Page 321 - Accounting Best Practices

c15.qxd 7/31/03 3:27 PM Page 310
Internal Auditing Best Practices
310
The glaring exception to the low-cost rule is the use of workflow software,
which can easily cost well into the six figures and also require a considerable
amount of time to install, which may put it out of reach of most smaller internal
auditing departments.
One best practice is to outsource the internal audit department, though all the
other recommendations in this chapter assume that the department will be
retained. Outsourcing is only useful in those cases where a company does not feel
that internal auditing is a core company function, and where it either can afford
the substantially increased cost of shifting this area to an outside audit firm or
where it conducts so few internal audits that it requires less than one full-time
person to conduct the work.
Consequently, with few exceptions, implementing the best practices in this
chapter can result in significant improvements not only in the usefulness of the inter-
nal audit department, but also in the efficiency with which it conducts its operations.

15–1 ANNUALLY UPDATE AN INTERNAL CONTROL
ASSESSMENT OF EACH BUSINESS UNIT

It is not uncommon for an internal audit department to continually send its auditors
into the field with instructions to review whatever was done in the work papers
from the year before, thereby bringing continual attention to the same risks, year
after year. Though this approach certainly informs those being audited of the
areas requiring strong controls, it does not account for changes in the business
that may require different audit work.
An alternative is to periodically create a formal internal control assessment
document, both for the entire company and for individual business units. This
document points out changes in the business and how they will impact controls,
as well as the status of existing controls and why those controls are needed. This
document can then be sent to the senior management team to promote their
understanding of emerging control issues, as well as to business unit managers,
who will therefore have a greater understanding of which controls are likely to be
subject to review by internal audit teams. Of particular importance to the audit
manager is this document’s usefulness in determining how control reviews must
change from year to year in order to schedule more effective audits.
This document will require a substantial amount of time to prepare and revise,
but the time investment is easily offset by the greater understanding of control issues.

Cost: Installation time:

15–2 ISSUE SELF-AUDIT GUIDES TO BUSINESS UNITS

Many of the best practices noted in this chapter involve the conversion of the
internal audit staff from reviewers of controls to advisors who impart knowledge