Engagement planning, work programs and the final report

• Plan an engagement with a documented risk assessment, objectives, scope and criteria
• Build a work program that meets Standard 13.6
• Evaluate and rate findings using root cause and significance
• Draft a final communication that meets Standard 15.1 and set up follow-up

Planning (Principle 13)

Communicate early. Standard 13.1 requires internal auditors to communicate the objectives, scope and timing to management and to tell management promptly about later changes.

Engagement risk assessment. Standard 13.2 requires an understanding of the activity under review: its strategies, objectives and risks, the organization’s risk tolerance if set, the risk assessment behind the plan, the governance, risk management and control processes, and the frameworks or criteria that apply. Then identify potentially significant risks, consider fraud risks specifically, and prioritize them. If a prior engagement already identified the risks, a review and update is enough.

Objectives and scope. Standard 13.3 requires documented objectives and a scope that names the activities, locations, processes, systems, time period and other elements covered. Scope limitations (for example, restricted access to data or people) must be discussed with management, and if unresolved, the CAE takes them to the board. The CAE approves the objectives and scope and any changes during the engagement.

Criteria. Standard 13.4 requires the most relevant criteria. If management’s criteria are adequate, use them; if not, identify appropriate criteria with the board or senior management. For a SOX-related engagement, the criteria are usually the control descriptions in the RCM and the COSO framework the company uses for its ICFR assessment.

Work program. Standard 13.6 requires a documented work program that identifies the criteria for each objective, the tasks, the methodologies including analytical procedures and tools, and the auditors assigned to each task. The CAE must review and approve the work program before it is used and approve later changes promptly.

Fieldwork (Principle 14)

Gather information that is relevant, reliable and sufficient, compare the condition to the criteria, and document potential findings. Standard 14.3 requires internal auditors to evaluate each potential finding for significance, to collaborate with management to identify root causes when possible, to determine potential effects, and to consider likelihood and impact. A significant risk exposure must be documented and communicated as a finding. Findings are prioritized using the CAE’s methodology.

Standard 14.6 requires documentation that would let an informed, prudent internal auditor repeat the work and reach the same results. Internal auditors and the engagement supervisor review it, and the CAE approves it.

Reporting (Principle 15)

Standard 15.1 requires a final communication for each engagement that includes objectives, scope, recommendations or action plans where applicable, and conclusions. For assurance engagements it must also include:

• the findings with their significance and prioritization;
• an explanation of any scope limitations;
• a conclusion on the effectiveness of the governance, risk management and control processes reviewed.

It must name the individuals responsible for addressing findings and the planned completion dates, acknowledge actions management already took, be reviewed and approved by the CAE before issue, and go to parties who can ensure the results get due consideration.

Follow-up

Standard 15.2 requires internal auditors to confirm implementation using an established method: inquire about progress, perform risk-based follow-up assessments, and update a tracking system. If management misses dates, internal auditors obtain and document an explanation and discuss it with the CAE, who decides whether senior management has accepted a risk beyond tolerance. Under Standard 11.5, unresolved unacceptable risk goes to senior management and then to the board.

A finding that holds up

Write each finding with the four elements reviewers expect:

• Criteria: what should happen (policy, control description, regulation).
• Condition: what you found, with numbers.
• Cause: the root cause agreed with management.
• Effect: the risk or impact, tied to significance.

Then the recommendation or management action plan, owner and date.

Vendor master data engagement at Elmstead Foods, Inc.