How To Use Audit Management Software for An Audit Engagement

Audit management software are used to automate the process of auditing. Most standard audit management software like Morgan Kai Internal audit management software or Wolters Kluwer, Teammate Audit Solutions come handy with good audit process automation. First, the Auditors need to define the audit universe for the audit. In the context of internal audit, the audit universe is basically the coverage and the mandate of the internal audit department as defined in its audit charter. Management and regulatory authorities would have authorized/empowered the internal audit department to cover all or certain areas of the organization's business, operations, processes and systems as part of its mandate to provide reasonable assurance on the effectiveness of controls implemented by the management to achieve business objectives. Hence the internal audit team defined its audit universe in the audit management software along the lines of its mandate from Executive management and regulatory compliance perspectives. For example, 2018 Financial Year (FY) Internal Audit Plan could be defined as the audit universe.

Definition of Audit Units

Secondly, the Audit Department defines the audit units or components, for example Strategic Business Audit, Subsidiary Audit, Branch/Regional Business Audit, Information Systems Audit, Retail Services Audit, etc., can be defined as the audit units under the audit universe as applicable. Thirdly, the Auditors should defined the audit type, which can either be routine, adhoc, spot check, follow up, or special (investigation) audit. The audit type will determine the approach, resources, template and report formats that can be deployed to fulfill the audit. Lastly, the audit area will need to be defined. Audit area for example can be Accounts and Financial control (FINCON) audit, Strategic Risk management audit, Treasury products and operations audit, Credit analysis and administration audit, Brand Assurance and Corporate communications audit, Foreign operations audit, physical security audit, Data center audit, IT Power and Infrastructure audit, Core Business Applications Audit, IT Operations and Infrastructure audit, Business Continuity Management and Disaster Recovery Assurance audit, Business Units among others..

After the above steps has been defined in the software (note: a robust audit management software should come with most of these features inbuilt), the Audit team will have to design its Audit Work Programs (AWP) or IT Audit Programs/Checklists for details on audit programs), which should capture the identified risk (Risk Assessment Template) in the area being audited, controls to mitigate the identified risks, audit test procedures or Test of controls (TOC) that will be carried out to confirm that the controls implemented are working as expected or otherwise, the severity of the risk (Critical/very high, high, medium or low). The AWP can be uploaded into the audit software in the form of a template predefined in a format that the audit team can conform with. After the AWP has been uploaded in the audit management software under a defined audit area, then the audit can be approved for commencement by the audit management. Once the audit work program has been approved. It becomes an active/scheduled audit in the audit management software based on the effective date of commencement of the audit assignment. The AWP is the working document for the audit team during the audit assignment. The audit team populates the AWP with their findings and root causes of the noted exceptions based on their observation of the issues in the field. Appropriate corrective actions or recommendations are also provided based on observations. Thereafter the audit client (i.e. auditee) then provided their responses to the issues raised during the audit as well as the root cause and remedial actions. These responses can be fed into the audit management software if properly implemented or integrated with the organization's active directory and email systems, which gives room for the audit clients to give their response directly into the audit software. Where the provided responses are adequate and provide accurate account of the issues as observed/captured by the audit team, the audit team can then conclude the audit and submit same for review and adjustment by the audit management.

Audit Rating and Reporting

A robust audit management software also provide guide on the rating of the audit clients. There are several models or methodologies that can be adopted in determining the audit rating of an audit client. Some school of thought or models believe that each audit exception or non-conformity should be assigned a weighted score (or %) based on their severity. For instance, 5% for critical severity, 4% for high severity, 3 for medium severity, 2 for low severity, 1 for very low severity and 0 for effective control). The applicable scores for each exception or nonconformity are deducted from a maximum score of 100 while the remain score after all deduction forms the final audit rating, which is usually banded for example, above 70% is low risk (Good rating), 30 to 60% is medium risk (opportunity for improvement or average rating) and below 30% is high risk (poor rating). The best practice for audit rating requires that the various risk identified in each audit area be rated rather than rating the controls/exceptions. The weighted score of each of the risk associated with a given audit area determines the audit rating of audit clients/auditee. Where the control(s) implemented to mitigate each risk is either adequate or inadequate, the audit team apportions a weighted score based on their opinion of control adequacy. Rating guide that could be adopted are Very high risk/very poor rating (0 -20%), high risk/poor rating (20-30%), medium risk/average rating (30-50%), low risk/good rating (50-70%), very low risk/very good rating (70-90%), no risk/outstanding (90-100%). The cumulative weighted score of each of the risk areas forms the audit rating for the client.

A good audit management software comes with pre-formatted reports and the report format will depend on what has been agreed and adopted by the Audit department with the software vendor at the point of implementation. Some of the reports comes with cover memo, executive/issue summary, main/detailed report (issues/findings, recommendations, root causes, closure timelines, etc.), rating sheet, consequence management report and audit work papers (i.e. AWP and appendices of audit evidences).

Audit Documentation

It is important to note that the audit template or what I call the AWP, which has been uploaded into the audit management software and used for the real audit field work can be in different states in the audit management software.

  • State I: In-Development (Offline)
  • State II: Under-review
  • State III: Active (Live)
  • Depending on the state, any member of the audit team assigned to carried out a given audit (audit area) can work on each of the AWPs or audit checklists at any time. All they need to do is to first checkout the audit work program or checklist (i.e. checking out active AWP into In-development state). While In-development state, the audit team can work on different versions of the AWP or audit checklist for a given audit area. After working on the AWP or checklist while In-Development state, the Auditor can check-in the program to become Active or Live in the software, which become the final version at any given time except updated. As such, the audit team members have the opportunity to do back-and-forth (i.e. amend/change) on their AWP or audit checklists till they agree on the final version that will be relevant for the job. Once they have agreed, the team lead can change the state of the final version by checking it in to become "Active" or send same to his/her superior for approval (i.e. "Under-review" state). Once reviewed and approved, it is then checked-in as the final version (i.e. "Active" state).

    When the audit work is completed, the final report is then generated via the audit management software for management review and Chief Audit Executive's (CAE) final approval and issue. The management review can either be done in software or offline depending on the choice of the CAE. Once the audit report has been issue to the organization's management or Board Audit Committee, the follow up process is kick-started. The team designated for this purpose is drive the process and ensure that the timeline specified by the Audit Client for closure of the audit exceptions/non-conformities are adhered to and closed with a status report sent to the follow up team for documented and management review. This is pretty much what happens with audit management software and how an audit team or auditors can use audit management software to conduct an audit.

    Nwabueze Ohia

    (Tech Blogger and Author)

    Will appreciate your questions and contributions on this post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at

    Back To Information and Cyber Security Jobs

    Learn More About Our Valuable IT Audit Programs/Checklists

    Learn More About Our Valuable Risk Assessment & Treatment Templates

    Learn More About Leading Practices in Internal Audit Function

    Popular Articles

    Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
    Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)...Learn More
    Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
    Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application..Learn More
    Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
    Privilege access mgt is one of the critical elements of user access mgt for every organization & building controls around them is vital for security of information/IT assets.Learn More
    Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised dailyLearn More
    Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobileLearn More

    IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia

    Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
    IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
    Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
    Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now

    Let us know your thoughts post. Leave a Comment below.