The operational auditing handbook : auditing businesses and IT processes

Content: Preface.  <
p>
Acknowledgements. <
p>
PART I UNDERSTANDING OPERATIONAL AUDITING. <
p>
1 Approaches to Operational Auditing. <
p>
Definitions of    Operational Auditing.    <
p>
Scope. <
p>
Audit Approach to Operational Audits. <
p>
Resourcing the Internal Audit of Technical Activities. <
p>
Productivity and Performance Measurement Systems. <
p>
Value for Money (VFM) Auditing. <
p>
Benchmarking. <
p>
2 Business Processes. <
p>
Introduction. <
p>
An Audit Universe of Business Processes. <
p>
Self Assessment of Business Processes. <
p>
A Hybrid Audit Universe. <
p>
Reasons For Process Weaknesses. <
p>
Identifying the Processes of an Organization. <
p>
Why adopt a    Cycle    or    Process   Approach to Internal Control Design and Review? <
p>
Business Processes in the Standard Audit Program Guides. <
p>
The Hallmarks of a Good Business Process. <
p>
Academic Cycles in a University. <
p>
3 Developing Operational Review Programs for Managerial andAudit Use. <
p>
Scope. <
p>
Practical Use of SAPGs. <
p>
Format of SAPGs. <
p>
Risk in Operational Auditing. <
p>
4 Governance Processes. <
p>
Introduction. <
p>
Internal Control Processes Being Part of Risk ManagementProcesses. <
p>
Risk Management Processes Being Part of GovernanceProcesses. <
p>
Objectives of Governance, Risk Management and ControlProcesses. <
p>
The COSO View of Objectives. <
p>
Should there be a Single Set of Objectives? <
p>
The Internal Governance Processes. <
p>
The Board and External Aspects of Corporate Governance. <
p>
The Board\'s Assurance Vacuum. <
p>
Risk and Control issues for Internal Governance Processes. <
p>
Risk and Control issues for the Board. <
p>
Risk and Control issues for External Governance Processes. <
p>
5 Risk Management Processes. <
p>
Introduction. <
p>
Objectives of Risk Management. <
p>
Essential Components of Effective Risk Management. <
p>
The Scope of Internal Audit\'s Role in Risk Management. <
p>
Tools for Risk Management. <
p>
The Risk Matrix. <
p>
Risk Registers. <
p>
Risk Management Challenges. <
p>
Control issues for Risk Management Processes. <
p>
6 Internal Control Processes. <
p>
Introduction. <
p>
Paradigm 1: COSO on Internal Control. <
p>
Paradigm 2: Turnbull on Internal Control. <
p>
Paradigm 3: COCO on Internal Control. <
p>
Paradigm 4: A Systems/Cybernetics Model of Internal Control. <
p>
Paradigm 5: Control by Division with supervision. <
p>
Paradigm 6: Control by Category. <
p>
The Objectives of Internal Control. <
p>
Determining Whether Internal Control is Effective. <
p>
Control Cost-Effectiveness Considerations. <
p>
Issues for Internal Control Processes. <
p>
7 Review of the Control Environment. <
p>
Introduction. <
p>
Control Objectives for a Review of the Control Environment. <
p>
Risk and Control Issues for a Review of the ControlEnvironment. <
p>
Fraud. <
p>
8 Reviewing Internal Control Over Financial Reporting    the Sarbanes-Oxley Approach. <
p>
Introduction. <
p>
Costs and Benefits. <
p>
2007 SOX-LITE. <
p>
Revised Definitions of    Significant Deficiency    and   Material Weakness.    <
p>
Using a Recognized Internal Control Framework for theAssessment. <
p>
Risk and Control Issues for the Sarbanes-Oxley s. 302 and s.404Compliance Process. <
p>
9 Business/Management Techniques and Their Impact on Controland Audit. <
p>
Introduction. <
p>
Business Process Re-Engineering. <
p>
Total Quality Management. <
p>
Delayering. <
p>
Empowerment. <
p>
Outsourcing. <
p>
Just-In-Time Management (JIT). <
p>
10 Control Self Assessment. <
p>
Introduction. <
p>
Survey and Workshop Approaches to CSA. <
p>
Selecting Workshop Participants. <
p>
Where to Apply CSA. <
p>
CSA Roles for Management and for Internal Audit. <
p>
Avoiding Line Management Disillusionment. <
p>
Encouragement from the Top. <
p>
Facilitating CSA Workshops, and Training for CSA. <
p>
Anonymous Voting Systems. <
p>
Comparing CSA with Internal Audit. <
p>
Control Self Assessment as Reassurance for Internal Audit. <
p>
A Hybrid Approach-Integrating Internal Auditing Engagements withCSA Workshops. <
p>
Workshop Formats. <
p>
Utilizing CoCo in CSA. <
p>
Readings. <
p>
Control Self Assessment. <
p>
11 Evaluating the Internal Audit Activity. <
p>
Introduction. <
p>
Ongoing Monitoring. <
p>
Periodic Internal Reviews. <
p>
External Reviews. <
p>
Common Weaknesses Noted by Quality Assurance Reviews. <
p>
Internal Audit Maturity Models. <
p>
Effective Measuring of Internal Auditing\'s Contribution to theEnterprise\'s Profitability. <
p>
Control Objectives for the Internal Audit Activity. <
p>
PART II AUDITING KEY FUNCTIONS. <
p>
12 Auditing the Finance and Accounting Functions. <
p>
Introduction. <
p>
System/Function Components of the Financial and AccountingEnvironment. <
p>
Control Objectives and Risk and Control Issues. <
p>
Treasury. <
p>
Payroll. <
p>
Accounts Payable. <
p>
Accounts Receivable. <
p>
General Ledger/Management Accounts. <
p>
Fixed Assets (and Capital Charges). <
p>
Budgeting and Monitoring. <
p>
Bank Accounts and Banking Arrangements. <
p>
Sales Tax (VAT) Accounting. <
p>
Taxation. <
p>
Inventories. <
p>
Product/Project Accounting. <
p>
Petty Cash and Expenses. <
p>
Financial Information and Reporting. <
p>
Investments. <
p>
13 Auditing Subsidiaries and Remote Operating Units. <
p>
Introduction. <
p>
Fact Finding. <
p>
High Level Review Program. <
p>
Joint Ventures. <
p>
14 Auditing Contracts and the Purchasing Function. <
p>
Introduction. <
p>
Control Objectives and Risk and Control Issues. <
p>
Contracting. <
p>
Contract Management Environment. <
p>
Assessing the Viability and Competence of Contractors. <
p>
Maintaining and Approved List of Contractors. <
p>
Tendering Procedures. <
p>
Contracting and Tendering Documentation. <
p>
Selection and Letting of Contracts. <
p>
Performance Monitoring. <
p>
Valuing Work for Interim Payments. <
p>
Contractor\'s Final Account. <
p>
Review of Project Outturn and Performance. <
p>
15 Auditing Operations and Resource Management. <
p>
Introduction. <
p>
System/Function Components of a Production/ManufacturingEnvironment. <
p>
Control Objectives and Risk and Control Issues. <
p>
Planning and Production Control. <
p>
Facilities, Plant and Equipment. <
p>
Personnel. <
p>
Materials and Energy. <
p>
Quality Control. <
p>
Safety. <
p>
Environmental Issues. <
p>
Law and Regulatory Compliance. <
p>
Maintenance. <
p>
16 Auditing Marketing and Sales. <
p>
Introduction. <
p>
System/Function Components of the Marketing and SalesFunctions. <
p>
General Comments. <
p>
Control Objectives and Risk and Control Issues. <
p>
Product Development. <
p>
Market Research. <
p>
Promotion and Advertising. <
p>
Pricing and Discount Policies. <
p>
Sales Management. <
p>
Sales Performance and Monitoring. <
p>
Distributors. <
p>
Relationship with the Parent Company. <
p>
Agents. <
p>
Order Processing. <
p>
Warranty Arrangements. <
p>
Maintenance and Servicing. <
p>
Spare Parts and Supply. <
p>
17 Auditing Distribution. <
p>
Introduction. <
p>
System/Function Components of Distribution. <
p>
Control Objectives and Risk and Control issues. <
p>
Distribution, Transport and Logistics. <
p>
Distributors. <
p>
Stock Control. <
p>
Warehousing and Storage. <
p>
18 Auditing Human Resources. <
p>
Introduction. <
p>
System/Function Components of the Personnel Function. <
p>
Control objectives and Risk and Control Issues. <
p>
Human Resources Department. <
p>
Recruitment. <
p>
Manpower and Succession Planning. <
p>
Staff Training and Development. <
p>
Welfare. <
p>
Performance-Related Compensation, Pension Schemes (and otherBenefits). <
p>
Health Insurance. <
p>
Staff Appraisal and Disciplinary Matters. <
p>
Health and Safety. <
p>
Labour Relations. <
p>
Company Vehicles. <
p>
19 Auditing Research and Development. <
p>
Introduction. <
p>
System/Function Components of Research and Development. <
p>
Control Objectives and Risk and Control Issues. <
p>
Product Development. <
p>
Project Appraisal and Monitoring. <
p>
Plant and Equipment. <
p>
Development Project Management. <
p>
Legal and Regulatory Issues. <
p>
20 Auditing Security. <
p>
Introduction. <
p>
Control Objectives and Risk and Control Issues. <
p>
Security. <
p>
Health and Safety. <
p>
Insurance. <
p>
21 Auditing Environmental Responsibility. <
p>
Introduction. <
p>
Environmental Auditing. <
p>
The Emergence of Environmental Concerns. <
p>
EMAS-The European Eco-Management and Audit Scheme. <
p>
Linking Environmental Issues to Corporate Strategy and SecuringBenefits. <
p>
Environmental Assessment and Auditing System Considerations. <
p>
The Role of Internal Audit. <
p>
Example Programme. <
p>
PART III AUDITING INFORMATION TECHNOLOGY. <
p>
22 Auditing Information Technology. <
p>
Introduction. <
p>
Introduction to Recognized Standards Related to InformationTechnology and Related Topics. <
p>
System/Function Components of Information Technology andManagement. <
p>
Control Objectives and Risk and Control Issues. <
p>
23 IT Strategic Planning. <
p>
24 IT Organisation. <
p>
25 IT Policy Framework. <
p>
26 Information Asset Register. <
p>
27 Capacity Management <
p>
28 Information Management (IM). <
p>
29 Records Management (RM). <
p>
30 Knowledge Management (KM). <
p>
31 IT Sites and Infrastructure (Including PhysicalSecurity). <
p>
32 Processing Operations. <
p>
33 Back-up and Media Management. <
p>
34 Removable Media. <
p>
35 System and Operating Software (Including PatchManagement). <
p>
36 System Access Control (or Logical Security). <
p>
37 Personal Computers (Including Laptops and PDAs). <
p>
38 Remote Working. <
p>
39 Email. <
p>
40 Internet Usage. <
p>
41 Software Maintenance (Including ChangeManagement). <
p>
42 Networks. <
p>
43 Databases. <
p>
44 Data Protection. <
p>
45 Freedom of Information. <
p>
45 Data Transfer and Sharing (Standards and ProtocolGuidelines). <
p>
47 Legal Responsibilities. <
p>
48 Facilities Management. <
p>
49 System Development. <
p>
50 Software Selection. <
p>
51 Contingency Planning. <
p>
52 Human Resources Information Security. <
p>
53 Monitoring and Logging. <
p>
54 Information Security Incidents. <
p>
55 Data Retention and Disposal. <
p>
56 Electronic Data Interchange (EDI). <
p>
57 Viruses. <
p>
58 User Support. <
p>
59 BACS. <
p>
60 Spreadsheet Design and Good Practice. <
p>
61 IT Health Checks. <
p>
62 IT Accounting. <
p>
Appendix 1: Index to SAPGs on the Companion Website. <
p>
Appendix 2: Standard Audit Program Guides. <
p>
Appendix 3: International Data Protection Legislation. <
p>
Appendix 4: International Freedom of InformationLegislation. <
p>
Appendix 5: Information Management Definitions. <
p>
Appendix 6: IT and Information Management Policies. <
p>
Bibliography. <
p>
Index.