Audit management software are used to automate the process of auditing. Most standard audit management software like Morgan Kai Internal audit management software or Wolters Kluwer, Teammate Audit Solutions come handy with good audit process automation. First, the Auditors need to define the audit universe for the audit. In the context of internal audit, the audit universe is basically the coverage and the mandate of the internal audit department as defined in its audit charter. Management and regulatory authorities would have authorized/empowered the internal audit department to cover all or certain areas of the organization's business, operations, processes and systems as part of its mandate to provide reasonable assurance on the effectiveness of controls implemented by the management to achieve business objectives. Hence the internal audit team defined its audit universe in the audit management software along the lines of its mandate from Executive management and regulatory compliance perspectives. For example, 2018 Financial Year (FY) Internal Audit Plan could be defined as the audit universe.
Secondly, the Audit Department defines the audit units or components, for example Strategic Business Audit, Subsidiary Audit, Branch/Regional Business Audit, Information Systems Audit, Retail Services Audit, etc., can be defined as the audit units under the audit universe as applicable. Thirdly, the Auditors should defined the audit type, which can either be routine, adhoc, spot check, follow up, or special (investigation) audit. The audit type will determine the approach, resources, template and report formats that can be deployed to fulfill the audit. Lastly, the audit area will need to be defined. Audit area for example can be Accounts and Financial control (FINCON) audit, Strategic Risk management audit, Treasury products and operations audit, Credit analysis and administration audit, Brand Assurance and Corporate communications audit, Foreign operations audit, physical security audit, Data center audit, IT Power and Infrastructure audit, Core Business Applications Audit, IT Operations and Infrastructure audit, Business Continuity Management and Disaster Recovery Assurance audit, Business Units among others..
After the above steps has been defined in the software (note: a robust audit management software should come with most of these features inbuilt), the Audit team will have to design its Audit Work Programs (AWP) or IT Audit Programs/Checklists for details on audit programs), which should capture the identified risk (Risk Assessment Template) in the area being audited, controls to mitigate the identified risks, audit test procedures or Test of controls (TOC) that will be carried out to confirm that the controls implemented are working as expected or otherwise, the severity of the risk (Critical/very high, high, medium or low). The AWP can be uploaded into the audit software in the form of a template predefined in a format that the audit team can conform with. After the AWP has been uploaded in the audit management software under a defined audit area, then the audit can be approved for commencement by the audit management. Once the audit work program has been approved. It becomes an active/scheduled audit in the audit management software based on the effective date of commencement of the audit assignment. The AWP is the working document for the audit team during the audit assignment. The audit team populates the AWP with their findings and root causes of the noted exceptions based on their observation of the issues in the field. Appropriate corrective actions or recommendations are also provided based on observations. Thereafter the audit client (i.e. auditee) then provided their responses to the issues raised during the audit as well as the root cause and remedial actions. These responses can be fed into the audit management software if properly implemented or integrated with the organization's active directory and email systems, which gives room for the audit clients to give their response directly into the audit software. Where the provided responses are adequate and provide accurate account of the issues as observed/captured by the audit team, the audit team can then conclude the audit and submit same for review and adjustment by the audit management.
A robust audit management software also provide guide on the rating of the audit clients. There are several models or methodologies that can be adopted in determining the audit rating of an audit client. Some school of thought or models believe that each audit exception or non-conformity should be assigned a weighted score (or %) based on their severity. For instance, 5% for critical severity, 4% for high severity, 3 for medium severity, 2 for low severity, 1 for very low severity and 0 for effective control). The applicable scores for each exception or nonconformity are deducted from a maximum score of 100 while the remain score after all deduction forms the final audit rating, which is usually banded for example, above 70% is low risk (Good rating), 30 to 60% is medium risk (opportunity for improvement or average rating) and below 30% is high risk (poor rating). The best practice for audit rating requires that the various risk identified in each audit area be rated rather than rating the controls/exceptions. The weighted score of each of the risk associated with a given audit area determines the audit rating of audit clients/auditee. Where the control(s) implemented to mitigate each risk is either adequate or inadequate, the audit team apportions a weighted score based on their opinion of control adequacy. Rating guide that could be adopted are Very high risk/very poor rating (0 -20%), high risk/poor rating (20-30%), medium risk/average rating (30-50%), low risk/good rating (50-70%), very low risk/very good rating (70-90%), no risk/outstanding (90-100%). The cumulative weighted score of each of the risk areas forms the audit rating for the client.
A good audit management software comes with pre-formatted reports and the report format will depend on what has been agreed and adopted by the Audit department with the software vendor at the point of implementation. Some of the reports comes with cover memo, executive/issue summary, main/detailed report (issues/findings, recommendations, root causes, closure timelines, etc.), rating sheet, consequence management report and audit work papers (i.e. AWP and appendices of audit evidences).
It is important to note that the audit template or what I call the AWP, which has been uploaded into the audit management software and used for the real audit field work can be in different states in the audit management software.
When the audit work is completed, the final report is then generated via the audit management software for management review and Chief Audit Executive's (CAE) final approval and issue. The management review can either be done in software or offline depending on the choice of the CAE. Once the audit report has been issue to the organization's management or Board Audit Committee, the follow up process is kick-started. The team designated for this purpose is drive the process and ensure that the timeline specified by the Audit Client for closure of the audit exceptions/non-conformities are adhered to and closed with a status report sent to the follow up team for documented and management review. This is pretty much what happens with audit management software and how an audit team or auditors can use audit management software to conduct an audit.
(Tech Blogger and Author)
Will appreciate your questions and contributions on this post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at firstname.lastname@example.org.