Chapter 5:
Audits were scheduled after a comprehensive risk assessment of the entire organization was performed. Thus, the internal auditing organization tried to ensure that important risks were being addressed. Douglass said he wished the FBI worked that way, instead it was forced to constantly react to emergencies.
The first thing you do when you are assigned an internal audit or an external audit is to set audit objectives. This task is what makes it an audit and not a fishing expedition. Generally, the audit objectives of an internal audit will correspond to the type of audit: operational, financial, or compliance. After the audit objectives are known, then a preliminary survey is done to understand as much about the auditee’s operations as possible. This survey entails interviewing key employees, observing operations, and reading or examining documents and records. When the preliminary survey is completed, then an audit program is written, listing the audit procedures that will be done during the audit. A budget is then estimated based on the audit program. For large, public companies a brainstorming session is required.
Once they have completed the audit tests, the auditors can review the evidence gathered and reach conclusions which are then reported to management.
Once the report is issued and managements responds, then a follow-up visit is made to ensure that the issues identified in the audit report are addressed.
Walker told Douglass that the modern internal auditing profession was only 50 years old. In 1941, the institute of Internal Auditors or IIA was founded in New York City. The IIA is currently headquartered in Altamonte Springs, Florida, near Orlando. This global organization has over 60,000 members representing nearly every nation. Over half of the members are from outside North America.
The IIA represents the internal auditing profession by