Audit Plan

Document Sample
Audit Plan
Description

The purpose of this spreadsheet is to demonstrate how a list of risks can be used to generate an audit plan. The IIA standards (2010.A1) states, "The internal audit activity's plan of engagements should be based on a risk assessment, undertaken at least annually. The input of senior management and the board should be considered in this process."

Audit Plan

March 07, 2008 (3 years 11 ago)
Sometimes auditing is really a difficult task like know what is missing balancing an accounting transactions. This plan is of great help for auditing.

Shared by: carthi
Categories
Tags
Stats
views:
4512
posted:
12/24/2007
language:
English
pages:
85
Risk register and audit plan



8/12/2008 6:59 PM



Risks register and audit Universe (RAU)

Last updated 21 November 2005



Purpose

The purpose of this spreadsheet is to demonstrate how a list of risks can be used to generate an audit plan. The IIA standards (2010.A1) states, "The internal audit activity's plan of engagements should be based on a risk assessment, undertaken at least annually. The input of senior management and the board should be considered in this process." The starting point: lists of risks from many people in the organisation at various levels The end point: a list of all the audits (the "audit universe") necessary to check that all risks are mitigated by internal controls . These audits to be scored in order to indicate their priority To understand the way this risk register is used, you need to visit www.internalaudit.biz This is not a "Best Practice" guide but an example, which you must change to fit your organisation



The process map

In order to produce an audit plan from a list of risks, the first task is to group the risks. I believe this is best done by linking them to the processes which any organisation has to fulfill its objectives. The advantage of linking risks to processes is that audits also involve processes. Hence by identifying all important processes, it should be possible to ensure a complete list of audits required (the "audit universe"). Do not confuse this approach with 'Process based' or 'Systems based' auditing. Processes in risk based auditing are used only for convenience. Risks drive the audit plan and individual audits. If you have a risk with no process, go and set up a new process! Processes are the means to achieve the organisation's objectives. They do not necessarily represent actual departments and could be outsourced. It is important to concentrate on the theoretical processes required, since the actual processes may have weaknesses or ommmissions.



©David M Griffiths



Introduction



1 of 85



Risk register and audit plan

Processes are arranged in a hierarchy (like an organisation chart), with each process being split into more detail. The first level of processes is known as level 1 and these are split into more detailed processes at level 2. It's usually possible to plan audits at this level. Processes are split further in the audit and the more detailed risks and controls are linked to these. The advantage of this approach is that it avoids having a huge database. Each level has "Define objectives" at the start and "Support" at the end. There is a need to define the objectives of any set of processes - even if it only to set targets. "Support" refers to the support directly required by the processes at that level. The example will give you more of an idea. The processes in this spreadsheet are for a company which manufactures goods and sells them through its own shops, to resellers (wholesalers) or direct to the public.



8/12/2008 6:59 PM



The risk register

The process maps are used to set up the risk register, where risks are linked to processes. Each box on the process map has a row. This enables risks to be attached to processes at each level, and for each level to have a risk score. This is useful in summarising the risk scores for levels 1 & 2. (This format is slightly different to that used in www.internalaudit.biz) Several risks may be linked to one process or several processes to one risk. If you have a process with no risks, you may need to ask management if risks do exist in this area. If you have risks but no process - you need to add a process. Do NOT drop risks because they don't fit neatly into your map! The risk register will be constantly updated with new risks, as they occur to me, or as my researches reveal. It can never be complete. The important point for your risk register is that it gives you a complete "audit universe". It is these audits which need to identify all the key risks in order to assess the controls which mitigate them The last columns in the register show details of the last audit of that risk and the next audit planned. This enables the register to be used as an audit planning tool. By sorting and filtering the database an annual audit plan can be produced. A calculation at the end of the "next audit budget" column will show if sufficient resources are available. The register has one line of titles, so that it can be used as a database (sorted, filtered, reports produced) I intend to produce example audit databases (audit programmes) for many of the audits in the risk register. See www.internalaudit.biz for more details



©David M Griffiths



Introduction



2 of 85



Risk register and audit plan

Some audit work may be duplicated. For example; "Transaction processing - purchasing goods for resale" may have some audit work which appears in the support processes for "Purchase of goods for resale". This is not necessarily bad, as it may cover important areas in slightly different ways You may have many risks against one process at level 2. If this is the case split the process to give processes at level 3. See 9.6 - Process Transactions Certain major areas of risk, such as health & safety, the environment and quality control only have one entry each. The level of detail will depend on the responsibilities of the internal audit department. It is assumed that these areas are covered by other specialists and the audit would be concerned with the proper operation and reporting of these functions



8/12/2008 6:59 PM



The following notes are tips when considering risks:

When wording risks, try not to make them just the failure to deliver a process. For example if the process is, "Pay invoices", the risk is not, "Fail to pay invoices". However, one risk would be "Invoices not selected for payment" More importantly risks should not be the absence of a control. For example, the risk “Invoices are not authorised” presupposes a control. The risk is “Invoices may be paid for goods or services not required”; the control is “All invoices are authorised by a senior manager”.



Worksheets

There are 6 worksheets in this spreadsheet: Introduction Process map Risk register Column key Scoring risks Process map for purchases



Language

I have used UK english for the risk register. Variations from US english include: Supplier = Vendor Purchase = Procure Cheque = Check



©David M Griffiths



Introduction



3 of 85



Risk register and audit plan



8/12/2008 6:59 PM



I have used the term "accounts payable" for purchase ledger, since this is now common in the UK. All sheets copyright David M Griffiths Not to be copied or distributed without acknowledging the author, or in conjunction with a commercial product



©David M Griffiths



Introduction



4 of 85



Risks register and audit plan



Level 1 and 2 processes



Define objectives



Research



Obtain premises



Decide strategy



Define objectives



Define objectives



Communicate strategy



Research products



Obtain offices



Deliver strategy



Research markets



Obtain factories



Maintain strategy



Research customers



Obtain warehousing



Purchase finished



Support strategy



Research locations



Obtain retail premises



Purchase expense



Support research



Support obtaining premises



Organisation's objectives



Purchase



Manufacture



Promote



Supply



Define objectives



Define objectives



Define objectives



Define objectives



Purchase raw materials



Design products



Promote in-store



Store goods



Purchase assets



Specify manufacturing



Promote to customers



Distribute goods



Purchase finished goods



Plan manufacturing



Advertise in papers



Support distribution



Purchase expense goods



Manufacture



Advertise on TV



Support purchasing



Support manufacturing



Support promotions



Sell



Support



Define objectives



Define objectives



Sell in stores



Process transactions



Sell to resellers



Provide systems



Sell direct



Prepare management accounts



Support sales



Prepare financial accounts



Provide staff



Provide legal services



Provide tax services



Ensure quality



Ensure health & safety



Manage the environment



Ensure security



Communicate



Manage risks



Manage assets



Support the support services



Risks register and audit plan



Risks register and audit plan

L1 L2 L3 L4 L



Ref



Process



L1



L2



L3



L4



L



Ref



Process



1 1 1 1 1



1 1 1 2 3



2 2 2 2 2



1.1 Decide strategy 1.1 Decide strategy 1.1 Decide strategy 1.2 Communicate strategy 1.3 Deliver strategy



1 1



3 3



2 2



1.3 Deliver strategy 1.3 Deliver strategy



1



3



2



1.4 Maintain strategy



1 1 2 2 2



4 5 0 1 2



2 2 1 2 2



1.4 Maintain strategy 1.5 Support strategy 2 Research 2.1 Define objectives 2.2 Research products



2 2 2 2 3 3 3



3 4 5 6 0 1 2



2 2 2 2 1 2 2



2.3 Research markets 2.4 Research customers 2.5 Research locations 2.6 Support research 3 Obtain, and fit out, premises 3.1 Define objectives 3.2 Obtain offices



©David M Griffiths



Risk Register



3



3



2



3.3 Obtain factories



3 3



4 5



2 2



3.4 Obtain warehousing 3.5 Obtain retail premises



3 3 4 4 4 4 4 4 4



6 7 0 1 2 2 3 4 5



2 2 1 2 2 2 2 2 2



3.6 Maintain premises 3.7 Support obtaining premises 4 Purchase 4.1 Define objectives 4.2 Purchase raw materials 4.2 Purchase raw materials 4.3 Purchase assets 4.4 Purchase finished goods 4.5 Purchase expense goods and services 4.5 Purchase expense goods and services 4.6 Support purchasing 5 Manufacture 5.1 Define objectives 5.2 Design products 5.3 Specify manufacturing 5.4 Plan manufacturing 5.5 Manufacture 5.5 Manufacture 5.6 Support manufacturing 6 Promote 6.1 Define objectives for promotion 6.2 Promote in-store 6.3 Promote to customers



4



5



2



4 5 5 5 5 5 5 5 5 6 6



6 0 1 2 3 4 5 5 6 0 1



2 1 2 2 2 2 2 2 2 1 2



6 6



2 3



2 2



©David M Griffiths



Risk Register



6 6 6 7 7 7 7 7 8 8



4 5 6 0 1 2 3 4 0 1



2 2 2 1 2 2 2 2 1 2



6.4 Advertise in papers 6.5 Advertise on TV 6.7 Support promotions 7 Supply 7.1 Define objectives for supplying goods 7.2 Store goods 7.3 Distribute goods 7.4 Support supply 8 Sell 8.1 Define objectives for selling goods 8.2 Sell in stores 8.2 Sell in stores 8.2 Sell in stores 8.2 Sell in stores 8.2 Sell in stores 8.2 Sell in stores 8.2 Sell in stores 8.2 Sell in stores 8.3 Sell to resellers 8.3 Sell to resellers 8.3 Sell to resellers 8.4 Sell direct 8.4 Sell direct 8.4 Sell direct 8.4 Sell direct 8.4 Sell direct 8.5 Support selling



8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8 8



2 2 2 2 2 2 2 2 3 3 3 4 4 4 4 4 5



2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2



©David M Griffiths



Risk Register



9 9



0 1



1 2



9 Support 9.1 Define objectives for supporting the organisation 9.2 Prepare management accounts 9.3 Prepare financial accounts 9.3 Prepare financial accounts 9.4 Provide staff 9.4 Provide staff 9.4 Provide staff 9.4 Provide staff 9.5 Provide systems 9.5 Provide systems 9.5 Provide systems 9.5 Provide systems 9.5 Provide systems



9



2



2



9 9 9 9 9 9 9 9 9 9 9



3 3 4 4 4 4 5 5 5 5 5



2 2 2 2 2 2 2 2 2 2 2



9



6



2



9.6 Process transactions



9



6



1



3



9.6.1 Process transactions purchases 9.6.2 Process transactions retail sales 9.6.3 Process transactions wholesale sales 9.6.4 Process transactions direct sales 9.6.5 Process transactions manufacturing stock



9



6



2



3



9



6



3



3



9



6



4



3



9



6



5



3



9



6



6



3



9.6.6 Process transactions wholesale stock



©David M Griffiths



Risk Register



9



6



7



3



9.6.7 Process transactions store stock



9



6



8



3



9.6.8 Process transactions payroll 9.6.9 Process transactions personal expenses



9



6



9



9



6



10



3



9.6.10 Process transactions fixed assets 9.6.11 Process transactions cash and bank



9



6



11



3



9



7



2



9.7 Provide legal services



9



8



2



9.8 Provide tax services



9



9



2



9.9 Ensure quality



9



10



2



9.10 Ensure health & safety



9



11



2



9.11 Manage the environment



9



12



2



9.12 Ensure security



9



12



2



9.12 Ensure security



9 9



13 14



2 2



9.13 Communicate 9.14 Manage risks



9



15



2



9.15 Manage the assets



©David M Griffiths



Risk Register



9



15



2



9.15 Manage the assets



9



16



2



9.16 Support the support functions



©David M Griffiths



Risk Register



egister and audit plan

Process Description Key risk to process



Process Description



Key risk to process



The most senior management group (the "board") decide on the objectives of the organisation The most senior management group (the "board") decide on the objectives of the organisation The most senior management group (the "board") decide on the objectives of the organisation The objectives are communicated to all staff in a comprehensible form An action plan is devised, at high level, which will deliver the objectives An action plan is devised, at high level, which will deliver the objectives An action plan is devised, at high level, which will deliver the objectives The strategy is regularly updated to take account of changing business conditions



The strategy does not anticipate customer demands The strategy is too risk-averse The objectives within the strategy are not clearly defined, financially justified or documented Staff do not understand the objectives in relation to their own jobs The action plan does not cover all objectives and does not consist of SMART targets addressed to senior management The organisation has not got the resources to deliver the strategy Major projects intended to deliver the strategy are late and/or over budget All staff, including the Board, fail to maintain high ethical standards, which undermine the controls necessary to achieve the organisation's objectives, including that of ensuring compliance with laws and standards Internal and external influences are not monitored to assess their impact on the strategy The resources required are not understood are not sufficient to deliver the strategy (Summary level) The objectives will not deliver the organisation's objectives effectively and efficiently The research does not identify the most effective products for achieving the objectives The research does not identify the most effective market segments for achieving the objectives The research does not identify the most effective customer segments for achieving the objectives The research does not identify the most effective locations for achieving the objectives The resources required are not understood are not sufficient to deliver the strategy (Summary level) The objectives will not deliver the organisation's objectives effectively and efficiently The locations are not cost-effective, have insufficient staff in the vicinity and has poor communications



The strategy is regularly updated to take account of changing business conditions Resources are made available to carry out the above processes The objectives of the research processes are defined Research the products, to be manufactured or purchased, which will achieve the organisation's objectives Research the market segments which will achieve the organisation's objectives Research the customer profile which will achieve the organisation's objectives Research the locations, in-country and abroad, which will achieve the organisation's objectives Resources are made available to carry out the above processes



The objectives of the processes for obtaining premises are defined Decide on the best locations for offices to house the support staff



©David M Griffiths



Risk Register



Decide on the best locations for factories to manufacture products Decide on the best location for premises to store goods Decide on the best location for shops



The environment is not suitable for a factory, insufficient trained labour is available, property costs are too high The buildings are not suitable for storing products, costs are too high and labour is not available The locations are not cost-effective, have insufficient staff in the vicinity and are not near our target customers Poor maintenance results in injury to staff or customers



Premises are maintained to ensure safety, effectiveness and efficiency at all times Resources are made available to carry out the above processes



The resources required are not understood are not sufficient to deliver the strategy (Summary level) The objectives of the processes for purchasing are The objectives will not deliver the organisation's defined objectives effectively and efficiently Purchase items to manufacture goods The purchased items are unsuitable, too expensive or delivered late Purchase items to manufacture goods A major supplier of a vital raw material, not obtainable elsewhere, is not able to deliver Purchase fixed assets Assets are not required, not suitable or too expensive Purchase goods for resale Purchase goods and services for the organisation Goods are not suitable, too expensive or delivered late Goods or services are not suitable, too expensive or delivered late Minimum prices for utilities are not negotiated



Purchase utilities for the organisation



The resources required are not understood are not sufficient to deliver the strategy (Summary level) The objectives of the processes for manufacturing The objectives will not deliver the organisation's are defined objectives effectively and efficiently Products to be manufactured are designed There is no market for the product. The product is too expensive to produce Specify how the products are to be manufactured The method of manufacturing specified is inefficient Plan the manufacturing schedule Make the goods Make the goods Resources are made available to carry out the above processes The objectives of the processes for promoting sales are defined The schedule produces the wrong goods at the wrong time The goods are made inefficiently New environmental legislation makes manufacturing process uneconomic The resources required are not understood are not sufficient to deliver the strategy (Summary level) The objectives will not deliver the organisation's objectives effectively and efficiently



Resources are made available to carry out the above processes



Promote goods in the retail stores through various Promotions do not make a profit offers Promote goods to resellers using offers Promotions do not make a profit



©David M Griffiths



Risk Register



Advertise goods in newspapers and magazines Advertise on television Resources are made available to carry out the above processes



Promotions do not make a profit Promotions do not make a profit



The resources required are not understood are not sufficient to deliver the strategy (Summary level) The objectives of the processes for supplying The objectives will not deliver the organisation's goods are defined objectives effectively and efficiently Store goods in warehouses at stages of the supply Goods are damaged, or lost chain Distribute goods between factories, warehouses, A strike of fuel suppliers brings transport in the UK to a stores and customers stop Resources are made available to carry out the The resources required are not understood are not above processes sufficient to deliver the strategy (Summary level) The objectives of the processes for selling are The objectives will not deliver the organisation's defined objectives effectively and efficiently Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods in stores operated by the organisation, or franchised Sell goods to customers who will resell them Sell goods to customers who will resell them Sell goods to customers who will resell them Sell direct to the public. For example, through the internet Sell direct to the public. For example, through the internet Sell direct to the public. For example, through the internet Sell direct to the public. For example, through the internet Sell direct to the public. For example, through the internet Resources are made available to carry out the above processes Fail to stock goods which the customers want to buy Fail to anticipate the competitions' initiatives to take a bigger market share Prices are not competitive Store layout confuses customers Prices are incorrect No stock for customers to buy Higher minimum wage legislation makes some stores unprofitable Poor service/quality of goods leading to customer complaints A major customer goes bankrupt No stock for customers to buy Poor service/quality of goods leading to customer complaints Poor service/quality of goods leading to customer complaints Fraudulent credit cards used No stock for customers to buy Internet sites unavailable Goods are lost The resources required are not understood are not sufficient to deliver the strategy



©David M Griffiths



Risk Register



(Summary level) The objectives of the processes for supporting the The objectives will not deliver the organisation's organisation are defined objectives effectively and efficiently Collect the data from processed transactions into accounts for management to make decisions Collect the data from processed transactions into accounts for statutory or tax purposes Collect the data from processed transactions into accounts for statutory or tax purposes Recruit staff and manage staff policies Recruit staff and manage staff policies Recruit staff and manage staff policies Recruit staff and manage staff policies Provide systems, including computer systems to support the organisations operations Provide systems, including computer systems to support the organisations operations Provide systems, including computer systems to support the organisations operations Provide systems, including computer systems to support the organisations operations Provide systems, including computer systems to support the organisations operations Process transactions (for example, purchases, payroll, sales) resulting from the organisation's operations Receive invoices, obtain approval for payment, pay for goods and services Management accounts do not provide timely information on which to make decisions Financial accounts are issued which do not comply with UK law The organisation is not prepared for the International Accounting Standards (IAS) High-calibre staff are not recruited and retained Properly qualified staff are not available to take vacancies Staff are not properly trained Staff successfully claim unfair dismissal A virus brings down all computer systems for a week Data is lost Data or programs are corrupted Major hardware failure Major network failure



(Summary level)



Payment is made where the organisation has not received the goods or services at the price and quality ordered



Receive cash and cash equivalents at the till, bank Cash taken at the till is not banked them and check all money is received Carry out credit checks before goods are despatched, issue invoices and receive payment for goods Process the credit card payments before authorising despatch of the goods Goods are sold to customers who cannot pay for them



Fail to pass transaction details to the credit card company



Receive goods against the order, update stock Stock is incorrectly valued records, issue the goods to manufacture, manage stock levels, minimise stock losses, account for stock Receive goods from the factory, or supplier,, Stock is incorrectly valued update stock records, issue the goods to manufacture, manage stock levels, minimise stock losses, account for stock



©David M Griffiths



Risk Register



Receive goods from the warehouse, update store stock records, sell the goods to customers, manage stock levels, minimise stock losses, account for stock



Stock is incorrectly valued



Receive details of employees, their salary and Receive incorrect data from stores on hours worked and working hours. Calculate pay based on these, less new employees deductions. Pay over deductions Personal expenses (for travelling) are claimed, authorised and paid Receive invoice details. Deceide on whether to capitalise costs. Add assets to register. Attach depreciation data and calculte. Expenses were not incurred



Revenue expendite capitalised, or capital expenditure put to revenue



Receive cash transaction data for purchases, Differences not cleared sales, payroll, personal expenses and other transactions. Reconcile these to transactions passing through the bank account. Follow-up differences Advise all areas of the company concerning action The impact of legislation is not anticipated which results to be taken on legislation in considerable costs Advise all areas of the company concerning action Schemes to minimise tax are not used to be taken on tax legislation Ensure all goods sold meet the quality standards set by legislation and the organisation Poor quality goods harms the organisation's reputation



Ensure the organisation complies with legislation A failure in H & S occurs which results in bad publicity and good practice to ensure the safety of staff and and law suits customers Ensure the operations of the organisation obey all environmental laws and good practice The physical security of tangible and intangible assets, and staff and customers, is maintained at all times to ensure the continued operation of the organisation The physical security of tangible and intangible assets, and staff and customers, is maintained at all times to ensure the continued operation of the organisation Inform internal and external stakeholders of the organisation's policies and intentions Identify, evaluate and manage risks down to the level considered acceptable by the organisation An environmental disaster occurs at one of the organisation's premises Confidential information is stolen



Offices are destroyed by fire



The London Stock Exchange is given information which cannot be substantiated



The external and internal risks threatening the objectives, and related processes, of the organisation are not understood or mitigated Ensure that assets of the organisation, particularly Financial contracts are set up which open the company cash, are maintained at optimum levels to achieve to significant losses the objectives



©David M Griffiths



Risk Register



Ensure that assets of the organisation, particularly Working capital is not optimised cash, are maintained at optimum levels to achieve the objectives Resources are made available to carry out the The resources required are not understood are not above processes sufficient to deliver the strategy



©David M Griffiths



Risk Register



Consequence of risk



Risk source



IRC



IRL



IRS



Last Audit Adjusted inherent

score

Opinio Year Gap n LA LA year arc

opinion



Consequence of risk



Risk source



irc



irl



irs



0 0 0 0 0



0 0



0



0 0



0 0



0 0 0 0



0 0



©David M Griffiths



Risk Register



0



0 0



0 0



0 0 0 0 0 0



0



0



0 0 0 0 0 0 0



0



0 0



©David M Griffiths



Risk Register



0 0 0



0 0 0 0



0



0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0



©David M Griffiths



Risk Register



0



0



0 0 0 0 0 0 0 0 0 0 0



0



0



0



0



0



0



©David M Griffiths



Risk Register



0



0



0



0



0



0



0



0



0



0



0



0 0



0



©David M Griffiths



Risk Register



0



0



©David M Griffiths



Risk Register



Adjusted inherent Process owner score

Factor Sig

arl ars Owner



Audit Group



Control



Monitoring control

Monitoring control



Residual risks

Cons. Like.

rrl



Audit Group



Control



rrc



0 0 0 0 0



Managing Director Managing Director Managing Director



A A A A B



0 0



B C



0



D



0 0



E



0 0



F G



0 0 0 0



G H I J



0 0



K L



©David M Griffiths



Risk Register



0



M



0 0



N O



0 0 P



0 0 0 0 0 0



Q Q R S T U



0



U



0



V



0 0 0 0 0 0 0



X Y Z AA AB AC AD



0



AE



0 0



AF AG



©David M Griffiths



Risk Register



0 0 0



BD

AH AI



0 0 0 0



AJ AK AL AM



0



AN



0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0



AO AO AO AP AQ AR AS AS AT AR AR AU AU AR AU AU AV



©David M Griffiths



Risk Register



0



AW



0



AX



0 0 0 0 0 0 0 0 0 0 0



AY Project audit AZ BA BB BC BE BF BG BH BI



0



BJ



0



BK



0



AT



0



AU



0



BL



0



BM



©David M Griffiths



Risk Register



0



BN



0



BO



0



BP



0



BQ



0



BR



0



BS



0



BT



0



BU



0



BV



0



BW



0



BX



0



BY



0 0



BZ CA



0



CB



©David M Griffiths



Risk Register



0



CC



0



CD



©David M Griffiths



Risk Register



Last audit details Residual risks

Sig.

rrs Last audit number Last audit name Last audit Budget Last audit actual Last timing Last auditor Last final report Target



Last audit Audit name number



Last audit Budget



Last audit actual



Last timing



Last auditor



Last final report Target



Organisation's strategy Organisation's strategy Organisation's strategy Organisation's strategy Delivery of strategy Delivery of strategy (Projects are individually audited) Ethical guidelines



Monitoring of external influences (Carried out within the above audits) Research strategy Product research



Market research Market research Geographic research Research resource planning



Location strategy Locating offices



©David M Griffiths



Risk Register



Locating factories



Locating warehouses Locating shops



Maintenance of premises Location resource planning Purchasing strategy Purchasing for manufacture Purchasing for manufacture Purchase of assets Purchase of goods for resale Purchase of expense goods and services Purchase of expense goods and services Purchase resource planning Manufacturing strategy Product design Manufacturing specification Scheduling manufacture Production accounting Environmental audit Manufacturing resource planning Selling strategy



Retail promotions Wholesale promotions



©David M Griffiths



Risk Register



Newspaper advertising TV advertising Promotions resource planning Supply strategy Warehouse operations Distribution Supply resource planning Selling strategy



Pricing Pricing Pricing Store planning Price file maintenance Stock control Store accounts Store accounts Accounts receivable Stock control Stock control Internet sales Internet sales Stock control Internet sales Internet sales Selling resource planning See above



©David M Griffiths



Risk Register



Support strategy



Management accounting Financial accounting Project - IAS Recruitment Succession planning Staff training Staff policies Virus checking Back-up procedures Access controls IS contingency plans - hardware IS contingency plans communications



Accounts Ppayable Retail cash takings



Accounts receivable Internet sales



See above



See above



Manufacturing stock



Wholesale stock



©David M Griffiths



Risk Register



Retail stock



Payroll



Personal expenses



Fixed assets



Bank and cash



Provision of legal services Provision of tax services Quality control



Health and safety



Environmental



Site security



Contingency planning



Communications Risk management



Treasury



©David M Griffiths



Risk Register



Working capital



Support resource planning



If the audit budget shows only days for th audits due next year, then this calculation wi show if the resources available are sufficient complete all of the audits.



©David M Griffiths



Risk Register



s

Final report achieved Last result Next audit Next audit number name



Next audit details

Next audit Next Budget timing Next auditor Status



Final report achieved



Last result



Next audit number



Next audit name



Next audit Budget



Next timing



Next auditor



Current status



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



If the audit budget shows only days for the audits due next year, then this calculation will show if the resources available are sufficient to complete all of the audits.



TOTAL



0



Available auditors Weekdays (auditors*52*5) Holidays Training Projects Secondments Total available for above audits Surplus/deficit 0 0 0



©David M Griffiths



Risk Register



it details

Next final report Target Target

Next final report Target



Next final report Achieved Achieved

Next final report Achieved



2006 opinion on risk



2006 opinion on risk



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



©David M Griffiths



Risk Register



Risks and audit universe Column key:

L1 Level 1 process L2 Level 2 process L3 Level 3 process Process Process Description Risk Risk source IRC IRL IRS Last audit result Last audit date Adj factor Adj IRS Process owner Audit Group



Control Monitoring control RRC RRL RRS Last audit number Audit name Last audit Budget Last audit actual Last timing Last auditor Last final report Target



Last audit



Last a

Final report achieved Last result Next audit number



Current/Next audit



Next audit name Next audit Budget Next timing Next auditor Status Next final report target Next final report Achieved 2006 opinion on risk



nd audit universe

Level 1 risk number. Corresponds to the Risk database Name of process Level 2 risk number. Corresponds to the Risk database Name of process Level 3 risk number Name of process Title of the process A brief description of what the process does. Any more details should be filed in the audit file The threat to the process. There may be several risks to one process, or one risk may threaten several processes Who identified the risk (management, risk workshop, auditor, meeting) Inherent risk consequence score Inherent risk likelihood score Inherent risk scores multiplied. (Inherent Risk Significance score ) Conclusion of last audit (acceptable/issues/unacceptable) Year of the last audit Factor applied to the IRS depending on how many years ago the last audit took place, and the result. ( See www.internalaudit.biz) IRS X adj factor = adj IRS. Sorting on this score gives the priority order for the associated audits Who is (are) responsible for the process. Should be a senior manager/director Letter(s) given in order to group several risks into one audit (if necessary). They will not necessarily be in order, as new risks, with associated audits, will be added and some may be removed Direct response to the risk Management's response to ensure the control is operating properly Residual risk consequence score. Residual risk likelihood score Residual risk scores multiplied Unique number given to each audit. This is the number of the last audit to cover this risk Name given to the audit Approximate number of auditor-days the audit should take. This aids resource planning Number of days the last audit actually required Months/year of last audit Names of principal auditors Target date for producing report (from scope)



Date actually achieved for issuing final report Conclusion of last audit (acceptable/issues/unacceptable) Unique number given to each audit. This is the number of the next audit to cover this risk - if it has been allocated Audit name. Will usually be the same as for the last audit, but could be different if this risk has been included in another audit Approximate number of auditor-days the audit should take - based on last audit's actual time. This aids resource planning Expected quarter/year of next audit - if it can be allocated Name|(s) of auditors - if allocated Status of audit (Planning/fieldwork/reporting) when it is in progress Target date for producing report (from scope) Actual date the final report was issued The opinion as to whether the risk was being properly managed (When the final report from "next audit", its details are moved into the "last audit" columns



Audit: Purchasing and payment of expense goods and services



Advice on scoring risks (inherent and residual)

1 to 3 scale If the consequence when the OR the likelihood of risk occurs is: the risk occurring is:

To prevent the organisation Almost certain achieving all, or a major part, of its objectives for a long time. Cash at risk> £100,000 To stop the organisation achieving Possible its objectives for a limited period. Cash at risk £5,000 To cause minor inconvenience, not affecting the achievement of objectives Cash at risk £1,000,000 To prevent the organisation Probable achieving all, or a major part, of its objectives for a long time. Cash at risk £100,000 To stop the organisation achieving Possible its objectives for a limited period. Cash at risk £30,000 To stop the organisation achieving Unlikely its objectives for a limited period. Cash at risk £5,000 To cause minor inconvenience, not affecting the achievement of objectives Cash at risk <£5,000



Rare



Probable (4) Almost certain (5)



Likelihood of residual risk



9 acceptable risk



5

Supplementary Issue



10 Issue



15

Unacceptable



20

Unacceptable



25

Unacceptable



4 Acceptable



8

Supplementary Issue



12 Issue



16

Unacceptable



20

Unacceptable



Possible (3)



6 acceptable risk

Supplementary Issue 3



3 Acceptable



6

Supplementary Issue



9 Issue



12 Issue



15

Unacceptable



Unlikely (2)



2 Acceptable



4 Acceptable



6

Supplementary Issue



8

Supplementary Issue



10 Issue



3 ptable



Rare(1)



1 Acceptable



2 Acceptable



3 Acceptable



4 Acceptable



5

Supplementary Issue



High (3)



risk



Insignificant (1)



Minor (2)



Moderate (3)



Major (4)



Catastrophic (5)



Likelihood



Unlikely (2)



Supplementary Issue 3



2 Acceptable



4 Acceptable



6

Supplementary Issue



8

Supplementary Issue



10 Issue



3 ptable



Rare(1)



1 Acceptable



2 Acceptable



3 Acceptable



4 Acceptable



5

Supplementary Issue



High (3)



risk



Insignificant (1)



Minor (2)



Moderate (3)



Major (4)



Catastrophic (5)



Consequence of residual risk



isk score = Likelihood score X Consequence score



nacceptable: Immediate action required to control the risk sue: Action required to control the risk upplementary issue: Action is advisable if it is cost-effective cceptable: No action required



Then the measure is defined to be:



Catatrophic (5)



Major (2)



Moderate (2)



Minor (2)



Insignificant (1)



15



20

Unacceptable



25

Unacceptable



nacceptable



12 Issue



16

Unacceptable



20

Unacceptable



9 Issue



12 Issue



15

Unacceptable



6



8

Supplementary Issue



pplementary Issue



10 Issue



3 cceptable



4 Acceptable



5

Supplementary Issue



Moderate (3)



Major (4)



Catastrophic (5)



6



8

Supplementary Issue



pplementary Issue



10 Issue



3 cceptable



4 Acceptable



5

Supplementary Issue



Moderate (3)



Major (4)



Catastrophic (5)



e of residual risk



Risks register and audit plan



Level 2 and 3 processes

Purchase



Define objectives



Purchase raw materials



Purchase assets



Purchase finished



Decide strategy



Define objectives



Define objectives



Communicate strategy



Deliver strategy



Maintain strategy



Support strategy



Support purchase raw materials



Support purchase assets



Support purchase



Purchase finished goods



Purchase expense goods



Support



Define objectives



Define objectives



Define objectives



Set up vendors



Process transactions



Set up items



Provide systems



Requistion goods and services



Prepare management accounts



Place order



Prepare financial accounts



Support purchase finshed goods



Receive goods



Provide staff



Return goods



Provide legal services



Support purchase expense goods



Provide tax services



Ensure quality



Ensure health & safety



Manage the environment



Ensure security



Communicate




Share This Document


Related docs
Other docs by carthi
How to Apply for Financial Aid
Views: 304  |  Downloads: 1
Introduction to ERP Systems
Views: 816  |  Downloads: 142
Legal Aspects of Nursing
Views: 14648  |  Downloads: 147
Piano Pieces dianthus
Views: 158  |  Downloads: 1
How to Get Into a Top 5 MBA Program
Views: 834  |  Downloads: 45
Service Oriented Business Intelligence _SoBI_
Views: 513  |  Downloads: 52
mba_standalone
Views: 218  |  Downloads: 10
MBA Education in China and Shanghai University
Views: 83  |  Downloads: 3
Legal Issues for Not-For-Profits
Views: 375  |  Downloads: 8
by registering with docstoc.com you agree to our
privacy policy

You are almost ready to download!

You are almost ready to download!