Internal Audit (X423.2) Course Syllabus Jim Tiao 1. Course Title: Internal Auditing: Operational and Management (X 423.2)

Transcription

1 Internal Audit (X423.2) Course Syllabus Jim Tiao 1 Course Title: Internal Auditing: Operational and Management (X 423.2) Course Catalog Description: An advanced online course designed for accounting, auditing, and business students; CPA, CIA, and CMA candidates; CPAs, CIAs, and CMAs; controllers and internal auditors; financial and auditing managers; corporate executives; and federal and state auditors and managers. Topics include Internal Auditing (IA) fundamentals; IA standards; internal controls; IA working papers, procedures, evidences, sampling, and flow-charting; major areas of operational auditing (such as production, marketing, finances, IT, purchasing, personnel, etc.); fraud detection, including a discussion of the latest developments in financial crimes; major areas of management auditing; IA reports; and evaluation of the IA function. Prerequisite: X 120A, B, and C Intermediate Accounting Theory and Practice, or consent of instructor. WELCOME ANNOUCEMENT: Instructor: Jim Tiao Welcome to the Summer Quarter and to my class. I look forward to meeting you soon and working together to achieve the learning objectives for this course. If you are new to online classes, I want to assure you it is easy to adapt to. Please take time to familiarize yourself with the Blackboard environment and its many features and tools. To begin, along the left side of your screen, you will see a course menu/navigation bar. Click on "Course Documents to view the course syllabus. A copy of the entire syllabus is provided which you may want to print it out for future reference. Click on "Syllabus" to view your weekly discussions and assignments. The Discussion Boards will be a major part of this course and provide many opportunities for you to interact with me as well as with your fellow classmates. It is important for you to check the discussions boards frequently and participate fully in order to have a lively and active virtual classroom. You will find information on how to contact me as well as your course manager (tech support) under Contacts. Other communication features are under Communication section. Click on the other menu items and become comfortable with the online Internal Auditing course. I am happy you are here and I am here to assist you with gaining a deeper understanding of internal auditing, its processes and its role within an organization. I hope you enjoy this learning experience! Jim Tiao, CIA, CISA, MBA 1

2 Internal Audit (X423.2) Course Syllabus Jim Tiao 2 Staff Information Instructor: Phone: Office Location: Office Hours: Jim Tiao jim.tiao@live.com Sometimes, it s easier to answer your questions by phone, so feel free to call me at (Mon-Fri: 9am 3pm PST) Online I check my daily and should respond within 24 hours Hello and welcome to the class: My name is Jim Tiao and I will be teaching this online course. I started my career in internal auditing right after getting my MBA from UCLA and began working for the University of California s Internal Audit Division. As an internal auditor, I was involved in a broad range of reviews of operations and programs throughout the UC system and its medical centers. I then gained some international experience by joining an oil services firm with several diverse divisions and international operations. The internal audit work has provided me with a bird s eye view of these large organizations as well as providing me with great experience in the nuts and bolts of some of its core business processes and operations. I then joined Honda in the early 80 s as it began to expand its operations in the US and fortunate enough to be part of its growth and success that it now enjoys. At Honda, I managed the audit groups responsible for the sales/marketing and captive-finance divisions and supported audits of the manufacturing divisions. I have also managed the IT audit group for a period of time, as well as leading the efforts to comply with the Sarbanes-Oxley Act. In addition, I have managed the administrative, IT and accounting functions for one of Honda s subsidiaries for several years. I have taught the Internal Auditing course and various parts of the CIA Exam Review at UCLA Extension and UCI Extension and management accounting courses at California State University at Dominquez Hill. In addition, I have my Certified Internal Auditor (CIA) and Certified Information Systems Auditor (CISA) designations. As you can see, most of my professional career has been in internal auditing, and I ve seen its growth and continued evolution into its important role in supporting today s need for more accountability and transparency. I ve eager to share my knowledge and experience with you and looking forward to working with you. 2

3 Internal Audit (X423.2) Course Syllabus Jim Tiao 3 Instructor Expectations I'm looking forward to working with you, learning about what you're educational goals are, and how you plan to use the course in your career. We bring different kinds of experiences and knowledge and each of you will have different needs, expectations and concerns. As your facilitator, it will be easier to help meet your needs if you communicate these concerns directly to me on a timely basis. I hope you'll always find that I am responsive and supportive. Here are a few expectations I would like emphasis: Commit to doing your best in this course and interacting with your classmates. Read the chapters and submit the completed assignments on time. Participate in group discussions on a timely and meaningful basis. Stay on schedule so everyone can benefit from each other s postings/replies. Discussion Questions (DQ) & Interacting with Classmates: The online environment provides a great opportunity to display your critical thinking skills based on your assigned readings or other research. Each student is expected to post a substantive answer to each discussion question, and post thoughtful replies to at least one other student s postings. This means a minimum of 2 postings per DQ. Pacing your work earlier in the week will give you more time to get feedback from your classmates, learn from their viewpoints and allow you to further demonstrate and enhance your understanding of the issue or topic involved. Your responses should include more than phrases such as "I agree with that" or "Interesting comment." A substantive posting should include your assessment and critical analysis of what you read (cite your sources textbook, articles, etc), and/or what you experienced, a short synopsis of key concepts, or why other arguments could be incorrect. Your posts should feature good writing, correct spelling and mechanics. Internal auditors are judged by the quality and clarity of their communications. Your posts should be professional and use good netiquette. In the spirit of scholarly discussion, I expect responses that agree and disagree with others, as long as they apply to the topic and are respectful. Your postings should help you to test your ideas, reinforce what you have learned, and share resources with others in the class. Please review the Discussion & Reflection Rubric sheets for more details. Posts/replies made after the assigned week will lose points as discussed in the grading section. Instructor s Comments in the DQs: I will be in the classroom several times a week to make sure the discussions are heading in the right direction and/or provide clarification, as needed, to stimulate interaction among the group. And typically, I will summarize the discussions with some closing comments that emphasis a real world perspective on these auditing issues. No posted messages are private - so please feel free to call me directly if you have any personal or specific questions that the group may not benefit from. I'd like to talk and get to know you. Of course, you can send an and I will usually respond within 24 hours. If after reading the assignment/dq, you do not understand what to do, please call or me so that I can explain the assignment. This is much better than turning in an assignment that is not done correctly or timely and losing points. 3

4 Internal Audit (X423.2) Course Syllabus Jim Tiao 4 Course Materials and Resources Syllabus: A copy is available in Course Documents section of the course shell Textbook: Internal Auditing: Assurance & Consulting Services by Kurt F. Reding et al, published by The Institute of Internal Auditors Research Foundation, 2013 edition; ISBN-13; (2009 edition: ISBN or 2007 edition: ISBN can be used) Other Instruction materials: (refer to PowerPoint slides and other materials included in the weekly folders) External links- Institute of Internal Auditors: Information Systems Audit & Control Association: Control Framework: Internet/Discussions Forum etiquette: 4

5 Internal Audit (X423.2) Course Syllabus Jim Tiao 5 Syllabus Outline This page organizes your course by weeks & textbook chapters: In addition to the required readings from the textbook, you ll be expected to perform additional research and inquiry on the web, as needed, for various assignments/dqs. Week 1 - Introduction to Internal Auditing (Chapter 1 of textbook) Week 2 - Professional Standards & Ethics (Chapter 2) Governance & Risk Management (Chapter 3 & 4) Week 3 - Business Process & Business Risks (Chapter 5) Week 4 - Internal Control (Chapter 6) Week 5 - Reflection/Open Discussions & Assignment Week 6 - IT Risk Management (Chapter 7) Fraud Risks & Controls (Chapter 8) Week 7 - Audit Evidence, Workpapers & Audit Sampling (Chapter 10 & 11) Week 8 - Conducting Assurance Engagements (Chapter 12 &13) Week 9 - Communicating Audit Results & Follow-up (Chapter 14) Week10 - Consulting Engagements (Chapter 15) FINAL EXAM This online course has each week starting on Wednesday, and all weekly assignments are due by midnight Tuesday. It is important to stay on schedule as subsequent topics build on previous lessons. (Previous editions have different chapter numbering system, but most of the content have not changed, with some materials updated due to new legislation and technology trends). 5

6 Internal Audit (X423.2) Course Syllabus Jim Tiao 6 Course Introduction Learning Goals & Objectives: By the end of this course, a successful learner should be able to: Define the roles and responsibilities of internal auditors (IA) within an organization and its professional practices Apply governance, risk management and internal control concepts to real world situations Perform an evaluation of a business process that includes a risk-based, and controlfocused audit approach, including: o Considerations in the planning phase o Collecting and documenting audit evidence o Communicating audit results Identify relevant risk issues related to information technology and fraud situations Compare the similarities and difference between assurance and consulting engagements 6

7 Internal Audit (X423.2) Course Syllabus Jim Tiao 7 Course Grading Policies Grading: 300 points possible for all course components Grades are assigned based on quality of work and timely completion as follows: 1. Discussion participation: Varying points are given for each discussion for a total of 125 points. A minimum of 2 postings for each Discussion Question is required to be eligible for maximum number of points. A substantive posting should include your assessment and critical analysis of what you read (more than just cutting & pasting passages from resources), what you experienced, a short synopsis of key concepts, or why some arguments/assumptions could be incorrect. Please review the Discussion-Reflection Rubric for further information on grading guidelines. 2. Assignments & Quizzes: Varying points are awarded for each assignment and quiz for a total of 115 points. 3. Final Exam: The final exam is comprised of 28 multiple choice and 4 T/F questions, for a total of 60 points. The final will be available one week prior to the due date which allows for plenty of time to complete the exam. The final will be comprehensive and cover materials from the discussions, assignments and readings. You will have only 1 attempt on this exam. The final exam is due at 11:59 PM Tuesday night. Grades are earned as follows: A points B points C points D points F Below 179 points (+/- grades will be assigned within point range) Academic Policies: Certificate Students: All courses to be applied toward a certificate program must be taken for a letter grade and a grade of C or better is required. If you receive a grade of C- or lower, you must either repeat the course or confer with your Certificate Advisor to find a suitable substitute. Incompletes: The interim grade Incomplete may be assigned when a student's work is of passing quality, but a small portion of the course requirements is incomplete for good cause (e.g. illness or other serious problem). It is the student s responsibility to discuss with the instructor the possibility of receiving an I grade as opposed to a non-passing grade. The student is entitled to replace this grade by a passing grade and to receive unit credit provided they complete the remaining coursework satisfactorily, under the supervision of and in a time frame determined by the instructor in charge, but in no case later than the end of the next academic quarter. At that time, the Registrar will cause all remaining Incompletes to lapse to the grade "F". Note: 7

8 Internal Audit (X423.2) Course Syllabus Jim Tiao 8 Receiving an I does not entitle a student to retake all or any part of the course at a later date. Student Behavior: Cheating, copying other s work, and plagiarism are not tolerated and will result in disciplinary action. Students are responsible for being familiar with the information on Student Conduct in the General Information Section of the UCLA Extension Catalog or on the website at If anything on this syllabus is unclear or ambiguous, please me for clarification. Deadlines and Late Submission Life happens and I understand that work and family emergencies occur. If you will contact me before the work is late, we can try to work out something that will mesh with your schedule. However, if you don t contact me before-hand, and the work from one week is posted late during the next week, you ll lose up to twenty percent for each day that it is late. After the work is more than 7 days late, it will no longer receive a grade. There are no extensions for the class. All work must be turned in by the last day of class. 8

9 Internal Audit (X423.2) Course Syllabus Jim Tiao 9 Discussion Rubric This rubric will be used to assess the quality of your participation in the online discussion forums. Please use this tool as a guide when constructing your postings. Mechanics of the Posting Participation in the Discussion Content of Posting Critical Thinking Evidenced by Posting Unsatisfactory Basic Proficient Distinguished Uses incomplete Uses complete Uses complete Uses complete sentences, is sentences and the sentences, sentences, organization unstructured in its posting is organization is is clear and thoughtful, organization, and comprehensible. The evident, and the the posting is includes frequent or organization could be posting includes no grammatically correct, consistent errors in improved to present a more than one and free of spelling mechanics (grammar, more coherent mechanical error errors. The tone is clear spelling, usage) in argument, statement, (grammar, spelling, and respectful. each paragraph. The or question. Includes usage) per posting is unreadable 2-3 mechanical errors paragraph. The tone and there is a distinct grammar, spelling, is clear and lack of tone. usage) per paragraph. respectful Provides minimal comments and information to other participants in the forum. Writes a general or superficial posting that is unrelated to the discussion at hand and/or posts no comments. Provides no evidence of agreement or disagreement with an existing discussion. The tone is respectful. Provides comments, and some new information on a sporadic basis. Interacts with only 1-2 participants in the forum. Demonstrates a restricted understanding of the concepts, topics, and ideas as evidenced by posting information that could be derived from prior posts and/or including highly general comments. Indicates agreement or disagreement with an existing discussion but provides no justification or explanation for comments. Provides comments, discussion, questions, and new information on a fairly regular basis. Interacts with a few participants in the forum. Demonstrates an adequate understanding of the concepts, topics, and ideas as evidenced by posting superficial, or general statements in the forum. Includes a few details in the posting. Indicates agreement or disagreement with an existing discussion including a limited explanation or justification. Provides comments, discussion, and questions without a clear connection to the course material at hand. Provides comments, discussion, questions, and new information on a regular, active, and weekly basis. Shows a high degree of interaction with other participants in the forum. Demonstrates a solid understanding of the concepts, topics, and ideas as evidenced by thoughtful responses and questions that show a clear connection (are integrated) with the course material at hand. The posting shows depth, and includes many supporting details. Demonstrates a critical analysis of an existing posted idea or introduces a different interpretation to an existing concept or idea. Includes comments, discussion, and questions that have a clear connection (are integrated) with the course material at hand. 9

10 Internal Audit (X423.2) Course Syllabus Jim Tiao 10 Reflection Rubric During your course, you will be asked to reflect on your work and how you will apply what you have learned. This rubric will help you assess your reflections. Coherence & Relevance Transformation Unsatisfactory Basic Proficient Distinguished One cannot discern Paper adequately Paper describes the Paper thoroughly the learner s describes the learner s learner s thoughts, describes the learner s perceptions and perceptions, attitudes perceptions, perceptions, attitudes attitudes or what he and what she or he attitudes and what and what he or she or she learned. learned; however, was learned; a few learned from the project. gaps and omissions gaps or omissions It is not clear how the experiences transformed the learner. are present. There are gaps in the learner s description of how the experiences helped transform him or her into a scholarpractitioner. are present. Learner adequately describes how the experiences helped transform him or her into a scholarpractitioner. Learner clearly describes how the experiences helped transform him or her into a scholarpractitioner. The rubrics provide a way for you and your facilitator to agree on the level of performance. It provides the performance-based criteria that help to steer discussions so that they are effective and reflect on your learning experiences. 10

11 Internal Audit (X423.2) Course Syllabus Jim Tiao 11 Suggested Schedule within Each Week All Weekly Assignments & DQs due by Tuesday midnight Week 1 Jul 2 Wed Thurs Fri Sat Sun Mon Tues W1DQ1- W1DQ2 - W1DQ3-State W1A1- Post Bio & External and of the IA IIA website 5 Follow-ups 5 Internal Profession 10 Auditing10 Week 2 W2DQ1- Risk Management 10 W2DQ2- ERM10 W2A1- IPPF 5 Week 3 Week 4 Week 5 Week 6 Week 7 Week 8 Week 9 Week10 Sep 3 W3DQ1- Auto Industry risks 5 (Final Exam posted) W4DQ1- IC Myths 10 W5DQ1- Open Discussions 5 W6DQ1- Significant IT issues 10 W7DQ1- Design & Operating Effectiveness 5 W8A1 Case Study (Payroll) 25 W9DQ1- Audit Criteria 5 W10DQ1- Course Reflections 5 W6DQ2- Frauds 10 W3DQ2- Entity risk model; audit universe 5 W4A1- IC Framework 5 W7A1- MCQs 10 W8A1- MCQs 10 W3A1- MCQs 5 W4DQ2- Governance, risks & controls 5 W6A1- CoBiT 5 W5A1- Risks, controls & audit tests 15 W7A2- Sampling risks 5 W8A2- Design Adequacy & Design Adequacy 5 W9A1- Communicat ing Results 10 W3A2- Risk/Control Matrix 10 W4A2- MCQs 10 W6A2- MCQs 5 W9EC Last day to submit Final Exam 60 DQ = Discussion Question: 130 points (Requires a minimum of 2 postings to be eligible to receive maximum points. A substantive posting should include your assessment and critical analysis of what you read (cite your sources textbook, articles, etc), and what you experienced, a short synopsis of key concepts, or why some arguments could be incorrect) Postings submitted after the assigned week will not receive full credit. A = Assignments (quizzes/homework): 110 points Final Exam: Is comprised of 28 multiple choice and 4 T/F questions, for a total of 60 points. The final will be available one week prior to the due date which allows for plenty of time to complete the exam. The final will be comprehensive and cover materials from the discussions, assignments and readings. You will have only 1 attempt on this exam. The final exam is due at 11:59 PM Tuesday night. 11

12 Internal Audit (X423.2) Course Syllabus Jim Tiao 12 Week 1: Introduction to Internal Auditing Learning objectives; Be able to define roles and responsibilities of internal auditors Become familiar with the internal audit profession and Institute of Internal Auditors Distinguish between internal auditing and external auditing services Readings: (Textbook: Internal Auditing-Assurance & Consulting Services by K. Reding) Introduction to Internal Auditing (Chapter 1) The relationship between a company s Audit Committee & Internal Audit: (Audit Committees & Internal Audit.doc) References/Resources: Institute of Internal Auditors website: Major accounting firms sites: W1DQ1 - Post your Biography & Follow-up (5 points) Please post a bio to this discussion forum that includes information about your work background, education, and what you hope to get out of this course (certificate requirement, personal development, etc.). Include your experience with internal auditing, online learning and any impressions on what internal control is all about. Please include something about your personal interests, your address and a photo so we can envision you as we work together. Please reply to at least one other classmate regarding a point of interest from their bio. It could be in response to similar work history, common experience or other connections. The response should help stimulate the building of a network by sharing experiences and information with each other W1DQ2 External and Internal Auditing (10 Points) Both internal audit and external audit provides assurance and consulting services to its clients. Although they have many similarities, they also have several differences. Provide your comments on the similarities and differences between the two auditing professions Make sure to critique at least one other student s posting in addition to your own. W1DQ3 State of the Internal Auditing profession (10 points) Search the web for information on the state of the internal auditing profession in today s environment. (Please cite the source and date of your information). Discuss how the current financial crisis, recession and/or recent legislation has impacted the following: 1). Internal Audit s role & status within an organization, 2) Its relationship with the external auditors, 3) Importance of the Certified Internal Auditor (CIA) designation, and 4) other trends related to the internal auditing profession. Make sure to critique at least one other student s posting. W1A1 Institute of Internal Auditors (5 points) Tour the Institute of Internal Auditors ( which is the leading voice for the internal audit profession by setting standards for its practice and resources for professional development and certification. Post your comments on at least one feature/topic within the site to share with your classmates how the specific feature might help them with this course or their career. When you post your reply to this assignment, please include the specific feature/topic in the Subject Line of your response. 12

13 Internal Audit (X423.2) Course Syllabus Jim Tiao 13 Week 2: Professional Standards; Governance & Risk Management Learning objectives: Become familiar with the profession s ethics, standards and guidance materials. Apply governance, risk & enterprise risk management (ERM) concepts Readings: Professional Practices Framework (IPPF) (Chapter 2) Governance (Chapter 3) Risk Management (Chapter 4) Resources/References: W2DQ1-Risk Management (10 points) Refer to the relevant everyday questions outlined in the chapter that can be used to apply risk management thinking. Think about some of the common business processes or any process of your choice. Select a fairly narrow activity or process (payroll, accounts payable, estimating reserves, planning a party, losing xx pounds) and answer the following questions: 1) What are you trying to accomplish (i.e. what are the objectives of your selected process? Be as specific and measureable as possible. 2) What could stop you from accomplishing it? (i.e. relevant risks) 3) What can you do to make sure those things don t happen? (i.e. control activities). Make sure to critique at least one other student s posting, particularly on their identified risk as to likelihood and impact, in addition to your own. Please include the name of your process in the Subject Line of your posting. W2DQ2-Enterprise Risk Management (ERM) (10 points) Now that you have had a chance to read about the ERM framework, go to secfilings.com to read about how a public company discusses its business risks. Select a company to review, and go to the form, 10-K and read, in particular item 1 (Business risks), item 7 (Management's discussions & analysis of ) and item 9A (Controls & Procedures) in its most recent 10-K filing. Please provide your comments to the following: 1. Company name and a brief summary of its business and related risks 2. Regarding management s discussion & analysis of and "controls & procedures (item 7 & 9A), do you think management covers the ERM framework in its entirety or just certain aspects of the framework? Why is that so? 3. Does your selected company described the roles & responsibilities for risk, including but not limited to: Board of Directors, Risk Officer, Senior Executives, etc. If so, please include a brief summary. 4. Provide your thoughts on the roles & responsibilities that the IA function may play in this company as it relates to risk management. Make sure to critique at least one other student s posting in addition to your own. W2A1- IIA s Professional Practices Framework (5 points) The specifics of the professional standards can be found at the following site: For this assignment, provide the following: 1. Choose one of the standard from either the Attribute or Performance section and discuss whether you believe this standard is easy to comply with by practicing internal auditors? And why or why not? Please include the name of the standard on the Subject Line of your post.) 2. What are the top 3 reasons that the internal audit function should follow the IPPF standards? 13

14 Internal Audit (X423.2) Course Syllabus Jim Tiao 14 Week 3 Business Processes & Risks Learning objectives: Understand how a business structure its activities to achieve their objectives Define approaches to documenting business processes and related risks Perform a risk/control matrix analysis for a selected process Readings: Business Processes & Risks W3DQ1-Auto Industry risks (5 points) 1. Name at least four of the most important business processes and key business risks for a large automotive company. 2. For each of the processes identified in 1) above, identify at least 2 or more supporting business processes. 3. Comment on whether you believe companies like GM and Toyota have basically the same business processes and risks. Make sure to critique at least one other student s posting in addition to your own. W3DQ2-Entity s Risk Model/Audit Planning (5 points) This chapter covers an approach that a company could take in developing a detailed business risk model. The Sarbanes-Oxley Act now requires public companies to identify, document and assess their financial reporting processes. 1. Discuss how a company would decide which business processes would be in-scope for complying with SOX. 2. Discuss how SOX has or should affect the internal auditor s definition of their audit scope and its annual audit plans. Make sure you comment on at least one other student s post. W3A1- Multiple Choice Questions (5 points) In the Quiz section of the course menu, go to Week 3 Quiz. This assignment is to assess your understanding of some of the key concepts for business processes and risks. You will have only 1 attempt but there is not time limit on the quiz. Good luck. W3A2-Risk/Control Matrix (10 points) Develop a risk and control matrix, using the attached Word document file (under Course Documents/Week 3), for the following assignment: A company night is to be sponsored by a school s internal audit student club. The event is designed to provide internal audit functions in companies, government agencies, and service providers the opportunity to interact with college students to increase the students awareness of the opportunities in the internal auditing profession. Food and beverage (including beer and wine) will be a part of the event. The event will be held in a rented party facility in a park adjacent to campus. The plan is that the expenses related to the event will be covered by a sponsorship fee charged to the attending internal audit functions Submit your answers directly to my address: jim.tiao@live.com and post a note to this discussion forum that you have completed the assignment. If your name is not the same as your class name, please note such in your so I can identify you. 14

15 Internal Audit (X423.2) Course Syllabus Jim Tiao 15 Week 4 - Internal Control Learning objectives; Understand what is meant by internal control Identify the components of an effective internal control framework Know the roles & responsibilities for internal control in an organization Understand the process for evaluating the system of internal controls Readings: Internal Control Lecture: A PowerPoint presentation on internal controls: Internal Control Slides.ppt Resources/References: Visit other sources of recognized control frameworks and models: Committee of Sponsoring Organizations (COSO): Canadian Chartered Accountants (CoCo): W4DQ1-Internal control myths (10 points) Listed below are statements about internal control. Please discuss why you believe each statement is a myth, fact, or somewhere in between, and your reasoning and basis: 1. Internal control starts with a strong set of policies & procedures. 2. Internal control is a finance thing! 3. With downsizing & empowerment, we have to give up certain amount of control. 4. Companies without internal auditors will not have effective internal controls. 5. If internal controls are strong enough, we can be sure there will be no fraud. Make sure to critique at least one other student s posting in addition to your own. W4A1-Internal control framework (5 points) Post your comments to the following questions: 1. What is the connection between the Sarbanes Oxley Act and an internal control framework? 2. The COSO framework identifies a commitment to ethics & integrity as an important attribute of a company s control environment (i.e. company culture). Please list at least 4 attributes (I m not looking for definitons of ethics/integrity, but features, characteristics or other aspects of a company s practices/processes) that demonstrate that an organization has a highly effective ethical culture. W4DQ2- Governance, risks & controls (10 points) Let s discuss some of the concepts from the textbook as it applies to the slew of bankrupt and failed companies during this recent financial crisis. 1. What can you say about those companies risk assessment and risk appetite practices? 2. Did you believe that those companies had weak governance practices? Why or why not? 2. Discuss whether you think companies could have effective internal controls over financial reporting (i.e. SOX 404 compliance), yet still have major weaknesses in its overall system of internal controls. Make sure to critique at least one other student s posting in addition to your own. W4A2-Multiple Choice Questions (5 points) In the Quiz section of the course menu, go to Week 4 Quiz. This assignment is to assess your understanding of some of the key concepts on internal control. 15

16 Internal Audit (X423.2) Course Syllabus Jim Tiao 16 Week 5 Open Discussions; Assignment Learning objectives: To re-enforce, challenge or question concepts learned to date Apply you understanding of a risk-based process approach to auditing W5DQ1-Reflections & Open Discussions (5 points) A. We have covered the fundamental concepts of internal auditing and its role in GRC. Reflect on these key concepts and provide your thoughts on which topic(s) will have the most impact to your current or future career. Please provide your reasoning and/or specifics on how it will affect your job/career..or, if such concepts will oot have much impact in your future career and why. B. It's been said that "internal controls" in a company are like the brakes in a car. Do you agree with this statement? Pleae provide your reasoning and arguments on why this is a good or poor analogy. Make sure to critique at least one other student's posting in addition to your own. W5A1 - Risks, Controls & Audit Tests (15 points) The attached assignment (see file in Course Documents section/week 5) is a good exercise to review your understanding of a risk-based, process approach to evaluating internal controls. Provide your answers in the attached word document and it directly to me at jim.tiao@live.com. And post a note in this discussion forum that you have completed this assignment. (refer to attached file: W5A1-Risks, Controls & Audit Tests Assigment.doc). 16

17 Internal Audit (X423.2) Course Syllabus Jim Tiao 17 Week 6 IT Risks; Fraud Learning objectives: Become familiar with some fundamental IT concepts, risks and IT controls Obtain a basic understanding of fraud risk and controls Become aware of fraud prevention, deterrence and detection programs Understand professional skepticism, professional judgment, and use of forensic technology Readings; Information Technology Risk Managemnt Fraud CoBiT Executive Summary (pdf file) W6DQ1-Significant IT Issues (10 points) Research the internet and identify at least 3 IT risks of current significance to share with the class. (Please cite your sources). Include in your discussion, the scope, complexity, and likelihood of the IT risk and whether you believe technology changes will reduce/increase such risks. Make sure to critique at least one other student s posting in addition to your own. W6DQ2-Fraud Situations (10 points) A. Search the internet to gain a deeper understanding of a recent and major case of fraud within an organization (there have many, including Enron, WorldCom, Tyco, Healthsouth, etc, or you could find your own). Describe the circumstances that surrounded the fraud, including but not limited to: 1. Who was involved, financial impact and consequences. 2. Detail nature of how it was perpetrated (i.e. control breakdown, mgmt override, collusion) 3. Were the control breakdowns of entity-level controls and/or process-level controls? Please support your argument. 4. What role, in any, the internal auditors and external auditors played B. Discuss whether you believe that only a small portion of the frauds that occur within a company are ever discovered. Back up your reasoning with facts, examples or other arguments. Make sure to critique at least one other student s posting in addition to your own. W6A1-CoBiT (5 points) Review the attached Executive Summary of the CoBiT framework. For more details, go to the following site: Please discuss the following: 1) How does COSO and CoBiT relate or connect to each other if at all? 2) Selected one of the many IT processes and discuss why it is important to include your selected process as part of the review of ICFR (internal controls for financial reporting) that's required by SOX. 3) For your selected process, what kind of specialized skills or knowledge, if any, would an auditor need in order to adequately evaluate such. W6A2-Multiplec Choice Questions (5 points) In the Quiz section of the course menu, go to Week 6 Quiz. This assignment is to assess your understanding of some of the key concepts for fraud issues. 17

18 Internal Audit (X423.2) Course Syllabus Jim Tiao 18 Week 7 - Audit Evidence Learning objectives: Understand key activities is planning, performing and reporting on the results of an audit Become familiar with how an auditor gathers audit evidence Understand the importance of a well-prepared audit working papers Become familiar with statistical and nonstatistical sampling in audit testing Readings: Audit Evidence & Workpapers Audit Sampling W7DQ1- Design & Operating Effectiveness (5 points) 1. Should auditors consider performing test of both the "design adequacy" and operating effectiveness" of key controls activities in every audit? Why or why not? 2. Is evaluating control design more challenging than evaluating operating effectiveness? Include your arguments for your position. Make sure to critique at least one other student s posting in addition to your own. W7A1-Multiple Choice Questions (10 points) In the Quiz section of the course menu, go to Week 7 Quiz. This assignment is to assess your understanding of some of the key concepts for gathering audit evidence. W7A2-Sampling risks (5 points) Provide your answers to the following questions regarding sampling 1. List the steps involved in attribute sampling. 2. What is meant by "sampling risks" and what is its impact on audit findings? 3. Identify and define the factors that affect the size of an attribute sample. 4. Explain how the purpose of statistical sampling in tests of monetary values differ from the purpose of statistical sampling in tests of control activities Provide your responses directly to me at jim.tiao@live.com and post a note to this discussion forum that you have completed this assignment. 18

19 Internal Audit (X423.2) Course Syllabus Jim Tiao 19 Week 8 Assurance Engagements Learning objectives: Determine engagement purpose, objectives and scope Understand how a process-level risk assessment is performed Describe how to evaluate design adequacy and how to design different types of testing approaches Conduct & document certain types of tests to gather evidence Readings: Introduction to the Engagement Process Conducting the Assurance Engagement W8A1-Payroll Audit (Case Study) (25 points) Attached is a case study on performing an assurance engagement of a payroll process. Please provide your answers directly on the attached file. (Payroll Audit.doc). Also, included is an Excel worksheet (also located in the Course Documents tab of the course shell) where you will complete the Risk & Control Matrix. Preparing a process flowchart is not required,but could help with your documentation and analysis. Provide your responses directly to me at jim.tiao@live.com and post a note to this discussion. W8A1-Multiple Choice Questions (10 points) In the Quiz section of the course menu, go to Week 8 Quiz. This assignment is to assess your understanding of some of the key concepts for assurance engagements W8DQ1 Audit Coverage & Design Adequacy (5 points) Answer the following concerns when performing an assurance engagement: 1. What are the consequences of identifying too many or too few key process-level risks in performing an assurance audit? 2. What are some of the considerations when evaluating the design adequacy of controls for a business process? (There is no need to comment on other posts for this particular DQ). 19

20 Internal Audit (X423.2) Course Syllabus Jim Tiao 20 Week 9 Communicating Results Learning objectives: Identify the different forms of and steps involved in creating effective communications within an engagement Understand what is involved in effective monitoring of and follow-up on audit results Readings: Communicate Assurance Engagements Outcomes W9DQ1-Audit Criteria (5 points) 1. Discuss some of the considerations that an auditor should make in determing the criteria to be used in an audit of an activity, process or function. 2. What should an auditor do if there are no clearly established criteria that can be used? Make sure to critique at least one other student s posting in addition to your own. W9A1-Comommunicating Results Assignment (10 points) See attached file (under Course Documents/Week 9) for an exercise on communicating audit results for an engagement. Provide your responses directly to me at jim.tiao@live.com and post a note to this discussion forum that you have completed this assignment. (see W9A1 Communicating Results Assignment.doc) W9EC - Extra Credit: (up to 10 points) Entity-level controls (ELC) A. Different levels of controls: In connection with W8 Case Study involving the process-level controls for payroll: 1 Document your assumptions regarding the effectiveness of entity-level controls of BFF (that includes describing in detail, at a minimum, 4 specific entity-level controls that you have assumed is working effectively), and 2. How such controls affect the payroll process-level controls, if at all. B. Testing Entity-Level Controls 1. The COSO model uses the terms, soft and hard controls. Discuss these terms and what different characteristics do you have to keep in mind as you plan your tests of soft and hard controls. 2. Expand on the testing characteristics of ELC, discuss the considerations you should keep in mind for your testing approach, including a. Skills needed b. Timing of evaluation c. Documentation Send your answers to jim.tiao@live.com 20

21 Internal Audit (X423.2) Course Syllabus Jim Tiao 21 Week 10 Consulting Engagements; Reflection/Final Exam Learning objectives; Awareness of the different types of consulting activities and services provided by internal auditors Understand the benefits to an organization when internal auditors acts as an agent of change for risk management To reflect on what you re learned to-date and where you believe the internal audit profession is headed Readings: Consulting Engagements W10DQ1-Course Reflections; Internal auditing (5 points) A. We have covered a lot of topics on the fundamentals of internal auditing over the past 10 weeks. This is good time to reflect on your original objectives for taking this course and whether you have successfully achieved them. To sustain continuous learning, reflect on a subject matter or topic covered in this course that you want to delve into more depth and/or breadth. Please describe the topic(s) and discuss what steps your plan to take to gain a deeper understanding or perspective. Please include the topic in the Subject Line of your posting. B. Just recently, the SEC updated its NYSE listing standards so that listed companies must maintain an internal audit function to provide management and the audit committee with ongoing assessments of the company s risk management processes and system of internal control.. Do you believe this will increase the demand for internal auditing in private companies or non- NYSE public companies? Please provide your arguments on why you think it will or won t. Make sure to critique at least one other student s posting in addition to your own. FINAL EXAM (60 points) The final exam is comprised of 28 multiple choice and 4 T/F questions, for a total of 60 points. The final will be available one week prior to the due date which allows for plenty of time to prepare for the exam. The final will be comprehensive and cover materials from the discussions, assignments and readings. You will have only 1 attempt on this exam but there is not time limit. The final exam is due at 11:59 PM Tuesday night. Good luck. 21