Preparing an Audit Work Program

As a general guide, audit efforts are focused on the aims and objectives identified for an audit. Detailed audit work program should be created to execute an audit according to its objectives. During work program creation, an audit lead defines audit procedures with steps to make the audit process systematic and planned. Audit risk and materiality, among other business relevant matters, need to be considered together in designing the nature, timing, and extent of audit procedures in a work program.

Work program preparation starts after audit initiation or announcement letter distribution, depending on the enablement of the announcement letter step for a particular audit type. An audit lead creates an audit work program for execution - execution work program - and submits it for approval to an audit manager. The audit manager receives the work program, reviews it, and decides to approve or reject it. After the audit manager approves an execution work program of the audit, the audit execution phase will be started for this audit.

Prior to the preparation of the execution work program, the audit lead can prepare the work program for a risk assessment - preparation work program. Then the audit team conducts a risk assessment involving external auditors and partners to clarify the audit execution plan, scope, and update objectives for the most important areas. After the risk assessment process, the audit lead will start an execution work program preparation on the basis of risk assessment results. The risk assessment step is optional and can be enabled for certain audit types and disabled for others.

As an audit lead allocated to an audit, you can prepare a work program. Audit work program preparation is performed in the Prepare Audits app.

There are several ways to create a work program:

• Create from scratch

  This way is usually used if you have a limited number of work packages. Select Edit to start creation of an audit work program. A system will show the edit mode of the work program that allows you to define details manually.

• Create a work program using an Excel template

  If you need to define your program with a larger number of work packages, then it might be easier to prepare them offline. You can download an Excel template and fill the template with all work program content, such as work packages, procedures, and steps of procedures. When it is edited, upload your file.

• Copy a work program from an existing audit or prefilled template

  One of the desirable states for an Audit department is to administer an audit plan involving a high level of continuous auditing. Generally, that entails the implementation of continuous auditing with established priority areas. Practically, this means that you have identified a stable set of monitoring and continuous audit rules on a very generic process, can apply the same set of continuous audit parameters, can determine predictable follow up, and just need to adjust on how and to whom to communicate results. Therefore, you don't need to rebuild an audit work program each time, you can simply copy a previous one. SAP Audit Management allows you to extend or replace a work program by a work program from existing audits.

  To copy a work program from an existing audit, select Copy, and choose the From an Audit option. After selecting an existing audit from which a work program will be copied, you can choose whether to Extend or Replace a work program of your audit by the work program from the existing audit. In the case of the Extend option, previous work program entries, if any, will be kept and the previous work program will be amended with the copied work program. In the case of the Replace option, previous work program entries, if any, will be deleted and the copied work program will replace the previous work program.

  In addition, it is possible to fill a set of Excel templates and configure SAP Audit Management system to make them available for a user. Then the user can use these prefilled templates and save effort while creating a work program. To copy a work program from a template, click on the Copy button and choose From a Template. Select a template from which to copy, and select Replace or Extend. In the case of the Extend option, previous work program entries, if any, will be kept, and the previous work program will be amended with a work program from the template. In the case of the Replace option, previous work program entries, if any, will be deleted, and the work program from the template will replace the previous work program.

There are two categories of work program in SAP Audit Management: B and C. Work program of category B is a preparation work program and used for a risk assessment process, work program of category C is an execution work program and used for audit execution. If the risk assessment process is enabled for a particular audit type and scope scheme for category B is set in configuration of this audit type, then the Category column will be shown in a work program structure of an audit of this audit type. Otherwise, category column will not be shown in a work program structure.

Work programs of both categories are created in the same way and consist of work packages. Work packages define a content of an audit work program. All upper level entities of a work program, for example, key scopes on the screenshot below, are used only for building a structure and placing work packages into sections.

An audit work program structure can be of one-level, two-level, or three-level. The structure of the work program in the following screenshot is two-level.

This is an example of three-level work program structure.

To create a work program from scratch, select Edit in the Work Program section of an audit in the Prepare Audits app. You can add new rows in a hierarchy by selecting Add, then choose the category of a work package if applicable. Fill rows, select responsible persons for work packages, and select Save. To remove rows, select a row, and select Delete.

You can add multiple key scopes to a work program by selecting Add Multiple in edit mode. Specify the category, if applicable, the number, and a responsible person for work packages. In the result, multiple key scopes with one work package in each key scope will be added to the work program.

Press on the button to the right to maximize a window with the work program, you will see the work program hierarchy in a separate window where you can add, delete scopes and work packages.

To add multiple underlying work program structure items, select upper level item, and select Add Multiple. For example, on the screenshot below, to add multiple work packages to a particular key scope, select the key scope, and select Add Multiple, and specify the number of work packages and a responsible person for them. In the result, three additional work packages will be created within the key scope.

Test procedures contain information about controls to be checked and set of steps to be performed by an audit team. To create a test procedure, select an audit in the Prepare Audits app, go to the Work Program section of the audit, open a work package of an audit work program, switch to the Procedures section, select Add, and choose Test. Define the following attributes of a test procedure during creation: title, description of a procedure, a responsible person, and planned start and end dates. Select Save.

When a procedure is created, you can add controls, create test steps manually or copy test steps of controls imported from SAP Process Control. To have controls available for assigning to the test procedure, add corresponding risks to the audit, then assign risks and controls of the risks to the work package.

In addition, there is a possibility to enter comments for the test procedure.

You can copy test steps from a control to a test procedure if the control is imported from SAP Process Control and has a test plan. Initially, a needed control with a test plan must be added to the test procedure to copy steps. When the control is added, the test steps from the control can be copied by selecting Copy.

After you select Copy, a window with a list of controls will be shown. Select controls from which the test steps are to be copied, and select OK. The test steps will be copied into the test procedure. You can copy test steps from multiple controls.

It is also possible to add additional test steps directly to the test procedure. In this case, go to the Steps section, and select Add or Add Multiple. Enter the details of the step/steps, and select Create.

The test steps can be manually adjusted or deleted. Select Edit to change, delete the steps, or adjust the sequence.

For some audits, audit objectives are often set out in the form of one overall audit question and a limited number of subsidiary questions (that is, what is needed to be known) or hypotheses (that is, what is needed to be confirmed). The aim of the audit is to answer, verify, and conclude against these. All evidence gathering, data evaluation, and analysis are guided by audit questions.

It is therefore of fundamental importance that questions are well-founded, relevant, and auditable. Posing questions incorrectly or asking the wrong questions will inevitably lead to audits going in the wrong direction. By doing it right, the auditor can save time by not collecting and analyzing less relevant information. SAP Audit Management solution allows you to define audit question procedures in an audit work program.

Refer to the screenshot below to get an overview of how question procedures are processed on the audit execution phase. An auditor answers a question by choosing one of answers and enters text in the Remarks field to clarify the answer. In addition, findings can be attached to the question, descriptive assessment should be stored in the Working Papers section of the procedure, and comments can be added to the procedure.

Each answer has a rating defined in configuration. Such configuration should be done by the administrator of SAP Audit Management. A rating has a numeric value. Question ratings can be set for each audit type, so that each audit type has own set of answers with numeric value of score for each answer.

To define a question procedure on the audit preparation phase, go to a work program section, select a work package, and select Add→Question in the Procedures section.

Enter a title and description of the question procedure. During question procedure creation, it is mandatory to define a weight for the question procedure.

On the execution phase, a score of the question procedure is calculated by multiplying a rating and a weight. The score of an audit is calculated by summing up the scores of all question procedures in the audit. Thus, using weights, you can define to what extent a particular question procedure influences the score of the audit - for example, you set a higher value in the weight field for questions about critical processes and a lower value in the weight field for questions about minor processes.

Detection procedures allow the use of the detection and investigation capabilities provided by SAP Business Integrity Screening to find irregularities in business data. The prerequisite for working with detection procedures is configuration of integration with SAP Business Integrity Screening. To create a detection procedure, go to the Work Program section, select a work package, select Add→Business Rule in the Procedures section, define a title, description, and detection strategy, and select Save.

A detection strategy is an automated activity of SAP Business Integrity Screening that finds irregularities in business processes and generates alert items. On the audit execution phase an auditor will run a detection strategy from a detection procedure, then the detection strategy will be executed in SAP Business Integrity Screening. Results will automatically come to the SAP Audit Management detection procedure and can be viewed within the automatically generated working paper.