Page 326 - Accounting Best Practices

c15.qxd 7/31/03 3:27 PM Page 315
315
15–9 Create a Control Standards Manual
meet the upcoming schedule to work on the next audit, rather than to complete
the one currently being conducted. This results in a long trail of incomplete
audits that requires constant badgering by senior management to complete these
audits, frequently requiring weekend work by the internal audit teams. To avoid
this problem, the standard procedure for all internal audits should be that the
work papers be fully completed in the field before an internal audit team is
allowed back to the main office or to proceed to the next audit. Work paper com-
pletion should include the clearing of all points that arose during the audit, as
well as producing the draft report. If this results in delays in the completion of
subsequent internal audits, then fine—it will also yield much more rapid comple-
tion of the final audit reports, which was the objective when the audits were
scheduled. This point can be made to the audit teams more convincingly by issu-
ing even a small bonus for all the internal audits that are wrapped up in the field.
Cost: Installation time:

15–9 CREATE A CONTROL STANDARDS MANUAL

Auditors are trained to have a good idea of which control standards should be
attached to a business process. However, the managers who supervise those
processes typically have no idea of which controls are involved. This can result in
inadvertent changes to processes by managers who are simply trying to devise
more efficient systems, which in turn results in adverse findings by auditors when
they conduct reviews.
A reasonable way to avoid this problem is to create a control standards man-
ual for use by process managers. The manual should note the internal control
objectives to be met for each business process, as well as the specific procedures
used to meet those objectives. The manual can also note how different control
points support each other, and what happens when specific controls are removed
from the process. The manual can include flowcharts of the processes, noting
each control point, as well as forms used in the process. Any reports arising from
a process should be noted, describing what information managers should review
that can bolster the control objectives. Clearly, this can be an exceedingly dry
document (except to internal auditors!), so an audit staff person should walk
managers through the manual to highlight its key points. Also, whenever an audit
team arrives for any type of review, they should always bring with them the latest
version of the control standards manual, making a point of highlighting key
changes to it. Only by this constant emphasis on the importance of the manual
will managers take the time to review and understand it.
Cost: Installation time: