How To Use Audit Management Software To Manage Audit Engagement

Audit management software are used to automate the process of auditing. Most standard audit management software such as Pentana Audit (previously MKInsight), AutoAudit by Refinitiv, RSA Archer by CloudSpace and Teammates by Wolters Kluwer come handy with good audit process automation. First, the Auditors need to define the audit universe for the Internal Audit function. The audit universe is basically the auditable areas that are within the coverage of the Internal Audit function. The Board Audit Committee (BAC) empowers the Internal Audit function to have unfiltered access to all records or areas of the organization through the Internal Audit charter, which outlines the authority and mandate of the Internal Audit function. Such areas are not limited to business/relationship management, operations, backoffice processes and IT systems. Hence, there is need for Internal Audit to identify and document its audit universe after which it is recognized/captured in the audit management soluition for planning purporse. Documenting the audit universe are part of the planning stages of the audit lifecycle.

Definition of Audit Units

As part of the audit planning process, the Internal Audit function identifies business areas or units within the organization whose activities and mandate are captured in the audit universe. This could include Operations department, Financial Control (FINCON), Risk Management, Information Technology, Relationship Management, Business Development, Compliance. etc. These information are captured in the audit management software as part of the planning process. With the audit universe, the Internal Audit function conducts risk assessment (use the Risk Assessment Template/Checklist) of the areas in scope of their mandate with a view to identify processes and functions that constitutes significant risk to the organization. This process is called risk-based assessment process. The outcome of the risk assessment will result to internal audit being risk focus and determining its annual audit plan from a risk-based approach (also known as risk-based audit approach). Internal Audit are at liberty to rely on risk assessment carried out by the business units (also known as Risk & Control Self-Assessment - RCSA) or the enterprise risk management function to do their job. In which case, Internal Audit could request for the risk register or RCSA documentations in other to gain understanding of the risk of significant risk exposure to the organization. The risk assessment results are captured in the audit management software as part of the planning process. Afterwards, a risk-based audit plan is generated and scheduled from the audit management software based on the information earlier captured in the solution. Most audit management solution have the features for risk assessment and audit planning/scheduling. In capturing the audit activities/plans for period, Auditors are expected to define the audit type of audit for each process that made it to the audit plan. Audit type examples are routine, adhoc, spot check, follow up, or special (investigation), etc. The audit type will determine the approach, resources, template and report formats that can be deployed to fulfill the audit.

After the above planning stages have been completed in the audit management software the Audit team will have to design/document its Audit Work Programs (AWP) or IT Audit Programs/Checklists , which should capture the identified risk areas (Risk Assessment Template) in the area being audited, exisitng controls that mitigate the identified risks, audit test procedures or Test of controls (TOC) that will be carried out to confirm that the controls implemented are adequate or otherwise, the severity of the risk in terms of ranking (critical, very high, high, medium or low). The developed audit work programs (AWP) can be uploaded into the audit management software using the template/format predefined solution, which will guide the audit team on how to about their work. The AWP serves as the working document for the audit team and will give insight into the extent of work and control testing performed by the audit team. Once the AWP is in place, then the audit can be scheduled and approved for commencement by the Audit Manager. On approval, the AWP becomes a live document that can be tracked both by the audit team and Audit Manager.The audit team populates the AWP in the audit software with their findings and root causes of the noted exceptions based on their observation of the issues in the field. Appropriate corrective actions or recommendations are also provided based on observations made. Thereafter, the audit client (i.e. auditee) then provided their responses to the issues raised during the audit as well as the root cause and remedial actions includig timelines work resolution. These responses can be fed into the audit management software if properly implemented. The audit management solution is usually integrated with the organization's Single SignOn solution (Windows active directory) and email infrastructure to ensure seemless interact and collaboration. Through the audit management solution, the audit client receives the audit issues/exceptions in their email and are expected to response through same within the timelines stipulated. Where the responses provided are adequate with a accurate account of the issues as captured by the audit team, the audit team can then conclude the audit and submit same for review and adjustment by the Audit Manager.

Audit Rating and Reporting

A robust audit management software provide a guide risk rating or ranking of issues noted in the audit depending on the way the solution was implemented and the risk methodology of the organization. There are several models or methodologies that can be adopted in determining the audit rating of an audit client. Some school of thought or models believe that each audit exception or non-conformity should be assigned a weighted score (or %) based on their severity. For instance, 5% for critical, 4% for high, 3 for medium, 2 for low, 1 for very low and 0 for effective control). The applicable scores for each exception or non-conformity are deducted from a maximum score of 100 while the remaining score after all deduction forms the final audit rating, which is usually banded. For example, above 70% is low risk (Good rating), 30 to 69.9% is medium risk (opportunity for improvement or average rating) while below 30% is high risk (poor rating). The best practice for audit rating requires that the various risk identified in each audit area be rated rather than rating the controls/exceptions. The weighted score of each of the risk associated with a given audit area determines the overall audit rating of audit client. Where the controls implemented to mitigate each risk is either adequate or inadequate, the audit team apportions a weighted score based on their opinion of control adequacy. Rating guide that could be adopted are Very high risk/very poor rating (0 -20%), high risk/poor rating (20-30%), medium risk/average rating (30-50%), low risk/good rating (50-70%), very low risk/very good rating (70-90%), no risk/outstanding (90-100%). The cumulative weighted score of each of the risk areas forms the audit rating for the client.

Most audit management software comes with pre-formatted reports that one can select from. There could also be flexibility in the solution for customized report to be built for the Internal Audit department in question. The report format will depend on what has been agreed and adopted by the Audit department with the software vendor at the point of implementation. Some of the reports come with cover memo, executive/issue summary, main/detailed report (with issues/findings, recommendations, root causes, closure timelines, correction action, etc.). Rating sheet, consequence management report, audit work papers and room to attach appendices, suporting audit evidence and more are some of the features of audit management solution.

Audit Documentation

Within the audit management software, audit documents generated by the audit team members such as audit working papers and risk assessment templates can be different states as stated below.

When the audit work is completed, the final report is then generated via the audit management software for management review and Chief Audit Executive's (CAE) final approval and circulation to the Board Audit Committee (BAC) members. Management review can either be done in the software or offline depending on the choice of the CAE. Once the audit report has been issue to the organization's management or BAC, the follow up process is kick-started automatically based on the due date. The team designated for this purpose drives the process and ensure that the timeline specified by the Audit Client for closure of the audit exceptions/non-conformities are adhered to and closed with a status report sent to the follow up team for documented and management review. This is pretty much what happens with audit management software and how an audit team can use audit management software to conduct audit assignments.