AuditNet® Ask the Auditor Forum

Audit Programs

Disclaimer


Also post your question at AudiTalk The AuditNet Discussion Forum

AuditPrograms-l Discussion Forum Archives


 

 

 

Index of Audit Programs Archive

My question -concern relates to the effectiveness of the fraud related audit programs in general. Conditions such as : 1) Fake tenders obtained by the purchasing dept. 2) Inflated tenders obtained from the competing suppliers with the ultimate aim that in the future they will take an order which for the time being have lost. 3) Cases where a mark-up of the offered price returns (black money) to the purchasing department and part of it goes up to management. Cannot usually or easily be addressed by audit programs unless i make a mistake. I would appreciate your opinion on how could such risks be addressed by an audit step or any alternative means to capture them?

 

 

  Where can I find audit programs for the treasury department of a commercial bank together with audit objectives, controls and procedures for back office, middle office and front office?

You can find audit programs for the banking industry by clicking here (you must be a registered user to access this page). You should also check with BankersOnline as they have bank auditing resources as well as a discussion forum for bankers.

 

I think could be useful to classify the Audit programs, which now are alphabetically listed, according to two key-words: -Functional Area (i.e. Mkt, Adm, Fin, Contr., R.H., Legal, I.T. etc.) -Argument (i.e. invoice, tax, general acct, payments, recruitment, travel etc.) This classifications, coupled with an order capability of the list, may improve the use of the database. Even other ordering items may be included, such as date, language, file extension etc.)

Great idea! Perhaps you or someone else would like to take on this task and develop a classification system. There is already a page that has the programs organized by broad subject areas (www.auditnet.org/asapind2.htm).

I am looking for an audit program for auditing an ERP implementation.

I performed a Google search using "ERP Implementation Audit Program" for the query and the 2nd item returned was a memo from the CAE at the University of Florida that included an ERP audit program for the above subject. There are other resources, tools and presentations on auditing and risks for ERP systems on the SAP Audit page of AuditNet®.

I am looking for an audit program to audit performance measures.

While many local government internal auditors are involved in auditing performance measures there have not been a significant number of programs contributed to AuditNet® on this subject.  There are some sites that do however provide guidance. Start with the Maricopa County Internal Audit's Performance Measurement Program Information package. It includes an overview of the process as well as an audit checklist. The AICPA has information on performance auditing activities including a generic audit methodology. The Association of Government Accountants provides guidance on the subject in conjunction with their Service Efforts and Accomplishments program and certification program. The Texas State Auditors office has reports on their audits of performance measures.

AuditNet® has a page of performance measurement resources for auditors which should provide you with general information on the subject.

Other useful tools would be best practices for reporting performance measures such as the report from the UK National Audit Office or the guide from the New South Wales Australia Audit Office.

I am auditing a not-for-profit board (specifically looking at Corporate Governance), I am looking for audit programs and or any checklists to look at the effectiveness of Boards.

Start with the A.I.C.P.A. Audit Committee Effectiveness Center for guidance and resources. For a consultant's advice on assessing a Board click here. For not for profit Board governance best practices click here for tools and resources. You might also check the Corporate Governance page on AuditNet for checklists and tools for assessing Board effectiveness. The same principles should apply regardless of whether it is a for profit or NFP.

I wanted to get audit procedures for an audit of the Facilities Maintenance Department of a category one Airport.

The best place to find audit procedures for a specific industry is through a special interest group. Start with the Association of Airport Internal Auditors. Networking with members of the Association should provide you with resources and tools for all facets of auditing airports. In the U.S. some airports are operated by local governments or airport authorities. Find out who operates those airports and then contact management for internal audit contacts. You should consider posting a message on audit-related discussion lists to see if other auditors could help based on work performed in the facilities maintenance cycle. Another method to find audit procedures would be to look for similar industries that would conduct facilities maintenance operations and contact their internal auditors. The way to do this would be using meta information. This is an underutilized search methodology that focuses on using the power of the Internet to find information that may not be directly available via the Web.

Do you have any procedures for airport security and operations audit to ensure compliance with ICAO standards and best practices?

Start by obtaining the official standards. They should be available from the IATA operational safety audit site. Download your free copy of The IOSA Standards Manual.  Also available are The IOSA Programme Manual and The IOSA Checklists.You would then conduct a compliance audit to ensure that the organization complies with the established standards. 

I have been newly assigned a Internal Auditor in ship chartering company. Essentially what I am looking for is an industry specific audit (i.e. vessel chartering) guidance.

Lloyd's Register offers Security management ISPS Ship and Port Practical Pack. I would also suggest that you contact other large commercial charter companies and network with their internal auditors. You should be able to find other similar companies by using Internet meta-information. Also consider audits of the standard cycles that you would find in any business organization such as accounts payable, accounts receivables, purchasing etc. There are audit work programs for these cycles available through the AuditNet inventory.

I have been asked by one of my clients who are a record company to audit the royalties they receive. Does anyone have a program that would cover this in the UK?

 A royalty examination is a detailed examination of a limited set of transactions and activities related to the manufacture, distribution, and sale of goods resulting in payment of a potentially incorrect royalty to the accountant's client. This question has been asked several times and you should be able to find previous Ask the Auditor responses by using your browsers "find on this page" feature (under Edit in MSIE) and enter "royalty". In general, royalties are amounts paid to the creator of tangible and intangible property or ideas. For a fee, the owner permits others the rights of exploitation. The terms and conditions for payment of royalties are based on contracts and law. Royalty audits are therefore contract audits and rely heavily on the formal legal documents. These documents would set out the conditions under which royalties are paid, when they are paid, reporting requirements etc. They are therefore usually tailored to each specific engagement.

There are several licensee royalty audit programs in the AuditNet® inventory.  Also, click here for a brief guide to royalty auditing. You might also take a look at the U.S. Internal Revenue Service Market Segment Specialization guides which include audit programs for the music industry. Another potential resource is an article License Agreements: Are You Getting the Royalties You Bargained For?

Question: We are introducing a new fraud action plan within the Agency and we wish to start the assessment on internal controls on certain areas. One of those areas is the assessment of the background screening that the Agency conduct prior to appointment of employees i.e. reference check, education check, experience check, criminal record .... etc. do you have an audit program or assessment of internal controls related to this subject.

Response: You should begin this review by determining whether your organization has a background checks policy. All organizations should have a pre-employment screening program. At a minimum, screening should include character and background checks, reference and prior employment checks, review of education, salary history, job-title history, criminal conviction record, driving record, and credit history.  If they do, then review the background checks policy. If not then try searching for sample policies on the Internet. For example here are security guidelines for the electricity industry for employment background screening.

While there are no strict mandates for pre-employment screening, the best tests for determining how much is necessary are the after-employment results. For example, auditors should find out whether pre-employment screening would have prevented the selection of people who have done any of the following:

  • Lied on their application about their employment, salary history, education, driving history, or anything else
  • Stolen from the company
  • Been in accidents or received traffic citations while operating company vehicles
  • Proved unqualified for the specific job assigned
  • Become involved in conduct that reflects poorly on the facility

The audit program needs to be developed to fit the background check profile desired by the "Agency". Several aspects need to be considered to insure the integrity of the system:

Adequacy of sources of information and limitations of these sources

  • attributes for verification must be documented, by job type or description if  necessary
  • responsible management must be aware of all limitations of sources of information and make sure the information gathered fits the verification profile desired
  • industry accepted verification practices followed?
  • Audit trail developed during the check process
  • can you prove you followed the verification procedures?

Adequacy of recordkeeping

  • secure
  • for the prescribed and proper period of time

Follow up processes

  • are any follow up / periodic verifications required for sensitive positions or in general, such as drug screenings, etc?

This is a "common sense" type review, however the auditor needs to be
familiar with the concepts and tools used (or available for use) in the verification process. I would make some contacts in the private detective arena (the folks that do this) to learn how they do it. There is a lot of information out there, so you must decide how much of it is relevant to your business and and what may pose a security risk to you. The more information you gather, the higher the cost.

An internal control questionnaire will be included in the AuditNet® inventory in April 2004 on background screening that is a companion to the recruitment of staff ICQ.

Protiviti KnowledgeLeader, a fee based subscription site has a checklist for reviewing background policies. Here are some additional sites that have checklists for background reviews:

SafeHR.com

The ABC's of Background Checking

Introduction to the Human Resources Audit

Checklist for Safe Hiring

Please consider sharing the audit program that you develop with the AuditNet® community.

 

Question: I'm looking for an audit program on a random (drug/alcohol) test program for transportation (railroad) employees.

Response: You might want to start with U.S. Department of Transportation FTA Safety and Security site drug and alcohol testing audit program. The Washington Aviation Administration has a checklist for anti-drug and alcohol program audit. Click here for sample FAA/DOT audit protocols. I hope these help get you started in this specialized audit area. I would also suggest you network with other railroad industry audit professionals to find out how they audit random drug/alcohol test programs. Perhaps AMTRAK's Office of Inspector General could provide some assistance.

Question: I have to set up a audit department (from scrap) for a logistic company. This company provides normal transport activities (freight by truck and train, sea freight and airfreight), but also logistic activities, such as warehousing, projects and supply chain management. Later for example covers just in time deliveries for automobile companies (working with EDI).  As I am just starting, so I am not yet very familiar with the details of this company.

Where do I find audit programs covering the operational area of the business for transport and logistic companies?

Response: This is a complex question given that this is a new area for you. Your first task is to become familiar with the operational details of the company. You should conduct a business risk analysis and inventory of audit units. The audit committee or senior management may provide some direction as to high risk areas for you to concentrate on. The result should be a prioritized audit plan. At that point you will have a better idea of the specific operational areas that you will be auditing. Audit programs on operational areas such as you have mentioned are available in the inventory available on AuditNet®.  The IRS has an audit guide for the trucking industry that may help. For those areas where audit programs are not available online you may have to use online forums and network within your industry. Find contact information for other similar companies and see if they have an internal audit department. Call them and see if you can establish a relationship. Sometimes auditors form informal special interest groups for networking. Visit the IIA Web site and see if there are local chapters available in your region where you can network with other auditors. 

Question: Would you be able to provide any guidance on where I can find an audit work program for succession planning? Also, any better practice or benchmarking guidance documents on succession planning would be great. I work in an electrical transmission company but I assume succession planning is pretty similar across most industries.

Response: Succession planning is a process designed to ensure the continued effective performance of an organization by making provision for the development and replacement of key people over time. Succession planning is generally considered to be a strategy of work force planning.  There is an article that will appear in the January AuditNet® newsletter on Succession Planning for Auditors. There are few audit programs available on the subject however there is an Audit Report on Succession Planning completed by the Canadian Public Service Staff Relations Board. Also the following resources may help:

Classification Workforce Planning Guide

Guide to Auditing the Management of Workforce Adjustment

Guide to Workforce Planning in Local Authorities

When you develop your program please consider sharing it with us!

Question: I am planning an audit of the pharmacy department having 7-10 pharmacy satellite, storing, dispensing, compounding medicines to cater the need of the hospital. If anybody can share audit program?

Response: Begin by looking at the resources in the next question such as the AHIA. The Purchasing and Distribution Interest Group where they have posted Guidelines for the Audit of Hospital Pharmacy Procurement, Storage & Distribution. The Royal Pharmaceutical Society of Great Britain produces model standards for self audit in community pharmacy in England. You might want to seek out local health departments for any legal requirements that should be incorporated into your audit program. Look at audits performed by state and local government agencies to get ideas and contact the jurisdiction for audit program they used. Internet meta-information is a powerful resource. You should also post a message on the auditprograms-l discussion group to get input from other auditors.

Question: Where can I find a Pharmaceutical Billing and Collections Audit Program? The audit will be operational, financial, and compliance in nature.

Response: There are several pharmacy related audit programs in the AuditNet inventory. Check with the American Society of Consultant Pharmacists for resources. The Association of Healthcare Internal Auditors has an audit program library accessible to members only. You might also look at audits performed by other organizations in this area and contact them for assistance/guidance. Here are a few examples:

Combined Assessment Program Review of the VA Long Beach Healthcare System

Maricopa Integrated Health Systems

I would also suggest that you network with other internal auditors in your industry area to share information and resources. AuditNet® would be willing to act as a clearinghouse and set up a special interest group to facilitate this network.

Question: Any suggestions on where I can locate a call center audit program?

Response: There is a call center audit program in the AuditNet inventory in Section B Information Systems Technology Audit Programs.

Question: Where can I find audit programs on auditing a gas & power company at the wholesale and retail levels?

Response: There are several audit programs for gas and oil refineries in the AuditNet inventory. There is also an IRS audit program for the oil and gas industry that may be helpful. There are some power company audit programs in the supplemental audit programs section of this site. Look at the management and operational audit programs. You could also conduct a search on Google on this topic to locate consultants or training for this area. I would also suggest that you network with other power company internal auditors to share resources. This may take some creativity but using Internet meta information is a powerful search tool. First locate the Web sites for power companies such as Potomac Electric and Power, Washington Gas Light, Florida Power and Light or others in your state. Call them up and ask for their internal audit department. Establish a dialogue with power company internal auditors and establish an informal (or formal) network to share information and resources. AuditNet® would be willing to act as a clearinghouse and set up a special interest group to facilitate this network.

Question: Where can I find audit programs related to mortgage loan production and loan servicing programs?

Response: Start by looking at the audit programs on the AuditNet® banking page. There are a group of programs for loans. The Mortgage Banking Comptroller's Handbook from the OCC includes an audit program for mortgage loan production. You might also consider purchasing one of the following publications: Mortgage Compliance Audit Program or the Regulatory Compliance Audit Program from Alex Information. Try using the following query: audit program for loan servicing and locate some organizations that have audited in this area. Contact them via their e-mail address and ask a copy of their audit work program. Examples might include Audit of Loan Processing and Disposition Procedures, Southwest Bank, Jennings, Louisiana.

Question: I am looking for an audit program for sundry creditors will you be able to assist?

Response: There are a number of audit programs on the Internet for credit and collections and accounts receivable. Begin by looking in the AuditNet® audit programs inventory. Look for programs for accounts receivable, collections, and credit and collections. You will find additional programs for accounts receivable here. Michigan State government also has an accounts receivable audit program available. If these do not meet your needs then I suggest you post a request on the auditprograms-l discussion list.

Question: I am looking for an audit program to audit the security for Novell Netware 4.X.

Response: For a Novell Netware audit program which includes security click here.  

Question: Currently doing an audit on our organization's Workers' Compensation program. We are self insured. Anyone have an audit program that I can look at?

Response: Workers' compensation insurance is one of the costs of doing business in the United States. Employers can and should dramatically reduce their workers' compensation expenditures, and thus their overall costs, by examining workers' compensation as they would any other cost of doing business. They should undertake this effort independently of external factors, such as governmental initiatives that are either in effect or proposed. Click here for a link to a sample chapter from a Workers' Compensation Guide that may help. Click here for another book on Workers' Compensation.

It helps to know what where your company operates as Workers' Compensation is typically a state issue. For example:

A Guide for Vermont Business Owners: Workers compensation Insurance

North Dakota Workers' Compensation Guide

Oregon Workers' Compensation Division

Many government organizations have audited workers' compensation. You should conduct a search using Google and then contact the jurisdiction and ask for a copy of their audit program or steps that they used in their examinations. Here are a few to get you started:

City of Austin Employee Safety Audit

U.S. Department of Veteran's Affairs Workers' Compensation Program Resources Page

The Internal Auditor for the City of San Jose has a risk matrix for Workers' Compensation. 

When you have developed an audit work program for Workers' Compensation consider sharing it with others by sending a copy to editor@auditnet.org

Question: Has anybody got a security/audit checklist for tomcat? (We require a comprehensive checklist for websphere, apache tomcat, apache)

Response: The best resource available for Tomcat may be the Apache Jakarta Project where you will find a Tomcat mailing list. You might also check the Tomcat User List Archive. The Apache Tomcat Security Book may be helpful.

If you or any other reader develops a Tomcat security/audit checklist send it along to editor@auditinet.org to share with others.

Question: Where can I find the Bank ACH Self-Audit Program that Banks are required to perform by December of each year?

Response: The Financial Manager's Society publishes the Financial Institutions Internal Audit Desk Reference with the FMS Audit Program Collection that contains an ACH audit program. The New England ACH Association produces a publication called ACH Self Audit Guide. You might also want to check the NCUA Examiners Guide for information about ACH self audits. Finally check the audit programs available from this site as there are banking related programs including an ACH work program and an ACH ICQ.

Question: Can you please provide me a detailed audit procedure on the review of pier/port operations?

Response: This is a specialized area that may not be generally available via traditional Internet sources. The UK Department of Transport provides a guide to the good practice of port marine operations that you should review. The American Association of Port Authorities produces an environmental management handbook which may provide some help. Look at other Port Authorities for types of audits they conducted and then find contact information on their Web sites. Then ask their auditors for tips or audit programs on port operations. For example the Virginia Auditor of Public Accounts audited the Virginia Port Authority. You should be able to find internal audit contacts at other port authorities by using the query "port authority" +audit in a Google query.

Question: Where could I obtain an audit program for value added taxes (VAT)?

Response: The Irish Revenue Department publishes a Revenue Audit Guide for Small Businesses that may be useful. The IIA UK and Ireland offer a course on Auditing VAT. Click here for specific steps in auditing VAT.

Question: I would like to request information or an actual audit program covering Banking Regulatory Reporting Applicable. Specifically, FED report 2900 and Quarterly Call Report.

Response: Start by reviewing this earlier question. You should also check the AuditNet bank and financial institutions page, The FDIC site is a must for regulatory reporting and audit guidance as they regularly issue financial institution letters. You should also tap into Internet meta-information by contacting other bank auditors and ask them to share their audit work programs in the area of regulation and call reporting.

Question: I am trying to locate an audit program or some sort of audit guideline pertaining to the audit of Political Action Committees PACs). Specifically, the audit program should address compliance with the regulatory requirements and reporting requirements of PACs. I have done some searches, but have not specifically found such an audit program. Can you help?

Response: I am not aware of specialized audit programs or guidelines covering PACs but that does not mean that they do not exist. There is a campaign finance audit manual available from the city of San Francisco that may provide some general guidance. Political action committees have specific compliance and reporting requirements as stipulated by the Federal Election Commission (FEC) and the Internal Revenue Service. As you identified this as a compliance audit perhaps you should start with the regulatory requirements and then test for them. It should be relatively straightforward to develop an audit program testing for the regulatory compliance requirements. You should be looking at disclosure requirements pertaining to contributions, expenditures, accrued expenditures, and loans, including itemization when required; restrictions on contributions, loans and expenditures; accuracy of total reported receipts, disbursements and cash balances as compared to bank records; and compliance with all record-keeping requirements.

Here are some additional Web sites where you may be able to get more information:

Check with the State Board of Elections for your state to review specific state laws:

Question: Could you please provide me with audit programs / links concerning the audit of Television Stations? Specifically I am looking to draft an audit program on the Substitutions/Trafficking Process, however any audit programs/links pertaining to the audit of TV Stations would be appreciated.

Response: Finding industry specific audit programs can be difficult. Because different industries have unique features it is necessary to network and find other auditors within that industry. I would suggest you post a message on one of the general audit discussion lists such as Audit-l. Ask if there are any auditors in the broadcasting industry that would like to exchange ideas/information. Another method of finding auditors in this industry would be to go to peer organization Web sites and send them an email requesting contact information for their internal audit department. Try contacting the National Association of Broadcasters for peer companies. While auditing TV stations may have some unique areas there may be some common areas where you could find existing audit programs. For example, accounts payable and receivable, human resource and payroll, purchasing etc. You can find audit programs for these areas in AuditNet or you could try Protiviti KnowledgeLeader, a fee based subscription service. Finally if you have unique audit programs for the broadcasting industry consider sharing them with AuditNet®.

Question: Is there an Audit Program for Cash account under SAP System?

Response: Go to the AuditNet® Virtual Library page and click on SAP Audit. The AuditNet® SAP page has various documents that should prove helpful especially the SAP Auditing Manual. There is also a discussion list for auditors using SAP and other ERP systems. 

Question:  I am looking for an example of a risk management program/plan for investments (i.e. property trusts, local and overseas equities, fixed interest securities, money market and cash deposits) detailing the objectives, risks and controls.

Response:  There is a wealth of information on audit risk management for investments available on the Internet. Check out the PricewaterhouseCoopers working guide for an investment company's audit committee which may provide some direction. Also the N.Y. Office of the State Comptroller published investment guidelines for public authorities. The Capital Market Risk Advisors group publishes Risk Standards for Institutional Investment Managers (site registration required).  For an audit program try the Texas State Auditor which has one for compliance with the Public Funds Investment Act that include steps for evaluating investment policies and procedures. For training in this area consider the Institute of Internal Auditors seminar entitled auditing investment activities.  You might also consider contacting the internal auditors at Charles Schwab as they implemented COBIT and IT governance for their operations. Two publications you should consider adding to your library include Auditing Investments from the IIA and The Financial Managers Society Internal Audit Desk Reference which includes objectives, risk and controls for financial institutions. 

When you have developed your audit program/guide for this area consider sharing it with AuditNet! 

Question: Do you have an audit program for disposition of overstock inventory?

Response: Start with our Audit Programs page which includes the following audit work programs for inventory:

Next stop should be Protiviti KnowledgeLeader, a fee based subscription site that includes an audit work program space. There are 4 inventory audit programs at their site. AuditNet® users can sign up for a free 30 day evaluation. 

I would also suggest reviewing the GAO report on Inventory System Checklist which includes a section on inventory disposition. For best practices on inventory management check out GAO's Best Practices in Achieving Consistent Accurate Physical Counts of Inventory and Related Property. If you develop a specific audit program for disposition of overstock inventory consider sharing it!

Question: Can you provide examples of good audit programs for hospital inventories, particularly in the financial evaluation and testing of inventory values?

Response: The best place to start a search for hospital or healthcare related audit programs is the Association of Healthcare Internal Auditors. They maintain an audit program library accessible by members only. The State of Iowa has a hospital audit program guide that includes a section with audit steps for inventory. Another approach is the use of Internet meta-information. For example look for organizations that have issued audit reports on hospital inventory management and contact them and request a copy of their audit program. ie. DoD OIG audit report. For best practices on hospital inventory management perhaps a search of vendors such as Hospital Inventory Specialists would be worthwhile.

Question: I am currently busy with the planning phase of an internal audit on warranty claims relating to trucks and buses. I will appreciate any related Audit Programs that will assist me in developing an appropriate Audit Program regarding the afore mentioned audit.

Response: The AuditNet® audit program inventory includes some audit programs for fleet maintenance. You might want to check some local government audit departments. There are audit programs for fleet maintenance that include warranty claims. Start with the City of Tampa Internal Audit Department. The IRS Market Segment Specialization Program has an audit guide for auto dealerships and trucking companies. Contact the City of Austin Texas Auditor who also reviewed fleet maintenance and repair. Also consider Protiviti KnowledgeLeader, a fee based subscription site, as they have a warranty/field services audit program. AuditNet users (and others) may sign up for a free 30-day evaluation for this content rich site.

Another potential resource is from Ufleets.com, a Website focusing on utility company fleet maintenance. They have the following articles in their publication:

Question: Is there an Audit Program for Disposal of Waste Materials?

Response: Proper disposal of waste material would come under the area of environmental auditing. An audit program for this area would be dependent on the type of waste materials that you are disposing. Laws and regulations may govern what your organization can and must do when disposing of waste materials. This would come under the category of compliance auditing. For example, the Minnesota Pollution Control Agency has a environmental audit checklist for solid waste. They also have an automotive service providers audit checklist for aerosol containers.  Their publication site has various publications including risk based site guidance documents. 

Question: I understand that the IIA has a lot of audit program for its members. I am a member of IIA but am unable to locate the section in the IIA website. Can anyone direct me to the right site?

Response: The Institute of Internal Auditors has a library of publications available for sale that include audit work programs. For example the IIA is developing an auditors toolbox which will include audit programs and other materials available for purchase by members. There are also audit handbooks and other publications that include audit programs. Of course the primary resource for free audit work programs continues to be AuditNet® with an inventory of over 500 audit work programs. The AuditNet® Audit Work Programs page also provides links to other pages and sites containing audit programs. KnowledgeLeader, a fee based subscription service, also has an excellent inventory of audit work programs. Members of the Association of Healthcare Internal Auditors and the Association of College and University Auditors also have respective member access to their audit program libraries.    

Question: Our team is currently performing an audit of Postal Inspection Service's (The law enforcement arm of the Postal Service) budget process. I've been researching possible audit steps that may be used in our audit program and have only found your sites "Questionnaire" relating to budgetary controls. Do you have in your files any specific audit steps that could help me prepare a more comprehensive audit program related to the budget process for government?

Response: The best way to develop this review is by looking at the control objectives for the budget cycle for authorization; economy, efficiency and effectiveness; transaction processing; classification; substantiation and evaluation; and physical safeguards.   

Authorization - ensure that the agency's budget was developed in accordance with the agency mission, authorized in accordance with laws, regulations and management's policy, and developed in accordance with Congressional, OMB. legal and management policies and procedures.

Economy Efficiency and Effectiveness - planned program results should be in accordance with laws, regulations, and managements policies and plans, programs should be planned in an efficient and economical manner, budgeting processing procedures should be economical and efficient.

Transaction processing - budgetary information should be properly classified in accordance with budget guidelines, actual information for previous periods included within the budget should be taken or reconciled to reliable financial reporting systems, budget information developed from the lowest levels of the organization should be accurately and promptly classified, summarized and reported, changes made to budget submissions should be properly controlled and reconciled to final budgets and approved budgets should be properly entered into appropriate agency systems.

Classification - Apportionments made should be properly accounted for and reconciled with overall appropriations, budget reports should be prepared accurately, promptly and on a consistent basis that adequately presents the information they are supposed to display.

Substantiation and Evaluation - detail budget data should be properly controlled and accounted for and reconciled with final appropriations.

Physical safeguards - access to critical budget forms and records, processing areas and processing procedures should be permitted only in accordance with laws, regulations and management's policy. 

Following are some additional resources on auditing the budget process:

Governmental Audit Program for North Carolina Local Government
Budget and Fiscal Control Act

City of Tampa Internal Audit Program for the Budget Office

The City of Berkeley California performed an audit of the departmental budgeting process. 

Contact the City Auditor auditor@ci.berkeley.ca.us for their audit work program if needed.

Best Practices in Public Budgeting

Question: Are there any standards or guidelines for royalty audits in the area of patents or other related fields? Are there any source materials that practitioners in this area regularly use

Response: Royalties are payments made for the use or rights owned by another person, company, partnership or trust. They may be periodic, irregular or one-off payments. Royalty payments are generally part of contractual agreements so auditing them is not complex. In the area of Minerals Management there is an audit manual for the Royalty Management Program. AuditNet® has a royalty audit work program in the Audit Programs section.

The IRS Market Segment Specialization Program provides audit guides for specific industries including those that involve royalty payments. 

The following is an audit clause from a publishing contract:

Audits

The writer should ensure that he has appropriate rights of audit. An audit of a publishing company tends to be far less complicated than a record company audit but nevertheless it is prudent periodically to carry out an audit. If a writer's royalty account is unrecouped so that the audit is unlikely to give rise to any additional payment then it may be sensible to delay carrying out the audit. The writer should be careful not to fall foul of restrictions in the agreement to the effect that accounting statements are to be deemed accepted and no longer subject to any objection after a given period (usually two or three years). Generally, it is a simple matter to persuade the publisher to extend any objection period to allow any audit to be deferred.

Question: I am looking for a audit program concerning a bank Call Report. 

Response: The DOS Manual of Examination Policies is a possible resource for audit guidance on bank Call Reports. The Financial Manager's Society provides workshops on call report basics. The State of Florida provides a  minimum audit procedures report for their comprehensive annual audit. The Comptroller of the Currency has several publications with guidance on call reports. 

The following are standard steps from bank audit guidelines:

Determine if the allowance for loan and lease losses is reviewed by
management or the board of directors, or both, at least quarterly to
coincide with the call reporting requirements and accurately reflects
the risk in the loan portfolio.

Does management’s assessment state that the internal control
structure and procedures for financial reporting (including
preparation of the Call Report) are effective as of the end of the
fiscal year? Yes___ No___

Question: My organization is a Gambling regulator. It collects gambling taxes from casinos, horseracing for the government. It is also responsible for issuing gambling licenses, curbing illegal gambling and regulating the gambling industry. There are inspectors and investigators that are tasked with ensuring compliance with Gambling Acts, Rules and regulation -including verifying accuracy and completeness of gambling tax returns. As an Internal Auditor I have been asked to perform an audit to review their performance as well as adequacy and effectiveness of the the procedures they use in performing their duties. Would you help me find a relevant audit program or guidance?

Response: There are several resources available on AuditNet and the Internet for gaming industry auditors. In the audit programs section of AuditNet there is a bingo audit program and a casino audit program which may help. The Institute of Internal Auditors has a gaming audit group. The IIA has a publication called Auditing the Casino Floor: A Handbook for Auditing the Casino Cage, Table Games, and Slot Operations. Also the following Web sites are including in the AuditNet Resource List.

Internal Audit Compliance Checklists from the Nevada Gaming Commission and State Gaming Control Board provides a walk through and testing procedures for each type of game. 

Internal Control Minimum Procedures from the state of Colorado, provides forms and control procedures for gaming operations. 

Other possible resources include the National Gaming Board of South Africa which has an audit process model, practice guidelines, an audit file index, and regulations for limited payouts and the Virginia Charitable Gaming Commission.

Question: I am an internal auditor and in search of a standard audit
program regarding auditing bank's treasury front and back offices . Bank has a head office treasury as well as overseas treasuries.

Response: There are a number of bank audit programs available in the AuditNet Audit Programs section. Also AuditNet established a section for banking and financial institutions which includes additional reference material for auditing banks.

Question: I am in the process of conducting an audit of my fraternity's financial records. I plan to use the non-profit organization checklist to develop my program. However, please let me know if there is another resource or program available that may help me with this engagement.

Response: This was a tough question as at first glance there appears to be limited resources available specifically for auditing fraternity's. However, the power of the Internet came through. There is general information available on auditing non-profits and a few of the links include:

Finances for Nonprofits

Nonprofit Audit Preparation Checklist

There is also an AuditNet page with  resources for not for profit organizations. 

Phi Sigma Kappa has a finance guide available which includes a basic checklist as well as audit steps to review chapter financial operations. Other national chapters of fraternities and sororities may provide similar guidance.

Question: Is an audit program for customer billing/ invoicing available?

Response: Customer billing and invoicing are part of the revenue cycle so you should expand your search to that area. The AuditNet inventory of audit programs has an audit program for receivables as well as a Revenue Recognition audit guide that may provide some direction. There are also some receivables/billing audit programs available here. The Defense Contract Audit Agency has an audit program for billing system controls. Andersen's KnowledgeSpace, a fee based subscription service, has a billing and collections review audit program in their library of audit work programs. They were offering 30 day trial subscriptions but may have suspended that program in light of recent events.  Depending on the organization that you work for, there may be other industry specific resources available. For example unique industry related issues may exist for billing in government, utilities, college and universities. 

Question: Do you have any audit programs or suggestions for developing an audit plan for misuse of cell phones? I was planning on obtaining a data dump of all the bills with detailed info and loading it into A.C.L. but what should I be looking for?

Response: A number of local governments audited cellular phone usage. Following are some highlights of audit findings from other organizations: 

  • Employees being enrolled in inappropriate plans
  • Questionable bills that went unchallenged
  • Inadequate monitoring of which phones were being used. (Audit found that users of cell phones couldn't be identified
  • Discrepancies in inventory of cell phones
  • Personal calls that were not reimbursed at full cost (cost plus tax plus overhead)
  • Underutilization of service
  • Cellular telephones assigned to staff that perform tasks or dedicate 50% or more of their time in the office
  • Billing errors not discovered and corrected
  • Excessive personal calls made during business hours

Following are links to some of the audit reports (request a copy of the audit program from the auditors):

King County Auditor's Office
West Palm Beach Auditor's Office
Missouri State Auditor

We also added a request for a cellular phone audit program to the ASAP Clearinghouse to encourage auditors to contribute work programs for this area. 

Question: Could you please provide me with audit programs / links concerning the audit of printing and journal publishing units? If feasible the focus should be the audit of ads (income position) and the distribution (subscription).

Response: Auditing printing or journal publishing units is a very unique area because of the nature of the industry. The question was asked before so click here for the response. There was also a question asked about the advertising audit programs that may be helpful. While there are no audit programs for printing and publishing units in the AuditNet inventory that does not mean they do not exist. This is another area where Internet meta-sources should help locate audit programs. Find an association or trade group for printing and publishing concerns and look for a list of companies similar to yours. Find an email contact and ask if the company has an internal audit department and whether they can provide the name and email address for the Director. Send an email and ask for help. You should also contact the Institute of Internal Auditors and ask them for audit contacts within the printing and publishing industry. When you find or create an audit program for this area consider sharing it with AuditNet.

Question: I work for a state authority and have been asked to audit the current contract of a cleaning service for potential violations of compliance with prevailing wage rates. I have no experience with either janitorial services or prevailing wage, and have not found a great deal of information from my usual sources. Any advice or audit helps (audit programs, questionnaires, articles, etc.) would be appreciated.

Response: The place to start this audit would be from a contract perspective. This would be a compliance audit to ensure that the cleaning service is following the contract and following wage rate guidelines. The contract should detail what is meant by prevailing wage rates. For assistance on contract auditing your should visit the Defense Contract Audit Agency site. They are the U.S. Federal governments contract auditors and they have a great deal of experience in this area. They may be able to provide guidance on auditing prevailing wage rates. 

Question: I am looking for an audit program to review application security on the MONTRAN and ST400 applications. While I have found generic application security ICQ's, I would like something that addresses the specific security features of these money transfer applications.

Response: There are two suggestions for application specific audit programs. First you should try to locate other companies that have the specific application installed and then contact the internal audit department for that company for assistance. This meta-searching recognizes that while the Internet may not provide a specific answer to a question, it provides links to people or organizations that may have the answer. Secondly I would post a message to the CISACA-L list for assistance. Subscription information is available here.

Question:  By chance do you have an audit program for reviewing Managing General Agents?

Response: AuditNet does not have any specific audit programs for this area however we have added this request to the Clearinghouse of Audit Program Requests. 

Question: I need an audit program and internal control questionnaire for auditing contract management.

Response: The AuditNet inventory of audit programs includes a contract attribute test that may be helpful. There is a contract audit program available for purchase here. D.C.A.A. has many contract audit tools available which could be adapted to different organizations. NASA has a contract management division that may be able to provide some guidance for auditing that area. 

Question: I would like to receive an audit program on Treasury for an operational audit with a preliminary objective of ensuring the safeguard of assets.

Response: Safeguarding assets comes under the scope of work standards for internal auditors. While not specific to auditing a treasury operation there is a quality assurance review work program that covers the issue of safeguarding assets available here. AuditNet has the following treasury related audit programs and questionnaires:

There may also be some useful information on the banking page of AuditNet.

Question: I'm trying to put together an Audit Program for Data warehouse Operations audit. I have looked into Physical/Logical security programs, Data retention program but no one covers the data warehouse. Please help me out.

Response: There are some resources that will help in auditing data warehouses. The Institute of Internal Auditors February 1998 journal (Internal Auditor) contained an article entitled Data Warehouse Control and Security. A similar article by the same author was published in the journal of the Association of College and University Auditors in April 1997 and is available online. The AuditNet inventory includes a data warehouse control worksheet. The Hong Kong ISACA chapter has a presentation on auditing the development of a data warehouse available here. Finally the The Data Warehousing Information Center contains Articles on Data Warehousing.

Question: Do you have any audit program for Car Rental / used Cars buying and selling business?

Response: I assume that you are looking for the used car sales side of car rental agencies. While I have not seen a specific program for this industry, there are various resources that you should investigate that could assist in developing an audit work program.  The AICPA has an annual National Auto Dealership Conference which include updates for car dealerships, internal controls and other sessions of interest for accountants and auditors in this industry. Contact them and see if they have information provided at the conference. They also publish an Auto Dealership Engagement Manual that may help.