Millennium ready

Internal Auditor, Feb, 1999 by William E. Chadwick

Is your audit department prepared for the challenges of the next century? The Boston College internal audit staff has developed 13 best practices that they believe will help them conquer the future.

At Boston college, we've scanned the future and identified several best practices that we believe will enable us to provide state-of-the-art audit services as our organization faces the technological challenges and changes of the next millennium. Specifically, we think these innovative tactics will move us forward in terms of how we conduct our audits, report our audit results, and create a positive control environment.

CONDUCTING AUDITS

As organizations take more and more technological strides, how and what we audit must change. For example, in just five to ten years, audits likely will be performed exclusively within the four walls of the internal auditor's office. It will no longer be necessary to travel to the business unit. All source transaction documents will either be created via electronic commerce or converted to electronic format using document-imaging. Financial data will be extracted using audit software, and programmed audit tasks will be performed without the need for physical examination by internal auditors. In addition, transaction data will be continuously reviewed as transactions occur, instead of after the fact, as in current practice. Exceptions will be flagged instantaneously for further investigation by internal auditing. In this high-wired environment, the following audit practices may become commonplace:

1 AUTOMATED SELECTION OF AUDITS Many internal audit organizations rely on a formal risk analysis process to identify operating units that should be audited and to establish the frequency of audit engagements. Often, a matrix based on risk evaluation criteria is utilized to perform the analysis.

Instead of this passive approach, internal audit departments should consider a process whereby audit engagements are automatically "triggered" once certain performance criteria are achieved. By electronically flagging certain situations and immediately alerting internal auditing of the need for a review, financial risks can be addressed in a more timely and direct fashion.

The organization's financial vice president or controller should establish the specific financial conditions that would automatically result in an audit. For example, management may require a review if a subsidiary's monthly gross margin drops to 48 percent when the expected margin is 50 percent. On the other hand, management may determine that the two percent margin change requires only a "close watch," and that a margin drop of five percentage points may be established as the audit trigger.

Other possible indicators include an unexpected increase in the amount of accounts receivable balances as a percentage of sales, or the average daily sales outstanding in excess of an expected result. In an ideal situation, the performance indicators would be built into the accounting system. Otherwise, a subsystem could be set up either by internal auditing or the controller's organization to track and flag financial changes electronically.

2 AUTOMATED WORKPAPERS Eventually, all business activities will be transacted electronically, and internal audit organizations will need to conduct their activities on-line, as well. Several public accounting firms have designed software for internal audit organizations, such as PricewaterhouseCoopers' "Workbench" and "Team Mate" products. At Boston College, we've designed our own fully automated workpapers utilizing existing software, networked scanners, and a client/server.

Our electronic workpaper protocols enable on-line reviews of audit engagements by utilizing the annotation features of Microsoft Word. A desktop document-imaging system called PaperPort, which is manufactured by Visioneer, Inc., was instituted to provide scanner technology. The scanner electronically records and stores source audit documents and exhibits, thereby eliminating the need to maintain copies of paper documents such as invoices, flowcharts, and contracts. The optical character recognition (OCR) feature of the system provides electronic modification of scanned data, and we use it to modify other organizations' audit programs to fit the unique features of Boston College's systems and procedures.

In addition, our client/server component enables the sharing of files and information among audit staff. Now, staff members can work on the same audit concurrently, and the audit director can review and edit workpapers and the report on-line.

We've found that the adoption of electronic workpapers has already enhanced the efficiency of our audit procedures. For example, the scanner features reduced our paper costs and decreased the amount of time we spend searching through paper documents.

3 INNOVATIVE AND HIGHLY VISUAL PRESENTATIONS Developing more creative and visual methods for presenting audit issues and recommendations will become increasingly important in the next few years. Graphic presentations can not only increase the persuasiveness of recommendations to management and improve the professionalism and readability of audit documents; they may also help us compete with other providers of internal audit services who may have more resources at their disposal.