Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

Write Effective Audit Objectives

​Well-written objectives can define a successful internal audit.

Comments Views

​Audit objectives are the mission statement, or the reason, for the audit engagement. Once they've been established, everything done on the engagement — either directly
or indirectly — supports their achievement.

Audit objectives are one of the most important parts of the audit engagement, and they impact every aspect of it, including the:

  • Audit scope, which determines how much evidence the auditors will review.
  • Audit resources and how they will be deployed.
  • Audit program that will be developed to achieve the audit objectives.
  • Audit results, which reflect the achievement of the audit objectives.

Well-written objectives are crucial to performing an effective audit. There are three basic principles that can help develop effective audit objectives. Each objective should:

  1. Be simple and focused.
  2. Seek to reach a conclusion.
  3. Be traceable to the summary results.

IIA Standards Relative to Audit Objectives

Based on the International Standards for the Professional Practice of Internal Auditing, the chief audit executive (CAE), in consultation with management, must develop a risk-based plan to determine the areas of significant risk to the organization. Those areas are then prioritized to ensure that audit resources are deployed accordingly. A preliminary assessment, with input from management, is conducted for each audit performed. Using the preliminary assessment results, the CAE then develops the audit objectives based on the selected risks, the available audit personnel, and the allotted time for the engagement.

Keep Objectives Simple and Focused

Each audit objective should be straightforward and not overly broad. It should be easy to identify what is to be accomplished. For example, the audit objective statement, "To determine that the preventive maintenance is done in accordance with policy and procedures," would imply that every control in the preventive maintenance process has to be tested. And the failure of any control, significant or not, would be subject to a write-up. It is better to focus on the top key controls for that area.

Audit Objective Standards

Several IIA Standards relate to audit objectives, but the most significant are:

2010: Planning — "The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity. …"

2010.A1: Planning — "The input of senior management and the board must be considered in this [planning] process."

2200: Engagement Planning — "Internal auditors must develop and document a plan for each engagement, including the engagement's objectives. …"

2210: Engagement Objectives — "Objectives must be established for each engagement."

2210.A1: Engagement Objectives (Assurance) — 
"Internal auditors must conduct a preliminary assessment of the risks relevant to the activity under review. Engagement objectives must reflect the results of this assessment."

2220: Engagement Scope — "The established scope must be sufficient to achieve the objectives of the engagement."

2230: Engagement Resource Allocation — "Internal auditors must determine appropriate and sufficient resources to achieve engagement objectives. …"

Now consider this example: "The objectives of the audit were to assess the weekly bus mileage reports to determine their accuracy and timeliness, to verify that preventive maintenance is performed timely, to confirm that mechanics received the requisite number of annual training hours, and to evaluate whether repair parts were safeguarded adequately."

A simpler, clearer, and more focused audit objective statement would be: "The objectives of the audit were to determine whether:

  • The weekly bus mileage reports were both accurate and timely.
  • Preventive maintenance was performed timely.
  • Mechanics received the requisite number of annual training hours.
  • Repair parts were safeguarded adequately."

Using a bulleted list makes the audit objectives obvious and easy to follow. There is the added advantage that each bullet point can serve as an objective for developing a step-by-step audit program. Plus, the bullet points can be directly correlated to the summary results.

Seek to Reach a Conclusion

Each audit objective should try to reach a conclusion or seek to prove something. For example, the statement, "The objective of the audit was to assess the weekly bus mileage reports," does not constitute an audit objective. It states what is to be done, but it does not state what it is to accomplish.

Audit objective statements will generally have the words "to determine" or similar phrases such as "to assess," "to review," or "to evaluate." Audit objectives are essentially "yes or no" questions that seek some type of determination.

  • Were the weekly mileage reports accurate and timely?
  • Was preventive maintenance performed timely?
  • Did the mechanics receive the requisite number of annual training hours?
  • Were the repair parts adequately safeguarded?

Each objective should determine either "yes," the controls worked, or "no," they did not work or only partially worked.

Make Objectives Traceable to the Conclusion

The summary of findings should be worded very similar to, or mirror, the audit objectives. For example, the summary results statement would read:

"Based on the results of our review, analysis, evaluation, and testing, we determined that:

  • The weekly mileage reports were accurate and timely.
  • Preventive maintenance was performed timely
    except for… .
  • Mechanics received the requisite number of annual training hours.
  • Repair parts inventory was not adequately safeguarded."

Summary conclusions should be in the same order and read almost exactly like the audit objectives were written, making them easily traceable back to the audit objectives. The example shows that there were problems in the second and fourth conclusions.

The Value of Well-written Objectives

Because the primary mission of every audit engagement is to achieve the audit objectives, how well the objectives are written can be crucial to performing a successful audit. Applying the three principles when developing audit objectives will make them more effective and useful. It will ensure that audit objectives will be effectively addressed and audit resources can be more efficiently deployed.

Jonnie T. Keith
Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.

About the Author

 

 

Jonnie T. KeithJonnie T. KeithJonnie T. Keith, CIA, CFE, CGAP, is an audit consultant with JonSherr Enterprise in Atlanta. https://iaonline.theiia.org/authors/Pages/Jonnie-T--Keith.aspx

 

Comment on this article

comments powered by Disqus
  • IIA GRC_July 2020_Premium 1
  • AuditBoard_July 2020_Premium 2
  • IDEA_July 2020_Premium 3