+ternal !nvironment—the riskidentification process consider changes to regulatory, economic,and the physical environment in *hich the entity operates

-etails of reDuired risk responsesrecorded$ together witharrangements to track riskimprovement recommendations

#etermines /o* to Respond to Risks—management ensures thatthe risk assessment includes considering ho* the risk should be

managed and *hether to accept, avoid, reduce, or share the risk

-etails of reDuired risk responsesrecorded$ together witharrangements to track riskimprovement recommendations

Reassesses )olicies and )rocedures—management periodicallyrevie*s control activities to determine their continued relevance,

and refresh them *hen necessary

,ncident reporting procedures

established to facilitateidentification of risk trends$together with risk escalationprocedures

Communicates *ith the oard of #irectors—communication e+ists

bet*een management and the board of directors so that both haveinformation needed to fulfill their roles *ith respect to the entity’sobjectives

Business continuit& plans anddisaster recover& plansestablished and regularl& tested

Arrangements in place to audit theefficienc& and effectiveness of thecontrols in place for significantrisks

nvolves ppropriate 'evels of Management—The organi(ation putsinto place effective risk assessment mechanisms that involveappropriate levels of management

Arrangements in place to audit theefficienc& and effectiveness of thecontrols in place for significantrisks

nvolves ppropriate 'evels of Management—The organi(ation putsinto place effective risk assessment mechanisms that involveappropriate levels of management


26/343

Arrangements in place formandator& reporting on risk$including reports on at least thefollowing: .isk appetite$ toleranceand constraintsE .isk architectureand risk escalation proceduresE.isk aware culture currentl& inplaceE .isk assessment

arrangements and protocolsE*ignificant risks and ke& riskindicatorsE ritical controls andcontrol weaknessesE *ources ofassurance available to the Board

ssesses Results—management and the board of directors, asappropriate, assess results of ongoing and separate evaluations


27/343

longer be available

Overall onclusion:

Internal audit action:

AP ontrol

http:88www!ferma!eu8risk#management8standards8iso#standard

ontrol IIA /ithaendents

*tatement produced that sets outrisk responsibilities and lists therisk#based matters reserved for theboard!

The organi'ation+s intranet shows a statementfrom the board setting out the risk managementframework and the responsibilities of the boardand management!

.isks been allocated to specific obtitles

The ).. shows risks allocated to specific obtitles

.isk management responsibilitiesallocated to an appropriatemanagement committee ordepartment

There is no .isk Management ommittee but a@ead of .isk Management

http://www.ferma.eu/risk-management/standards/iso-standard/http://www.ferma.eu/risk-management/standards/iso-standard/


28/343

All levels of staff have had risk awareness training

2o eDuivalent n8a

Management have been trained tounderstand what risks are$ andtheir responsibilit& for them!

Managers are assessed on theirrisk management performance$which ma& reDuire improvementsto the level of risk maturit&

The @ead of Accounting *ervices takes intoaccount risk management performance (includinginternal audit reports in her annual appraisal ofthe A/ manager

*ources of risk assurance for theBoard have been identified andvalidated

The Board has identified in its intranet statementthat the @ead of .isk Management is responsiblefor assuring them that the ).. accuratel&reflects obectives$ risks and control and that theA is responsible for providing an opinion that allthe significant risks threatening the organi'ation+s

obectives are operating to bring the risks to withinthe risk appetite set b& the board!

The risk appetite of theorgani'ation has been defined interms of the scoring s&stem!

.isk Management have issued details of the riskappetite$ which are available on the compan&intranet! The Board statement contains thestatements on risk culture and philosoph&!

The organi'ation+s obectives aredefined

There is an annual meeting of senior managementto hear and discuss the organi'ation+s obectivesfor the ne%t &ear! The @ead of Accounting *ervicesattends this meeting before having a meeting withher Managers!

The organi'ation+s obectives aredefined

The @ead of Accounting *ervices and A/ Managermeet to determine the obectives specificall& for A/! The results of this meeting are communicatedto all staff

/rocesses have been defined todetermine risks$ and these havebeen followed!

.isks threatening the obectives have beenidentified using a risk workshop and interviews$and the )bectives and .isk .egister completed

A scoring s&stem for assessingrisks has been defined!

.isk Management have issued standards forscoring risks$ which is available on the compan&intranet

.esponsibilit& for thedetermination$ assessment$ and

management of risks is included in ob descriptions and targets

9ob descriptions and targets include the need todetermine$ assess and operate controls$ as

appropriate to the ob!


29/343

.isk Management collect all risks into the )..

2o eDuivalent

All risks been assessed inaccordance with the definedscoring s&stem!

The ).. shows risk scores based on thestandards set b& .isk Management

All risks and controls have beencollected into one list!

All significant new proects areroutinel& assessed for risk

The A/ manager is responsible for ensuring thatproects are assessed for risks

.isks are identified when functionsand processes change due tochanges in the business or

e%ternal changes

2ew risks are notified to the keeper of the riskregister # .isk Management

.esponses to the risks (e!g!controls have been selected andimplemented!

The A/ Manager ensures all risks haveappropriate controls which should be operating

.isks are regularl& reviewed b& theorgani'ation!

.isk Management notif& A/ of significant riskchanges$ for e%ample resulting from new laws

Management have reported risks

to directors where responses arenot managing the risks to a levelacceptable to the board!

The A/ manager meets the @ead of Accounting

*ervices ever& month and highlights an& riskse%ceeding the risk appetite! The @oA* takesaction as appropriate

Management have set up controlsto monitor the proper operation ofke& controls!

Management have identified monitoring controlsfor all risks listed in the ).. for all risks with aninherent score of over "6

Management have set up controlsto monitor the proper operation ofke& controls!

A/ operating manuals$ which are used for trainingand on#going reference$ contain all the tasks whichare responses to risks


30/343

Managers provide assurance onthe effectiveness of their riskmanagement

Annual check for all functions$ who receive a reportof the obectives$ risks and controls for which the&are responsible! This is signed and returned to.isk Management!


31/343

.isk Managed

Audit test )est result Monitorin# ontrol

Audit risk managementprocesses and use managementassessment of risk asappropriate

Assume controls are as stated inthe )..! heck that the& arean adeDuate response to therisks! Test controls over highinherent risks

nsured the intranet statement iseasil& accessible!

The statement is accessible andcomprehensive

.isk Management departmentensures all risks are allocated

nsured risks are allocated tomanagers!

%amined ).. and confirmed allrisks allocated to appropriatepeople

.isk Management departmentensures all risks are allocated

-iscussed this with @ead of .iskManagement!

The Audit ommittee havediscussed the need for a .iskManagement ommittee but don+tconsider it necessar&


32/343

The standards are on the intranet

,nterviewed managers to confirmtheir understanding of risk and thee%tent to which the& manage it!

@ead of Accounting *ervices and A/ Manager clearl& understoodrisks and their responsibilit& forthem (Meeting date: < 9an 5;"

@ead of Accounting *erviceschecks that staff have been trained

%amine a sample of appraisals forevidence that risks managementwas properl& assessed forperformance!

.isk management is included inappraisals

The hief 7inancial )fficer checkstargets for the A/ manager! The@ead of Accounting *ervices signsoff targets for all A/ staff

hecked the intranet and e%aminedDuarterl& returns to the Auditommittee from the @ead of .iskManagement and A

,ntranet statement seen! Fuarterl&assurance from the @ead of .iskManagement and opinion from theA verified

The Audit ommittee reDuiresDuarterl& returns

hecked the document on whichthe Board has approved the riskappetite! nsured it is consistentwith the scoring s&stem and hasbeen communicated!

The risk appetite is consistent withthe scoring s&stem

2one # e%cept that managers wouldcomplain if the risk appetite detailswere not present

hecked the organi'ation+sobectives have been determinedb& the board and have beencommunicated to all staff$ b&e%amining the agendas from allmeetings!

Agendas for the meetings$ andnotes distributed after the meetingsshow all the obectives

The @ead of Accounting *ervicessigns off targets for all A/ staff$which should show evidence of theneed to achieve compan& and A/obectives

heck other obectives and targetsare consistent with theorgani'ation+s obectives!

Agendas for the meetings$ andnotes distributed after the meetingsshow all the obectives

The @ead of Accounting *ervicessigns off targets for all A/ staff$which should show evidence of theneed to achieve compan& and A/obectives

%amined the processes to ensurethe& are sufficient to ensureidentification of all risks! heckedthe& are in use$ b& e%amining theoutput from an& workshops!

.isk Management held riskworkshops and included the resultsin the )bectives$ .isks andontrols .egister ()..

@ead of Accounting *ervices signsoff )..

hecked the scoring s&stem hasbeen approved$ communicated andis used!

2one # e%cept that managers wouldcomplain if the standards were notpresent

%amined ob descriptions andtargets!

9ob descriptions and targets includerisk management and control tasks

as necessar&!

A/ manager has set up a monthl&+critical controls+ checklist which

reDuires supervisors to confirm theoperation of ke& controls


33/343

The scoring is consistent

2one

urrentl& no new proects

2o risks are above the risk appetite

hecked the scoring applied to aselection of risks is consistent withthe polic&! Look for consistenc&(that is$ similar risks have similarscores!

.isk Management departmentensures all risks are scoredconsistentl&

%amined the)..! nsured it iscomplete$ regularl& reviewed$assessed and used to managerisks!

).. is complete$ reviewed$assessed and manages risks$based on these audit results

%amine proect proposals for ananal&sis of the risks which mightthreaten them!

-etermined the process used toupdate the register when e%ternalor internal changes result in new

risks

There is no formal procedure tonotif& .isk Management of newrisks$ although e#mails have been

seen which notif& .iskManagement

.isk Management departmentcontacts all functions ever& Duarterto update the )..

%amined the risk register toensure proper controls should be inplace!

As part of this audit$ checks ofresponses will be made

.isk Management departmentensures all risks have responses

Met with .isk Management ande%amined their procedures!

/rocedures are good! .M liaisewith Legal and Ta% department toensure new risks are identified

Fuarterl& meeting between .iskManager$ @ead of Ta%$ hief Legal)fficer and 7) to discussemerging risks

7or risks above the risk appetite$

check that the board has beenformall& informed of their e%istence!

.isk Management check for an&

inherent risks above the riskappetite

7or significant risks$ e%amined thecontrol(s treating it and ensuremanagement would know if thecontrol failed!

As part of this audit$ checks ofresponses will be made

@ead of Accounting *ervices signsoff )bective and .isk .egister

%amined operating manuals!hecked a sample of high risks tothe manual to ensure controls wereincluded

As part of this audit$ checks of themanual will be made

A/ manager approves the manualbefore it is issued


34/343

,nternal Audit e%amine all returns%amine the assurance provided!7or ke& risks$ check that controlsand the management s&stem ofmonitoring$ are operating!

The annual check for A/ wasproperl& approved


35/343

Audit )est )est %esult

2ot considered necessar& G*


G*

.iskenabled

.iskmanaged

.iskdefined


36/343

G*



G*

G*

G*

hecked ).. for signature G*

n8a n8a G*

G*

@ead of Accounting *ervicesasks about staff training for risksat monthl& meetings! heckednotes from these meetings

2otes show that @oA* doescheck

%amined targets for a selectionof staff!

All contained targetsreflecting A/ and compan&obectives (including theneed for integrit&!

%amined targets for a selectionof staff!

All contained targetsreflecting A/ and compan&obectives (including theneed for integrit&!

4o eidence of check(note as %e-ciency 2

%amined checklists for2ovember and -ecember 5;!

All checklist present andproperl& completed


37/343


n8a

%amined the replies G*


%amined notes from meetings G*

%amined the ).. G*

hecked ).. for signature G*

2ot considered necessar&G*

Many were missin# andnot followed up (noteas %e-ciency ,

Meeting cover importantareas for new risks

2o risks above the risk

appetite

2o evidence of check (notein ,**0 5


38/343



39/343

.isk aware .isk naHve

.isk enabled

.isk managed

.isk defined

.isk aware


40/343

.isk naHve


41/343


42/343


43/343

haracteristics Internal audit actionris&s

.isk management and internal controls full&

embedded into the operations

Audit risk management

processes and usenterprise approach to risk managementdeveloped and communicated

Audit risk managementprocesses and usemanagement assessment ofrisk as appropriate

*trateg& and policies in place andcommunicated! .isk appetite defined

7acilitate riskmanagement8liaise with riskmanagement and usemanagement assessment ofrisk where appropriate

*cattered silo based approach to riskmanagement

/romote enterprise#wideapproach to risk managementand rel& on audit riskassessment


44/343

2o formal approach developed for riskmanagement

/romote risk managementand rel& on audit riskassessment


45/343


46/343


47/343

Internal audit actioncontrols

Assume controls are as stated in

the )..! heck that the& are Assume controls are as stated inthe )..! heck that the& arean adeDuate response to therisks! Test controls over highinherent risks

Where controls are included inthe ).. check that the& are anadeDuate response to the risks!7acilitate the determination ofcontrols reDuired to manage other

risks! Test controls over high andmedium inherent risks

-etermine the risks and controlsnecessar& b& holding workshopswith appropriate managers andstaff! heck controls over all risksconsidered unacceptable


48/343

-etermine the risks and controlsnecessar& b& holding workshopswith appropriate managers andstaff$ otherwise use internalaudit+s assessment! 0sespecialists if necessar&! heckcontrols over all risks consideredunacceptable!


49/343


50/343


51/343

205 Accounts Payable AuditObjectives' %is&s and ontrols %e#ister 8Incoplete9o .4obj .4 Objectives .4ris& .4 %is&s .2obj

"

5

3

4

6

<

=

>

?

Maintain profit of e%istingbusiness

/rocesses do not support thebusiness


















52/343

"

""

"5

"3

"4

"6

"<

"=

">

"?

5

5"

55

53

















Maintain profit of e%istingbusiness /rocesses do not support thebusiness












53/343

54

56

5<

5=

5>

5?

3

3"

35

33

34

36

3<

3=

3>

3?





Maintain profit of e%isting

business

/rocesses do not support the

business




















business


business






54/343

4

4"

45

43

44

46

4<

4=

4>

4?

6

6"

65

63

64

66

6<






business


business








business


business








business


business













55/343

6=

6>

6?


56/343

=5

=3

=4

=6

=<

==

=>

=?

>

>"

>5

>3

>4




























57/343

>6

><

>=

>>

>?

?

?"

?5

?3

?4

?6























58/343

?<

?=

?>

??

"

""

"5

"3

"4

"6

"<

"=


























59/343

">

"?

""

"""

""5

""3

""4

""6

""<

""=

"">

""?

"5




























60/343

"5"

"55

"53

"54

"56

"5<

"5=

"5>

"5?

"3

"3"

"35

"33

"34

"36


























business


business






61/343

"3<

"3=

"3>

"3?

"4

"4"

"45

"43

"44

"46

"4<

"4=

"4>

"4?

"6

"6"






business


business



























62/343

"65

"63

"64

"66

"6<

"6=

"6>

"6?

"


63/343

"


64/343

"><

">=

">>

">?

"?

"?"

"?5

"?3

"?4

"?6

"?<

"?=

"?>

"??

5

5"

55






business


business








business


business








business


business














65/343

53

54

56

5<

5=

5>

5?

5"

5""

5"5

5"3

5"4

5"6

5"<

5"=

5">

5"?






business


business








business


business








business


business








business


business






66/343

55

55"

555

553

554

556

55<

55=

55>

55?

53

53"

535

533

534

536

53<






business


business








business


business




















67/343

53=

53>

53?

54

54"

545

543

544

546

54<

54=

54>

54?

56

56"

565

563






business


business








business


business








business


business








business


business






68/343

564

566

56<

56=

56>

56?

5


69/343

5


70/343

5=4

5=6

5=<

5==

5=>

5=?

5>

5>"

5>5

5>3

stablish strategies fordelivering the obectives

ompan& does not achievestakeholder obectives











stablish strategies for

delivering the obectives

ompan& does not achieve

stakeholder obectives








71/343

5>4

5>6

5><

5>=

5>>

5>?

5?

5?"

5?5



















stablish strategies fordelivering the obectives ompan& does not achievestakeholder obectives


72/343

5?3

5?4

5?6

5?<

5?=

5?>

5??

3

3"

35















stablish strategies fordelivering the obectives ompan& does not achievestakeholder obectives








73/343

33

34

36

3<

3=

3>

3?

3"

3""




















74/343

3"5

3"3

3"4

3"6

3"<

3"=




















75/343

.2 Objectives .2ris& .2 %is&s .7obj

/a& suppliers the correctamount at the time agreed

/rocesses are not fit for purpose orwill not remain fit for purpose


















76/343

















/a& suppliers the correctamount at the time agreed /rocesses are not fit for purpose orwill not remain fit for purpose












77/343

,ncorrect set up data





,ncorrect standing data






Losses result from inadeDuatecontrols



/a& suppliers the correct

amount at the time agreed

Losses result from inadeDuate

controls



















78/343
































*uppliers paid incorrect amountand8or at wrong time







79/343






,ncorrect supplier data












/a& suppliers the correctamount at the time agreed *uppliers paid incorrect amountand8or at wrong time






Transaction data used to updatebalances is incorrect





Transaction data used to update

balances is incorrect




80/343




























81/343



















/a& suppliers the correctamount at the time agreed Transaction data used to updatebalances is incorrect




82/343


























83/343




























84/343



























*uppliers paid incorrect amount

and8or at wrong time






85/343







*uppliers paid incorrect amount

and8or at wrong time







/a& suppliers the correctamount at the time agreed *uppliers paid incorrect amountand8or at wrong time


















/a&ment (possibl& fraudulent ismade when no goods or serviceshave been properl& received


86/343





/a& suppliers the correctamount at the time agreed /a&ment (possibl& fraudulent ismade when no goods or serviceshave been properl& received














/a&ment (possibl& fraudulent ismade when no goods or services

have been properl& received/a& suppliers the correctamount at the time agreed







/a&ment (possibl& fraudulent ismade when no goods or services

have been properl& received/a& suppliers the correctamount at the time agreed







87/343

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances

,ncorrect balances







/a&ment (possibl& fraudulent is

made when no goods or serviceshave been properl& received



















88/343

,ncorrect balances

,ncorrect balances

,ncorrect output

,ncorrect output

,ncorrect output

,ncorrect output

,ncorrect output

,ncorrect output

,ncorrect output

,ncorrect output















The databases are corrupted or

destro&ed (The audit covering theserisks ma& be a separate ,T audit


The databases are corrupted ordestro&ed (The audit covering theserisks ma& be a separate ,T audit












89/343









































/a& su

rbi a manual

Documents