I want to share a couple of techniques I used when building the audit plan and then the audit scope, and for assessing the level of risk presented by a control failure.
The first is like a reverse root cause analysis when there is a control failure. (See this earlier post.) But rather than figuring out what caused the control failure, it’s about determining what the failure means, its potential effect and how significant it is.
As with a root cause analysis, this should be done in collaboration with operating management for best results.
As an example, let’s say we find that the controls over recording inventory receipts are not functioning properly.
- Receipts of raw materials may not be recorded in the company’s records, and quantities and type of materials might be recorded incorrectly.
- As a result, the financial statements are incorrect, and management may be relying on inaccurate materials inventory records.
- If inventory is overstated, there might be an impact on manufacturing. They schedule a manufacturing run to fulfil a customer’s order only to find out that the raw material is insufficient. If inventory is understated, Procurement might place an order for the materials when that order is not necessary. Finally, if there is excess inventory, some of it might deteriorate.
- A delay in manufacturing…
