Acquiring Knowledge of Business
The early stage of planning a performance audit requires that auditors develop a sound understanding of the nature, objectives, and activities of the organization or organizations that will be audited. This involves obtaining basic information on an organization’s mandate, organizational structure, accountability relationships, programs, resources, key risks, past performance, and so on. It also means gathering more detailed information on specific systems and practices in areas that auditors are particularly interested in, including oversight.
At this stage, if not already done during the audit selection process, auditors interested in auditing the oversight of a critical program, project, or service would be expected to clearly document what aspects of the selected initiative make it an especially important one that requires strong oversight:
- Is the initiative a high-risk one?
- Is it a key government-wide initiative?
- Does it involve large sums of public money?
- Has the initiative’s implementation been delegated to a private sector provider?
- Is the initiative of primary importance to a large proportion of citizens?
In addition to determining why the selected initiative is particularly important, auditors will need to have a clear understanding of key targets, performance expectations, and outcomes for this initiative. Knowing this will be important for auditors who intend to audit how the department oversees the initiative’s performance and takes corrective actions when performance issues arise.
Auditors will also need to obtain information on the structures and processes put in place to govern and oversee the selected initiative. Table 9 provides a list of questions that will help auditors gather information on oversight structures and systems, while Table 10 provides a list of questions about their results and effectiveness.
At this stage of the audit process, auditors can ask questions that will provide them with an overview of an initiative’s oversight regime without requiring them to conduct extensive research and file reviews. Auditors typically ask more detailed questions that would require in-depth review and testing of evidence in the audit’s examination phase.
|
Table 9 – Knowledge of Business: Questions on Oversight Structures and Systems
|
|---|
- What structure has been put in place to govern and oversee the selected major initiative (program, project, or service)? How many senior officials are part of this structure? What are their respective positions within the department?
- Has the government or department formally provided the oversight body with clear performance expectations and information on the key outcomes to be achieved?
- Are there terms of reference (or a similar document) that define the oversight body’s mandate and the specific roles and responsibilities of its members? Does the mandate include clear authority to conduct specific oversight functions? What are these oversight functions and how are they conducted?
- Are there independence requirements for the oversight body and its members? Are the members of the oversight structure also involved in the day-to-day management of the selected initiative? Are there processes in place to manage conflicts of interest and other threats to independence?
- How often do the oversight body’s members meet? Are records of those meetings kept on file?
- What information does the oversight body need to make informed decisions (business case, expected benefits, targets, baselines, timelines, etc.)? Have those needs been documented and communicated to managers of the selected initiative? What systems has management put in place to help produce the required information?
- Is the oversight body’s performance in fulfilling its roles and responsibilities periodically assessed?
- To whom is the oversight body accountable? What accountability reports and information does it provide?
- What resources are allocated to the oversight body each year? Are there significant resource gaps?
|
|
Table 10 - Knowledge of Business: Questions on Results and Effectiveness
|
|---|
- Is the oversight body receiving the information it requests from the management of the selected initiative? Is this information of good quality?
- How does the oversight body obtain assurance that the selected initiative is in compliance with laws, regulations, bylaws, and the organization’s code of ethics? Is compliance regularly monitored?
- Has the oversight body ensured that adequate risk management practices exist for the selected initiative? Is the oversight body aware of the key risks facing the initiative? Are risk profiles and risk mitigation strategies prepared by initiative managers regularly reviewed by the oversight body?
- Is there a process in place for the oversight body to monitor the implementation of recommendations of internal audits and evaluations related to the selected initiative? Are actions taken in response to the recommendations of internal audits and evaluations?
- Can the results of important oversight activities or functions be measured? Is there a monitoring system in place? Is performance information available? How is performance data gathered, used, and reported?
- What performance information is reported by the oversight body to fulfill its accountability responsibilities? Is the information reported complete, accurate and transparent? That is, do the reports include sufficient information for readers to be able to understand key results and evaluate performance?
- Does the oversight body periodically evaluate its performance in discharging its oversight roles and responsibilities?
|
Completing the knowledge of business part of their audit planning will help auditors to draw an overall picture of the oversight of their selected initiative. It will also help them determine what the most important oversight functions are and why. Equipped with this information, auditors will be able to start considering where the audit could fall on the spectrum of audits of oversight.
In addition to drawing inspiration from the questions included in Table 9 and Table 10, auditors can use the overall oversight framework presented in Figure 12 as a reference or when developing their knowledge of business questions.
Figure 12
Overall Oversight Framework for A Major Initiative
LinkedIn
Twitter