Module 4 - Introduction to Performance Audit_4B
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Internal audi<strong>to</strong>rs must develop and document a plan for each engagement, including the<br />
engagement’s objectives, scope, timing, and resource allocations. The plan must<br />
consider the organization’s strategies, objectives, and risks relevant <strong>to</strong> the engagement.<br />
2201 – Planning Considerations<br />
In planning the engagement, internal audi<strong>to</strong>rs must consider:<br />
<br />
<br />
<br />
<br />
The strategies and objectives of the activity being reviewed and the means by which<br />
the activity controls its performance.<br />
The significant risks <strong>to</strong> the activity’s objectives, resources, and operations and the<br />
means by which the potential impact of risk is kept <strong>to</strong> an acceptable level.<br />
The adequacy and effectiveness of the activity’s governance, risk management, and<br />
control processes compared <strong>to</strong> a relevant framework or model.<br />
The opportunities for making significant improvements <strong>to</strong> the activity’s governance,<br />
risk management, and control processes. 48<br />
For external audi<strong>to</strong>rs, ISSAI 3000/96-105 provides standards for planning performance<br />
audits and may be summarized as follows:<br />
<br />
<br />
<br />
<br />
<br />
<br />
<br />
The plan should support quality and timely results.<br />
The audit should be considered as a project requiring “organizing, securing,<br />
managing, leading, and controlling resources <strong>to</strong> achieve specific goals.”<br />
The audi<strong>to</strong>r needs sufficient background knowledge which generally requires initial<br />
research “for building knowledge, testing various audit designs and checking whether<br />
the necessary data are available” (acquired through the pre-study).<br />
<strong>Audit</strong> responsibilities should be clearly assigned.<br />
<strong>Audit</strong> plan and procedures should be designed <strong>to</strong> gather “sufficient and appropriate<br />
evidence” based on the objectives and develop timely and relevant findings,<br />
conclusions, and recommendations.<br />
The plan and procedures should be flexible <strong>to</strong> respond <strong>to</strong> insights gained.<br />
“<strong>Performance</strong> audit is a learning process involving adaptation of methodology, as<br />
part of the audit itself.”<br />
<strong>Audit</strong> plan, procedures, objectives, and criteria should be approved by the supervisor<br />
as part of quality control. 49<br />
<strong>Performance</strong> <strong>Audit</strong> Pre-Study<br />
The pre-study is used <strong>to</strong> ensure the audi<strong>to</strong>r has sufficient information <strong>to</strong> plan and manage<br />
the engagement. Implementation Guidance 2201 – Planning Considerations suggests a<br />
survey may be useful at the planning stage of an internal audit engagement.<br />
Internal audi<strong>to</strong>rs can plan effectively for an engagement if they start with an<br />
understanding of the mission, vision, objectives, risk, risk appetite, control environment,<br />
governance structure, and risk management process of the area or process under<br />
48<br />
The International Professional Practices Framework, The IIA, 2016.<br />
49<br />
ISSAI 3000 <strong>Performance</strong> <strong>Audit</strong> Standard, INTOSAI, 2019.<br />
30