FORM 9 SURVEY CHECKLIST

Transcription

1 FORM 9 SURVEY CHECKLIST Note: This checklist contains steps, which are to be completed during the audit survey. Because each audit is unique, some steps will need to be added or deleted. Auditors should write NA by those tasks which are not applicable, and describe additional steps in the blanks provided. I. General Familiarization Review adopted budgets, budget requests, annual reports and other documents, which provide general descriptions of services and operations. Participate in walk-throughs of offices and facilities. Participate in ride-alongs with field personnel. Auditor Initials and Date Complete W/P Ref. II. Interviews Conduct interviews with managers and staff to gain an understanding of the program, to identify potential problem areas/risk exposures and to complete other survey steps. Conduct interviews with knowledgeable personnel in other City departments (e.g., City Legal, Finance). Conduct interviews with representatives of organizations or individuals outside the City government who have contact with the service or program. III. Legal and Regulatory Requirements, Contract Provisions and/or Grant Agreements a. Review major enabling laws (e.g., Provincial/Federal regulations, Municipal Code and Bylaws) and make a list of other legal and regulatory requirements. b. Determine if outside agencies do compliance reviews and, if so, obtain and review their reports. c. Identify major risks (e.g., risks of non compliance with legal and regulatory requirements, provisions of contracts or grant agreements, information system controls and public endangerment, etc.) 1

2 d. Complete a risk assessment matrix by reviewing and assessing adequacy of controls for ensuring general compliance with major enabling laws, assess the risk that violations of these laws, regulations, and provisions of contracts or grant agreements could occur. e. Evaluate the reasonableness and effectiveness of controls and/or compensating controls in preventing or detecting non - compliance with legal and regulatory requirements, contract provisions, etc. Assess the nature and extent of risk that violations and non - compliance could occur. Design procedures to provide reasonable assurance of detecting instances of significant violations. Reduce the extent of audit compliance testing if auditors obtain sufficient, appropriate evidence of the effectiveness of controls. Refer to the Government Accountability Office s publication, Assessing Compliance with Applicable Laws and Regulations. IV. Fraud and Abuse a) Identify risks of fraud and status of internal controls that the entity has established to detect and prevent fraud, or the risk that officials could override internal control. If the auditors determine that significant risks or factors related to potential fraud have occurred or is likely to have occurred, identify investigations or legal proceedings that are initiated or in process, and evaluate the impact on the current audit. Report to the Directors and the Auditor General for appropriate action when information comes to the auditors attention indicating that potential fraud that is significant may have occurred. Auditor General and/or Director make appropriate decisions and actions, including the appropriateness of withdrawing from or deferring further work on the audit, or a portion of the audit to avoid interfering with an investigation, or referring to the Fraud Unit If the fraud that may have occurred is not significant within the context of the audit objectives, consider referring to other parties with oversight responsibility or jurisdiction. b) Identify risks of abuse and status of internal controls that the entity has established to detect and prevent abuse, or the risk that officials could override internal control. Design procedures specifically directed to ascertain the potential effect of abuse if auditors become aware of abuse that could be quantitatively or qualitatively significant to the program under audit. V. Management Controls Review mission statement, goals, objectives, priorities and plans. 2

3 Obtain and list performance standards established by the City or by other related agencies. Review organization chart and descriptions of staff responsibilities. Review written policies and procedures. Identify reporting systems that provide management information and review management reports. Prepare a list of the type of financial assets i.e., cash, equipment and property. Understand internal control system. Refer to the Government Accountability Office s publication Assessing Internal Controls in Performance Audit. VI. Information Systems Obtain a basic understanding of the IT environment, fundamentals of data processing and controls. Research COBIT (Control Objectives for Information and Information Technology) and apply as appropriate. Consult the Director or the AGO s IT personnel if advance technical expertise is required. Make a list of computerized information systems for possible need to test reliability of data. Evaluate the use of CAATs in performing analysis and testing (such as data analysis through ACL). In determining the potential use of CAATs, consider the following: - Audit objectives and expected outcomes; - The IT environment, systems, source, size, availability and the format of data; - Efficiency and effectiveness of using CAATs over manual audit procedures; - Integrity of the audit results; and - Level of audit risks Refer to the following documents for ACL Starter Tips and File Management Process. ACL Starter Tips.doc \\Vs-ago\agodata\ AGO\AGO\Audit Manu Document reasons for not using CAATs. 3

4 VII. Environmental Issues Review federal and provincial environmental laws, regulations, City policies and by-laws, departmental business plan and objectives. Identify environmental issues that relate to the business unit/program under review. Identify existence of property management responsibilities for Cityowned property and/or involvement in new construction or renovation of existing properties. Consider: - water conservation, energy efficiency (including energy retrofits) and use of non-toxic materials. - compliance with environmental and health and safety requirements (e.g., indoor air quality, environmental information on buildings fuel storage tanks, asbestos, PCBs). - environmental liabilities due to site contamination. Obtain information on how environmental matters are addressed. Consider: - waste reduction activities and plans (reduction, reuse and recycling of solid waste). - management of medical waste, hazardous substances. - environmentally responsible purchasing. VIII. Analysis and Tests Conduct a historical analysis of budget and staffing levels. Conduct limited tests of selected systems processes as needed. IX. Results of Previous Audits Identify related City audits and determine what actions have been taken to address audit recommendations. If actions are unsatisfactory, determine what should be done (e.g., detailed followup work, memorandum to management, etc.) X. Research of Literature Identify and review prior City audit reports and relevant management studies of the program area under review. Obtain and review relevant audit reports from other jurisdictions. Good sources of information include Canadian municipal and federal resources, ALGA Quarterly, Institute of Internal Auditors journals and publications of the U.S. Government Accountability Office and the International City and County Management Association. Obtain reports containing relevant statistical data. XI. Other Survey Steps 4

5 XII. Risk Assessment Analyse internal controls and assess whether they have been properly designed and implemented. Assess risk exposures related to program activities under review. Document risk assessment results and prepare Terms of Reference and audit program for Director and/or Auditor General s approval. 5