Audit objectives are the mission statement, or the reason, for the audit engagement. Once they've been established, everything done on the engagement — either directly
or indirectly — supports their achievement.
Audit objectives are one of the most important parts of the audit engagement, and they impact every aspect of it, including the:
Well-written objectives are crucial to performing an effective audit. There are three basic principles that can help develop effective audit objectives. Each objective should:
Be simple and focused.
Seek to reach a conclusion.
Be traceable to the summary results.
Standards Relative to Audit Objectives
Based on the
International Standards for the Professional Practice of Internal Auditing, the chief audit executive (CAE), in consultation with management, must develop a risk-based plan to determine the areas of significant risk to the organization. Those areas are then prioritized to ensure that audit resources are deployed accordingly. A preliminary assessment, with input from management, is conducted for each audit performed. Using the preliminary assessment results, the CAE then develops the audit objectives based on the selected risks, the available audit personnel, and the allotted time for the engagement.
Keep Objectives Simple and Focused
Each audit objective should be straightforward and not overly broad. It should be easy to identify what is to be accomplished. For example, the audit objective statement, "To determine that the preventive maintenance is done in accordance with policy and procedures," would imply that every control in the preventive maintenance process has to be tested. And the failure of any control, significant or not, would be subject to a write-up. It is better to focus on the top key controls for that area.
Audit Objective Standards
Standards relate to audit objectives, but the most significant are:
2010: Planning — "The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity. …"
2010.A1: Planning — "The input of senior management and the board must be considered in this [planning] process."
2200: Engagement Planning — "Internal auditors must develop and document a plan for each engagement, including the engagement's objectives. …"
2210: Engagement Objectives — "Objectives must be established for each engagement."
2210.A1: Engagement Objectives (Assurance) —
"Internal auditors must conduct a preliminary assessment of the risks relevant to the activity under review. Engagement objectives must reflect the results of this assessment."
2220: Engagement Scope — "The established scope must be sufficient to achieve the objectives of the engagement."
2230: Engagement Resource Allocation — "Internal auditors must determine appropriate and sufficient resources to achieve engagement objectives. …"
Now consider this example: "The objectives of the audit were to assess the weekly bus mileage reports to determine their accuracy and timeliness, to verify that preventive maintenance is performed timely, to confirm that mechanics received the requisite number of annual training hours, and to evaluate whether repair parts were safeguarded adequately."
A simpler, clearer, and more focused audit objective statement would be: "The objectives of the audit were to determine whether:
Using a bulleted list makes the audit objectives obvious and easy to follow. There is the added advantage that each bullet point can serve as an objective for developing a step-by-step audit program. Plus, the bullet points can be directly correlated to the summary results.
Seek to Reach a Conclusion
Each audit objective should try to reach a conclusion or seek to prove something. For example, the statement, "The objective of the audit was to assess the weekly bus mileage reports," does not constitute an audit objective. It states what is to be done, but it does not state what it is to accomplish.
Audit objective statements will generally have the words "to determine" or similar phrases such as "to assess," "to review," or "to evaluate." Audit objectives are essentially "yes or no" questions that seek some type of determination.
Each objective should determine either "yes," the controls worked, or "no," they did not work or only partially worked.
Make Objectives Traceable to the Conclusion
The summary of findings should be worded very similar to, or mirror, the audit objectives. For example, the summary results statement would read:
"Based on the results of our review, analysis, evaluation, and testing, we determined that:
Summary conclusions should be in the same order and read almost exactly like the audit objectives were written, making them easily traceable back to the audit objectives. The example shows that there were problems in the second and fourth conclusions.
The Value of Well-written Objectives
Because the primary mission of every audit engagement is to achieve the audit objectives, how well the objectives are written can be crucial to performing a successful audit. Applying the three principles when developing audit objectives will make them more effective and useful. It will ensure that audit objectives will be effectively addressed and audit resources can be more efficiently deployed.