Operations Audit Module 1 Exam

Leson 1: Operations Audit

Definition:
“operational auditing” - conjures up different images for internal auditors.
It may be used to mean any of the following:
(1)Audit of operating units
- manufacturing plants, depots, subsidiaries, overseas units.
Audit scope
- accounting, financial and administrative controls may be broadened in
scope to cover the administrative and operational controls, risk
management and governance processes of the operating unit under
review.
Audit
- how the functional areas of a business (such as sales, marketing,
production, distribution, HR, etc.) account for their activities and exercise
financial control over them.
- acknowledges that the internal auditing activity should review all the
operational areas of the business, but too narrowly specializes in the audit
of accounting and financial controls.
- It is likely to imply that the internal auditing activity is representing only
the finance director or the chief accountant in providing assurance about
accounting and financial control across the business
(2) The audit of any part of the business (operating unit, functional area,
section, department or even business process, etc.) where the audit objective
is to review the effectiveness, efficiency and economy with which
management is achieving its own objectives.

- Depending upon how broadly one defines internal control, the approach to
operational auditing goes further than a review of detailed internal control
procedures since management’s objectives are not achieved merely by
adhering to satisfactory systems of internal control.
operational audit
- examination of the manner in which an organization conducts business,
with the objective of pointing out improvements that will increase its
efficiency and effectiveness.
- This type of audit is substantially different from a normal audit, where the
objective is to examine the adequacy of controls and to evaluate the
fairness of presentation of the financial statements.
- usually conducted by the internal audit staff, though specialists can be
hired to conduct reviews in their areas of expertise.
primary users of the audit recommendations - management team, and
especially the managers of those areas that have been reviewed.

Purpose
operational audit
- is a systematic and objective evaluation of an organization’s operations
to assess how effectively it uses its resources to achieve its objectives.
- aims to identify areas where the organization can improve its efficiency,
effectiveness, and compliance with regulations and policies.
key purposes
- Identify Inefficiencies:
o By reviewing the organization’s processes, policies, and procedures,
auditors can identify areas where the organization wastes
resources, time, or money.
o For example, an operational audit may identify redundant or
unnecessary steps in a process or equipment not being used to its
full potential.
- Improve Efficiency:
o Once inefficiencies are identified, the operational audit
recommends how the organization can improve its efficiency.
o This may involve streamlining processes, removing redundancies,
or reallocating resources.
o The organization can reduce costs, increase productivity, and
improve its overall performance by implementing these
recommendations.
- Increase Effectiveness:
o The audit can help identify areas where the organization is not
meeting its objectives and make recommendations for improving its
performance.
o For example, an operational audit may identify areas where the
organization is not meeting its customer’s needs or identify a need
for additional training to improve employee performance.
- Ensure Compliance:
o Operational audits also help ensure an organization complies with
regulations, policies, and procedures.
o By reviewing the organization’s operations, auditors can identify
areas where the organization may be at risk of non-compliance and
make recommendations to improve its compliance.
o For example, an operational audit may identify a need for additional
training to ensure employees follow the organization’s policies and
procedures.
- Improve Risk Management:
 o An operational audit also helps identify organizational operations
risks.
o By reviewing the organization’s processes, policies, and procedures,
auditors can identify areas where the organization may be at risk of
fraud, errors, or other issues.
o By making recommendations to address these risks, the
organization can improve its risk management and reduce the
likelihood of adverse outcomes.
- Support Decision-Making:
o An operational audit can support decision-making by providing
objective and reliable information about the organization’s
operations.
o By identifying areas of inefficiency, recommending improvements,
and identifying risks, the operational audit provides decision-
makers with the information they need to make informed decisions
about the organization’s operations.
operational audit - aims to objectively and systematically evaluate an
organization’s operations, identify areas where it can improve efficiency and
effectiveness, ensure compliance with regulations and policies, improve risk
management, and support decision-making and By conducting operational audits,
organizations can identify improvement opportunities and make the necessary
changes to achieve their objectives
Scope
A key issue for a business and its internal audit function to decide upon is whether
the scope of internal audit work in an operational area of the business should be
restricted to a review of the appropriateness of, and extent of compliance with, key
internal controls or should be a more comprehensive review of the operation
generally.
Internal control is broadly defined as a process, effected by the entity’s board of
directors, management and other personnel, designed to provide reasonable
assurance regarding the achievement of objectives in the following categories:
- Effectiveness and efficiency of operations.
- Reliability of financial reporting.
- Compliance with applicable laws and regulations
Differing positions are adopted in different enterprises. The middle-of-the-road
approach is to encourage internal audit to interpret its mission as being the
appraisal of internal control (in all its component parts, in all operational areas of
the business and at all levels of management).
If during the course of audit work, other matters are noted which should be of
management concern but do not directly have a control dimension, internal audit
should be encouraged to report on them.
Beyond the consideration of the point of focus for audit reviews of operational
areas, the audit function will have to define those aspects of the organization which
are to be subject to review.
In practice, of course, this will vary considerably between organizations, and will be
related directly to the nature of the business and the way the organization is
structured.
For example, a multinational pharmaceutical company may have its principal
manufacturing bases and research and development activities in only those few
countries where the economic and commercial environments are most suitable,
whereas sales and marketing operations (of varying scale) may exist in every
country where there is a proven market for the products
Although the focus of operational auditing is likely to be on those activities which
are most strongly associated with the main commercial markets of the organization
(for example, production, sales, after sales support, service provision, etc.), it is
likely that the supporting or infrastructure operations will also need to be reviewed
on the basis that they too contribute to the well-being of the organization as a
whole.

This particular top level classification would be appropriate for a large organization
involved in product development, manufacturing and sales activities. A modified
model would emerge for an organization (public or private) associated with
providing a service (for example, a public health authority or a roadside vehicle
repair service).
When approaching the review of operational areas of the organization, it is
important that the auditor has an accurate appreciation of the related key issues. If
necessary, prior research should be conducted in order to provide the auditor with
an acceptable level of understanding. Beyond the auditor’s self-interest in being
able to tackle confidently the review project, there is also the matter of the auditor’s
credibility in the eyes of operational management.
Unless the auditor can readily demonstrate a pragmatic awareness of the critical
issues and set these against the objectives of senior management for the area
under review, any subsequent work and findings may be in danger of not being
treated seriously by management due to inaccuracies, misinterpretations and an
inappropriate focus. Unless management can be suitably assured that the reviews
conducted by internal audit are objective, professional and based upon an accurate
understanding of the issues, they may question the worth of such activities to the
organization.

Lesson 2: Audit Approach to Operations Audit

Auditors of operations should keep firmly in their mind the objectives of
management for the operations being audited.
At an early stage in planning the audit engagement, the audit team need to
establish what are management’s objectives.
If management are unclear as to their objectives, then these objectives must be
worked out with management before the audit engagement can process.
During the planning phase of the audit engagement the audit objectives need to be
established. “Audit objectives” are not synonymous with “management’s
objectives” as the audit objectives specify the particular focus that the auditors will
have during the audit engagement.
Even so, each audit objective must be determined because it will potentially add
value in assisting management to achieve one or more of their objectives. No time
should be expended during the audit engagement on issues which are immaterial to
the achievement of management’s objectives. Nothing should appear in the audit
report of the engagement which is immaterial to the achievement of business
objectives by management.

Auditing for the 3 and 6 E’s

- are auditing for the “three Es”—effectiveness, efficiency and
economy. They are looking for opportunities for business processes to be
done differently to improve their effectiveness, efficiency and economy.
- At the very least they are intending to provide assurance to management
and to the board that business processes are effective, efficient and
economic. Too often auditors fail to appreciate the distinctiveness
between each of these “three Es” with the risk that auditors fail to address
all three separately.
- further “three Es” to their portfolio of matters of audit interest,
particularly as a consequence of their role in the audit of governance
processes:
o Equity—avoidance of discrimination and unfairness; acceptance
and promotion of diversity.
o Environment—acting in an environmentally responsible way.
o Ethics—legal and moral conduct by management and staff.
Figure 1.1 presumes that our economy, efficiency and effectiveness are each
measured against economy, efficiency and effectiveness targets we set ourselves. If
we are insufficiently demanding we may achieve 100% outcomes against the
modest targets we set ourselves. Clearly we need ways of avoiding falling into this
trap by:
- benchmarking against other organizations for indications as to whether
we are “economic enough” , “efficient enough” and “effective enough”;
- comparing with other parts of our organisation;
- measuring and interpreting trends over time;
- aiming for continuous improvement.

Productivity and Performance Measurement Systems

Organizations are likely to have in place a number of key performance measures, so
as to, among other things, assess the achievement of their objectives and goals,
assess their progress, and compare relative performance (for example, over time).
The nature and form of such measures will, of course, vary between types of
organization and indeed specific specialized forms of measurement may apply in
certain industries or sectors. However, there are a number of general measures of
effectiveness, efficiency and economy which usually apply universally.
Measurement methods can be applied in order to identify whether there is any
initial potential for improvement, and then subsequently used to monitor that the
required levels of performance are maintained. The need to apply effective and
realistic performance measurement methods is often generated as a by-product of
fundamental change processes where, for example, an organization is refocusing its
strategy and position.

The Audit Implications for Measurement

During the course of a review of an operational area, the auditor is often faced with
the need either to set the review findings into an appropriate context, or to
indicate the performance of the area under review against the criteria
previously established by management.
In most cases, it is preferable to utilize the measurement standards and
criteria put in place by management as this results in the auditor using a common
and compatible language when communicating results and points of concern.
Conversely, if the auditor chooses to use a new, alternative or perhaps radical form
of performance measure, this may influence or jeopardize management’s view of
the auditor’s findings.
This is not to say that auditors should only adopt the prevailing measurement
criteria established by management, as there may be a compelling reason for
introducing another objective form of performance assessment in some cases.
Whatever the form of measurement applied, its use must be founded on both
accurate and reliable data and a proven method, otherwise the credibility of
internal audit will suffer.
Examples Performance Measures
Economy Performance Measures
- These may highlight waste in the provision of resources indicating that the
same resources may be provided more cheaply or that more enterprise
may be conducted at the same cost.
- Examples:
o Cost of actual input in comparison with planned input
o Cleaning costs per hour worked
o Maintenance costs per unit area

Efficiency Performance Measures

- These may highlight potential opportunities to convert given resources to
end product with less waste. Many performance measures will point to
either uneconomic or inefficient practices, or both. It is often not possible
to distinguish between one and the other.
- Examples:
o Ratio of actual input to actual output
o Breakdown per production day
o Accidents at work per 1000 personnel

Effectiveness Performance Measures

 - These performance measures focus on how objectives are being achieved
—regardless of economy, efficiency or equity (except where the objectives
relate specifically to economy, efficiency and equity).
- Examples:
o Actual output in comparison to planned output.
o Ratio of customer complaints to sales.

Equity Performance Measures

- These performance measures draw attention to unfairness or potential
social irresponsibility in terms of corporate policy and practice.
- Examples:
o Proportion of female employees
o Proportion of disabled employee

Benchmarking
- comparison of one’s own performance in a specific area with that applied
by others in compatible circumstances. As a technique it is founded on the
premise that there may be viable alternative ways of performing a process
and fulfilling a requirement
- platform used to identify and subsequently launch the required or
necessary processes of change within a department, function, activity,
process or organisation
principal objectives of benchmarking
- maintaining a competitive advantage in the appropriate market;
- establishing current methods, best practice and related trends;
- ensuring the future survival of the organization;
- maintaining an awareness of customer expectations (and being able to
address them);
- ensuring that the organization has the appropriate approach to quality
issues

Lesson 3: An Audit Universe of Business Process

How do auditors decide upon the most appropriate way to define universe
of audit review projects?
- separate the “productive” or commercial aspects of the business
(such as manufacturing or sales) from the support or infrastructure
activities (such as accounting, photocopying or security).
- This type of subdivision is generally geared to the fundamental nature of
the business or operations of the organization and tends to lend a natural
priority to those more significant areas of activity.
- The simplest (although not necessarily the best) way to define the audit
universe is to look at the internal telephone directory.
Advantages of using departmental of functional basis
- the area under review is clearly bounded
- reporting lines to responsible management are clear-cut
It is often at the point of interaction between systems or departments where
controls are critical.
In any event, the auditor will need to establish and communicate the boundary or
scope of each review project, partly as a means of ensuring that all concerned are
aware of what is being examined (and equally important, what is not being
included) within the review.
Dividing up the audit universe for review purposes into a number of business
processes, rather than according to how the organization is structured into
departments, divisions, operating units, HQ functions and so on, has great potential
to reveal opportunities to improve economy, efficiency and effectiveness.
Auditors will need to assess the risks inherent within their organizations as the
primary basis for allocating audit review resources, and accordingly adopt the most
suitable review methods for their specific circumstances.
Reasons for Process Weakness
It is not just that formal, laid-down procedures tend not to be so thoroughly defined
to address requirements for coordination between sections of the business. Control
is likely to be weaker between sections than within sections for behavioural
reasons as well. Staff are sociable people. Everyone values his or her membership
of groups. The workgroup that someone belongs to is usually important to that
individual. Staff tend to identify with their immediate workgroup more strongly than
they identify with the organization as a whole. Indeed, this intra-group loyalty is
likely to contrast strongly with inter-group rivalry. It is a responsibility of
management to use their best endeavours to mitigate this likely default mentality.

IDENTIFYING THE PROCESSES OF AN ORGANIZATION

- This approach focuses on a number of related economic events that
occur within an organization that in turn may generate
transactions and interactions with systems. It is often referred to as
the “business cycle” approach.
- Its prime aim is to take account of the lifecycle of a series of events
within the business operations and review them in their entirety across
all functional and organizational boundaries.
6 Ubiquitous Process
Revenue - Related to those activities that exchange the organization’s products
and services for cash
- credit granting;
 - processing orders;
- delivery and shipping;
- billing to customers;
- maintaining accurate and reliable inventory records;
- the activities associated with accounts receivable;
- bad debt (including pursuing debtors and writing off balances);
- reflecting the related transactions correctly in the accounting systems.

Expenditure - Those activities/systems that acquire goods, services, labour and

property; pay for them; and classify, summarize and report what was acquired and
what was paid.
- ensuring that suppliers are stable, reliable and able to provide the
appropriate goods/services on time, at the
- right price and to the required quality;
- the requisitioning of goods, services, corporate assets and labour;
- receiving, securely storing and correctly accounting for goods;
- all the activities associated with accounts payable (e.g. matching orders to
suppliers’ invoices and confirming
- the accuracy of pricing, etc.);
- recruiting and correctly paying staff;
- ensuring that all taxes due are correctly calculated and disbursed;
- ensuring that all the related accounting records are accurate, up to date and
complete.
Product/Conversion - “conversion” relates to the utilisation and management of
various resources (inventory stock, labour, etc.) in the process of creating the goods
and services to be marketed by the organization.
- The key issues in this process include accountability for the movement and
usage of resources up to the point of supply which is then dealt with in the
revenue cycle. Conversion cycle activities include product accounting/costing,
manufacturing control, and stock management.
Treasury
- the definition of the cash requirements and cash flow management;
- allocation of available cash to the various operations;
- investment planning;
- the outflow of cash to investors and creditors (i.e. dividends).
Financial reporting
- This process is not based on the basic processing of transactions reflecting
economic events, but concentrates upon the crucial consolidation and
reporting of results to various interested parties (i.e. management, investors,
regulatory and statutory authorities).
Corporate Framework
- incorporates those activities concerned with ensuring effective and
appropriate governance processes and external accountability.
 - It is to do with the development and maintenance of values, culture and
ethics, and effective management, strategic, infrastructure and control
frameworks that should aim to give form to the underlying direction,
structure and effectiveness of an organization. This category can also include
issues such as specific industry regulations and compliance.

An Alternative, More Detailed Classification of Business Processes

This more detailed classification into processes draws upon Johnson and Jaenicke. It
covers in more detail the six overall “ubiquitous” processes set out above. Johnson
and Jaenicke say that the four cycles (marked with an asterisk below) form the
internal accounting control system for most enterprises.
1. Cash process: The flow of cash into the business principally through payments
from customers, the custodial function with regard to that cash and the conversion
of the cash in settlement of debts due principally to suppliers.
2. Information process: The gathering of data and its conversion into information;
the analysis of that information leading to decisions which in turn result in data on
performance.
3. Integrity process: “[the] controls over the creation, implementation, security
and use of computer programs, and controls over the security of data files. These
controls, technically referred to as integrity controls, constitute a cycle because they
operate continuously from the time programs are instituted and data are introduced
into the computer records.”
4. Launching a new product process: The cycle that includes market research, R
& D, provision of necessary finance, tooling up (or the equivalent), commencement
of production and the sales launch.
5. *Payments process: “Transaction flows relating to expenditures and payments
and related controls over (among other activities) ordering and receipt of purchases,
accounts payable, and cash disbursements.”
6. Planning and control process: Planning a course of action, executing that
action, measuring the results, comparing actual performance with planned
performance and deciding upon corrective action.
7. *Production process: “Transaction flows relating to production of goods or
services and related controls over such activities as inventory transfers and charges
to production for labour and overhead.”
8. Product life process: Commencing with the processes of launching a new
product, through the routine production phase, product revision and relaunch,
product price adjustments, and termination or decline of the product line.
9. *Revenue process: “Transaction flows relating to revenue generating and
collection functions and related controls over such activities as sales orders,
shipping, and cash collection.”
10. *Time process: “Not strictly related to transaction flows, this cycle includes
events causedby the passage of time, controls that are applied only
periodically,certain custodial activities, and the financial reporting process.

WHY ADOPT A ‘‘CYCLE’’ OR ‘‘PROCESS’’ APPROACH TO INTERNAL CONTROL

DESIGN AND REVIEW?
Audit trail implies the preparation and retention within an organization
(a) for an adequate period,
(b) in a reasonably accessible form, and
(c) in enough detail to satisfy the auditors, of records which allow each
detailed element of any transaction to be tracked from its source through each
intermediate stage to its final disposition (or dispositions); and vice versa—that is,
the facility to use records to trace back in detail from the final outcome (or
outcomes) through the intermediate stages back to the initial source (or sources) of
the transaction

Hallmarks of Good Business Process

1. designed to meet objectives which are clear;
2. has regard to competitive issues;
3. performance can be (and is) measured;
4. unsatisfactory performance is rectified;
5. activities are completed in a timely way;
6. processes are cost effective;
7. controls are “preventive” rather than merely “permissive”;
8. as few “movements”/“stages” as possible;
9. unnecessary steps have been eliminated;
• nothing is done which is unimportant to the achievement of objectives;
10. proper authorizations;
11. controls positioned as early as possible in the process;
12. documented;
13. has an audit trail;
14. right people doing the right job;
15. room for adaptation;
16. defines risks within the process itself.