Page 332 - Accounting Best Practices

c15.qxd 7/31/03 3:27 PM Page 321
321
15–18 Assign Internal Auditors to System Development Teams
15–17 ASSIGN AN AUDITOR TO BE A RELATIONSHIP MANAGER
WITH EACH BUSINESS UNIT
The internal audit department rarely has visibility into the work of individual
business units. The unit managers typically revise their own systems on an ongo-
ing basis in order to streamline processes, and never think to check with the inter-
nal audit staff for advice on these changes. Also, the internal audit department has
access to a wealth of information about how other business units structure their
processes, but rarely has an opportunity to relay this information to business unit
managers, resulting in many lost opportunities for improvements.
Both of these issues can be avoided by assigning a senior internal auditor to
the role of relationship manager with the manager of each business unit. This per-
son is responsible for communicating regularly with an assigned manager, not
only to impart improvement information but also to find out which activities at
the business unit should involve the participation of the internal audit staff. For
example, if a business unit is considering programming a new accounts payable
system, the relationship manager can ask that an auditor be assigned to the design
team to ensure that appropriate controls are built into the system. This approach
is also an excellent means for improving relations between the internal audit
department and the rest of the company.

Cost: Installation time:

15–18 ASSIGN INTERNAL AUDITORS TO SYSTEM
DEVELOPMENT TEAMS

When a company’s software development staff creates a new business system,
either the accounting staff or the external auditors find control problems after the
fact that require either significant programming changes or major modifications to
other systems that must now be relied upon as secondary controls that offset the
problems found. Some of these problems are so severe that entire systems must be
scrapped or entirely reworked. The worst case is when a control weakness is spot-
ted by someone who exploits it to fraudulently part a company from its assets.
Many of these control problems can be eliminated by making an internal
audit person an integral part of a systems design team. By regularly reviewing the
conceptual and detailed designs of new systems, internal auditors can spot poten-
tial control problems before any significant programming time has been spent on
them. This not only achieves a higher level of control in new systems, but also
avoids the time that would otherwise be spent on correctional changes to systems
at a later date. Proper use of this best practice requires the involvement of audi-
tors with significant systems design and controls knowledge.

Cost: Installation time: