Auditing Tips - Writing an Effective Risk-Based Internal Audit Program

If you're like most auditors out there, creating an auditwork program should broadly follow the flow and
work program from scratch is a daunting task, evenmethodology of a typical risk-based internal audit
under the best of circumstances. Striking the balanceengagement. In terms of methodology, most internal
between summary and detail while at the same timeaudits generally follow an iterative series of steps that
trying to satisfy the idiosyncratic likes and dislikes ofapproximate the following:
your boss can be truly challenging to say the least.1. Understand and document the processes and
Rest assured, however...you're not alone. Creating anprocedures of the function or area being audited.
effective audit work program takes years of practice2. Define the objectives of the area or function being
and experience. Fortunately, there are many auditorsaudited.
out there that have traveled down this path before3. Define the risks or threats to the achievement of
and can lend you the benefit of their expertise, savingthose objectives.
you valuable time and needless frustration. Having said4. Understand the controls in place to mitigate the risks
this, there is one thing that most senior auditor-typesto an acceptable level or the control weaknesses that
will agree on: Having an effective framework andexist in support of the risk.
some sound advice at your fingertips can go a long5. Test the controls for adequate design and operating
way towards consistently generating high-qualityeffectiveness and/or quantify the impact of control
risk-based internal audit work programs.weaknesses or gaps.
Let's start with a general discussion about the purpose6. Report your findings and offer recommendations for
and objective of an audit work program in order tocontrol and/or operating efficiency improvements.
clarify the goals that you are hoping to achieve. An7. Monitor and report managerial mitigation efforts for
internal audit work program is used to guide you orcontrol weaknesses identified that were outside of
your staff through the audit process and ensuremanagement's risk tolerance level.
thorough and complete coverage and documentationThese processes or steps generally fall into one of
of the audit itself. In general, it should illustrate thefour buckets or stages typically associated with the
overall work performed, the work paper referencesinternal auditing process; Planning, Fieldwork, Reporting,
for any applicable support papers, the person whoand Follow-Up. Aligning the activities within your audit
performed the work, the person who approved theprogram with these categories and steps will help to
work, and any applicable summarization notes neededensure thorough and diligent completion of the entire
to clarify points and/or results along the way. As aaudit cycle.
general guide, the individual steps or actions to yourRemember, too, that the audit work program is only a
audit will be laid-out down the left-hand column of yourguide and is not intended to be a static document. The
program and the work paper references, auditor initialsactivities and tests that you perform throughout the
approvals, and any summary notes will be representedaudit cycle are bound to deviate from the original plan
by subsequent columns, creating a matrix or table-likebased on the results of your audit work. Don't be
effect for your program. For this reason, many workafraid to stray off the path as long as you evaluate
programs are often created in table or spreadsheetyour activities in light of your overall objectives, maintain
formats like Microsoft Word or Excel.perspective on your resource limitations, and
Next, let's address the general framework andcommunicate the nature of your activities to your
methodology of the generic audit program. Your auditsupervisor or manager.