Impact of Control Self Assessment On Station Audit Scope and Work Programme

Transcription

1 Impact of Control Self Assessment On Station Audit Scope and Work Programme Emmanuel Rominiyi IAAIA Station Audit Work Programme Workshop Singapore, 18 August 2011

2 Contents Scope of Station Audit Programme Control Self Assessment Audit Data Analytics Station Audit Key Risks and Controls Control Self Assessment and Station Audit Risk Assessment Process of Using CSA For Station Audits Effect of Using CSA on Station Audits Conclusion.

3 Scope of Station Audit Programme A typical station audit programme should cover seven key areas of the airline business: 1. Finance 2. Commercial (Sales and Marketing) 3. Airport Operations 4. General Administrations and Human Resources 5. Cargo Operations 6. General IT Controls 7. Catering

4 Scope of Station Audit Programme (Cont d) A high level review of scope for the above stated business areas will be determined by: 1. Level of activities 2. Legal and Regulatory Framework 3. Process Type e.g Process outsourced to third party provider e.g Cargo GSA. 4. Existing Controls 5. Existing Self Assessment Mechanisms e.g CSA 6. Availability of Audit Analytical Tools

5 Control Self Assessment A simple test of controls which management can use as a checklist to provide assurance that their business is controlled effectively. CSA promotes the evaluation of risks and control by the employees actually performing the work. CSA enhances compliance with IIA Practice Advisory 1210.A1-1: Obtaining Services to Support or Complement the Internal Audit Activity. Create a control conscious culture by building compliance routines into business processes. Useful in generating quarterly Statement of Assurance sign offs in SOX 404 implementation.

6 Audit Data Analytics Audit Data Analytics benefits Internal Auditors in their operational processes by enabling greater audit coverage, whilst drastically improving sampling techniques and productivity. Queries could be written to generate exception reports in testing controls around bank reconciliations, purchase ledgers, ADM, excess baggage reports etc. There are several audit analysis tools, for example ACL. Audit Data Analytics could actively be used both in planning and testing phases of a station audit. It is very useful for continuous monitoring and to implement prescriptive control frameworks such as SOX 404.

7 Station Audit key Risks & Controls Risks and Controls in Station Audit could be categorised into 17 key risks and controls 1. General Controls 2. General Accounting & Balance Sheet Management 3. Contingency Planning & Risk Management 4. Procurement & Supplier Management 5. Payroll & Employee Expenses 6. Cash & Accountable Documents 7. Assets & Inventory Management 8. Debt Management & Controls 9. General IT Controls

8 Station Audit key Risks & Controls (Cont d) 10. Fares & Deals Management 11. Refunds & Passenger Compensation 12. Legal & Regulatory 13. Training & Development 14. Security of Information 15. Bank Account Reconciliations 16. Free and Discounted Tickets 17. Passenger Travels Airport Operations

9 CSA and Station Audit Risk Assessment. Annual Station Audit Risk Assessment is based on a number of criteria such as 1. Flight Frequency 2. Revenue 3. Cost 4. Station s complexity 5. Corruption Index etc Trend analysis of past CSA results could be used an a very effective consolidated outstation risk assessment tool.

10 Process of using CSA for Station Audit Planning Review Station CSA Results Identify controls with highest rate of failure and controls with 100% pass rate Amend your audit programme based on the information above. Fieldwork Validate CSA Results. Expand or limit your test scope based on the result of validation above. Concentrate on failed tests and failed validated tests Reporting Report any significant variance as part of detailed findings. Where there is no variance, state this as part of your audit report.

11 Effect of Using CSA on Station Audit Reduces or eliminate costly and ineffective controls while creating valuable alternatives. CSA facilitate a more effective risk assessment. Create a control conscious culture by building compliance routines into business processes. Emphasize management responsibility for developing and monitoring effective internal control systems. Reinforces accountability that has a direct, positive impact on the quality of control execution. Enhance greater coverage of stations.

12 Conclusion The CSA is a simple test of controls which management can use as a checklist to provide assurance that their business is controlled effectively. It can be designed for all outstation business units (e.g. Airport, Cargo, Commercial, Finance and Human Resources. It is not a replacement for outstation audits but is a self assessment mechanism for station management to measure themselves against. It is not a control in itself, but a measure of control compliance across the outstation network. When properly combined with station audit programme, it enhances station audit work and save valuable time for auditors.