South East Training - Business Process Auditing Toolkit
The Business Process Auditing Toolkit is owned by South East Training.
You may use this resource for free on the condition that you include this statement on each page.
Copyright South East Training 2010 Available for free from: www.businessprocessauditing.co.uk
Click here for details of South East Training's
Click to download the Business Process Auditing Toolkit
Pre-planning the audit by preparing checklists is one of the techniques of effective auditing. The use of checklists:
- helps to ensure the audit sample is well balanced
- helps to ensure that the auditors are well briefed about the objectives and permits the lead auditor to evaluate the preparatory work carried out by other members of the team
- helps the auditors control the ‘pace’ of the audit
- is helpful where there is need to reassign part of the audit from one auditor to another
- provides a record of the specific areas and activities investigated during the audit.
With the audit programme agreed the audit team must then decide what aspects of the processes and controls are to be examined in each area. This information is documented in a checklist. In doing this, the auditor is defining the sample of activities to be investigated at each stage. During the audit, the checklist will be used as an aide-mémoire to remind the auditor what to investigate.
Guidance points for the preparation of audit checklists are:
- Before preparing the checklists the auditor should become fully conversant with the objectives and scope of the audit, the audit criteria, the activities carried out in each area, and the controls for ensuring that requirements are met.
- There should be a separate checklist for each department or work area. It may be helpful to have more than one checklist for a single area where there is more than one process involved, e.g. training development and training administration.
- The number of items to be included in a checklist will depend on the time available for that part of the audit.
- The amount of detail included in the checklist should suit the needs of the auditor. The auditor may write out a series of questions, or simply list headings.
The level of detail on the checklist may be restricted by the amount of information available during the preparatory phase. Some auditees may not have defined their processes and controls, and therefore will not be able to provide adequate process descriptions. In such cases it will be necessary for the auditor to determine the sequence of activities during the audit and, possibility, even construct outline process diagrams in order to understand where the controls apply.
There are numerous different checklist formats. However, they tend to fall into three categories:
- Bullet list: A list of bullet points consisting of one or two words on each line which serve to remind the auditor of the points to be covered during the audit. This type of list is common with experienced auditors. The disadvantage with this type of checklist is that there may be difficulties if the checklist has to be used by another member of the audit team.
- Questions for the auditor: A list of questions to which the auditor requires answers. However, since these questions are often ‘closed’, i.e. requiring only a yes/no answer, these questions are not in a form that can be put directly to the auditee if informative answers are required.
- Questions for the auditee: A list of questions in a form suitable for putting directly to the auditee. These questions are generally ‘open’ in format, i.e. they cannot be answered with yes or no. Typically, these questions would be begin with what, how, when, where, who or why.
The following is an example of the questions that might be asked by the auditor to determine the extent to which an equal opportunities policy has been implemented within a department.
Audit of the Equal Opportunities Policy - Checklist Questions for Interview with Department Manager
Note that the checklist above includes not only the questions for the department manager, but where a document or record is requested, what the auditor should be looking for, e.g. check training records for dates, content and coverage of events.
The checklists should be a good servant, never the master, of the auditor. The auditor may come across useful information, not referenced in the checklist, which could provide a valuable insight into the way the process operates. However, the auditor should only deviate from a checklist if time allows and the overall objective of the audit is not jeopardised. In general, if an audit has been well prepared, deviation from the checklist should not be necessary.
Go back to the Home page.