AuditNet: Standard Management Audit Programs

Set 3 Personnel

Set 4 Procurement

Set 5 Stock & Materials Handling

Set 6 Production / Manufacturing

Set 7 Marketing & Sales

Set 8 After Sales Support

Set 9 Research & Development

Set 10 Information Technology

Set 11 Contracting

Set 12 Reputation Management

Building Societies & Home Loans Co.

National Health Service

+ Special comprehensive programs for Information Processing Facilities and Contract Management.

1.2 Each SAPG has been created in Microsoft Word for Windows Version 6 format, and therefore can be edited, updated and maintained like any other word processing document. The relevant system/activity files can be issued to auditors and data relevant to the audit project can be entered as a record of the work undertaken and also subsequently form part of the audit documentation file. Section 4 of this document provides guidance on the use of the SAPG.

1.3 The SAPG document files are compatible for use with later versions of Word, including Word 97 either as a freestanding application or as part of the Microsoft Office suite. However, the default directory structures vary between versions and users should consult Section 3 and their system documentation for further guidance on how to load the files for use.

2. THE SAPG FILES

2.1 The SAPG product is grouped in four main groups of file, the first contains the main group of 181 activity or system-level SAPG files, the second contains the four special comprehensive programs for Contract Management and the Information Processing Facility, the third contains five document files, and the last is a modified Template file which incorporates the macro files. The contents and loading of the main SAPG files are described in sections 2 & 3 of this document. Details of the macros and how to load them are contained in Section 8 of this document.

All the files in the first three groups noted in the preceding paragraph are in Word 6 format with the file extension .DOC.

2.1.1 The first group of 181 files relate to the individual system or activity-level SAPGs. They all have filenames in the form SAPGnnnn.DOC, where nnnn is a unique numeric reference which when used in connection with the index in 2.2 below, identifies the subject matter of the file.

2.1.2 The five document files have very specific purposes, as follows:

Filename Comments

FACTFIND.DOC This is the "Fact Finding Program", which is fully described in section 5 of this document.

HIGHVIEW.DOC This is the "High Level Review Program", which is described in section 6 of this document.

PROCESS.DOC This is the "Business Process" document, which is described in section 7 of this document.

SAPG_NEW.DOC This is a blank SAPG format for your own use in developing new and specific programs.

SAPG_XXX.DOC This is a special format blank SAPG document for use with the supplied macros when copying selected SAPG

contents – See Section 8 for further details.

2.2 The 181 activity or system-level SAPGs are detailed in the following index table. Please note that the "SAPG Ref." noted in the second column can be related to the Word filename (for example number 0105, "Risk Management" relates to filename SAPG0105.doc).

Set 1 – Management & Administration

0101 The Control Environment
0102 Organization
0103 Management Information
0104 Planning
0105 Risk Management
0106 Legal Department
0107 Quality Management
0108 Estates Management & Facilities
0109 Environmental Issues
0110 Insurance
0111 Security
0112 Capital Projects
0113 Industry Regulation & Compliance
0114 Media, Public & External Relations
0115 Company Secretarial Department
0116 Auditing the Board

Set 2 - Financial & Accounting

0201 Treasury
0202 Payroll
0203 Accounts Payable
0204 Accounts Receivable
0205 General Ledger / Management Accounts
0206 Fixed Assets (and Capital Charges)
0207 Budgeting & Monitoring
0208 Bank Accounts & Banking Arrangements
0209 VAT Accounting (where applicable)
0210 Taxation
0211 Inventories
0212 Product / Project Accounting
0213 Petty Cash and Expenses
0214 Financial Information & Reporting
0215 Investments

Set 3 - Personnel

0301 Human Resources Department
0302 Recruitment
0303 Manpower & Succession Planning
0304 Staff Training & Development
0305 Welfare
0306 Pension Scheme (and other benefits)
0307 Health Insurance
0308 Staff Appraisal & Disciplinary Matters
0309 Health & Safety
0310 Labor Relations
0311 Company Vehicles

Set 4 - Procurement

0401 Purchasing

Set 5 - Stock & Materials Handling

0501 Stock Control
0502 Warehousing / Storage
0503 Distribution, Transport & Logistics

Set 6 - Production / Manufacturing

0601 Planning & Production Control
0602 Facilities, Plant & Equipment
0603 Personnel
0604 Materials & Energy
0605 Quality Control
0606 Safety
0607 Environmental Issues
0608 Law & Regulatory Compliance
0609 Maintenance

Set 7 - Marketing & Sales

0701 Product Development
0702 Market Research
0703 Promotion & Advertising
0704 Pricing & Discount Policies
0705 Sales Management
0706 Sales Performance & Monitoring
0707 Distribution
0708 Relationship with Parent Company
0709 Agents
0710 Order Processing

Set 8 - After Sales Support

0801 Warranty Arrangements
0802 Maintenance and Servicing
0803 Spare Parts and Supply

Set 9 - Research & Development

0901 Product Development
0902 Project Appraisal & Monitoring
0903 Plant & Equipment
0904 Development Project Management
0905 Legal & Regulatory Issues

Set 10 - Information Technology
1001 IT Strategic Planning
1002 IT Organization
1003 IT Sites
1004 Processing Operations
1005 Back-up and Media
1006 Systems / Operating Software
1007 System Access Control
1008 Personal Computers
1009 Software Maintenance
1010 Local Area Networks
1011 Databases
1012 Data Protection
1013 Facilities Management
1014 System Development
1015 Software Selection
1016 Contingency Planning
1017 Electronic Data Interchange
1018 Viruses
1019 Electronic Office
1020 User Support
1021 BACS
1022 Spreadsheet Design
1023 Expert Systems
1024 IT Accounting
1025 Millennium Compliance

Set 11 - Contracting
1101 Contract Management Environment
1102 Project Management Framework
1103 Project Assessment and Approval
1104 Engaging, monitoring, & paying consultants
1105 Design
1106 Assessing Viability/Competence of Contractors
1107 Maintaining an Approved List of Contractors
1108 Tendering Procedures
1109 Contract & Tender Documentation
1110 Insurance & Bonding
1111 Selection & Letting of Contracts
1112 Management Information & Reporting
1113 Performance Monitoring
1114 Sub-Contractors & Suppliers
1115 Materials, Plant, and Project Assets
1116 Valuing Work for Interim Payments
1117 Controlling Price Fluctuations
1118 Monitoring & Controlling Variations
1119 Extensions of Time
1120 Controlling Contractual Claims
1121 Liquidations & Bankruptcies
1122 Contractor’s Final Account
1123 Recovery of Damages
1124 Review of Project Outturn & Performance
1125 Maintenance Obligations

Set 12 – Reputation Management
1201 General overview
1202 Financial performance, profitability and long-term investment value
1203 The board, the chief executive and the senior management team
1204 Quality of products and services – brand image
1205 Treatment of staff
1206 Social responsibility
1207 Customer service
1208 Information and communication

Set 13 -Building Societies/Home Loans Companies
BS01 Branch Security
BS02 Branch Operations
BS03 Management
BS04 Treasury Environment
BS05 Treasury Dealing
BS06 Investments – New Accounts
BS07 Investments – Account Maintenance
BS08 Investments – Account Statements
BS09 Secured Personal Loans
BS10 Unsecured Loans
BS11 Commercial Lending – New Business
BS12 Commercial Lending – Account Maintenance
BS13 Check Accounts
BS14 ATM Services
BS15 Credit & Debit Cards
BS16 New Mortgage Business
BS17 Mortgage Account Maintenance
BS18 Mortgage Arrears
BS19 Mortgage Possessions & Sales
BS20 Mortgage Mandates
BS21 Mortgage Annual Statements
BS22 Insurance Products
BS23 Staff Accounts
BS24 Securities

Set 14 - National Health Service
HS01 Purchaser Contracting
HS02 Provider Contracting
HS03 General Practitioner Fund Holding
HS04 Charitable Funds
HS05 Use of Health Centers
HS06 Private Patients
HS07 Welfare Foods
HS08 Residential Accommodation
HS09 Joint Finance
HS10 Residents’ Monies
HS11 Cashiers
HS12 Family Health Service Authority
HS13 Road Traffic Accidents
HS14 Nursing Homes
HS15 Trading Agencies
HS16 Pharmacy Stores
HS17 Risk Management
HS18 Cash Collection – Car Parks
HS19 Cash Collection – Telephones
HS20 Cash Collection – Prescriptions
HS21 Cash Collection – Shops/Restaurants
HS22 Cash Collection – Staff Meals
HS23 Cash Collection –Vending Machines
HS24 Income Generation
HS25 Staff Expenses
HS26 Losses & Compensations

SPECIAL COMPREHENSIVE PROGRAMS

SAPGCON1 Contract Management
SAPGCON2 Contract Management (Management checklist version with example controls and measures)
SAPGIPF1 Information Processing Facility
SAPGIPF2 Information Processing Facility (Management checklist version with example controls and measures)

GENERAL DOCUMENTS

FACTFIND Fact Finding Program
HIGHVIEW High Level Review Program
PROCESS Business Process Document
SAPG_NEW Blank SAPG Format
SAPG_XXX Special blank SAPG for use with macros – see Section 8 for details of use.

3. HOW TO USE & MAINTAIN THE FILES

3.1 All the files are provided in Word for Windows Version 6 format, and have the file extension .DOC. Individual filenames are described in the previous section (i.e. 2.1.1).

3.2 The files on the CD represent a valuable source of information and they should be adequately protected so that they remain accessible for use. In addition to securing the CD against losses, it is also suggested that you take further back-up copies of those files that you are likely to use and store them securely.

3.3 The supplied files can be regarded as the Source files which can be used as the foundation for creating specific Target files (each with their own unique filename) relevant to a particular audit project or company visit. The file-naming standard adopted by the user is very much a matter of choice, but should aim to uniquely identify the contents to a specific site, company and subject. In order to take these details into account, and also cater for different versions over a period of time to allow for subsequent audit visits, some form of accurate index should be separately maintained to support the prompt identification of individual files. Please note that the filename structure within MS-DOS and Windows has a limit of eight characters, whereas users of versions of Word designed specifically for Windows 95 will have the facility for longer file names upon saving the SAPG documents. However, all the supplied SAPG files have the conventional eight character filenames to ensure universal compatibility.

3.4 In order to access a particular file or combination of files, they should be copied onto the hard disk of the relevant personal or portable computer. Before undertaking this copying of files, the user will have to determine which Directory on the hard disk is normally used by the Word system to store document files. The default directory for version 6 of Word is WINWORD, but your own installation may have been customised and you can establish the relevant directory path by entering the Word system and initiating the File Open option from the File menu (or by clicking on the File Open icon). The dialogue box indicates the default path, which is normally C:\WINWORD. Later versions of Word use different default document directories (for example, Word version 7 for Windows 95 uses the default of C:\MYDOCUMENTS). Your Word documentation and Help system should provide such details. Although you can opt to use the default document directories, you may prefer to segregate the supplied SAPG documents into a separate directory.

3.5 As a general precaution, it is wise to save any amended version of an SAPG file with a different and unique file name, as this avoids overwriting the original version.

4. THE PRACTICAL USE OF THE SAPGs

4.1 The Standard Audit Program Guides (SAPGs) can either be used singly or in various combinations to provide detailed guidance and direction during audit projects and field visits. In following paragraphs we explore the format of the SAPG and how it can be used, but we should start by explaining how the sets of SAPGs are structured and the key contents.

4.2 Each SAPG covers a particular business system or activity (for example Accounts Payable or Staff Training & Development). The current SAPGs are divided into nine sets of related subjects (such as Management & Administration or Marketing & Sales). A full index of all the SAPGs is provided in section 2.2 of this document.

4.3 The scope and nature of each audit project may be different. This variability is driven by such practical aspects as availability of resources, the relative scale of the target business operations, logistical considerations, areas of specific management concern, etc. SAPGs can be used in combinations to match the audit coverage to the specified business systems and activities. Although each SAPG can be used in a "free-standing" context, they can also be linked in a number of ways to support the objectives established by audit management:

4.3.1 Most SAPGs cover systems that have interfaces with other systems (for example there are linkages between Purchasing, Accounts Payable and Stock Control). It follows therefore that perceived weaknesses in one system/activity may have implications for issues in another related system or activity. Each SAPG is provided with a table of such interrelationships so that the user can promptly determine the knock-on effects of any noted concerns (see 4.10);

4.3.2 The principal activities of an operating unit or overseas subsidiary can also be flexibly related to a number of individual SAPGs;

4.3.3 Away from the use of individual SAPGs to support the examination of discrete activities, there is the alternative view of a business expressed in terms of "Business Processes" (or alternatively "Cycles" although not every process is actually cyclic in form). These "Business Processes" can be described as being a series of related or interlinked economic events. The structure of individual SAPGs can also be used as the basis of using them in combinations supporting auditing on a Business Process basis. This approach is further discussed in Section 7 of these notes and we have provided a supporting document (i.e. PROCESS.DOC) which provides an analysis of SAPGs into the Process approach;

4.3.4 In any event, it is likely that most audit visits will be the subject of some prior research and preparation in order to ensure that the audit time spent on site is optimized for efficiency and direction, and that the auditors are focused upon the worthwhile investigations. In order to assist with such deliberations, we have supplied two further documents, namely "The Fact Finding Program" and the "High Level Review Program” These documents are discussed in sections 5 and 6 of these notes respectively.

4.4 The critical contents of each SAPG are a number of Risk or Control Issues relevant to the specific system. These are expressed in the form of questions which raise the issues in the context of what is being done to either achieve a desired outcome or to avoid an unwanted one.

4.5 The Risk and Control Issues are further divided into two groups, namely Key Issues and Detailed Issues. The former are the more significant and crucial points about the system under review and the aim should be to always take them into account during the audit. The latter category of issues take the user into more of the underlying system considerations, and would only be utilized if there was a potential weakness revealed as a consequence of considering the Key Issues. (We will return to the context of this division of issues later in these notes - see 4.9.1).

4.6 The purpose of the SAPG is to guide the auditor through an examination of the issues specific to the system or activity with the intention of recording the nature of measures and controls in place to either ensure that business objectives are achieved or that risks and exposures are successfully avoided. The auditor will need to record not only the nature of measures and controls in place, but also consider their effectiveness, and dependent upon that interpretation record the nature and results of any audit testing applied as a determinant in whether or not the situation needs to be reported to management for their consideration, etc. In subsequent pages, we examine in detail the format of the SAPG and how this information is recorded and interpreted.

4.7 SAPG is divided into three distinct sections (as noted below), the format and use of which are described in following paragraphs.

- A Title Page (see 4.8 overleaf);

- The Risk/Control Issues (See 4.9); and

- System Interfaces (See 4.10).

Please note that in all the examples that follow, the text in italics relates to that entered by the user, whereas the normal text is that included in the supplied form of the SAPG.

4.8 SAPG Title Page The title page has three separate areas, as follows:

4.4.8.1 Firstly an area which records the details of the subject matter covered by the SAPG and a reference number, for example

4.8.2 Secondly, an area used to record details about the specific audit project, for example

Company: XXX Inc.	Division: Orthopaedics	Country: USA	Site: Warsaw, IN
Audit Ref.: USA012-98	Date: 24 February 1998	Completed by: John Brown	Reviewed by: G. V. Rand

4.8.3 Lastly a section which describes the Control Objectives for the relevant system, for example

Control Objective(s):

(a) To ensure that the organizational structure is appropriate to the business and the achievement of strategic objectives; (b) To ensure that the organizational structure is determined by the business and operational needs and avoids needless sub-divisions and excessive levels; (c) To ensure that the structure enables the flow of key information upwards and outwards within the organization and across all the business activities; (d) To ensure that relevant responsibilities, authorities and functional terms of reference are defined and in place; (e) To ensure that responsibilities and authorities are adequately segregated in order to avoid conflicts of interest and the potential for fraudulent practices; (f) To ensure that the structure is periodically reviewed and any changes are agreed and authorized at a senior level; (g) To ensure that each manager's span of control is optimized and avoids either over or under-utilization; (h) To ensure that adequate staff resources are determined, authorized and provided in order to achieve the functional and business objectives;

(i) To ensure that the prevailing organizational structure is suitably documented and communicated to all relevant staff; and (j) To ensure that the organizational structure and the related functional divisions of responsibility are accurately and adequately reflected in the accounting and management information systems

Of course, the text in the last section of the page can be edited and updated whenever necessary by the user.

4.9 The Risk/Control Issues

This is the main part of the SAPG and consists of a table based on the headings noted below. It should be noted that all the cells in these tables are capable of expanding down the page as text is entered. Within Word (in default mode) if the text in a cell reaches the bottom of a page, the cell is divided and the text will span both pages. On this and subsequent pages, the use of each column is discussed.

Seq.	Risk/Control Issue	Current Control/Measure	WP Ref.	Effective Yes/No	Compliance Testing	Substantive Testing	Weakness to Report
1	Key Issues
1.1	What measures are in place to ensure that management are kept informed of production activities as the basis for their decision making?

2	Detailed Issues
2.1	How can management be assured that production downtime caused by plant breakdown is minimised?

4.9.1 The "Seq." column contains a sequential number used to identify each Risk/Control Issue. These issues are divided into two groups, Key Issues which are identified by being both in the sequence starting 1.1 and printed in bold text, and Detailed Issues which are in the sequence starting at 2.1. The Key Issues reflect the top-level and critical aspects of the system/activity under review and should always be considered by the auditor. There are normally between six and ten Key Issues noted on each system/activity SAPG. The Detailed Issues examine the relevant subject in greater elemental detail and should only be addressed by the auditor if the responses obtained in relation to the Key Issues suggest that there could be further inherent weaknesses in control. There can be any number of Detailed Issue recorded within an SAPG dependent upon the complexity and relevance of the system/activity.

4.9.2 The "Current Control/Measure" column is used by the auditor to record a brief description of any Controls or Measures that are in place to address the issues raised in the Risk/Control Issue column. Try to avoid going into too much detail in this column. This type of information can be obtained in a number of ways, for example, as a result of discussion with departmental staff, from a review of documented procedures, or from previous audit working papers. In practice there may be more than one control or measure in place which has an effect on the issue raised; any number of these can be noted in the Current Control/Measure cell.

The "WP Ref." column can be used to note any Working Paper cross-reference, such as a system flowchart or procedure manual.

Seq.	Risk/Control Issue	Current Control/Measure	WP	Effective	Compliance	Substantive	Weakness
			Ref.	Yes/No	Testing	Testing	to Report
1	Key Issues
1.1	What measures are in place to ensure that management are kept informed of production activities as the basis for their decision making?	Regular management report (type PRO78X) produced and circulated to unit managers. Contents are reviewed, discussed, and signed off at weekly team meetings.	Flow chart PRD04 page 8	YES

4.9.3 The "Effective Yes/No" column is used to note whether the recorded Current Control or Measure is likely to be effective in either supporting the required objective or counteracting any underlying risk posed by the issue. This judgment, which may need to be applied by the audit manager or supervisor, is an opinion on likely effectiveness. The responses recorded in this column can be used to determine those areas which should be subject to audit testing. The decision whether or not to apply audit testing will, of course, be relative to the user's own auditing standards, but a number of logical tactics could apply. For example, the consideration that a particular control or measure would be effective

(i.e. a YES response), may obviate the need for any testing, however, at this stage, the auditor does not know whether the control is actually being applied either correctly or consistently. This suggests that some limited Compliance Testing is desirable to ascertain if the control is actually being applied in an appropriate manner in every instance. In order to contain the amount of audit time spent on compliance testing, it is often desirable to identify the key controls and measures which represent the greatest potential and target these for compliance tests. The "Compliance Testing" column can be used to record the test applied and a summary outcome. Because space is limited, the user can elect just to record a working paper cross-reference to the detailed testing schedules rather than a full explanation.

4.9.4 In instances where either the compliance testing revealed an inadequate application of the measure or the control/measure was judged unlikely to be effective, further substantive testing may be justified to evaluate if a potential weakness has been exploited. Summary details of such substantive testing can be noted in the "Substantive Testing" column. By way of illustration, the following extract SAPG table incorporates example entries in the Compliance and Substantive Testing columns.

Seq.	Risk/Control Issue	Current Control/Measure	WP	Effective	Compliance	Substantive	Weakness
			Ref.	Yes/No	Testing	Testing	to Report
1	Key Issues
1.1	What measures are in place	Regular management report	Flow	YES	WP: Test No. 23	WP: Test No. 54	Recommend to
	to ensure that management	(type PRO78X) produced and	chart				management that
	are kept informed of production activities as the basis for their decision making?	circulated to unit managers. Contents are reviewed, discussed, and signed off at weekly team meetings.	PRD04 page 8		Reports for October 1997 examined - no evidence of examination or review by management	October & November reports examined in detail - 13 instances of production shortfall reported with no apparent follow-up action.	they ensure that this control is applied as defined in the procedures manual and that all reports are monitored for evidence of action taken to address reported problems. Discussed & agreed with Production Manager 01.03.98

4.9.5 The last column ("Weakness to Report") can be used to note that any points of audit concern arising from the audit review and testing which should either be discussed further with management or formally reported to them as a recommendation for action. The contents of this column can be interfaced with the reporting processes utilized by the audit function.

4.9.6 The completed SAPG file can be saved as a Word document file and printed out to form part of the audit working papers and permanent file.

4.10 System Interfaces

4.10.1 This page of the SAPG is intended to alert auditors to the likely interfaces between the system and activity being addressed in the SAPG and any others. Where weakness and control problems have been revealed during the system review, there may be consequences or implications for other systems either "downstream" or "upstream" of the system under review. The System Interfaces Table is intended to draw auditors’ attention to systems with either input or output connections. These connections may be based solely upon data flow or have additional operational implications. The example Systems Interface Table on the following page is provided for illustrative purposes and is related to an Accounts Receivable system.

EXAMPLE ONLY

SYSTEM INTERFACES FOR ACCOUNTS RECEIVABLE

It is unlikely that any activity or system will operate in complete isolation, but will need to interact with other data and systems in order to be fully effective. At a simple level, such interaction could relate to the input of data from a source system and the generation of amended or enhanced data which can be output to the next process. For example, taking coded transactions from an accounts payable system into the general ledger as the basis for subsequently producing management accounts information.

It is often at the point of interaction between systems where controls are critical. Auditors should be satisfied that the data moving between systems is consistent, complete and accurate, in order that the subsequent processes are undertaken upon a reliable basis.

The following table aims to plot, for the subject system of this Standard Audit Program Guide, the potential interfaces with other systems which may require audit attention. Indicators are provided to differentiate between those interfaces which act as input sources to the subject system and those which are potential output targets. The "SAPG Ref." column records the reference number of the Program Guide which addresses the issues for the related system

System	SAPG Ref.	Input Source	Output Target	System	SAPG Ref.	Input Source	Output Target
Management Information	0103			Stock Control	0501
Treasury	0201			Warehousing / Storage	0502
General Ledger & Management A/Cs	0205			Sales Performance/Monitoring	0706
Budgeting & Monitoring	0207			Warranty Arrangements	0801
Bank Accounts / Arrangements	0208			Maintenance and Servicing	0802
VAT Accounting (where applicable)	0209			Spare Parts and Supply	0803
Inventories	0211
Product / Project Accounts	0212
Financial Information & Reports	0214

5. HOW TO USE THE FACT FINDING PROGRAM

5.1 This document, which has the Word filename FACTFIND.DOC, can be used to record a range of key facts and general background data about the subject company or business operation. The document is divided into the following sections: -Title Page (a completed example is provided under paragraph 5.3) -

Section 1 - Nature & Scale of Business -

Section 2 - Organization and Key Contacts

Section 3 - Economic & Political Background

Section 4 - Policies and Procedures

These headings are self-explanatory, but each section contains a number of research questions which should be answered early on in the audit planning process so that the form and focus of the audit can be determined and planned for. For example, the nature and scale considerations explored in section 1 should enable audit management to identify those operations and systems which play a crucial role in the target company. This data can be used to suggest the most appropriate combination of Standard Audit Program Guides to utilise during the audit visit.

Sections 1 through to 4 have fields (see headings below) for the researcher to enter responses to the Research Issue questions and also to note the sources or working paper references supporting such responses. The Fact Finding Program can also be used to identify those specific issues which require follow up either prior to or during the audit visit.

5.2 The Internal Audit Fact Finding Program format can either be used on its own or in conjunction with the data gathered via the High Level Review Program which is discussed in Section 6 of these notes. p>

5.3 Title page of the Fact Finding Program

General Notes: This document contains a series of high-level Risk and Control Issues for a wide range of business related activities. The contents are based upon (and extracted from) the seventy-two detailed Standard Audit Program Guides (SAPG). Each grouping of issues is identified back to the relevant source SAPG by the use of a four digit reference noted in italics adjacent to the section title. The full range of activities addressed by this document may not all be relevant in every situation and in such cases the surplus sections can be marked as "Not Applicable".

7.1 This method offers an alternative approach to audit reviews not based upon the examination of discrete activities but by the broader scrutiny of larger "business processes". The nature of this approach and some of the implications of using it are summarized on the first two pages of the explanatory document PROCESS.DOC which are reproduced under paragraph 7.3.

7.2 Following the introductory text, the PROCESS document analyses the majority of the subjects contained in the system-level SAPG files as described elsewhere. An example of one of the analysis pages in reproduced under reference 7.4.

The standard set of Standard Audit Program Guides (SAPGs) is sub-divided into a number of separate Activities or Systems, each of which is capable of free-standing audit use. However, most of these systems do not operate in complete isolation and have both potential and actual bearing upon other systems. For example, Purchasing activities have a positive connection with Accounts Payable, with the order date from the former having a payment implication for the latter. Whether or not the SAPGs are used in isolation is partly a matter for how audit management perceives their universe of discrete audit projects, but it is likely that the control effectiveness of these separate systems will be dependent upon the flow of data and materials to and from other systems.

On the final page of each SAPG we have provided a simple table which aims to plot the potential input and output interfaces with other systems. This table can be used to suggest which other systems may have to be reviewed to form a wider impression of control effectiveness. It is often at the point of interface between systems and activities where the controls are weakest. It is logical therefore that where there are doubts about the integrity of controls within the primary system, an examination of the knock-on effects within the related systems may be justified.

A "systems" approach can be supported by the use of individual SAPGs with the added flexibility of using a number of related system SAPGs in combinations to provide wider coverage and take into account related issues and implications. This flexibility lets the user establish the breadth of focus applicable to the specific scenario taking into account the audit findings relative to an SAPG system. However, there are further possible ways of combining individual SAPGs in order to reflect larger associations of related systems, activities or economic events. Such combinations may be referred to as Business Processes. On the attached analysis we have utilized six categories of Business Process, as follows:

Treasury Revenue Expenditure Conversion Financial Reporting Corporate Framework The first four process categories (which are defined below) are built around a range of related economic events which may in turn generate transactions and interactions with systems.

Treasury Process: This process incorporates those activities concerned with an organization's capital funds. These activities may include inter alia definition of cash requirements, allocation of available cash to various operations, investment considerations and the outflow of cash to investors and creditors.

Revenue Process: This category is related to those activities that exchange the organization's products and services for cash, and therefore include (inter alia) the following elements: credit granting, order entry, delivery/shipping, billing, accounts receivable, and pursuing debtors.

Expenditure Process: This process could be defined to include those activities/systems that acquire goods, services, labor and property; pay for them; and classify, summarize and report what was acquired and what was paid.

Conversion Process: In this context, the term "conversion" relates to the utilization and management of various resources (i.e. inventory stock, labor, etc.) in the process of creating the goods and services marketed by the organization. The key issues in this cycle include accountability for the movement and usage of resources up to the point of supply which is then dealt with in the Revenue Process. Conversion Process activities include product accounting/costing, manufacturing control, and stock management.

The fifth category (Financial Reporting) is not based upon the basic processing of transactions reflecting economic events, but concentrates upon the crucial consolidation and reporting of results to various interested parties (for example management, investors, regulatory and taxation authorities).

The last category (Corporate Framework) incorporates those activities concerned with the development and maintenance of effective management, strategic, infrastructure and control frameworks which should aim to give form to the underlying direction, structure and effectiveness of an organization. This category can also include issues such as specific industry regulations and compliance.

It should be noted that there is likely to be selective interaction between the defined processes, for example the general management of cash is one of the key issues of the Treasury Process, but the Revenue Process is associated with cash receipts and the Expenditure Process will involve cash disbursements. In instances where a particular system or activity has a relevance to more than one of the named processes, we have differentiated between the Main (or primary) and Secondary relationships by the use of a large emboldened M and a regular S respectively on the attached analysis. This discrimination is intended to further assist users in selecting the appropriate combinations of SAPGs which can readily support the structural objectives of their adopted audit universe approach.

8.1 The standard SAPG product includes some useful macros for manipulating SAPG contents. Macros are automated routines or simple programs used to perform regular tasks. This section explains how to load and use the SAPG macros.

Eight macros are provided on the CD and are briefly described below. The first two are free-standing and the remaining six form two sets of three macros which can be used together to achieve the desired result. More detailed notes about each of the macros are provided later in this section.

ADDINFO Enables users to record further information about an SAPG issue by opening a large text cell below the relevant issue complete with additional topic headings. These new cells are referred to as “joined” cells. See section 8.6 below for further details.

CONTINUE Creates an additional row of SAPG data for a given issue, thus enabling users to continue to record information about that issue. See section 8.7 for further details.

The following two sets of three related macros each are used to extract selected SAPG rows and cells and copy them into either a separate table within the same SAPG document or a new SAPG document. This facility can be useful when summarising audit findings and points for reporting purposes.

ADDTABLE This macro inserts a new table at the end of the SAPG document so that users can copy in extracted issue information from the main SAPG table. Once this table is opened, issues rows can be automatically copied into the new table by use of either the MOVENORM or MOVEJOIN macros, which relate to normal SAPG format rows and Joined format rows respectively. NB: Joined cells are created by using the ADDINFO macro described above. See section 8.8.1 below for further details of ADDTABLE.

MOVENORM Normal format SAPG cells can be selected and copied into the new table at the end of the document with this macro - Macro ADDTABLE needs to be run once before either MOVENORM or MOVEJOIN can be used. See section 8.8.2 below for further details.

MOVEJOIN Joined format SAPG cells (i.e. those created by use of the ADDINFO macro) can be selected and copied into the new table at the end of the document with this macro - Macro ADDTABLE needs to be run once before either MOVEJOIN or MOVENORM can be used. See section 8.8.3 below for further details.

OPENFILE This macro opens a special format new SAPG document so that selected SAPG rows and cells can be subsequently copied

In addition to the macros mentioned above, a special formal SAPG document with the filename SAPG_XXX.doc is also provided on the CD. This file is used by macros ADDTABLE and OPENFILE and copies should be placed in two directories (i.e. C:\WINWORD and the default document directory for your specific version of Word if this different). Failure to do so will result in the failure of the relevant macros.

The above mentioned macros are provided on the Management Audit CD in the form of a separate Template file. The filename for this Template is SAPG.DOT, and with the exception of the special macros, the file contents are based upon the Normal Template format supplied with Word.

In order to use the macro facilities, it will be necessary to copy the SAPG.DOT template file onto your computer hard disk using the default subdirectory which contains your Template files; for free-standing versions of Word 6 for Windows this is normally:

NB: Not all user’s systems are identically configured and they may have been amended and have another directory defined to hold their templates and macros. For example, users of Word supplied as part of the Office 97 suite for use with Windows 95 are likely to have a default Template directory of

Once a Standard Audit Programme Guide document file has been opened in Word, you will have to switch to the SAPG.DOT template in order to taken advantage of the macro facilities. Once the SAPG.DOT file is copied onto the hard disk, it can accessed through the Template option on the File menu, and invoked by entering the name SAPG and clicking OK.

Once the SAPG.DOT template is activated, the user can gain access to the macros in a number of ways, and these are detailed in section 2 of these notes. However, one of the changes that is applied when the SAPG template has been loaded, is that the macro names are automatically added to the bottom of the Tools menu, and can be invoked by direct selection with the mouse.

8.4.1 By selecting the Macro option from the Tools menu, and then entering or selecting the required macro file name followed by clicking the Run button;

8.4.2 By opening the Tools menu and clicking directly on the name of the required macro from those listed at the bottom of the menu.

Subsequent sections of these notes fully describe the purpose and operation of all the available macros.

Users with macro command experience may wish to either further customise or edit the supplied macros. Lists of the macro contents are attached to the relevant sections of these notes for information and guidance. Selected macros contain further instructions and comments for the guidance of users, some of these remark (or REM) contents have been removed in the listings noted below, but can be viewed in the macro editing facilities of Word.

To enable users to enter additional information about a particular Risk or Control Issue by creating a large text cell below the relevant Issue, complete with appropriate headings (see the example printout attached at the end of this section). The new cell area will expand as text is entered, and may overspill onto the following page once the page limit is reached.

This macro is only designed to be used with the Word versions of the SAPG files and is likely to fail in execution or cause corruption to text, etc. if it is used with any other document file. It can be used with any of the following SAPG document formats:

-any of the system/activity level SAPGs;
-the High Level Review Programme;
-the blank format SAPG (or any user edited version based upon it); or
-any of the four special files for either Information Processing Facilities or Contract Management.

The macro is intended to be used in the main body of the SAPG where the Key and Detailed Issues are recorded. When applied, the macro will open up a text area below a specific issue row and enable users to record further details.

Before invoking the macro, ensure that the cursor is located in any one of the cells on the row relating to the required Issue. The cursor can be located anywhere in one of these cells; even in the middle of a block of text.

The macro can be initiated by either of the methods described in the introductory notes. If you wish to select the macro directly from the Tools menu, choose the menu option named ADDINFO. After a few seconds the macro will have created the new text area incorporating a number of headings, the first of which will feature of the relevant Issue.

Sub MAIN
StartOfRow
LineDown
TableInsertRow
TableSelectRow
TableMergeCells
LineUp
SelectCurSentence
EditCopy
LineDown
Bold
Insert "Issue Sequence No: "
Bold
EditPaste
Insert " " + Chr$(13)
Bold
Insert "AUDIT WORK DONE:" + Chr$(13)
Bold
Insert "FINDINGS:" + Chr$(13)
Bold
Insert "RECOMMENDATIONS:" + Chr$(13)
Bold
Insert "MANAGEMENT RESPONSE:"
End Sub

Example printout showing the effect of applying Macro ADDINFO to an SAPG file

Within Word, a table cell can run over more than one page if the cell contents exceed the page limit. Generally, this is acceptable, but users may wish to have the facility to open an additional row of cells for a particular Issue within the SAPG. This macro facilitates this by inserting a new row of cells and applying suitable labels and cross-references to the original cell. An example printout is attached, which indicates the effects of applying this macro.

-any of the 121 system/activity level SAPGs;
-the High Level Review Programme;
-the blank format SAPG (or any user edited version based upon it); or
-any of the four special files for either Information Processing Facilities or Contract Management.

The position of the cursor when invoking the macro is critical to its successful operation. Do not use the macro anywhere on either the first or last pages of the SAPG files as the format of these pages is incompatible with the functionality of the macro. Similarly, do not use the macro in cells or rows created using the ADDINFO macro described elsewhere in these notes.

The macro is intended to be used in the main body of the SAPG where the Key and Detailed Issues are recorded. When applied, the macro will open up a new row of cells below the row where the cursor was positioned and annotate this new row with Issue references so that users can continue to enter text. Please ensure that the macro is only applied once to any given row of cells.

The macro can be initiated by either of the methods described in the introductory notes. If you wish to select the macro directly from the Tools menu, choose the menu option named CONTINUE.

After a few seconds, the new row of cells should appear directly below the row where the cursor was located. Additionally, text labels will be entered into the new row which indicate that it is a continuation of the previous row of cells.

Sub MAIN StartOfRow LineDown TableInsertRow StartOfRow LineUp SelectCurSentence EditCopy LineDown EditPaste Insert "" + Chr$(13) Bold Insert "+See" Insert "Prev." Insert "Cell" NextCell Bold Insert "Continuation of Issue: " EditPaste StartOfRow LineUp EndOfLine Insert "" + Chr$(13) Bold Insert "+See" Insert "Next" Insert "Cell" End Sub

Example printout showing the effect of applying macro CONTINUE to an SAPG file

This suite of three macros will enable users to extract and copy selected SAPG rows and cells into a previously inserted table at the end of the current SAPG document. This is especially useful when extracting audit points and findings for summarisation and reporting purposes.

The ADDTABLE macro should be run first as this inserts the new table area at the end of the current SAPG document. Once the new table is inserted, the MOVENORM and MOVEJOIN macros can be run any number of times to move selected “normal” and “joined” format rows into the new table respectively.

Instructions, macro command listings and examples of the effects of processing are provided below for each of these three macros.

8.8.1 How to invoke the ADDTABLE macro The macro can be initiated with the cursor located anywhere in the main SAPG document area. This macro will insert a new table at the end of the current SAPG document. The new table is supplied in the form of a specific Word document file

called SAPG_XXX.doc. In order that this macro can execute correctly, it is essential that a copy of SAPG_XXX.doc file is located in the default
document directory, i.e. C:\WINWORD. If the file is not located in this directory, the macro will fail.
The macro can be run by applying the methods described in section 8.4 of these notes.

Sub MAIN
REM Macro: ADDTABLE
REM
REM MACRO COMMANDS
REM
REM The first command positions the cursor at the bottom of the current SAPG document in readiness to insert the new table area.
REM
EndOfDocument
REM
REM The next command inserts the SAPG_XXX.doc table document on to the last page of the current document.
REM
InsertFile .Name = "C:\WINWORD\SAPG_XXX.DOC", .Range = "", .ConfirmConversions = 0, .Link = 0
REM
REM Finally the cursor is returned to the top of the main SAPG table.
EditGoTo .Destination = "p'2'"
LineDown 1
REM
End Sub

Example printout showing the effect of applying macro ADDTABLE to an SAPG file - this image is taken from the last page of the SAPG document

This macro will copy the contents of a "normal" row from an SAPG file where the cursor is presently located to a previously inserted table area at the end of the current document. By "normal" rows we mean those that have all their columns in the original SAPG format. Another macro (i.e. MOVEJOIN) has been provided to copy across the "joined" format cells within the SAPG document.

This macro should only be run if the new table area has been previously inserted using the separate macro ADDTABLE. Please ensure that this is the

case, otherwise the selected data will be incorrectly copied to the bottom of the current document without the benefit of the SAPG table format.

The macro should be run from the "source" SAPG document with the cursor located anywhere along the row which the user wishes to copy. Only one row of data can be copied at a time and the macro can be repeated until all the required rows are transferred down to the new table area.

The macro can be run by applying the methods described in section 8.4 of these notes.

Sub MAIN REM Macro: MOVENORM REM MACRO COMMANDS REM REM These first commands will select the data in the row of the SAPG where the cursor is currently located and copy same to the clipboard. REM StartOfRow TableSelectRow EditCopy REM REM The next command will move the cursor down to the new table area at the end of the document. EditGoTo .Destination = "t+2" REM REM The following commands will insert a new table row at the end of the table and position the cursor in readiness to receive the selection copied from elsewhere in the SAPG document. REM TableSelectTable CharRight TableInsertRow StartOfRow REM REM The selected row data is now copied into the new table area. REM EditPaste REM REM Finally, the cursor is returned to the top of the main SAPG table so that the whole process can be repeated if required with either macro MOVENORM or MOVEJOIN. REM EditGoTo .Destination = "p'2'" LineDown 1 End Sub

Example printout showing the effect of running macro MOVENORM. The selected normal row contents have been copied into the new table located at the end of the SAPG document.

8.8.3 How to invoke the MOVEJOIN macro: This macro will copy the contents of a "joined" format row from an SAPG document where the cursor is presently located to a previously inserted table

area at the end of the current document. By "joined" rows we mean those that are single cells that cover the full width of the SAPG table. They are
normally created by the ADDINFO macro.
Another macro (i.e. MOVENORM) has been provided to copy across the "normal" format cells within the SAPG document.
This macro should only be run if the new table area has been previously inserted using the separate macro ADDTABLE. Please ensure that this is the

case, otherwise the selected data will be incorrectly copied to the bottom of the current document without the benefit of the SAPG table format.

The macro should be run from the "source" SAPG document with the cursor located anywhere along the row which the user wishes to copy. Only one
row of data can be copied at a time and the macro can be repeated until all the required rows are transferred down to the new table area.
The macro can be run by applying the methods described in section 8.4 of these notes.

Sub MAIN REM Macro: MOVEJOIN REM MACRO COMMANDS REM REM These first commands will select the data in the row within the "source" file and copy same to the clipboard. REM StartOfRow TableSelectRow EditCopy REM REM The next commands will move the cursor down to the new table area at the end of the document. REM EditGoTo .Destination = "t+2" REM REM The following commands insert a new table row at the end of the table and format it as a "joined" cell. The cursor is then positioned to receive the selection copied from elsewhere in the SAPG document. REM TableSelectTable CharRight TableInsertRow .NumRows = 2 StartOfRow TableSelectRow TableMergeCells StartOfRow REM REM The selected row data is now copied into the new table area. REM EditPaste TableSelectRow TableDeleteRow REM REM The cursor is then returned to the main SAPG table, so that the whole process can be repeated if required with either macro MOVENORM or MOVEJOIN. REM EditGoTo .Destination = "p'2'" LineDown 1 End Sub

Example printout showing the effect of running macro MOVEJOIN. The selected “joined” row contents have been copied into the new table located at the end of the SAPG document.

This suite of three macros will enable users to extract and copy selected SAPG rows and cells into a previously opened special format SAPG. This is especially useful when extracting points and findings for summarisation and reporting purposes.

The OPENFILE macro should be run first as this opens a new SAPG document in another Window. This macro uses a special document file with the

name SAPG_XXX.doc. In order to ensure the correct operation of this macro, the SAPG_XXX.doc file should be copied from the CD into the default

Once the new SAPG_XXX file is opened, the NORMCOPY and JOINCOPY macros can be run any number of times to copy selected “normal” and “joined” format rows respectively into the new file.

Instructions, macro command listings and examples of the effects of processing are provided below for each of these three macros.

This macro enables the opening of a suitably formatted Word document as the basis for copying in selected rows from another SAPG document file. We shall refer to these files as the "target" and "source" files respectively throughout these macro notes.

Please note that the copying of selected rows is subsequently handled by two other macros namely NORMCOPY and JOINCOPY. Further guidance on their use is provided below and in the notes provided in sections 8.9.2 and 8.9.3 below.

The overall intention is to provide macros to enable the copying of selected rows of text into another document, perhaps as the basis for either identifying the key points or in preparation of a management report.

When creating a "target" file for the first time in relation to a specific SAPG audit file, we have provided a specially formatted and prepared "target" file. This has the filename SAPG_XXX.doc and a copy of it should always be available in the default document directory in order that this macro can function correctly.

Macro OPENFILE should be run from the "source" SAPG document. Ensure that no other document files are open when using this macro.

Upon invoking this macro, the cursor can be located anywhere in the "source" SAPG document. Care should be taken to ensure that the correct "target" filename is specified in the Open File dialogue box. When initially creating the "target" file for copying purposes, you should always use the specially formatted file SAPG_XXX.doc.

Once the "target" file has been updated with the required copied rows, it can be saved with any filename that suits the user (excepting SAPG_XXX.doc). It is up to the user to maintain a record of the filename(s) of "target" files associated with the relevant "source" files. Once macro OPENFILE has been run, you can click on the Window for the "source" document in readiness to start the copying of selected rows to the newly opened file. There are two different macros provided for the copying process.

Macro NORMCOPY should only be used with "normal" rows of cells in the "source" document - that is a row with all the columns in their original format. Macro JOINCOPY should only be used with the full width of "joined" cell rows that have been previously created using the ADDINFO macro.

Sub MAIN REM Macro: OPENFILE REM The first commands deal with the opening of the "target" file and requires the user to enter the appropriate filename and directory path information into the standard File Open dialogue box. REM Once the correct details have been entered, the OK box should be clicked. REM Dim dlg As FileOpen GetCurValues dlg x = Dialog(dlg) FileOpen dlg REM REM This command ensures that the cursor is located in the table area of the "target" file. This is required for the successful execution of the subsequent copying macros REM TableSelectTable StartOfRow REM REM The following commands split the Window so that both documents can be displayed and returns the cursor to the "source" document so that a row can be selected for copying using either the NORMCOPY or JOINCOPY macros. REM

This macro will copy the contents of a "normal" row from an SAPG file where the cursor is presently located to a previously created separate Word document file. By "normal" rows we mean those that have all their columns in the original SAPG format. Another macro (i.e. JOINCOPY) has been provided to copy across the "joined" format cells within the SAPG document.

To create the correct operating conditions before running this macro, the user should run macro OPENFILE in order to open the "target" document file.

At this point, both the "source" and "target" document Windows should be open on the screen at the same time. Macro NORMCOPY should not be run unless both documents are open in this manner - failure to observe this requirement will result in the failure of the macro. Additionally, no other document files should be open - please check beforehand and close down any other Word file Windows.

The macro should be run from the "source" SAPG document with the cursor located somewhere along the row which the user wishes to copy. Only one row of data can be copied at a time and the macro can be repeated any number of times until all the required rows are transferred to the "target" document file.

Users should ensure that once updated, the "target" file is saved using the standard Word File Save or Save As facilities. If you are using the supplied blank file SAPG_XXX.doc, be sure to save the updated version with a different document filename.

Sub MAIN REM Macro: NORMCOPY REM MACRO COMMANDS REM REM These first commands will select the data in the row within the "source" file and copy same to the clipboard. REM StartOfRow TableSelectRow EditCopy REM REM The next commands switch the cursor to the "target" document file, insert a new table row at the end of the table and position the cursor at the bottom of the table format in readiness to receive the selection taken from the "source" document. REM For this part of the macro to work correctly, the cursor must be located in the table area of the "target" document, otherwise an error message is displayed and the macro will be aborted. REM

WindowList 1
TableSelectTable
CharRight
TableInsertRow
StartOfRow
REM
REM The row selected from the source document will now be copied into the "target" document.
REM
EditPaste
REM
REM The cursor is then returned to the "source" document, so that the whole process can be repeated if required with either macro NORMCOPY or JOINCOPY.
REM
WindowList 2
REM
End Sub

This macro will copy the contents of a "joined" format row from an SAPG file where the cursor is presently located to a previously created separate Word document file. By "joined" rows we mean those that are single cells that cover the full width of the SAPG table. They are usually created using the ADDINFO macro.

Another macro (i.e. NORMCOPY) has been provided to copy across the "normal" format cells within the SAPG document. "Normal" cells are those that have all their columns in the original SAPG format.

To create the correct operating conditions before running this macro, the user should have run macro OPENFILE in order to open the "target" document file.

At this point, both the "source" and "target" document Windows should be open on the screen at the same time. Macro JOINCOPY should not be run unless both documents are open in this manner - failure to observe this requirement will result in the failure of the macro. Additionally, no other document files should be open - please check beforehand and close down any other Word file Windows.

Users should ensure that once updated, the "target" file is saved using the standard Word File Save or Save As facilities. If you are using the supplied blank file SAPG_XXX.doc, be sure to save the updated version with a different document filename.

Sub MAIN REM Macro: JOINCOPY REM MACRO COMMANDS REM REM These first commands will select the data in the row within the "source" file and copy same to the clipboard. REM StartOfRow TableSelectRow EditCopy REM REM The next commands switch the cursor to the "target" document file, insert a new row at the bottom of the table, format this new row as a joined cell, and position the cursor in r readiness to receive the selection taken from the "source" document. REM For this part of the macro to work correctly, the cursor must be located in the table area of the "target" document, otherwise an error message is displayed and the macro will be aborted. REM WindowList 1 TableSelectTable CharRight TableInsertRow .NumRows = 2 StartOfRow TableSelectRow TableMergeCells StartOfRow REM REM The row selected from the source document will now be copied into the "target" document. REM EditPaste TableSelectRow TableDeleteRow REM REM The cursor is then returned to the "source" document, so that the whole process can be repeated if required with either macro NORMCOPY or JOINCOPY. REM WindowList 2 StartOfRow REM End Sub

Sponsored by