The scope of internal auditing encompasses the examination
and evaluation of the adequacy and effectiveness of the organization's
system of internal control; and the quality of performance in carrying
out assigned responsibilities. Our examinations and evaluations
are composed of the following types of audits:
Reliability and Integrity
of Information
Internal auditors should review the reliability and integrity
of financial and operating information and the means used to identify,
measure, classify, and report such information. Information systems provide
data for decision making, control, and compliance with external requirements.
Therefore, internal auditors should examine information systems and,
as appropriate, ascertain whether:
- Financial and operating records and reports contain
accurate, reliable, timely, complete, and useful information.
- Controls over record keeping and reporting are
adequate and effective.
Compliance
with Policies, Plans, Procedures, Laws, and Regulations
Internal auditors should review the systems established
to ensure compliance with those policies, plans, procedures, laws, and
regulations which could have a significant impact on operations and reports,
and should determine whether the organization is in compliance. Management
is responsible for establishing the systems designed to ensure compliance
with such requirements as policies, plans, procedures, and applicable
laws and regulations. Internal auditors are responsible for determining
whether the systems are adequate and effective and whether the activities
audited are complying with the appropriate requirements.
Safeguarding of Assets
Internal auditors should review the means of safeguarding
assets and, as appropriate, verify the existence of such assets. Internal
auditors should review the means used to safeguard assets from various
types of losses such as those resulting from theft, fire, improper or
illegal activities, and exposure to elements. Internal auditors, when
verifying the existence of assets, should use appropriate audit procedures.
Economical and Efficient
Use of Resources
Internal auditors should appraise the economy and efficiency
with which resources are employed. Management is responsible for setting
operating standards to measure an activity's economical and efficient
use of resources. internal auditors are responsible for determining whether:
- Operating standards have been established for measuring economy and efficiency
- Established operating standards are understood and are being met
- Deviations from operating standards are identified, analyzed, and communicated to those responsible for corrective action
- Corrective action has been taken
Audits related to the economical and efficient use
of resources should identify such conditions as:
- Under-utilized facilities.
- Nonproductive work.
- Procedures which are not cost justified.
- Overstaffing or understaffing.
Accomplishment
of Established Objectives and Goals for Operations or Programs
Internal
auditors should review operations or programs to ascertain whether
results are consistent with established objectives and goals
and whether the operations or programs are being carried out as planned.
Management is responsible for establishing operating or program
objectives and goals, developing and implementing control procedures,
and accomplishing desired operating or program results. internal
auditors should ascertain whether such objectives and goals conform
with those of the organization and whether they are being met. The
term "operations" refers
to the recurring activities of an organization directed toward producing
a product or rendering a service. Such activities may include, but are
not limited to, marketing, sales, production, purchasing, human resources,
finance and accounting, and governmental assistance.
An operation's results
may be measured against established objectives and goals which may include
budgets, time or production schedules, and/or operating plans. The term "programs" refers
to special purpose activities of an organization. Such activities
include but are not limited to the raising of capital, sale of
a facility, fund-raising campaigns, new product or service introduction
campaigns, capital expenditures, and special purpose government
grants. Special purpose activities may be short-term or long-term,
spanning several years. When a program is completed, it generally
ceases to exist. Program results may be measured against established
program objectives and goals. Management is responsible for establishing
criteria to determine if objectives and goals have been accomplished.
Internal auditors should ascertain whether criteria have been
established. If so, internal auditors should use such criteria
for evaluation if they are considered adequate. If management
has not established criteria, or if the established criteria,
in the internal auditors' opinion, are less than adequate, internal
auditors should report such conditions to the appropriate levels
of management. Additionally, internal auditors may recommend
appropriate courses of action depending on the circumstances.
Internal auditors may recommend alternative sources of criteria
to management, such as:
- Acceptable industry standards.
- Standards developed by professions or associations.
- Standards in law and government regulations.
If adequate criteria are not established by management,
internal auditors may still formulate criteria they believe to be adequate
in order to perform an audit, form an opinion, and issue a report on the
accomplishment of established objectives and goals. The internal auditors'
evaluation of the accomplishment of established objectives and goals may
be carried out with respect to an entire operation or program or only a
portion of it. Audit objectives may include determining whether:
- The objectives and goals established by management for a proposed, new, or existing operation or program are adequate and have been effectively articulated and communicated.
- The operation or program achieves its desired level of interim or final results.
- The factors which inhibit satisfactory performance are identified, evaluated, and controlled in an appropriate manner.
- Management has considered alternatives for directing an operation or program which may yield more effective and efficient results.
- An operation or program complements, duplicates, overlaps, or conflicts with other operations or programs.
- Controls for measuring and reporting the accomplishment of objectives and goals are established and are adequate.
- An operation or program is in compliance with policies, plans, procedures, laws, and regulations.
Internal auditors should communicate the audit results
to the appropriate levels of management. The report should state the criteria
established by management and employed by internal auditors and disclose
the nonexistence or inadequacy of any needed criteria. If internal auditors
formulated criteria by which to measure the accomplishment of objectives
and goals, the report should clearly state that internal auditors formulated
the criteria and then present the audit results. Internal auditors can
provide assistance to managers who are developing objectives, goals, and
systems by determining whether the underlying assumptions are appropriate;
whether accurate, current, and relevant information is being used; and
whether suitable controls have been incorporated into the operations or
programs.
