On-line control assessment - computer programs and Curtin University of Technology's internal audit shop

Internal Auditor, Oct, 1998 by Peter Perriam

By adapting an on-line assessment tool to their specific needs, Curtin University's internal audit shop has greatly enhanced its control reviews.

Internal audit departments worldwide face the double-edged challenge of servicing a growing audit universe with limited staff resources. Our internal audit staff at Curtin University of Technology in Perth, Australia was no exception. While we relied on a combination of systems, operational, EDP, and compliance-based audits to cover our broad territory, reviews of Curtin's 150 faculty and administrative areas, 50 university functions, and 70 EDP-related issues remained infrequent and inadequate. We desperately needed a tool that would enhance our control assessment process.

We were obviously elated when we learned that halfway around the world the University of Illinois, with funding from the Association of College and University Auditors (ACUA), had developed a Windows-based control assessment tool (CAT) using Microsoft Access. With a little tweaking that included customizing it to the Curtin environment and moving to on-line administration via our Web site, CAT proved ideal for our control assessment needs. Not only did it include features that would improve the timeliness of our reviews; it also enabled some degree of self-assessment, which we hoped would help process owners recognize and accept responsibility for internal controls and inculcate risk management into the overall business culture at Curtin.

TOOL ADAPTATION

When we originally received the CAT, it was divided into 11 separate sections or modules representing each process within a departmental area. The sections included organization and management; budgeting, accounting, and reporting; purchasing, contracting, and leasing; expenditures other than payroll; personnel and payroll; inventory; moveable equipment; revenue and transfer of expenses; cash receipts; administration of gifts and grants; and petty cash. Several of these modules contained procedures, questions, and policies that were applicable only to the University of Illinois and, therefore, had to be removed.

After we had manually identified and extracted the unusable aspects of the software, we further adapted the CAT to reflect Curtin's own policies, practices, and procedures. To do so, we referenced relevant process manuals and confirmed correct operating procedures with staff in various functional areas. We benchmarked with other Australian university internal control models and perused relevant internal audit textbooks and journals to determine whether additional modules should be added to our base. We further "Curtinized" the tool by changing the CAT's "Americanisms" to "Australianisms." Our resulting Curtin-specific modules included organization and management; budgeting; purchasing; non-payroll expenditures; recruitment; personnel/payroll; accounts receivable; cash receipts; petty cash; fixed assets; inventory; and electronic data processing.

GOING ON-LINE

Customizing the modules was only the first step in adapting the software for our use. After a few pilot cases, we quickly realized how difficult implementing the CAT in its disk-based form would be. In order for users to complete the assessment, it was necessary to physically install the five-disk CAT onto a host computer at each audit site. This time-consuming activity was slowed even further as a result of the variety of computer platforms used across the University. In addition, the policies, procedures, guidelines, and organizational structure throughout the University changed often, making it necessary to update the CAT frequently.

Our need for a flexible communications medium that would enable quick dissemination and frequent updates was answered by the Internet. The disk-based version of the CAT was converted to HTML format and placed on the Curtin University Internal Audit Web site at www.curtin.edu.au/curtin/audit/iad7.htm# Curtin Control Assessment.

THE ON-LINE PROCESS

After modifying the software to fit our needs, we began administering the tool to the various departments. Depending on the module being completed, any staff member possessing the requisite knowledge could complete the assessment. However, we requested that the department heads review the answers whenever possible, since University policy gives them ultimate financial responsibility for their areas.

As the user worked through the program, each module posed a series of questions pertaining to a particular policy or procedure. The questions required "yes," "no," or "N/A" answers. "Yes" indicated a positive situation, and "no" suggested that the area might be experiencing control problems. Sample questions included:

NON-PAYROLL EXPENDITURES

Are vendor invoices checked for accuracy and agreed to purchase orders, contract terms, receiving reports, or other documents to ensure proper payment?

CASH RECEIPTS

Are pre-numbered or cash register receipts promptly issued to individuals for in-person payments?

FIXED ASSETS

Is the asset register reviewed to ensure that all additions, disposals, losses, or thefts are properly recorded?