Scribd Logo
Upload

Welcome to Scribd!

  • 27 views

    Control Environment Governance Audit 1585631025

    Uploaded by

    Mohammed Osman
    This document discusses auditing an organization's control environment, which is the foundation of governance. It explains that internal audit has traditionally focused on control activities but not enough on the control environment. The control environment includes integrity and ethics, management philosophy, organizational structure, and human resource policies. The document provides examples of control environment audits internal audit could conduct, such as evaluating conflict-of-interest policies, communication processes, executive expenses, and best practices for the audit committee. These audits assess governance and add value beyond traditional reviews of control activities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Control Environment Governance Audit 1585631025

    Uploaded by

    Mohammed Osman
    27 views4 pages
    This document discusses auditing an organization's control environment, which is the foundation of governance. It explains that internal audit has traditionally focused on control activities but not enough on the control environment. The control environment includes integrity and ethics, management philosophy, organizational structure, and human resource policies. The document provides examples of control environment audits internal audit could conduct, such as evaluating conflict-of-interest policies, communication processes, executive expenses, and best practices for the audit committee. These audits assess governance and add value beyond traditional reviews of control activities.

    Original Title

    CONTROL_ENVIRONMENT_GOVERNANCE_AUDIT_1585631025

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses auditing an organization's control environment, which is the foundation of governance. It explains that internal audit has traditionally focused on control activities but not enough on the control environment. The control environment includes integrity and ethics, management philosophy, organizational structure, and human resource policies. The document provides examples of control environment audits internal audit could conduct, such as evaluating conflict-of-interest policies, communication processes, executive expenses, and best practices for the audit committee. These audits assess governance and add value beyond traditional reviews of control activities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    27 views4 pages

    Control Environment Governance Audit 1585631025

    Uploaded by

    Mohammed Osman
    This document discusses auditing an organization's control environment, which is the foundation of governance. It explains that internal audit has traditionally focused on control activities but not enough on the control environment. The control environment includes integrity and ethics, management philosophy, organizational structure, and human resource policies. The document provides examples of control environment audits internal audit could conduct, such as evaluating conflict-of-interest policies, communication processes, executive expenses, and best practices for the audit committee. These audits assess governance and add value beyond traditional reviews of control activities.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 4

    CONTROL ENVIRONMENT (GOVERNANCE) - AUDIT

    AUDIT
    Control Environment
    (Governance)

    Historically, internal audit has allocated a significant


    amount of time to auditing control activities but perhaps
    too little attention to the control environment. This is
    partly due to the objective nature of control activities and
    the subjective nature of the control environment, and
    partly due to the perceived role of internal audit in the
    past. Because the control environment is the foundation
    for organizational governance, audits of the control
    environment provide a significant opportunity for
    internal audit to add value and contribute to GRC.

    1
    CONTROL ENVIRONMENT (GOVERNANCE) - AUDIT

    Components of the control environment and the potential audits that may
    be conducted to provide value to the organization.

    Components of a Control Environment


    The first step in preparing for a governance audit is to understand the
    difference between a unit audit, a process audit (ERM), and a governance
    audit (which would include the control environment).
    Unit-level audits typically address the control activities while entity-level
    audits help evaluate the control environment (governance).
    Governance audits focus on the components of the control environment,
    which include:
     Integrity and ethical values
     Corporate culture
     Tone at the top—management philosophy and operating style
     Control conscience
     Employee morale
     Organizational structure
     Competence of personnel
     Adequacy of staffing
     Assignment of authority and responsibility
     Human resources—policies and practices
     Accountability and recognition for actions

    Control Environment (Governance) Audits


    When making plans to audit governance, it is best to consult the Standards
    for guidance. Standard 2110: Governance states:
    The internal audit activity must assess and make appropriate
    recommendations for improving the governance process in its
    accomplishment of the following objectives:
     Promoting appropriate ethics and values within the organization;
     Ensuring effective organizational performance management and
    accountability;

    2
    CONTROL ENVIRONMENT (GOVERNANCE) - AUDIT

     Communicating risk and control information to appropriate areas of


    the organization; and
     Coordinating the activities of and communicating information among
    the board, external and internal auditors, and management.

    Consistent with the requirement of Standard 2110, following are several


    examples of entity-level audits that CAEs should consider for their control
    environment audit plans. These audits are related to governance and reflect
    the difference between a governance audit and an ERM audit.
     Conflict-of-Interest Statement (Ethics and Values)

    The audit of the conflict-of-interest statement is important because


    conflicts of interest correlate with fraud cases. The audit should identify
    who manages the process and who they report to. Who manages the
    process and their organization status is the most critical element of the
    audit. The audit also should include the design, all-inclusiveness,
    dissemination, collection, and disposition aspects.
     Communication Process

    One element of the communication process is the complaint hotline. The


    quality of this process can be an indirect evaluation of one component of
    the control environment and governance. Critical to this audit is the
    appropriate selection of the process owner and their reporting
    relationships. The audit should include the design, compliance, disposition,
    and reporting. If outsourced, multiple reporting would be needed with one
    copy going directly to the CAE. It cannot be overemphasized that this
    process will not function unless employees perceive that management
    sincerely wants their comments and feedback. Often, management tends to
    favor good news.
     Executive Expense Reports

    The executive expense reports are a litmus test of the integrity of senior
    management. These reports directly or indirectly address the integrity and
    ethical value component in the control environment. The internal audit
    charter should list the executive expense reports as a mandatory annual
    audit. The charter of the audit committee should delineate the committee’s
    responsibility to review the annual audit report of executive expenses.

    3
    CONTROL ENVIRONMENT (GOVERNANCE) - AUDIT

    Involvement of the audit committee in this process is critical. The audit


    committee charter and the internal audit charter should articulate and be
    consistent relative to executive expenses. The audit of the expense reports
    should include a process audit as well as a transaction approach. The
    process includes the design, authorization, approval, budget, and oversight.
    The transaction aspect includes a review of each report for compliance with
    established policies and procedures.
     Best Practices for the Audit Committee

    The internal audit function can add value by ensuring that the audit
    committee operates using best practices. This would not necessarily be
    classified as an audit but as a best practice review that provides a gap
    analysis, including improvements for consideration. The review objectives
    would include determining that the audit committee charter is all-inclusive
    relative to the committee’s expected responsibilities and includes best
    practices. The audit should determine that the audit committee Improving
    GRC and ERM performs gap analysis, implements needed adjustments,
    and documents fulfillment of its responsibilities.

    Other areas of the control environment (governance) that can be audited


    include:
     ERM (auditing ERM could be considered a subset of auditing
    governance)
     The strategic planning process
     Executive compensation and benefits
     Corporate policy
     The annual employee survey

    You might also like