CIA Part 1 - 7. Planning & Supervising the Engagement

1STUDY UNIT SEVENENGAGEMENTPLANNING AND SUPERVISING THEAn engagement consists of(1)planning,(2)performing the engagement,(3)communicating results,and(4)monitoring progress.The internal auditor’s responsibility is to plan and perform the engagement,subject to review and approval by supervisors.This study unit concerns the first phase of the engagement.Supervision is included because it begins with planning.In this study unit,we present the pronouncements by The IIA that are relevant to the planning phase.This study unit also contains supplementary information about certain aspects of the engagement and the relevant pronouncements on supervision.Core Conceptss Internal auditors should develop and document a plan for the engagement.It should include the(a)scope,(b)objectives,(c)timing,and(d)resource allocations.s Internal auditors should make a preliminary assessment of the relevant risks.Objectives of the engagement should reflect the risk assessment.s The engagement scope should suffice to meet the engagement objectives.s Engagement resource allocation depends on the nature and complexity of the engagement,time limitations,and available resources.s Engagement work programs should meet the engagement objectives,be recorded,and receive prior approval.They consist of the planned engagement procedures.s The preliminary survey is a process for gathering information to(a)understand the activity reviewed,(b)identify areas for special emphasis,(c)obtain useful information,and(d)determine whether further auditing is needed.s Engagement supervision ensures that objectives are achieved,quality is assured,and staff is developed.2SU7:Planning and Supervising the Engagement7.1PLANNING1.This subunit describes the planning process and provides criteria for evaluating thatprocess.The engagement planning process is addressed by one General PerformanceStandard,one Specific Performance Standard,one Assurance Implementation Standard,one Consulting Implementation Standard,and one Practice Advisory.2.2200Engagement Planning–Internal auditors should develop and record a plan foreach engagement,including the scope,objectives,timing,and resourceallocations.a.PRACTICE ADVISORY2200-1:ENGAGEMENT PLANNING1.The internal auditor is responsible for planning and conducting the engagementassignment,subject to supervisory review and approval.The engagementprogram should:q Document the internal auditor’s procedures for collecting,analyzing,interpreting,and documenting information during the engagement.q State the objectives of the engagement.q Set forth the scope and degree of testing required to achieve theengagement objectives in each phase of the engagement.q Identify technical aspects,risks,processes,and transactions that shouldbe examined.q State the nature and extent of testing required.q Be prepared prior to the commencement of engagement work and bemodified,as appropriate,during the course of the engagement.2.The chief audit executive is responsible for determining how,when,and towhom engagement results will be communicated.This determination shouldbe documented and communicated to management,to the extent deemedpracticable,during the planning phase of the engagement.Subsequentchanges that affect the timing or reporting of engagement results should alsobe communicated to management,if appropriate.3.Other requirements of the engagement,such as the engagement periodcovered and estimated completion dates,should be determined.The finalengagement communication format should be considered because properplanning at this stage facilitates preparing the final engagement communication.4.All those in management who need to know about the engagement should beinformed.Meetings should be held with management responsible for theactivity being examined.A summary of matters discussed at meetings and anyconclusions reached should be prepared;distributed to individuals,asappropriate;and retained in the engagement working papers.Topics ofdiscussion may include:q Planned engagement objectives and scope of workq The timing of engagement workq Internal auditors assigned to the engagementq The process of communicating throughout the engagement,including themethods,time frames,and individuals who will be responsibleq Business conditions and operations of the activity being reviewed,including recent changes in management or major systemsq Concerns or any requests of managementq Matters of particular interest or concern to the internal auditorq Description of the internal auditing activity’s reporting procedures andfollow-up process3.2201Planning Considerations –In planning the engagement,internal auditors shouldconsider:q The objectives of the activity being reviewed and the means by which the activity controls its performance.qThe significant risks to the activity,its objectives,resources,and operations and the means by which the potential impact of risk is kept to an acceptable level.qThe adequacy and effectiveness of the activity’s risk management and control systems compared to a relevant control framework or model.q The opportunities for making significant improvements to the activity’s riskmanagement and control systems.4.2201.A1–When planning an engagement for parties outside the organization,internalauditors should establish a written understanding with them about objectives,scope,respective responsibilities and other expectations,including restrictions on distribution ofthe results of the engagement and access to engagement records.5.2201.C1–Internal auditors should establish an understanding with consulting engagement clients about objectives,scope,respective responsibilities,and other client expectations.For significant engagements,this understanding should be documented.SU 7:Planning and Supervising the Engagement 34SU7:Planning and Supervising the Engagement7.2OBJECTIVES,RISK ASSESSMENT,AND SURVEY1.This subunit defines objectives,procedures,the scope of work,and the purpose of thepreliminary risk assessment.These concepts are covered in one Specific PerformanceStandard,two Assurance Implementation Standards,one Consulting ImplementationStandard,and two Practice Advisories.2.2210Engagement Objectives–Objectives should be established for eachengagement.a.PRACTICE ADVISORY2210-1:ENGAGEMENT OBJECTIVES1.Planning should be documented.Engagement objectives and scope of workshould be established.Engagement objectives are broad statementsdeveloped by internal auditors and define what the engagement is intended toaccomplish.Engagement procedures are the means to attain engagementobjectives.Engagement objectives and procedures,taken together,define thescope of the internal auditor’s work.2.Engagement objectives and procedures should address the risks associatedwith the activity under review.The term risk is the possibility of an event’soccurring that could have an impact on the achievement of objectives.Risk ismeasured in terms of impact and likelihood.The purpose of the risk assess-ment during the planning phase of the engagement is to identify significantobjectives.areas of activity that should be examined as potential engagement Array3.2210.A1–Internal auditors should conduct a preliminary assessment of the risks relevant tothe activity under review.Engagement objectives should reflect the results of thisassessment.a.PRACTICE ADVISORY2210.A1-1:RISK ASSESSMENT IN ENGAGEMENTPLANNING1.Background information should be obtained about the activities to bereviewed.A review of background information should be performed todetermine the impact on the engagement.Such items include:q Objectives and goalsq Policies,plans,procedures,laws,regulations,and contracts that couldhave a significant impact on operations and reportsq Organizational information,e.g.,number and names of employees,keyemployees,job descriptions,and details about recent changes in theorganization,including major system changesq Budget information,operating results,and financial data of the activity tobe reviewedq Prior engagement working papersSU7:Planning and Supervising the Engagement5q Results of other engagements,including the work of external auditors, completed or in processq Correspondence files to determine potential significant engagementissuesq Authoritative and technical literature appropriate to the activity2.If appropriate,a survey should be conducted to become familiar with theengagement client’s activities,risks,and controls;to identify areas forengagement emphasis;and to invite comments and suggestions fromengagement clients.A survey is a process for gathering information,withoutdetailed verification,on the activity being examined.The main purposes areto:q Understand the activity under reviewq Identify significant areas warranting special emphasisq Obtain information for use in performing the engagementq Determine whether further auditing is necessary3.A survey permits an informed approach to planning and carrying outengagement work.It is an effective tool for applying the internal audit activity’sresources where they can be used most effectively.The focus of a survey willvary depending upon the nature of the engagement.The scope of work and thetime requirements of a survey will vary.Contributing factors include theinternal auditor’s training and experience,knowledge of the activity beingexamined,the type of engagement being performed,and whether the survey ispart of a recurring or follow-up assignment.Time requirements will also beinfluenced by the size and complexity of the activity being examined,and by thegeographical dispersion of the activity.4.A survey may involve use of the following procedures:q Discussions with the engagement clientq Interviews with individuals affected by the activity,e.g.,users of theactivity’s outputq On-site observationsq Review of management reports and studiesq Analytical auditing proceduresq Flowchartingq Functional“walk-through”(tests of specific work activities from beginning to end)q Documenting key control activities5.A summary of results should be prepared at the conclusion of the survey.Thesummary should identify:q Significant engagement issues and reasons for pursuing them in moredepthq Pertinent information developed during the surveyq Engagement objectives,engagement procedures,and specialapproaches such as computer-assisted audit techniques(CAATs)q Potential critical control points,control deficiencies,or excess controlsq Preliminary estimates of time and resource requirementsq Revised dates for reporting phases and completing the engagementq When applicable,reasons for not continuing the engagement6SU7:Planning and Supervising the Engagement4.The preliminary or on-site survey allows for the gathering of information,without detailedverification,about the activities to be reviewed.It is also an opportunity for the internalauditor and the client to begin a participative engagement.5.The survey should result in thorough internal auditor familiarity with the engagementclient’sa.Objectivesanizational structurec.Operationsd.Physical facilitiese.Risk management,control,and governance systems(including documentation andprocedures)1)Internal auditors must consider all such policies and procedures,not merelythose relevant to a financial statement audit.f.Personnelrmation systems6.The survey should become the basis for an efficient,effective engagement work programthata.Concentrates on matters of significance.b.Reduces the time allocated to areas in which risk appears to be minimal.SU7:Planning and Supervising the Engagement77.The survey should set a cooperative tone for the field work that follows.8.The more complex and extensive the activity,the greater the need for the overviewprovided by the preliminary survey.9.The survey requires certain abilities.The internal auditor musta.Ask intelligent questionsb.Prepare suitable questionnairesc.Have a clear understanding of1)The information needed,2)Sources of that information,and3)How to obtain the information.d.Understand and be adept at flowcharting and other means of documenting theinformation obtainede.Understand management’s objectives and be able to identify the objectives of eachactivity reviewed.f.Understand the purposes of risk management,control,and governance policiesand proceduresg.Identify the risks implicit in the areas under review10.Defects in risk management and control processes discovered during the survey should beimmediately communicated to the person who can best take corrective action.a.The initial communication should be oral.If corrective action is taken,no further stepsare needed until the final engagement communication.b.If corrective action is not taken,the defect is significant,and,in the internal auditor’sopinion,correction cannot be safely delayed,management should be alerted in aninterim or progress communication.11.The overall results of the survey,if warranted,may be communicated to management in anoral presentation.12.The results should be documented.13.2210.A2–The internal auditor should consider the probability of significant errors,irregularities,noncompliance,and other exposures when developing the engagementobjectives.14.2210.C1–Consulting engagement objectives should address risks,controls,andgovernance processes to the extent agreed upon with the client.7.3SCOPE AND RESOURCES1.This subunit contains the pronouncements on the established engagement scope andresource(especially staffing)allocation.These topics are addressed in two SpecificPerformance Standards,two Assurance Implementation Standards,one ConsultingImplementation Standard,and one Practice Advisory.2.2220Engagement Scope–The established scope should be sufficient to satisfy theobjectives of the engagement.2220.A1–The scope of the engagement should include consideration of relevantsystems,records,personnel,and physical properties,including those under thecontrol of third parties.8SU7:Planning and Supervising the Engagement2220.A2–If significant consulting opportunities arise during an assuranceengagement,a specific written understanding as to the objectives,scope,respectiveresponsibilities and other expectations should be reached and the results of theconsulting engagement communicated in accordance with consulting standards.2220.C1–In performing consulting engagements,internal auditors should ensurethat the scope of the engagement is sufficient to address the agreed-uponobjectives.If internal auditors develop reservations about the scope during theengagement,these reservations should be discussed with the client to determinewhether to continue with the engagement.3.2230Engagement Resource Allocation–Internal auditors should determineappropriate resources to achieve engagement objectives.Staffing should bebased on an evaluation of the nature and complexity of each engagement,timeconstraints,and available resources.a.PRACTICE ADVISORY2230-1:ENGAGEMENT RESOURCE ALLOCATION1.In determining the resources necessary to perform the engagement,evaluationof the following is important:q The number and experience level of the internal auditing staff requiredshould be based on an evaluation of the nature and complexity of theengagement assignment,time constraints,and available resources.q Knowledge,skills,and other competencies of the internal auditing staffshould be considered in selecting internal auditors for the engagement.q Training needs of internal auditors should be considered because eachengagement assignment serves as a basis for meeting developmentalneeds of the internal audit activity.q Consideration of the use of external resources when additionalneeded.knowledge,skills,and other competencies are7.4WORK PROGRAMS1.This subunit is devoted to engagement work programs(also see PA2200-1in Subunit7.1).They are addressed in one Specific Performance Standard,one Assurance ImplementationStandard,one Consulting Implementation Standard,and two Practice Advisories.2.2240Engagement Work Program–Internal auditors should develop work programsthat achieve the engagement objectives.These work programs should berecorded.a.PRACTICE ADVISORY2240-1:ENGAGEMENT WORK PROGRAM1.Engagement procedures,including the testing and sampling techniquesemployed,should be selected in advance,if practicable,and expanded oraltered if circumstances warrant.More detailed guidance is described inPractice Advisory2200-1.SU7:Planning and Supervising the Engagement92.The process of collecting,analyzing,interpreting,and documenting informationshould be supervised to provide reasonable assurance that the auditor’smet.objectivity is maintained and engagement goals areevaluating,and recording information during the engagement.The work program should be approved prior to its implementation,and any adjustments approved promptly.a.PRACTICE ADVISORY2240.A1-1:APPROVAL OF WORK PROGRAMS1.In obtaining approval of the engagement work plan,such plans should beapproved in writing by the chief audit executive or designee prior to thecommencement of engagement work.Adjustments to engagement work plansshould be approved in a timely manner.Initially,approval may be obtainedorally,if factors preclude obtaining written approval prior to commencingengagementwork.depending upon the nature of the engagement.5.A pro forma work program is designed to be used for repeated engagements related tosimilar operations.It is ordinarily modified over a period of years in response to problems encountered in the field.The“canned”program assures at least minimum coverage,provides comparability,and saves resources when operations at different locations have similar activities,risks,and controls.a.However,a pro forma(standard)work program is not appropriate for a complex orchanging operating environment.The engagement objectives and relatedprocedures may no longer be relevant.10SU7:Planning and Supervising the Engagement7.5SUPERVISION1.This subunit includes the pronouncements relevant to supervision of engagements as wellas some supplementary guidance.Engagement supervision is the subject of one SpecificPerformance Standard and one Practice Advisory.2.2340Engagement Supervision–Engagements should be properly supervised toensure objectives are achieved,quality is assured,and staff is developed.a.PRACTICE ADVISORY2340-1:ENGAGEMENT SUPERVISION1.The chief audit executive is responsible for assuring that appropriateengagement supervision is provided.Supervision is a process that begins withplanning and continues throughout the examination,evaluation,communication,and follow-up phases of the engagement.Supervisionincludes:q Ensuring that the auditors assigned possess the requisite knowledge,skills,and other competencies to perform the engagement.q Providing appropriate instructions during the planning of theengagement and approving the engagement program.q Seeing that the approved engagement program is carried out unlesschanges are both justified and authorized.q Determining that engagement working papers adequately support theengagement observations,conclusions,and recommendations.q Ensuring that engagement communications are accurate,objective,clear,concise,constructive,and timely.q Ensuring that engagement objectives are met.q Providing opportunities for developing internal auditors’knowledge,skills,and other competencies.2.Appropriate evidence of supervision should be documented and retained.The extent of supervision required will depend on the proficiency andexperience of internal auditors and the complexity of the engagement.Thechief audit executive has overall responsibility for review but may designateappropriately experienced members of the internal audit activity to perform thereview.Appropriately experienced internal auditors may be used to review thework of other less experienced internal auditors.3.All internal auditing assignments,whether performed by or for the internal auditactivity,remain the responsibility of the chief audit executive.The chief auditexecutive is responsible for all significant professional judgments made inthe planning,examination,evaluation,communication,and follow-up phases ofthe engagement.The chief audit executive should adopt suitable means toensure that this responsibility is met.Suitable means include policies andprocedures designed to:q Minimize the risk that professional judgments may be inconsistent withthe professional judgment of the chief audit executive resulting in asignificant adverse effect on the engagement.q Resolve differences in professional judgment between the chief auditexecutive and internal auditing staff members over significant issuesrelating to the engagement.Such means may include:(a)discussion ofpertinent facts,(b)further inquiry or research,and(c)documentation anddisposition of the differing viewpoints in the engagement working papers.In instances of a difference in professional judgment over an ethical issue,resolution may include referral of the issue to those individuals in theorganization having responsibility over ethical matters.SU7:Planning and Supervising the Engagement114.Supervision extends to staff training and development,employee performanceevaluation,time and expense control,and similar administrative areas.5.All engagement working papers should be reviewed to ensure that theyproperly support the engagement communications and that all necessaryprocedures have been performed.Evidence of supervisory review shouldconsist of the reviewer’s initialing and dating each working paper after it isreviewed.Other review techniques that provide evidence of supervisory reviewinclude completing an engagement working paper review checklist or preparinga memorandum specifying the nature,extent,and results of the review.6.Reviewers may make a written record(review notes)of questions arisingfrom the review process.When clearing review notes,care should be taken toensure that the working papers provide adequate evidence that questions raisedduring the review have been resolved.Acceptable alternatives with respect todisposition of review notes are:q Retaining the review notes as a record of the questions raised by thereviewer and the steps taken in their resolution.q Discarding the review notes after the questions raised have been resolved and the appropriate engagement working papers have been amended torequested.provide the additional information3.The internal audit activity should maintain the same degree of control over its own activitiesas it expects from other subunits of the organization.4.All projects should be formally assigned.Each should havea.An assignment sheet,i.e.,a work order authorizing expenditure of engagement workhours.b.An engagement title indicating the activity covered.c.A number identifying the engagement and indicating its nature,e.g.,a regular orspecial internal audit,a consulting engagement,or a fraud investigation.5.The chief audit executive should review the progress of each engagement periodically interms of budgeted employee-days,actual employee-days,and estimated completion date.12SU7:Planning and Supervising the Engagement6.Schedules for job completion should be set early,usually before the midpoint of theassignment.7.Requests for budget adjustment also should be made well before job completion,i.e.,assoon as it becomes apparent that the actual project differs significantly from that describedin the engagement work schedule.8.Adjusted budgets normally will be carried forward to future budgets and work schedules.Temporary obstacles,e.g.,those created by inexperienced assistants and unexpectedproblems,should not justify budget adjustments.9.Projects should be formally closed upon the issuance of a final engagementcommunication if no matters are unresolved when it is released.Otherwise,they should beclosed by the submission of a closure communication to the CAE.This submission occurswhen action on all unresolved matters discussed in the final engagement communication iscomplete.10.Activity reports should be prepared for senior management and the board at leastannually.These activity reportsa.Highlight significant engagement observations,conclusions,and recommendations.b.Explain major deviations from approved engagement work schedules,staffing plans,and financial budgets.11.All engagements should be kept under budgetary control.a.Project budgets are usually stated in employee-hours or employee-days.b.Financial budgets should include items other than internal audit activity staffpayroll,e.g.,1)Administrative and clerical support2)Engagement-related and training-related travel3)Outside service providers4)Telephone5)Supplies6)Library7)Staff professional society membership duesc.Budgets for recurring engagements should be the same as those shown in theengagement work schedule.d.Budgets for engagements for which the IAA has no prior experience should be set assoon as possible after the scope of the engagement becomes known.e.Because no projects are precisely the same(even those covering the same activity),budgets should be reevaluated after the preliminary survey.1)Excessive budgets should be reduced.2)Insufficient budgets should be expanded or the scope of the engagementreduced.3)Adjustments and the reasons for them should be documented for futureengagement work schedules.f.Budget adjustments should be justified.They should be approved at a level higherthan the engagement supervisor.Requests for budget adjustment should show1)The operational activities to be reviewed according to the engagement workschedule2)The activities actually being carried on3)The employee-days attributable to the differenceSU7:Planning and Supervising the Engagement1312.Administrative records should provide the CAE with control over engagements in progressand with sufficient information for useful reports to management on engagementaccomplishments.a.Staff auditors should submit time sheets periodically,showing the employee-dayscharged against their projects and accounting for all employee-days in the reportingperiod.1)Time should be accumulated in registers by project,including time off,vacations,holidays,etc.b.Staff auditors should report weekly to their supervisors on the time spent and thestatus of the job.c.The internal audit activity should maintain records to gather data for1)Status reports on all ongoing engagements2)Communication of results3)Suggestions adopted4)Savings accomplished as a result of recommendations5)Time expended by type of engagement in comparison with amounts budgeted7.6STUDY UNIT7SUMMARY1.Internal auditors consider(a)the objectives,resources,operations,and risks associated withthe activities reviewed;(b)the relevant risk management and control systems;and(c)possible improvements in those systems.The internal auditors can then(a)establishthe engagement’s objectives,(b)determine its scope,(c)allocate resources appropriate tothe achievement of the objectives,and(d)develop a work program.2.The engagement program(a)documents engagement procedures,(b)states theengagement’s objectives and scope,(c)identifies risks and other matters to be examined,and(d)states the nature and extent of testing.The program is prepared before workbegins and is modified during the work.3.Engagement objectives are broad statements of what is to be accomplished.Engagementprocedures are the means of attaining the objectives.Together,they define theengagement scope.4.Internal auditors should conduct a preliminary assessment of the risks relevant to the activityunder review.Engagement objectives should reflect the results of this assessment.5.A survey is usually performed to(a)become familiar with the client’s activities,risks,andcontrols;(b)identify areas of emphasis;and(c)invite comments from the client.6.The established scope should be sufficient to satisfy the objectives of the engagement.7.Internal auditors should determine appropriate resources to achieve engagementobjectives.Staffing should be based on an evaluation of the nature and complexity of eachengagement,time constraints,and available resources.。