In many organizations, the audit program is a key oversight tool for maintain-ing programs (safety, quality, environmental, improvement) and ensurmaintain-ing that the organization operates effectively and efficiently. In these organizations, manage-ment has a vested interest in the audit program’s annual results.
How to Summarize Results
Audit program management should address three questions in its annual sum-mary.7 The first question is, How did the audit department contribute to the organization last year? Management wants to know what the audit program con-tributed to the organization’s business performance during the previous period.
The audit program should not attempt to address this question directly before the review. It must compile and define program contributions throughout the review period. Figure 16.2 summarizes the actions described in each section.
The audit program direction comes from the analyses of the consolidated data.
Typically, the significance and trends reflect areas of strength as well as points of vulnerability in the program. Therefore, the audit program’s annual contribution to the organization is the result.
The second question is, What will the audit program contribute to the orga-nization next year? The audit program can recommend future audit activity and define its intended benefit to the organization on the basis of historical trends.
The third question is, Is there anything management should know to avoid future risks to the organization’s health? The audit program should identify potentially critical information, such as regulatory changes or defunct programs, and include them in the summary report.
Typically, the audit program’s summary report is one of many that compete for management attention. It must be concise, accurate, and eye- catching. Accom-panying graphs, matrices, and data summaries must capture and focus attention on the issues. Figure 16.3 provides two samples that can enhance the summary report. Graphs such as these allow management to appreciate the value of the audit program at a glance.
Figure 16.2 Audit result linkages.
Define audit program
Part IV a
5. INTeRNaL aUdIT PRogRaM MaNageMeNT
Regardless of the department in which it resides within the organization, the auditing function should be (1) independent of the audited areas, (2) supported by management, and (3) deployed positively. The degree of independence needs to be appropriate and practicable to the specific audit situation and circumstances. One common guideline is that auditors should not audit their own work.
Management of the audit function includes the following activities:
• Establishing a reporting relationship for the audit function
• Establishing audit authority, operational freedom, constraints, and boundaries
• Establishing and maintaining timely and effective communication with senior management
• Ensuring the availability of adequate resources for all audits
• Determining whether to use a single auditor or an audit team
• Staffing and training auditors
• Establishing procedures, processes, and criteria for an effective and efficient audit program
• Establishing methods for evaluating an audit program
• Establishing audit schedules
• Confirming audit dates and any requested changes of audit dates
• Setting priorities for audit subjects Figure 16.3 Charting results.
Part IV a
• Promoting and rewarding ethical behavior within the audit function
• Reviewing audit function performance
• Providing periodic reports to management on the status of the audit program
• Identifying risks to be managed, monitored, and reported The audit manager or audit coordinator is responsible for:
• Preparing an overall audit schedule
• Budgeting resources
• Assisting with or overseeing other administrative duties related to the auditing function
Additionally, the audit manager staffs and trains the audit department and moni-tors and evaluates audimoni-tors in the performance of their duties.
objectives
An audit program is the organizational structure, commitment, and documented methods used to plan and perform audits. Operational effectiveness of the audit program depends on clearly defined objectives.
A well- managed audit program:
• Plans and performs the audit
• Strives to standardize and improve its performance
• Produces meaningful audit results
• Verifies compliance
• Promotes continual improvement within the organization
The first step in successfully implementing an audit program is to define its objec-tives. Some audit organizations may choose to limit the objective of their audit program to verification of compliance/conformance to standards, while others also evaluate management controls. While objectives vary from one organization to another, they often include the following statements:
• Perform and present audits meaningfully to those who receive the audit results and use or act on them
• Ensure regular performance of required audits, and ensure frequent audits of critical functions
• Ensure that audits are performed by persons who are appropriately trained and qualified and suitably independent
• Promote a strong alliance between the audit function and the auditee
• Standardize the auditing process and determine a basis against which to measure continuous improvement of the audit program
• Support the objectives, strategies, and goals of the organization
Part IV a
• Ensure product and operational safety and proper environmental stewardship
• Support management objectives for improving organization performance Audits are valuable tools for evaluating a company’s ongoing conformance and performance when they meet management’s needs. Benefits realized from the performance of an audit are weighed against the cost of performing the audit.
According to Allan J. Sayle, author of Management Audits: The Assessment of Quality Management Systems, such costs include:
• The auditor’s time spent preparing, performing, following up and completing an audit
• The auditee’s time spent participating in audit process
• Overhead costs associated with an audit8
• The lead auditor/audit manager’s time spent analyzing the audit program and making improvements
Audit program objectives should address the questions “who,” “what,” “where,”
“when,” “why,” and “how”—for example:
• Who performs and who participates in the audits?
• What activity or system is being audited?
• Where are the audits performed?
• When are the audits performed?
• Why are the audits performed? What is the need for the audit?
• How is the audit performed?