TOP AUDITING ISSUES FOR 2013 - CCH

MODULE 1 — CHAPTER 3 — Performance Audits 29
Level and extent of review or other forms of independent oversight
Program’s strategic plan and objectives
External conditions or factors that could have a direct effect on the
program
Understanding the potential users of the auditor’s report is also important,
because they may have the ability to influence the conduct of the program.
Awareness of their interests and influence helps the auditor to judge the
significance of findings.
Obtaining an understanding of the program also helps auditors to assess
risk and its effect on the audit. Individual aspects of this understanding
may include:
Laws and regulations
Contracts and grant agreements
Program purpose and goals
Internal controls
Program inputs, or the resources that are put into the program
Program operations, which are the methods or activities that program
management uses to convert inputs into outputs
Outputs, or the quantity of goods and services produced by the program
Outcomes, or the results and accomplishments of the program
Internal control. This subsection states that auditors should:
Obtain an understanding of internal control that is significant within
the context of the audit objectives
Assess whether significant internal control has been properly designed
and implemented
Perform procedures to obtain sufficient, appropriate evidence to support
the assessment of the effectiveness of internal control
Determine whether it is necessary to evaluate information system controls
A deficiency in internal control exists in a performance audit when the design
or operation of a control does not allow management or employees, in the
normal course of performing their assigned functions, to prevent, or detect
and correct on a timely basis:
Impairments of the efficiency or effectiveness of operations
Misstatements in financial performance information
Noncompliance with laws, regulations, contracts, or grant agreements
A design deficiency exists when:
A necessary control is missing, or
An existing control, even when operating as designed, does not meet
the control objective.