The type or style of audit to be adopted for an audit area largely depends on the nature of the audit, area being audited, risk associated with the audit area (risk score), availability of resource, management objectives, etc. Hence, the internal audit management should determine the most suitable audit type and approach to be adopted for all audits. Based on risk assessment, areas with high risk scores are audited frequently than those with lower risk ratings. A combination of the different types of audit can be adopted to add value and deliver expected results to stakeholders.
Full Audit Full audit is performed on audit areas that have been scheduled in the internal audit plan. The audit process described above are adopted to provide assurance on the effectiveness and adequacy of internal controls and governance structures. This type of audit is conducted at most twice annual for a given audit area and depends of the risk rating of the area being audit. Full audit type must follow all the processes describe above in this book.
Spot-Check Spot-checks are unannounced audits or reviews designed to ascertain the effectiveness or state of workings of critical controls, processes or systems, which could adversely impact the business if not properly oversighted. It is randomly done to confirm consistency and ingenuity of the process, system or control when no one is watching. It has a bit of the surprise element. For example, cash count in a bank’s vault, ATM cash count, Bank Teller cash count, payment card production and personalization stock count, manufacturing or distribution stock count, misery shopping on service points or outlets, etc. Management occasionally request for this type of audit to provide independent assurance that a strategic/critical process of the organization is working as expected without any form of abuse or compromise.
Follow Up Audit
Follow up audits are performed in most cases to confirm status of resolution of audit findings noted in previously audited area or business unit. It is a compliance audit that verifies whether recommendations prescribed to close or resolve control weaknesses or lapses have been implemented by management and no further breaches are occurring in that area. This type of audit is usually requested by the board audit committee and the Chief Compliance Officer (CCO) of an organization.
Investigation and Special Audit Investigation and special audits are use in most cases to review specific business areas/functions, products or activities that witness abuse, fraud or irregular activities that embarrassed or with potential to embarrass the organization or in which the organization has lost funds or goodwill. It is also used to review security incidents or service failures. The objectives of such reviews are to ascertain what led to the incident, service failures, abuse or fraud, the root causes, process or control lapses that facilitated the incident, involvement of staff or other external parties, steps taken to forestall reoccurrence and recommendations that will prevent future occurrence. It could sometimes result to applying forensic methods and professional evidence collection. It could take longer time to complete and expected to be very detailed more than conventional audits (full audit). Management use reports of such audit to implement drastic changes, sanction employees, restructure the system and invest in measure to improve processes, systems and controls. They could also be used or requested during litigation proceedings or by government and regulatory authorities. Value for money audits, which are special audit are also requested by management or board audit committee to confirm that investments made in business area or technology of interest is yielding the desired returns on investment (ROI).