The Operational Auditing Handbook: Auditing Business and IT Processes, Second Edition By Andrew Chambers and Graham Rand 2010 John Wiley & Sons, Ltd Appendix 2 Standard Audit Programme Guides USE IN RELATION TO BUSINESS PROCESSES A Word version of this appendix is to be found in the Tools directory of the material available on a password protected website accompanying this Handbook, with the filename Process.doc. The password protected website contains a Word format Standard Audit Programme Guide for each of the approximately two hundred business activities listed in this Appendix. The standard set of Standard Audit Programme Guides (SAPGs) is subdivided into a number of separate Activities or Systems, each of which is capable of free-standing audit use. However, most of these systems do not operate in complete isolation and have both potential and actual bearing upon other systems. For example, Purchasing activities have a positive connection with Accounts Payable, with the order data from the former having a payment implication for the latter. Whether or not the SAPGs are used in isolation is partly a matter for how audit management perceives their universe of discrete audit projects, but it is likely that the control effectiveness of these separate systems will be dependent upon the flow of data and materials to and from other systems. On the final page of each SAPG we have provided a simple table which aims to plot the potential input and output interfaces with other systems. This table can be used to suggest which other systems may have to be reviewed to form a wider impression of control effectiveness. It is often at the point of interface between systems and activities where the controls are weakest. It is logical therefore that where there are doubts about the integrity of controls within the primary system, an examination of the knock-on effects within the related systems may be justified. A systems approach can be supported by the use of individual SAPGs with the added flexibility of using a number of related system SAPGs in combinations to provide wider coverage and take into account related issues and implications. This flexibility lets the user establish the breadth of focus applicable to the specific scenario taking into account the audit findings relative to an SAPG system. However, there are further possible ways of combining individual SAPGs in order to
720 THE OPERATIONAL AUDITING HANDBOOK reflect larger associations of related systems, activities or economic events. Such combinations may be referred to as Business Processes. In the attached analysis we have utilised six categories of Business Process, as follows: Treasury Revenue Expenditure Conversion Financial Reporting Corporate Framework The first four process categories (which are defined below) are built around a range of related economic events which may in turn generate transactions and interactions with systems. Treasury Process: This process incorporates those activities concerned with an organisation s capital funds. These activities may include, inter alia, definition of cash requirements, allocation of available cash to various operations, investment considerations and the outflow of cash to investors and creditors. Revenue Process: This category is related to those activities that exchange the organisation s products and services for cash, and therefore include, inter alia, the following elements: credit granting, order entry, delivery/shipping, billing, accounts receivable and pursuing debtors. Expenditure Process: This process could be defined to include those activities/systems that acquire goods, services, labour and property; pay for them; and classify, summarise and report what was acquired and what was paid. Conversion Process: In this context, the term conversion relates to the utilisation and management of various resources (i.e. inventory stock, labour, etc.) in the process of creating the goods and services marketed by the organisation. The key issues in this cycle include accountability for the movement and usage of resources up to the point of supply which is then dealt with in the Revenue Process. Conversion Process activities include product accounting/costing, manufacturing control and stock management. The fifth category (Financial Reporting) is not based upon the basic processing of transactions reflecting economic events, but concentrates upon the crucial consolidation and reporting of results to various interested parties (for example management, investors, regulatory and taxation authorities). The last category (Corporate Framework) incorporates those activities concerned with the development and maintenance of effective management, strategic, infrastructure and control frameworks which should aim to give form to the underlying direction, structure and effectiveness of an organisation. This category can also include issues such as specific industry regulations and compliance. It should be noted that there is likely to be selective interaction between the defined processes, for example the general management of cash is one of the key issues of the Treasury Process, but the Revenue Process is associated with cash receipts and the Expenditure Process will involve cash disbursements. In instances where a particular system or activity has a relevance to more than one of the named
STANDARD AUDIT PROGRAMME GUIDES 721 processes, we have differentiated between the Main (or primary) and Secondary relationships by the use of a large emboldened M and a regular S respectively on the attached analysis. This discrimination is intended to further assist users in selecting the appropriate combinations of SAPGs which can readily support the structural objectives of their adopted audit universe approach. 1. & Administration The Control 0101 M Environment Organisation 0102 S M 0103 M S Information Planning 0104 M Risk 0105 S S S S M Legal Department 0106 M Quality 0107 S M Estates 0108 S S M & Facilities Environmental 0109 S M Issues Insurance 0110 S S M Security 0111 M Capital Projects 0112 M S S Industry 0113 M Regulations and Compliance Media, Public and External Relations 0114 M Company Secretarial Department 0115 S M
722 THE OPERATIONAL AUDITING HANDBOOK 2. Financial and Accounting Treasury 0201 M S S Payroll 0202 S M S Accounts Payable 0203 S M S Accounts Receivable 0204 S M S S General Ledger/ Accounts 0205 M S Fixed Assets (and 0206 S M S capital charges) Budgeting and 0207 S S S S M Monitoring Bank Accounts & 0208 M S S S S Banking Arrangements VAT Accounting 0209 S S M (where applicable) Taxation 0210 S S S M S Inventories 0211 S S S M Product/Project 0212 S S S M M Accounting Petty Cash & 0213 M S S Expenses Financial 0214 S S S S M S Information and Reporting Investments 0215 M S S S 3. Personnel Human 0301 S S M Resources Department Recruitment 0302 S M Manpower & Succession Planning 0303 S M
STANDARD AUDIT PROGRAMME GUIDES 723 Staff Training and Development 0304 S S M Welfare 0305 S M Performancerelated 0306 S S M Compensation, Pension Schemes (and Other Benefits) Health Insurance 0307 S M Staff Appraisal & 0308 M Disciplinary Matters Health & Safety 0309 M Labour Relations 0310 M Company Vehicles 0311 S M 4. Procurement Purchasing 0401 S M S S 5. Stock and Materials Handling Stock Control 0501 S S M S S Warehousing/ 0502 S S M S S Storage Distribution, Transport and Logistics 0503 M S S S S 6. Production/Manufacturing Planning & 0601 S M S Production Control Facilities, Plant 0602 S S M S S and Equipment Personnel 0603 S M S Materials and Energy 0604 S M S
724 THE OPERATIONAL AUDITING HANDBOOK Quality Control 0605 S M Safety 0606 S M Environmental 0607 S S Issues Law and 0608 M Regulatory Compliance Maintenance 0609 S M S 7. Marketing & Sales Product 0701 S S S S M Development Market Research 0702 S M Promotion and 0703 S S M Advertising Pricing and 0704 M S S Discount Policies Sales 0705 M Sales 0706 M S S Performance and Monitoring Distributors 0707 M S Relationship with 0708 S S S S M Parent Company Agents 0709 M S Order Processing 0710 M S S 8. After Sales Support Warranty 0801 M S S Arrangements Maintenance and 0802 M S S Servicing Spare Parts and Supply 0803 M S S S 9. Research and Development Product Development 0901 S S S S M
STANDARD AUDIT PROGRAMME GUIDES 725 Project Appraisal and Monitoring Plant and Equipment Development Project Legal and Regulatory Issues 0902 S S S S M 0903 S M S S 0904 S S M 0905 S S M 10. Information Technology IT Strategic Planning 1001 S S M IT Organisation 1002 S M IT Policy 1003 S S M Framework Information Asset 1004 S M Register Capacity 1005 S S M Information 1006 S S M (IM) Records 1007 S S M (RM) Knowledge 1008 S S S M (KM) IT Sites and 1009 S M Infrastructure (including physical security) Processing 1010 S S S S S M Operations Back-up and 1011 S S S S S M Media Removable Media 1012 M
726 THE OPERATIONAL AUDITING HANDBOOK Systems/ Operating Systems (including patch management) System Access Control (or logical security) Personal Computers (including laptops and PDAs) 1013 M 1014 S M 1015 M Remote Working 1016 M Email 1017 M Internet Usage 1018 M Software 1019 S M Maintenance (including change management) Networks 1020 M Databases 1021 S M Data Protection 1022 S M Freedom of Information 1023 M Data Transfer & 1024 S M Sharing (Standards and Protocol Guidelines) Legal Responsibilities 1025 M Facilities 1026 S S M System 1027 S M Development Software 1028 M Selection Contingency 1029 M Planning Human Resources Information Security 1030 M
STANDARD AUDIT PROGRAMME GUIDES 727 Monitoring and Logging Information Security Incidents Data Retention & Disposal Electronic Data Interchanges 1031 M 1032 M 1033 M 1034 S S S S S M Viruses 1035 M User Support 1036 M BACS 1037 S S S M Spreadsheet 1038 S M Design & Good Practice IT Health Checks 1039 M IT Accounting 1040 M S 11. Contracting Contract 1101 S S S S M Environment Project 1102 M Framework Project 1103 S S S M Assessment and Approval Engaging, Monitoring & Paying Consultants 1104 S M Design 1105 S S M Assessing the 1106 S M Viability/ Competence of Contractors Maintaining an Approved List of Contractors 1107 S M Tendering Procedures 1108 S S M
728 THE OPERATIONAL AUDITING HANDBOOK Contract & Tendering Documentation Insurance and Bonding Selection & Letting of Contracts Information & Reporting Performance Monitoring Arrangements for sub-contractors and suppliers Materials, Plant & Project Assets Valuing Work for Interim Payments Controlling Price Fluctuations Monitoring & Controlling Variations Extensions of Time Controlling Contractual Claims Liquidations & Bankruptcies Contractor s Final Account Recovery of Damages Review of Project Outturn & Performance Maintenance Obligations 1109 M 1110 S M 1111 S M 1112 M S 1113 S S S M 1114 S M 1115 S M S S 1116 S M S S 1117 S M S S 1118 M S 1119 S S S M 1120 S S S M 1121 S S S S M 1122 S M S S 1123 S S S M 1124 S S S S M 1125 S M