Page 331 - Accounting Best Practices

c15.qxd 7/31/03 3:27 PM Page 320
Internal Auditing Best Practices
320
It can also inform each approver of the date by which approval must be obtained.
The system can also keep track of when each document was made, by whom, and
when it was subsequently reviewed and approved. Reviewers can also create
review notes that are attached to the electronic audit documents and that must be
cleared by the audit team before the work papers will receive final approval.
Workflow software can also maintain a database of previous audit work at each
company location, as well as the results of that work, so that subsequent audit teams
can review the prior work to see what efforts can be avoided in the future. Of partic-
ular importance is a risk assessment by prior audit teams, so one can immediately
see where the bulk of new audit work should be directed. The system can also be
used to summarize audit issues across all business units, thereby giving audit man-
agers visibility into broader risk issues that must be addressed on a continuing basis.
The initial cost of audit workflow software exceeds $100,000 (depending on
the configuration and number of seat licenses) and requires significant customiza-
tion and installation time. An example of this software is Audit Assistant, which
can be viewed at www.auditorassistant.com.

Cost: Installation time:

15–16 ADD SPECIALISTS TO AUDIT TEAMS
A typical internal auditor has received training in a standard set of auditing func-
tions that apply to the activities encountered in the majority of audits. However,
specialized processes will be scheduled for audits from time to time for which the
internal audit staff has received no training. This may arise when a business
process has been specially modified or enhanced at one or a few company loca-
tions, and the internal audit staff is unfamiliar with the modifications or their
impact on controls. These audits can be difficult, since the internal auditor must
spend time learning the new or revised process and determining any resulting
changes to the control environment.
A better approach is to invite specialists to an audit to deal with these
processes. A good person to invite is someone who has personally been involved in
the implementation of a particular system at a different location, and who, there-
fore, is an expert on the process under review. This person is particularly useful if
the intent of the audit is to recommend the implementation of the system in which
the person is an expert, since he or she can offer valuable implementation tips to the
local management team in regard to installing the system. Once the audit is over,
the audit team disbands, with the specialist returning to his or her business unit.
This person may be used again at a later date, or the internal auditors can learn
enough from the specialist to take that person’s place on subsequent audits.
Cost: Installation time: