Pre-Audit Planning Engagement (Information Gathering)

Information gathering before the audit is essential in gaining good understanding of the audit client's business processes, governance structures and risk inherent in the business. Request for information during audit planning phase can come in the form of pre-audit checklist or questionnaire, although questionnaires are not generally advisable as they are commonly tailored to expected answer without any value adding or disclosure of vital information to aid audit planning and execution. The pre-audit checklist can be used in gathering preliminary information for proper scoping of the audit, identifying key business risks, determining areas requiring more audit attention and communicating the data requirements of audit team.

Below are some of the information that could be requested by the audit team in preparation for the audit.

  • Site plan showing buildings, perimeters and layouts.
  • Site guidelines stating any particular trainings and other access requirements.
  • Organization chart (Organogram).
  • Job descriptions for the various job roles available in the site.
  • Applicable laws and regulatory requirements.
  • Standard operating procedures, policies and manuals.
  • Business objectives and plans.
  • Key performance indicators (KPIs).
  • Most recent management review minutes of meetings.
  • Training schedule/calendar and tracking sheet.
  • Leave schedule and tracking sheet.

Information gathering may also involve generating certain reports or metrics independent of the audit clients (i.e. without their involvement) as doing so lends more credibility to the accuracy of the information. For example, the audit team can use CAAT (Computer Assisted Audit Techniques) tools like Audit Command Language (ACL) or IDEA to generate reports such as access control list, audit trail/log, transaction reports, defined exception reports, etc. for further analysis. This will give the audit team heads up on the nature of the control environment and general view of compliance.

There could also be need to schedule a meeting with the audit client representatives to enable the audit team understand the operating environment.

To get our IT audit programs/checklists, Click here

To get our risk assessment templates, Click here

Back To Internal Audit Leading Practices

Let us know your thoughts post. Leave a Comment below.