Audit Tips

December 18, 2019

   Audit Tips   

Assessing risk is an important task when selecting the most significant oversight issues to audit. You can review the information gathered early in the audit (governance structure, minutes of board or committee meetings, and so on) and determine whether it can help you identify indicators that oversight of the selected project, program, or service may be at risk.

Here are some common indicators that oversight may be at risk.

	A wholesale change of oversight body members took place or turnover is very high.
	The oversight body does not (or rarely) question and challenge the managers of the overseen initiative.
	The chair of the oversight body is overdominant at oversight meetings.
	Conflicts of interests are a frequent occurrence among the members of the oversight body and/or actions taken to manage known conflicts of interest are not documented.
	Oversight body members are involved in the day-to-day management of the overseen initiative or there is no segregation of duties between the oversight body and the management of the initiative.
	The oversight body rarely meets or holds short, orchestrated, perfunctory meetings.
	Oversight body members do not understand their roles, are not aware of the scope of their oversight responsibilities and believe that many aspects are management’s responsibility.
	Internal audit recommendations are not, or rarely, implemented, or internal audit is being dismantled or outsourced.
	There are significant performance problems in the overseen initiative: poor performance against operational or strategic targets; significant delays and cost overruns; a high number of complaints, penalties, and fines; or risks that are escalating.
	There is a failure to take follow-up or corrective actions when significant issues are brought to the attention of the oversight body.

While such indicators can be useful to target further examination work, their presence should not be indiscriminately accepted as evidence that an oversight deficiency exists. You must always gather sufficient appropriate evidence to support a cause-and-effect relationship before concluding that the presence of an indicator means that an actual deficiency exists.

Liked it?

There is much more to learn in our Practice Guide to Auditing Oversight.

See more Audit Tips