Acquiring Knowledge of Business and Assessing Risk

Auditing procedures typically require auditors to acquire knowledge of the organization and subject matter being audited and to prepare a risk-based audit plan. In practice, this means that the audit team needs to:

• collect knowledge of business information about the governance structure of selected agencies, boards or authorities, especially their oversight bodies and functions, and

• identify significant areas that would benefit from an examination of oversight.

As in all performance (value-for-money) audits, the auditor’s understanding of significance and risks will be used to identify particular programs or areas to include in the audit and to develop audit objectives. This section of the Practice Guide is designed to help auditors acquire a sound understanding of significance and risks by providing them with examples of:

• general audit questions that can be used to better understand oversight roles and responsibilities in public sector organizations and

• indicators that oversight may be at risk in a program, project, or organization.

While these tools will be helpful to auditors, they should keep in mind that the Practice Guide does not foresee all possible situations. Applying professional judgment and knowing the particularities of each selected organization are key success factors for the planning phase of any audit of oversight.

• PreviousPlanning an Audit of Oversight of a Public Agency, Board or Authority
• NextAcquiring Knowledge of Business