In consequence, the period covered by the audit for a special examination is typically from the beginning of the planning phase until the end of the examination phase (end of field work). The audit scope includes a description of what elements are included in the audit. As a result of unexpected events, changes in conditions, or evidence obtained, the practitioner may need to revise the overall strategy and engagement plan, and thereby the resulting planned nature, timing and extent of procedures.
Each line of enquiry should clearly address the risks identified in the teams risk assessment (OAG Audit4020 Risk assessment). The audit team shall select issues on the basis of their significance, their planned value added, and their auditability. To avoid a qualification of the conclusion, the audit team may need to collect evidence that exists only in the LTWO-affiliated entity. Through consultations, the OAG concluded that the Act does not require the inclusion of all systems and practices within the scope of a special examination. Are controls poorly designed or not adequately implemented? [Nov2015], In special examinations, the audit team shall identify all affiliated entities of the Crown corporation and decide whether these affiliated entities are to be scoped into the audit. The Financial Administration Act requires the audit team to consider relying on work performed by the Crown corporations internal audit function, as far as it is practicable to do so. OAG Audit 2020 Significance (a) The assets of the corporation and each subsidiary are safeguarded and controlled; [] OAG Audit 7030 Drafting the audit report The results of engagement acceptance activities and, where applicable, whether knowledge gained on other engagements performed by the engagement partner for the appropriate party(ies) is relevant. If the risk is not covered by the core systems and practices, the team can then justify adding to the scope based on the rationale that a significant deficiency in the non-core system(s) and practice(s) could prevent the Crown corporation from having reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively.
The audit logic matrix (OAG Audit4044 Developing the audit strategy: audit logic matrix) and other risk tools and templates (OAG Audit4020 Risk assessment) will help auditors document the decisions made and logic used. Lines of enquiry address the issues that the audit team wants to examine. Section7(2) of the Act states that the Auditor General shall call attention to anything that he considers to be of significance and of a nature that should be brought to the attention of the House of Commons. In determining the audit approach to address past issues, teams should consider the action taken by management to address the issues and whether it has a reasonable level of assurance on actions taken in response. [Nov2015], Audits shall have a clear scope that focuses on the extent, timing, and nature of the audit. CPA Canada Handbook sections and excerpts are reproduced herein for your non-commercial use with the permission of The Chartered Professional Accountants of Canada (CPA Canada). OAG Audit 1510 Selection of performance audit topics Carefully scoping the audit early in the process helps increase its efficiency and effectiveness. To inform a scoping decision, the audit team determines the value that the audit will add in terms of the assurance, information, and advice to be provided. Together with the audit objective (OAG Audit4041 Audit objectives) and criteria (OAG Audit4043 Audit criteria), they form the overall audit design. ffVX7esxy=B] \@M]=pjnB'DdIA'1"]yMM. Relying on the work of others and on existing information could reduce the number of hours and the extent of audit effort required. OAG Audit 4041 Audit objectives Planning is not a discrete phase, but rather a continual and iterative process throughout the engagement. Assess the adequacy of controls to protect the security and confidentiality of sensitive data and compliance with regulations such as Gramm-Leach-Bliley, HIPAA, FERPA, etc. The planning phase involves the important tasks of elaborating a detailed approach; documenting the nature, timing, and extend of procedures to be performed; and the reasons for selecting them. Are there areas that have undergone a significant degree of change? For example, the team may need documents related to the LTWO-affiliated entitys strategic planning and risk management.
OAG Audit 4043 Audit criteria OAG Audit7030 Drafting the audit report sets out how scoping considerations are described in the audit report. Although these discussions often occur, the overall engagement strategy and the engagement plan remain the practitioners responsibility. A project or program may have a relatively small budget, but affect a large segment of the population or have a significant impact on the environment. (Ref: Para. OAG Audit 4090 Audit plan summary for performance audits Scoping the audit involves narrowing the audit to relatively few matters of significance that pertain to the audit objective and that can be audited within allocated resources. Considering what elements to be included in the audit (scope) and determining the nature of the work to be undertaken and how it will be undertaken (approach) are two interrelated concepts. This assessment requires professional judgment and should consider the concepts of significance (OAG Audit2020 Significance) and risk, including the impact on engagement risk (OAG Audit4020 Risk assessment). Once planning work begins, clearly defining the audit scope is important to determine the budget, human resources, and time required to conduct the examination work, and to determine what will be reported. HWn}W#'_'YVZaq . L%RAngY?
@F)cm{d
!aVf:[_)O|]"hYmu%z>&wF8k'VkX32*(LrByMENB;I`GAwdu=~hJ=|mmKMnw-_pm~3)Qo`?-QR(d The team determines if any recommendations or issues from previous audits will be included in the scope. The use of templates and tools discussed in OAG Audit4020 Risk assessment and OAG Audit4025 Internal controls facilitate the teams documentation. In order to identify this minimum set of systems and practices to be examined, the following assessments were performed: In order to answer the question, What is required for the Crown corporation to cause financial and management control and information systems and practices to be maintained (FAA S. 131 1 (b))? an analysis and cross-walk was performed to compare the FAA requirements with both best management practices from recognized sources as well as with expectations for management systems and practices found in documents linked to the changes to the FAA in 1984. Mango can be used to control and maintain all aspects of an organisation's QHSE compliance requirements.So whatever your needs - be they Health & Safety, Quality, Environmental Management, Food Safety - or all four - Mango is the answer. Section 131(2) The books, records, systems and practices referred to in subsection (1) shall be kept and maintained in such manner as will provide reasonable assurance that. OAG Audit 1143 Documenting significant matters and related significant professional judgments The scope and objectives for every audit are determined through discussion with the department's management and a department specific risk assessment. Is the timing appropriate for auditing the issue? To assess whether commitments and standards reflect client needs and the organizations responsiveness to service quality issues, we also examined the files for activities that occurred during the period of 1July2017 to 31March2020. (c) The financial, human and physical resources of the corporation and each subsidiary are managed economically and efficiently and the operations of the corporation and each subsidiary are carried out effectively. the area is outside the mandate of the OAG; the audit team does not have or cannot acquire the required expertise; the area is undergoing significant and fundamental change; suitable criteria or approaches are not available to assess performance; or. [Nov2015], In special examinations, the audit team shall consider significant deficiencies identified and recommendations made in the previous special examination report when determining the scope of the audit. The practitioner may decide to discuss elements of planning with the appropriate party(ies) to facilitate the conduct and management of the engagement (for example, to coordinate some of the planned procedures with the work of the appropriate party(ies)s personnel). This three-year span was selected as there were significant changes to service delivery approachesin June2019 and we expected to see evidence of the results of these changes.. To Parliament? Establishing the overall engagement strategy in such cases need not be a complex or time-consuming exercise; it varies according to the size of the entity, the complexity of the engagement, including the underlying subject matter and criteria, and the size of the engagement team. This includes email, fax, mail and hand delivery, or use of any other method of distribution or reproduction. To the public? Compliance, Audit issues from the original audit may also be dropped for the follow-up work, if they are no longer of interest, no longer pose a significant risk, or become irrelevant or obsolete. COPYRIGHT NOTICE This document is intended for internal use. The scoping decision for a special examination should be based on how significant the less than wholly-owned (LTWO) affiliated entitys operations are to the parent Crown corporation. The team should document the professional judgments used to make the selection of procedures to be performed and other key decisions during the planning phase. OAG Audit 1141 Identifying significant matters However, in consultation with the OAG Internal Specialist Research and QuantitativeAnalysis, the team may analyze multiple years of data to ensure sufficient appropriate evidence that includes a longer term trend analysis. The team can consider relying on the work of internal audit; using the work of audited entitys experts; and/or involving internal or external experts to assist with aspects of the audit work for which the team does not have sufficient experience or expertise. The audit teamcan consult withthe appropriate internal specialists (if applicable) before scoping the special examination. If different lines of enquiry or different audit tests cover different time periods, this should be disclosed in the About the Audit section of the report. Although the control objectives are identified separately in the FAA, each is affected by a variety of systems and practices acting in concert. (a) a statement whether in the examiners opinion, with respect to the criteria established pursuant to subsection 138(3), there is reasonable assurance that there are no significant deficiencies in the systems and practices examined. Professional judgment is needed to determine which controls are relevant in the engagement circumstances. The practitioner shall consider significance when: (Ref: Para. It is important that the collective weight of the evidence provides persuasive support for the findings in the report (OAG Audit 1051 Sufficient appropriate audit evidence). The extent to which the risk of fraud is relevant to the engagement. Summarizing the significant deficiencies or recommendations from the previous special examination report provides the audit team with considerable context and a strong starting point from which to gain an understanding of the entity and determine scope. The practitioner shall plan the engagement so that it will be performed in an effective manner, including setting the objective, scope, timing and direction of the engagement, and determining the nature, timing and extent of planned procedures that are required to be carried out in order to achieve the objectives of the practitioner. what entities (or parts thereof) are included in the audit, what programs or activities or functions are included in the audit, and. In a reasonable assurance engagement, understanding internal control relevant to the underlying subject matter assists the practitioner in identifying the types of deviations and factors that affect the risks of significant deviation. Section 139(2) The report of an examiner under subsection (1) shall include. Planning involves the engagement partner, other key members of the engagement team, and any key practitioners external experts developing an overall strategy for the scope, emphasis, timing and conduct of the engagement, and an engagement plan, consisting of a detailed approach for the nature, timing and extent of procedures to be performed, and the reasons for selecting them. For example, in lines of enquiry related to governance, risk management, strategic planning, and so on, the audit team could include the systems and practices in place to manage the LTWO-affiliated entity. It also helps ensure that sufficient appropriate evidence will be obtained to provide a reasonable basis to support the conclusion expressed in the report. A88. The audit approach corresponds to the nature, extent, and timing of the work being undertaken in order for the audit team to provide reasonable assurance to the intended user of the report on the audit conclusion, against the audit objective. The audit team shall perform a risk-based planning exercise to determine the scope and approach of the audit. It is also useful to communicate relevant matters to members of the engagement team, and to any practitioners external experts not involved in the discussion. Where there are significant risks facing the corporation, and where a significant deficiency in the mitigating systems and practices could prevent the Crown corporation from having reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively, teams must consider twooptions: If the risk is covered by the core systems and practices, the team considers increasing audit effort in the area of higher risk. Determining essential systems and practices. This is the time frame covered by the audit work for which a conclusion will be formed; for example, the three fiscal years before the audit. The special examination provides a conclusion on the Crown corporations systems and practices that are current and in place at the time of the audit. A90-A98), (a) Planning and performing the assurance engagement, including when determining the nature, timing and extent of procedures; and. Rather, the scoping of a special examination allows for the selection of specific systems, practices and criteria that reflect each Crown corporations circumstances, provided the selection is sufficiently comprehensive to determine if the corporation has reasonable assurance of achieving the statutory control objectives. The nature, timing and extent of resources necessary to perform the engagement, such as personnel and expertise requirements, including the nature and extent of experts involvement. Are there issues with high visibility or of current concern? assets are safeguarded and controlled, resources are managed economically and efficiently, and operations are carried out effectively).
OAG Audit 4010 Understanding the subject matter in planning an audit The team should also include a rationale for the period(s) chosen. It cannot be distributed to or reproduced by third parties without prior written permission from the Copyright Coordinator for the Office of the Auditor General of Canada. Mango is a popular Compliance Management solution developed by Mango Limited. Core systems and practices mitigate coverage risk. evidence-gathering techniques and testing strategies required. Wrestling with QHSE compliance. What is meant by the Audit Objective, Scope and Criteria? A156(c)), 44. .. If the engaging party imposes a limitation on the scope of the practitioners work in the terms of a proposed direct engagement such that the practitioner believes the limitation will result in the practitioner disclaiming a conclusion on the underlying subject matter, the practitioner shall not accept such an engagement as an assurance engagement, unless required by law or regulation to do so. The impact of the internal audit function on the engagement. While each audit is unique, there are some general or common objectives applied to most audits. The concepts of audit scope and approach are inter-related. Criteria: the requirements to audit against. The audit scope and approach, including lines of enquiry, should be included in the audit logic matrix (OAG Audit4044 Developing the audit strategy: audit logic matrix), which also includes the objectives, criteria and their sources, audit questions, data sources, and other information. Moreover, any given system and practice influences more than one control objective. OAG Audit 4044 Developing the audit strategy: audit logic matrix Identification of intended users and their information needs, and consideration of significance and the components of engagement risk. The rationale for dropping them is documented in the audit file. The audit conclusion relates to these systems and practices as being able to provide assurance to the corporation that it met its statutory control objectives during thisperiod. Section 131(1) Each parent Crown corporation shall cause. Core recognizes the complex relationships both among control objectives and the systems and practices of the corporation. The number of lines of enquiry may depend on the nature, scope, and complexity of the audit issues and the value that each line of enquiry will be adding. A99. These assessments identified a core set of systems and practices that were deemed to be applicable in all cases, and in most cases sufficiently comprehensive to determine if a Crown corporation is achieving its statutory control objectives. Either of these audit approaches would allow the audit team to examine the systems and practices designed to manage a significant LTWO-affiliated entity in order to gain reasonable assurance that the parent Crown corporation can fulfill its mandate and meet its statutory control objectives. Audit teams have considerable latitude in determining the scope of a performance audit due to the Auditor General Act. Examples of the main matters that may be considered include: A86. The audit team should examine all parts of the audit period.
Typically, scope includes the following threeelements: Scoping decisions include a rationale for including key elements as well as for elements explicitly not included. The engagement team members should ask themselves the following questions when applying professional judgment in deciding which systems and practices are essential to include within the scope of the audit: Is this system and practice of particular interest to the board of directors? The audit team may decide to have a shorter audit period, such as one-year. Section 138(1) Each parent Crown corporation shall cause a special examination to be carried out in respect of itself and its wholly-owned subsidiaries, if any, to determine if the systems and practices referred to in paragraph 131(1)(b) were, in the period under examination, maintained in a manner that provided reasonable assurance that they met the requirements of paragraphs 131(2)(a) and (c): Section 138(3) Before an examiner commences a special examination, he shall survey the systems and practices of the corporation to be examined and submit a plan for the examination, including a statement of the criteria to be applied in the examination, to the audit committee of the corporation, or if there is no audit committee, to the board of directors of the corporation. CSAE 3001 also requires that the audit team obtains an understanding of the subject matter in order to be able to identify and assess the risks of significant deviations and provide the basis for designing and performing audit procedures to respond to the assessed risks and obtain sufficient appropriate evidence to support the audit conclusion. 51R. Documentation is necessary to demonstrate that the team is meeting the CPA Canada assurance standards and to support the OAGs expectation of effective planning. Core systems and practices and standard criteria, as well as additional guidance for expanding the scope of a special examination based on risk and internal controls assessment, can be found in the document Special Examination Audit Approach., Determining the effect of affiliated entities on the scope. When selecting additional, non-core systems and practices for examination, the audit team should keep in mind its responsibility to conclude on the audit objective, which is to determine whether the systems and practices we selected for examination were providing the corporation with reasonable assurance that its assets were safeguarded and controlled, its resources were managed economically and efficiently, and its operations were carried out effectively. Another consideration relevant to the scope is the period covered by the audit. OAG Audit 4020 Risk assessment . Lines of enquiry are a way to organize the audit work and correspond to areas to be audited within the scope. Further, it assists, where applicable, the coordination of work done by other practitioners and experts. Watch and listen to some Mango clients. Are there areas involving large dollar amounts? 3. For example: The audit will assess practices in place during the period of the audit, 1April2019 to 31March2020. For further information, see Guidance to Integrate Value added into the Performance Audit Process and Guidance to Integrate Results Measures into Performance Audits, under the Audit Guidance section below. The scope of a special examination could include the systems and practices in place in the parent Crown corporation to manage the LTWO-affiliated entity. (b) financial and management control and information systems and management practices to be maintained, in respect of itself and each of its wholly-owned subsidiaries, if any. They tell stories of before and after using Mango. In order to answer the question, What is expected for a Crown corporation to have reasonable assurance that its assets are safeguarded and controlled, its resources are managed economically and efficiently, and its operations are carried out effectively (FAA S. 131 2 (a) and (c))? an analysis and cross-walk was performed to identify the expectations for systems and practices to be in place to achieve these statutory control objectives from documents written for guidance on conducting special examinations around the time of the change in the FAA. OAG Audit 4045 Evidence-gathering methods CSAE 3001 requires that the audit team consider the concept of significance when planning and performing the assurance engagement, including when determining the audit approach (i.e. Lines of enquiry are determined to help the audit team finalize its audit approach as documented in the audit logic matrix. (Ref: Para.
The statement of scope should be clear about any related areas that are not included. Obtaining an understanding of the underlying subject matter and other engagement circumstances provides the practitioner with a frame of reference for exercising professional judgment throughout the engagement, for example, when: A105. fb |8
endstream
endobj
33 0 obj
99
endobj
14 0 obj
<<
/Type /Page
/Parent 9 0 R
/Resources 15 0 R
/Contents 21 0 R
/MediaBox [ 0 0 595 842 ]
/CropBox [ 0 0 595 842 ]
/Rotate 0
>>
endobj
15 0 obj
<<
/ProcSet [ /PDF /Text ]
/Font << /F1 23 0 R /TT2 17 0 R /TT4 16 0 R /TT6 26 0 R >>
/ExtGState << /GS1 28 0 R >>
/ColorSpace << /Cs6 20 0 R >>
>>
endobj
16 0 obj
<<
/Type /Font
/Subtype /TrueType
/FirstChar 32
/LastChar 148
/Widths [ 278 0 0 0 0 0 0 0 333 333 0 0 278 333 278 278 556 556 556 556 556
556 556 556 0 556 278 278 0 0 0 0 0 667 667 722 722 667 611 778
722 278 500 0 556 833 722 778 667 0 722 667 611 0 667 944 0 0 0
0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 222 500 222 833
556 556 556 556 333 500 278 556 500 722 500 500 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 333 333 ]
/Encoding /WinAnsiEncoding
/BaseFont /MLNIFD+Arial
/FontDescriptor 19 0 R
>>
endobj
17 0 obj
<<
/Type /Font
/Subtype /TrueType
/FirstChar 32
/LastChar 150
/Widths [ 278 0 0 0 0 0 0 0 0 0 0 0 0 333 278 0 556 556 556 556 556 556 0 0
556 0 0 0 0 0 0 0 0 722 722 722 722 667 611 778 0 278 556 722 611
833 722 778 667 778 722 667 611 722 667 0 667 667 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 556 ]
/Encoding /WinAnsiEncoding
/BaseFont /MLNIFB+Arial,Bold
/FontDescriptor 18 0 R
>>
endobj
18 0 obj
<<
/Type /FontDescriptor
/Ascent 905
/CapHeight 718
/Descent -211
/Flags 32
/FontBBox [ -628 -376 2000 1010 ]
/FontName /MLNIFB+Arial,Bold
/ItalicAngle 0
/StemV 144
/FontFile2 27 0 R
>>
endobj
19 0 obj
<<
/Type /FontDescriptor
/Ascent 905
/CapHeight 718
/Descent -211
/Flags 32
/FontBBox [ -665 -325 2000 1006 ]
/FontName /MLNIFD+Arial
/ItalicAngle 0
/StemV 94
/XHeight 515
/FontFile2 31 0 R
>>
endobj
20 0 obj
[
/ICCBased 30 0 R
]
endobj
21 0 obj
<< /Length 2448 /Filter /FlateDecode >>
stream
Was this system and practice the subject of a recommendation or significant deficiency in the previous special examination report? As a result, you will be able to communicate those to all parties involved in the audit process. videos. Generally, areas with larger dollar amounts warrant more attention. Planned value added in Performance audits. The characteristics of the engagement that define its scope, including the terms of the engagement and the characteristics of the underlying subject matter and the criteria. OAG Audit 7040 Audit conclusion. OAG Audit 2070 Use of experts Examples of changes within an entity are new programs, increased staff turnover, and reorganization; examples of changes to an entitys environment are amendments to enabling legislation, federal hiring freezes, and budget cuts. Will the audit of the issue make a difference; that is, will it result in improved performance, accountability, or value for money? Scope: where you are going to start and stop the audit. Tags: This work is iterative and is not necessarily undertaken in a linear fashion. In this blog Andrew talks about how you can define a clear and concise audit objective, scope and criteria. ISO, OAG Audit 4030 Reliance on internal audit For further information on affiliated entities, see OAG Audit 4010 Understanding the subject matter in planning an audit. An important consideration when selecting the period covered by the audit is that the audit team must obtain sufficient appropriate evidence to conclude on the audit objective. This information is used to determine whether each line of enquiry is needed to support the overall planned value added of the audit. Some of the common objectives are: Internal Control Activities & Best Practices, Association of Certified Fraud Examiners - Pittsburgh Chapter, Association of College and University Auditors, Institute of Internal Auditors - PIttsburgh Chapter, Review activity for the most recent twelve-month period, Determine if revenues appear reasonable, are properly controlled and appropriately recorded, Review discretionary, self-supporting, restricted and agency account expenditures and determine if they are valid, reasonable and in compliance with University policies and donor restrictions, Determine if gifts are forwarded to Philanthropic and Alumni Engagement, Review sponsored project account expenditures and determine if they are in compliance with University policies, grant agreements and Federal regulations, if applicable, Review procedures for the use of and control over the Vincent payment system for research participant payments, Access the adequacy and effectiveness of internal controls over payroll processingReview travel and business expenditures for compliance with University policies and procedures, Review selected P-Card transactions for compliance with University policies and review procedures for reconciling and monitoring P-Card statements, Review Conflict of Interest procedures to ensure that adequate controls are in place to properly monitor any disclosed outside interests, Review controls over the IT environment, including physical security and policies and procedures.
Sitemap 1