Sample IRR

Republic of the Philippines
Ramon Magsaysay Technological University

Iba, Zambales
Internal Audit Services
Standard Operating Policies and Procedures Manual
(IASSOPPM)
October 2017
TABLE OF CONTENTS
RMTU At a Glance………………………………………………………………………......I
PREFACE………………………………………………………………………………...… II
1.0 Introduction…………………………………………………………………………........1
2.0 Internal Audit Services Charter
2.1 Purpose and Application……………………………………………………….….....2
2.2 Mandate……………………………………………………………………………...2
2.3 Mission………………………………………………………………………………2
2.4 Vision………………………………………………………………………………...2
2.5 Core Values…………………………………………………………….……...……..2
2.6 Objectives…………………………………………………………………...……….3
2.7 Responsibilities and Accountabilities………………………...……………………..3
2.8 Authority…………………………………………………………...………………..4
2.9 Auditees’ Responsibilities………………………………………...…………………4
2.10 Special Assignments………………………………………………...……………….5
2.11 Standards……………………………………………………………..……………...5
3.0 Personnel Management
3.1 Organizational Structure…………………………………………..………………..6
3.2 Conduct of Internal Audit………………………………………..…………………6
3.3 Standard Qualifications and Functions…………………………..…………………7
3.4 Training and Professional Development…………………………..……………….9
3.5 Personnel Performance Evaluation………………………………..………………..9
3.6 Personnel Recruitment and Transition…………………………..………………..10
4.0 The Audit Process
4.1 Overview and Conduct of the Audit Process………………..……………………..11
4.2 The Annual Audit Plan………………………………………….………………....12
4.3 Audit Engagement Planning………………………………………………..……...12
4.4 Audit Execution……………………………………………………..……………...16
4.5 Audit Reporting………………………………………………..…………………...19
4.6 Audit Follow-Up……………………………………………….…………………..22
4.7 Summary of Outstanding Recommendations………………….…………………..25
5.0 Workpapers
5.1 Qualities of Good Workpapers……………………………….……………………26
5.2 Retention…………………………………………………….……………………..26
5.3 Workpaper Techniques……………………………………………………………26
5.4 Types of Workpapers……………………………………….……………………...27
5.5 Workpaper Organization………………………………….……………………….28
5.6 Security and Control……………………………………….………………………28
6.0 IAS Management
6.1 Audit Monitoring…………………………………………….…………………….30
6.2 Time Reports………………………………………………………………………30
6.3 Progress Reports………………………………………………….………………..30
IASSOPPM
TABLE OF CONTENTS
6.4 Meetings………………………………………………….………………………...30
6.5 Decision-Making Procedures……………………………….……………………...30
6.6 Performance Evaluation………………………………………..…………………..31
6.7 Periodic Review of Policies and Procedures…………………..…………………...31
7.0 Glossary…………………………………………………………….…………………...32
8.0 Appendices………………………………………………………….…………………...38
Appendix 1 Annual Audit Plan (AAP)
Appendix 2 Audit Work Program (AWP)
Appendix 3 Risk and Control Matrix (RCM)
Appendix 4 Entry Conference (ENC)
Appendix 5 Exit Conference (EXC)
Appendix 6 Audit Finding Data Sheet (AFDS)
Appendix 7 Draft Audit Report (DAR)
Appendix 8 Final Audit Report (FAR)
Appendix 9 Summary of Outstanding Recommendations (SOR)
Appendix 10 Audit Monitoring Sheet (AMS)
Appendix 11 Flowchart Symbols
Appendix 12 Audit Process Flowchart (APF)
Appendix 13 Summary of Audit Process Flowchart (SAPF)
Appendix 14 Time Report (TR)
Appendix 15 Monthly Progress Report (MPR)
Appendix 16 Quarterly Return (QR)
Appendix 17 Evaluation of Internal Audit – Self Assessment
Appendix 18 Code of Ethics
Appendix 19 Evaluation of Internal Audit – Management
9.0 References……………………………………………………………...………………..58
List of Tables
Table 1 Director/Head of Internal Audit………………………………………….7
Table 2 Internal Auditor…………………………………………………………...8
Table 3 Internal Auditing Assistant……………………………………………….9
Table 4 Contents of an Audit Plan……………………………...………………...15
List of Figures
Figure 1 Audit Process Flow Diagram…………………………...………………..11
Figure 2 Audit Engagement Planning Flow Diagram…………...………………..13
Figure 3 Audit Execution Flow Diagram…………………………...……………..17
Figure 4 Audit Reporting Flow Diagram…………………………...……………..20
Figure 5 Audit Follow-Up Flow Diagram…………………………...……………23
IASSOPPM
RMTU At a Glance
The Ramon Magsaysay Technological University, a merger of three public education
institutions in the province of Zambales, was established by Republic Act 8498 enacted on
February 12, 1998 through the initiative of Congressman Antonio M. Diaz. The University
Charter integrated the former Ramon Magsaysay Polytechnic College (RMPC) in Iba, the
Western Luzon Agricultural College (WLAC) in San Marcelino, and the Candelaria School
of Fisheries (CSF) in Candelaria. The strengths of its parent-institutions, which had existed
since the early 1900s, served as RMTU’s springboard for its accelerated growth and
development.
With a viable organizational structure, the institution transformed dramatically as it
accelerated the full integration of its component campuses. Through strong partnership with
the Provincial Government, DepEd and municipal governments, the University had
established LGU-subsidized satellite campuses in Masinloc, Castillejos, and Sta. Cruz in the
year 2002, 2003 and 2004, respectively. Faculty development and infrastructure build-up
were intensified. Degree programs increased from 12 to 64 in the last 10 years. Enrolment
expanded from 2,000 to more than 8,000 per semester over the same period. Massive
scholarships from various stakeholders attracted more and more students. Graduates
registered commendable performance in licensure examinations especially in electrical,
mechanical and civil engineering and other flagship programs. Major curricular programs
attained various accreditation levels and the University achieved an unprecedented Level III-
A status under the CHED-DBM-PASUC Leveling Scheme. The University was also included
among the top 30 higher education institutions (HEIs) recognized by the People’s Republic
of China, South Korea and other technology-oriented countries.
As of September 30, 2017, RMTU stands proud with its high-performing seven (7) campuses,
64 curricular offerings, 8,748 students, 757 strong faculty and staff, and viable international
linkages and consortium agreements.
IASSOPPM I
Preface
PREFACE
This Internal Audit Services Standard Operating Policies and Procedures Manual
(IASSOPPM) establishes the policies and procedures to be followed in the conduct of internal
audit. This manual aims at standardizing internal audit in terms of uniformity and consistency
across all the internal control units/departments/offices. The IASSOPPM has been prepared
in lined with the Philippine Government Internal Audit Manual (PGIAM) and the National
Guidelines on Internal Control Systems (NGICS), which are developed by the Philippine
Government. In addition, this manual shall be consistent with the International Standards
for the Professional Practice of Internal Auditing (ISPPIA), developed and maintained by the
Institute of Internal Auditors. Internal Auditors of the University must comply with the
provisions contained in this manual. This document consolidates and brings up-to-date
existing guidelines and supports the development of the internal auditing function in the
University.
I – Integrity
A – Assurance
S – Strategic Support
IASSOPPM II
Introduction
1.0 INTRODUCTION
Internal auditing is an independent, objective assurance and consulting activity designed to
add value and improve an organization’s operations. It helps an organization accomplish its
objectives by bringing a systematic, disciplined approach to evaluate and improve the
effectiveness of risk management, control, and governance process. It is a strategic function
in ensuring good governance throughout the University.
The Internal Auditor in the Philippine Government has the fundamental role of assisting the
Governing Body/Audit Committee of the Governing Board in promoting effective, efficient,
ethical and economical (4Es) operations by appraising the adequacy of internal controls. The
findings on the appraisal of internal controls are provided to said officials/bodies to institute
corrective and preventive measures and achieve the agency objectives.
The role of the Internal Auditor is not about fault-finding, neither is it investigative nor
punitive. As a component of the performance management framework of RMTU, the Internal
Audit Services (IAS) assesses the levels of performance against agreed measures, targets and
objectives. The internal audit function is separate from, but complementary to, the day-to-
day monitoring of internal controls and the conduct of continual management improvement,
which are within the responsibility of operating units.
IAS shall be under the direct administrative supervision and control of the University
President, organized as an independent staff unit and shall correspondingly perform staff
functions. And shall be responsible for instituting and conducting a program of internal audit
for the University.
IASSOPPM 1
IAS Charter
2.0 INTERNAL AUDIT SERVICES CHARTER
2.1 Purpose and Application
The Internal Audit Services will apply cutting edge practices to support the University
in its quest to be a progressive learner centered Research University recognized in the
ASEAN Region.
This IASSOPPM is intended to provide the internal auditors with practical guidance,
tools and information for managing the internal audit activity and for planning,
conducting and reporting on internal auditing assurance engagements.
Users of the manual are expected to draw upon the information provided to form their
own judgments on the most suitable approaches to fulfilling the specific responsibilities
that they have been assigned in the context of continuously striving for the most effective
internal audit activity possible. If users encounter situations where they believe that the
guidance provided in the manual is in conflict with what they believe to be the most
effective approach, they should consult with more senior IAS officers.
This IASSOPPM is effective as of the date of approval.
2.2 Mandate
IAS is mandated to provide independent, objective assurance and consulting services
designed to add value and improve the RMTU’s system operations, internal control and
governance processes as a service to the University to assist it accomplish its goals and
objectives.
2.3 Mission
IAS shall assist RMTU Leadership in providing independent and objective information
analyses and counsel to achieve the highest quality services in education, research and
public services by promoting effective internal controls, transparency and accountability
with professionalism.
2.4 Vision
By 2020, the Internal Audit Services is a holistic value-added service to ensure operations
are managed ethically, effectively, efficiently and economically towards the attainment of
RMTU Vision.
2.5 Core Values

The Internal Auditors are expected to apply and uphold the following principles:
• INTEGRITY – We exhibit fairness, honesty and ethical behavior in our service to

the university.
IASSOPPM 2
IAS Charter
• OBJECTIVITY – We perform duties in an unbiased manner and make a balanced
assessment of all the relevant circumstances and are not unduly influenced by their
own interest or by others informing judgments.
• QUALITY – We provide accurate reports and timely, feasible, and relevant
recommendations.
• CONFIDENTIALITY - We respect the value and ownership of information we
receive and do not disclose information without appropriate authority unless there is
a legal or professional obligation to do so.
• COMPETENCY – We apply our professional knowledge, skills, and experience
needed in the performance of internal audit services.
2.6 Objectives
• Check the accuracy, reliability and integrity of applicable financial and performance
issues;
• Compliance with organization policies and procedures, laws, regulations or
guidelines;
• Ensure efficient, effective, ethical and economical operations; and
• Safeguarding of assets.
2.7 Responsibilities and Accountabilities

IAS takes place “after the fact” and covers a complete cycle of operations and is responsible
in performing duties in accordance with the PGIAM and the International Standards for
the Professional Practice of Internal Auditing (Standards). Any aspects of financial
auditing are conducted in accordance to Generally Accepted Accounting Principles
(GAAP) or any other standards adopted by any governing authority such as Government
Accounting Manual (GAM). At a minimum, IAS is charged up the following duties,
functions and responsibilities:
• Conduct management/operations performance audit of activities of the department

and their units and determine the degree of compliance with the mandate, policies, and
government regulations, establish objectives, systems and procedures/processes and
contractual obligations.
• Review and appraise systems and procedures, organization structure, practices,
records and performance standards.
• Verify and analyze management and operations data to ascertain if attendant must
generate data or reports that are complete, accurate and valid.
• Ascertain the reliability and integrity of information and the means used to identify,
measure, classify, and report such information.
• Ascertain the extent to which the assets and other resources of the University is
accounted for and safeguarded from losses of all kinds.
• Review and evaluate the soundness, adequacy and application of accounting financial
and management controls and promote the most effective control at reasonable cost.
IASSOPPM 3
IAS Charter
• Review operation or programs to ascertain whether or not such programs are being
carried out as planned.
• Evaluate the quality of performance of groups/individual is carrying-out their
assigned responsibilities.
• Perform functions of a protective nature, such as prevention and detection of fraud or
dishonesty, revision of cases involving misuse of agency property; and checking of
transactions with outside parties.
• Recommend realistic courses of action or operational deficiencies observed.
• Perform miscellaneous services, including special investigations and assistance to
outside contacts such as Commission on Audit.
• Report significant issues related to the processes for controlling its activities and
managing its risks in the areas set forth under the mission of work.
• Periodically provide information on the status and results of audit plan and the
sufficiency of departmental resources.
• Coordinate with and provide oversight of the control, and monitoring functions, risk
management, compliance, security, legal ethics, and environmental external audit.
• Establish appropriate policies and procedures to guide the internal audit function.
• Maintain a quality assurance and improvement program that covers all aspects of the
internal audit function.
• Advise/Report periodically to the University President on whether management ‘s
action plans have been implemented and whether the actions taken have been effective
2.8 Authority
The IAS’ activity with strict accountability for confidentiality and safeguarding records
and information is authorized full, free, and unrestricted access to any and all
departmental records, physical properties, and employees and has the right to obtain
information and explanations from departmental employees and contractors, subject to
applicable legislations.
We shall be authorized to allocate resources, set frequencies, select subjects, determine
scopes of work and apply the techniques required to accomplish audit objectives. We shall
consult to management on matters such as the design of business control systems, risk
management activities, and governance processes.
We shall participate as member of the Administrative Council and as members of other
committees, teams, boards, etc. provided such participation does not compromise or
appear to compromise the independence of IAS.
2.9 Auditees’ Responsibilities

• Treat Internal Audit Staff with respect and courtesy.
• Where applicable, execute their role faithfully and honestly.
• Respect the chain of command.
IASSOPPM 4
IAS Charter
• Respect the orderly execution of duties including queuing of job task in the internal
audit department.
• To submit their documents for consideration or required information in a timely
manner.
• Familiarize themselves with, and observe the financial regulations, public
procurement regulations and other relevant policies and guidelines applicable to the
public service in general and the University in particular.
• Respond faithfully to specific issues raised including audit queries.
2.10 Special Assignments

IAS Team may, upon request by any Department’s Officer, be assigned audit work on
Special Assignments that are in no way connected with the Annual Audit Plan. This may
be done provided approval is obtained from the IAS Director (IASD). After approval, the
internal auditor will be responsible for the audit assignment and he will report to the
IASD after completion of the assignment.
2.11 Standards
The internal audit function will be conducted in accordance with PGIAM, the NGICS,
the Institute of Internal Auditors’ ISPPIA, the International Organization of Supreme
Audit Institutions’ (INTOSAI) Guidelines for Internal Control Standards for the Public
Sector and the IASSOPPM. In the event of conflict with the International Standards for
the Professional Practice of Internal Audit, the PGIAM will prevail.
Prepared by: Date:
_____________________________ ____________________
Rowena Buan-Yost, CPA
IAS Director
Approved by: Date:
_____________________________ ____________________
Dr. Cornelio C. Garcia
University President
IASSOPPM 5
Personnel Management
3.0 PERSONNEL MANAGEMENT
3.1 Organizational Structure
BOARD OF REGENTS
UNIVERSITY PRESIDENT
DIRECTOR
Internal Audit Services
INTERNAL INTERNAL AUDITING INTERNAL

AUDITOR ASSISTANT AUDITOR
3.2 Conduct of Internal Audit

Pursuant to Sec. 2 of Administrative Order No. 70, Internal Audit shall be performed with
proficiency and due professional care in accordance with the following:
• The IAS shall ensure that the technical proficiency and educational background of
internal auditors are appropriate for the audit to be performed;
• Internal auditors shall possess/obtain the knowledge, skills and discipline needed to
carry out the audit responsibilities of the IAS;
• The IAS shall ensure that internal audits are properly supervised and performed with
due professional care;
• The IAS shall conduct the audit in conformity with International Standards for the
Professional Practice of Internal Auditing; and
• The Code of Ethics promulgated by the Association of Government Internal Auditors
(AGIA) shall be strictly observed to maintain high standards of honesty, objectivity,
diligence and loyalty.
IASSOPPM 6
3.3 Standard Qualifications and Functions
The table hereunder provides for the qualification standards and functions of each position
in the IAS. It reflects the minimum competency required in the areas of: a) Education, b)
Experience, c) Training, d) Eligibility and e) Functions that will enable auditors to
perform in a competent manner.
Table 1 - Director/Head of Internal Audit

Education Any of the following: Master’s Degree in Accounting, Public
Administration, Criminology, Information Technology (IT)/Computer
Science, and other related disciplines relevant to the
Department/Agency where he/she may be assigned; Bachelor’s Degree
in Law would be an advantage
Experience 4 years of relevant experience in one or a combination of the following:
Public Administration, Internal Auditing, Administrative or Criminal
Investigation, Forensics (e.g., Accounting, IT, International
Organization for Standardization (ISO) Management Systems, and
other related disciplines)
Training 40 hours of training in one or a combination of the following: Public
Administration, Internal Auditing, Administrative or Criminal
Investigation, Forensics, etc.
Skills • Intellectual, interpersonal, communication, and information
technology skills.
• Clear understanding of the internal audit’s contribution to effective
governance;
• Ability to develop plans and programs to contribute to the
achievement of mandated objectives;
• Strong management acumen and the ability to anticipate and assess
management control;
• Ability to build a strong network and credibility with the Head of
Agency and senior management; and
• Consistent observance of ethical principles
Eligibility Any of the following: CESO III; CESO III and Lawyer or CESO III
and CPA- Lawyer would be an advantage; Career Service
(Professional)/Secondary Level Eligibility, preferably BAR/CPA, (RA
1080 or both Lawyer and CPA)
Functions Administrative Functions:
1. Submits work and financial plan;
2. Submits annual procurement report;
3. Submits accomplishment reports; and
4. Submits performance evaluation, targets and ratings of staff.
IASSOPPM 7
Functions Operational Functions:
of Director 1. Establishes the annual goals, objectives and performance targets of
(continued) the internal auditing unit;
2. Establishes internal auditing standards, guidelines and procedures
for the guidance of the internal audit staff;
3. Determines the extent of coordination with COA to avoid
duplication of audit report;
4. Ensures support of management in the conduct of internal audit;
5. Responsible for work performance and disciplines of the staff;
6. Reviews and approves internal audit plans;
7. Discusses internal audit scope and objectives with agency/unit or
personnel to be covered prior to the conduct of audit;
8. Reviews and approves internal audit reports;
9. Discusses audit result with auditee/s before the report is finalized;
10. If necessary, discusses the conclusions and recommendations in the
audit report with the appropriate level of management;
11. Follows up actions to determine if audit recommendations have
been carried out or not and inquires for the reasons for non-
implementation;
12. Investigates anomalies discovered in audit and submits reports and
recommendations on investigations completed;
13. Reviews and approves recommendations for enhancement of the
internal audit functions; and
14. Does related work.
Table 2 - Internal Auditor

Education Bachelor’s degree relevant to the job (Law, Accounting, Public
Administration, Criminology, IT/Computer Science and other
disciplines related to the abovementioned)
Experience 3 years of relevant experience involving Internal Auditing,
Administrative or Criminal Investigation and/or Forensics (e.g.,
Accounting, IT, ISO Management Systems and other related
disciplines)
Training 16 hours of training in Internal Auditing, Administrative or criminal
Investigation and /or Forensics, etc.
Eligibility Career Service (Professional)/Secondary Level Eligibility, preferably
BAR/CPA, (RA 1080 or both Lawyer and CPA)
Functions 1. Under direct supervision, assists in supervising a division tasked
with internal audit functions;
2. Reviews internal audit plans;
3. Discusses internal audit plans with the concerned staff;
4. Reviews written internal audit reports;
5. Trains new internal auditors;
6. Rates performance of audit staff and does related work.
IASSOPPM 8
Table 3 - Internal Auditing Assistant
Education Completion of 2 years of study in college
Experience 1 year in position/s involving Internal Auditing, Administrative or
Criminal Investigation and/or Forensics (e.g., Accounting, IT, ISO
Management Systems and other related disciplines)
Training 4 hours of training in Internal Auditing, Administrative or Criminal
Investigation and/or Forensics, etc.
Eligibility Career Service (Sub-professional)/First level eligibility
Functions 1. Under immediate supervision, Assists internal auditors in the
conduct of internal audit; and
2. Does related work.
3.4 Training and Professional Development

Initially, new staff members will be exposed to various rules and regulations, copies of
which are currently maintained in the office library. These include: (a) Institute of Internal
Auditors’ (IIA) Code of Conduct, (b) PGIAM, (c) NGICS, (d) International Standards’
Manuals, (e) the department’s Audit Manual and (e) other relevant Circulars,
Administrative Orders or Executive Orders issued by the different Government Agencies
related to the conduct of Internal Auditing is accessible to each auditor.
Ordinarily, the department runs an annual training budget and auditors are regularly
taken for training seminars relevant to their job and grade. Therefore, the internal
auditors will attend seminars and training as appropriate. Professional proficiency is the
responsibility of the individual auditor. Each auditor should possess a body of specialized
knowledge and should maintain a recognized, continuous process of education to sustain
professional growth in the field of internal auditing.
The IASD, will assign each audit to the individual who possess the necessary knowledge,
skills and disciplines to conduct the audit properly. The internal audit staff has a
professional obligation to schedule and attend on-going professional education forums to
ensure they maintain academic proficiency and to advance professionally. The IASD is
responsible for providing appropriate audit supervision. Supervision is a continuing
process, initiated with the planning process and concluding with the completion of the
audit assignment. IASD will document evidence of supervision and review on all audits.
This may be accomplished by signing off on all work papers and audit documents.
3.5 Personnel Performance Evaluation

Personnel performance is continuously monitored by reviewing work performed and
providing immediate feedback for support. At the end of each engagement, a debriefing
meeting is held to identify areas of personal improvement. Semi-annual evaluations are
held with each employee using the evaluation instrument corresponding to each position.
IASSOPPM 9
3.6 Personnel Recruitment and Transition
IAS’ policy on recruitment is targeted at candidates who meet minimum academic
qualifications in line with the position they wish to be considered. Each internal auditor
is responsible for maintaining an adequate level and an understanding of the social,
academic, economic and political environment within which the University operates.
The success of IAS is dependent on the ability to proactively manage employee
recruitment and transition of competent staff. Personnel are recruited using the standard
hiring process held by the Human Resource Department (HRD).
Personnel are encouraged to keep the Director informed of any possible employment
changes. With thirty (30) days notification, IAS can actively recruit new employment
while exiting personnel is still with the department. The goal is to have an ample time to
recruit the most competent candidate available and continue audit services with minimal
impact.
IASSOPPM 10
Audit Process
4.0 The Audit Process
4.1 Overview and Conduct of the Audit Process
The Audit Process is divided into four phases, namely: audit engagement planning, audit
execution, audit reporting, and audit follow-up. See Figure 4-1. For each phase, there are
specific criteria to ensure a successful audit engagement.
Audit Engagement
Planning
Audit Execution
Audit Reporting
Audit Follow-up
Figure 4-1 Audit Process Flow Diagram

Although every audit project is unique, the audit process is similar for most engagements
and usually consists of nine stages. Through these stages IAS will determine ways to
minimize risks and increase efficiencies within the area.
Client involvement is critical at each stage of the audit process. An audit will result in a
certain amount of time being diverted from area personnel’s usual routine. One of the key
objectives is to minimize this time and avoid disrupting on-going activities.
4.1.1 Plan. IAS will develop an annual audit plan based on a review of all pertinent
information. Sources may include, but are not limited to: a risk assessment, internal and
external evaluations and management guidance.
4.1.2 Engagement. IAS will schedule a meeting with the area head and the senior
management of the process to be audited. Identify the scope and objectives of the audit,
how long it is expected to last and what the responsibilities for all parties are in the audit
process. Any factors that may impact the audit should be raised at this time. Factors
include vacations, fiscal year end reporting requirements, etc.
4.1.3 Test. Testing will include interviews with the staff, review of procedures and
manuals, compliance with the University policies and governmental laws and regulations
and assessing the adequacy of internal controls.
IASSOPPM 11
Audit Process
4.1.4 Communicate. Keep the department that is undergoing the audit updated on the
status of the audit on a regular basis especially if there are any findings. There may be
instances where the findings can be addressed immediately.
4.1.5 Draft. The report draft will include the audit Scope and Objectives, Audit Findings
and Potential Audit Recommendations.
4.1.6 Management Response. Management will receive the audit draft to confirm the
facts and respond to the Potential Audit Recommendations. Their response should assign
the responsibility and have a specific target date of completion for the corrective actions.
The time window for the Management Response is normally seven (7) business days.
4.1.7 Review. The final version of the audit will be reviewed, and all issues resolved by
the IASD.
4.1.8 Distribute. The report is then released to the audited department, the divisional
Director/Vice President and the President.
4.1.9 Verify. IAS will normally conduct a follow up on the Management responses to the
audit findings and recommendations within a reasonable time frame. This subsequent
review will be discussed with the involved management and the comments published.
4.2 The Annual Audit Plan (AAP)

The IASD, by authorization of the President, annually establishes a plan of scheduled
audits called the “Annual Audit Plan”. The audits selected can relate to specific
departments/areas within the university, or to processes that are carried out across
several different departments/areas. To maximize the use of IAS resources, a risk-based
approach is adopted in drawing up the plan. Major risk factors are identified, using
different risk assessment criteria, and areas with the highest perceived risk are given high
priority for audit.
The AAP (Appendix 1) is prepared and submitted to the President each year for review
and approval. Upon approval, the plan is executed by IAS during the following calendar
year. Additionally, unannounced audits may be performed at the discretion of the audit
director or at the request of the Board of Regents, the President, or area head.
4.3 Audit Engagement Planning

Audit requires good planning. Planning entails familiarization with the objectives,
processes, risks and controls of the auditee and activity to be audited, and developing a
strategy and approach in conducting the audit. It is the most important part of the audit
as the success of an audit depends on how well it has been planned.
Planning is an iterative process with the following important purposes:
• Understanding the control environment and the organization;

• Outlining the scope and objectives of the audit;
• Establishing the basis for budgeting (time, cost, personnel);
IASSOPPM 12
Audit Process
• Identifying the evidence required to develop the audit findings;
• Assisting in choosing/determining the audit procedures (nature, extent and timing);
• Establishing the basis for coordinating the staff.
Audit engagement planning is the third stage of planning, after strategic planning and
annual audit planning. It involves the listing down of audit activities per audit
engagement based on the AAP. The results of the strategic planning shall be validated to
determine if there are relevant changes in the control component, systems and processes.
Figure 4-2 summarizes the steps involved in Audit Engagement Planning.
PLANNING What to Audit
1. Document understanding of the program and

project
2. Determine the audit objective, scope and criteria
and audit evidence
3. Determine the resource required for the audit and
the target milestone/dates
4. Develop the audit plan and audit work program
5. Secure approval of the audit plan and audit program
EXECUTION What and How to Report
REPORTING How to Audit
FOLLOW-UP
What to Follow-up
Figure 4-2 Audit Engagement Planning Flow Diagram
4.3.1 Document Understanding of the Program and Project

Audit engagement planning starts from an understanding of the organizational mandate
and focusing on what areas will be audited. It involves the selection of specific internal
controls and focusing on the degree of compliance with laws, regulations and policies of
specific program/project and system/process for evaluation; evaluation of the control
effectiveness; and determination of if operations are conducted economically, efficiently,
ethically and effectively (4Es).
The audit plan should be based on a sound understanding of the internal control system,
operating and support systems and processes.
4.3.2 Determine the Audit Objective, Scope, Criteria and Evidence
a. Determine Audit Objective
Based on information gathered and analyzed during the understanding of the
program/project, the objective and scope of the audit can be defined. An audit objective
is what the audit aims to accomplish.
IASSOPPM 13
Audit Process
This is critical in establishing the scope, criteria, evidence and approach of the audit. It
is normally expressed in terms of what questions the audit is expected to answer about
the performance of an activity. Ideally, an audit objective would be consistent with the
achievement of the objectives of the organization, program or project. Determining the
audit objectives involves the following activities:
i. Preliminary gathering of documents/information;

ii. Identifying the focus of the audit and the aspect of performance to be examined;
and
iii. Determining the type of audit to be performed:
1) compliance with laws, regulations and policies;
2) evaluation of control effectiveness; or
3) determination if operations are conducted economically, efficiently, ethically
and effectively.
Audit objectives also relate to why the audit is being conducted. If controls are weak,
the IAS traces the root cause and recommends to top management courses of action to
address the deficiency. The IAS can also recommend further examination of the
underlying issues, or the legal action to take, if conditions so warrant.
b. Determine the Audit Scope
Audit scope is the framework or limits of the audit. It is normally defined by stating
what the audit intends to cover and the relevant timeframes.
The steps in determining the audit scope are as follows:
i Define the parameters and nature of the audit work to achieve the audit
objectives;
ii Determine the audit tools, techniques and methodology to be utilized; and
iii Select the method to be utilized.
The Internal Auditors could look for the answers to these questions:
i. Are the control components sufficient to safeguard the assets?

ii. Do they provide accurate and reliable accounting data?
iii. Do they adhere to managerial policies?
iv. Are they in compliance with laws, rules and regulations?
v. Do they ensure effectiveness, efficiency, economy and ethicality of operations?
The IAS can conclude on the effectiveness of the controls only when the internal
control components achieve all the control objectives.
c. Determine Audit Criteria and Evidence
Audit criteria are reasonable standards against which existing conditions are assessed.
These are expectations of the program or project as to what should be. It includes
statutory and/or managerial requirements; process requirements; and citizens’
requirements, needs and expectations.
IASSOPPM 14
Audit Process
To be able to come up with sound criteria, auditors must:
i. Gather/Identify the standards (laws, regulatory policies) for audit
evaluation;
ii. Set reasonable and attainable standards of performance, statutory or
managerial policies for evaluation; and
iii. Identify pieces of audit evidence required by law and standards and
the approaches to be utilized in obtaining them.
4.3.3 Determine the Resources Required for the Audit and the Target
Milestones/Dates
Careful planning involves the determination of the overall resource requirements to
accomplish the planned audits. This involves assessing the current staff
capability/capacity; technological resources (e.g., computers, software); financial
resources (budget requirements), among others.
Target milestones/dates for the completion or accomplishment of critical elements during
the audit process should be established to keep track of the progress of the engagement
and check on the quality of the outputs.
4.3.4 Develop the Audit Plan and Audit Program
An audit plan and audit work program must be prepared for all audits, and should be
approved by the audit director before the start of the fieldwork. Any substantial
adjustments should be promptly approved.
An audit plan is a document that provides the main guidance of the whole audit process
to achieve the audit objective in an efficient and effective way. It provides an integrated
description of the auditee and the audit by serving as a guide for the whole audit. The
audit plan for Management and Operations Audits will document the results of all the
planning tools which would necessarily contain the following:
Table 4 - Contents of an Audit Plan
Element Information
Introduction A brief description or background information of the internal controls,
i.e., the plan of organization and all the methods and measures adopted
within the University to ensure that resources are used consistent with
laws, regulations and managerial policies; resources are safeguarded
against loss, wastage and misuse; financial and non-financial information
are reliable, accurate and timely; and operations are economical, efficient,
ethical and effective
Audit Objective Overall objective and scope of the work to be accomplished
and Scope
Assessment of Critical processes identified by the IAS during the planning phase which
Controls led to the selection of the audit area approved by the President and the
formulation of the audit objective
IASSOPPM 15
Audit Process
Audit Approach Compliance audit, management control process audit, audit of program
or project results
Resources/ Statutory policies, mandates, managerial policies, government
Inputs regulations, established objectives, systems and procedures/processes,
stakeholders’ needs and expectations, manpower, materials, equipment
and timeliness
Audit Criteria Set of reasonable and attainable standards of performance, statutory or
managerial policies, laws and regulations, etc.
An audit work program (AWP) is the list of procedures, or steps, to be performed during
the fieldwork phase of the review. The procedures in the AWP should be sufficiently
comprehensive to ensure that the audit objectives are met. However, the program should
not be so rigid as to prohibit flexibility when unanticipated events arise.
For each segment of the audit, the program should include:
i. A statement of the objectives;
ii. The work steps required to test the effectiveness of the existing controls or make
a recommendation to require management to establish and implement controls
where needed;
iii. A space for referencing the related audit work papers and the initials of the
auditor performing the work step and;
iv. The specified time frame.
The AWP (Appendix 2) should be completed and approved at the end of the planning
phase and before the start of any fieldwork. Any adjustments made to the program should
be approved by the audit director, prior to implementation. An approved hardcopy of the
program should be maintained with the work papers.
A Risk and Control Matrix (Appendix 3) will be prepared to summarize the above
information. The audit program is derived from the outcome of the risk and control
analysis.
4.3.5 Approval of the Audit Plan and Audit Work Program
The audit plan and AWP are submitted by the internal auditor to the IASD for review
and approval prior to the commencement of the audit execution. The director will evaluate
the documents to assess the relevance, significance, auditability and other factors affecting
the conduct of the audit.
After the documents have been approved, management should be informed about the
approved audit plan and AWP. The audit plan should be discussed with management but
the AWP should not be shared.
4.4 Audit Execution

Execution of the audit is initiated with an entry conference to discuss the focus,
requirements and timeliness of the audit.
IASSOPPM 16
Audit Process
It involves performing the audit techniques and procedures enumerated in the audit
program to gather data and pieces of evidence, to achieve the stated audit objective/s.
During audit execution, if the auditor finds a need to revise the audit program, the revision
should be submitted to the IASD for approval.
The director uses the audit program to supervise and monitor the progress of the audit
and to check whether the team is generating sufficient and appropriate pieces of
substantial evidence.
At any point during the audit and during the conduct of the baseline assessment of the
Internal Control System (ICS), when significant risks/issues arise, the IAS will prepare
an Interim Report to the President to communicate findings, issues, and problems that
may affect the conduct of the audit and may expose the organization to considerable risks.
A summary of the interim report will be included in the audit report.
EXECUTION How to Audit
1. Entry Conference
2. Conduct compliance audit
a. Gather and analyze evidence
b. Compare conditions with criteria
c. Determine probable cause(s)
d. Prepare working papers
3. Conduct system/process audit
a. Gather and analyze evidence
b. Compare conditions with criteria
c. Determine root cause(s)
d. Prepare working papers
4. Exit conference
REPORTING What and How to Report
FOLLOW-UP What to Follow-up
Figure 4-3 Audit Execution Flow Diagram
4.4.1 Entry Conference

An audit starts with the issue of an engagement letter. The head of the department/area
to be audited (the ‘auditee’) is contacted by the audit director in writing before the audit
is scheduled to start and notified of the audit process.
IASSOPPM 17
Audit Process
The entry conference (Appendix 4) sets the tone of the audit. It is scheduled with area
management and key personnel to discuss the purpose, objectives and scope of the audit,
and the expected start and completion dates of the field work. Input from the area
management is welcomed at this stage, particularly with reference to any known concerns
or areas of potential internal control weakness. Matters arising from the entry conference
must be recorded (Entry Conference Notes) and should be considered during the conduct
of the engagement planning.
4.4.2 Conduct Compliance Audit
Compliance audit is the evaluation of the extent or degree of compliance with laws,
regulations, managerial policies and operating processes in the University, including
compliance with accountability measures, ethical standards and contractual obligations.
Only when there is compliance that control effectiveness is determined. If there is no
compliance, the probable cause for such non-compliance is determined. The IAS identifies
the standards as specified in the organization’s mandate and objectives or
laws/rules/regulations and compares whether the operations conform to the identified
standards.
The steps in the conduct of Compliance Audit are as follows:
a. Gather and analyze (substantial) evidence to establish the condition that the
auditee is in.
b. Compare conditions with criteria to draw conclusion.
c. Determine the probable cause(s). It must be noted that to come up with the
determination of probable cause/s, the IAS must be able to establish, not only the
facts and circumstances, but also the whys, the whats and the hows of the non-
compliance.
d. Prepare the working papers. These contain sufficient information to allow an
experienced auditor having no previous connection with the audit to ascertain
from them the evidence that supports the auditors’ findings.
e. Integrate audit findings and prepare the highlights of the audit findings in terms
of the 4Cs – Criteria, Condition, Conclusion and Cause.
4.4.3 Conduct System/Process Audit
Process audit is designed to evaluate the 4Es of operating systems selected for audit and
aims to evaluate control effectiveness. This step involves the documentation of the process
or system under audit, identification of the control procedures, verification and validation
if such control procedures are complied with and are working effectively. Progress is
discussed with area management, usually as individual objectives are finished, and
particularly regarding any audit concerns.
IASSOPPM 18
Audit Process
The steps in the conduct of Process Audit are as follows:
a. Gather and analyze (substantial) evidence to establish the condition, including
consequence, effects or impact.
b. Compare conditions with criteria to draw conclusion. This refers to conclusion of
facts which is defined as an inference drawn from the subordinate or evidentiary
fact.
c. Determine the root cause(s). Root cause is a structured investigation that aims to
identify the true cause of a problem and the actions necessary to eliminate it. The
determination of root cause through varying techniques is an essential audit
methodology that will assists auditors in analyzing pieces of audit evidence to
come up with appropriate recommendations.
d. Prepare the working papers.
e. Integrate audit findings and prepare the highlights of the audit findings in terms
of the 4Cs.
4.4.4 Exit conference
An exit conference (Appendix 5) is held to discuss the results of the completed audit and
any concerns that may have arisen. Those attending the conference usually include the
audit director, the in- charge auditor, the area head, and anyone the area head wishes to
invite. The exit conference provides an opportunity to resolve any question the audit
client may have about the concerns raised and to address any other issues before the audit
report is finalized. It also provides an opportunity to get the auditee’s comments
(management comments) and insights about the significant audit issues as a way of
validating the audit findings.
Management’s comments should be taken into consideration to arrive at workable
recommendations and obtain the auditee’s commitment towards performing remedial
actions – as a manifestation of progressive attitude towards the audit findings. The
auditee’s comments/responses are recorded in the audit findings sheet and integrated into
the draft report.
4.5 Audit Reporting

Audit reporting represents the culmination of the audit execution and the associated
analysis and considerations made during the audit. The audit report sets out the findings
in appropriate format; provides the pieces of evidence gathered to arrive at the audit
findings and the recommendations.
IASSOPPM 19
Audit Process
EXECUTION How to Audit
1. Develop audit findings

a. Criteria (laws and standards)
b. Condition (findings of facts)
c. Conclusion (conclusion of facts
d. Cause (root cause/s or probable cause/s)
2. Develop audit recommendations
3. Prepare the draft audit report
4. Prepare the final audit report
Figure 4-4 Audit Reporting Flow Diagram

4.5.1 Develop Audit Findings
The audit findings can be developed by analyzing the pieces of evidence gathered for each
of the audit elements. Evidence may be categorized as physical, documentary, testimonial,
analytical or electronic. Evidence should be sufficient and appropriate (substantial),
competent, and relevant. Audit findings provide answers to the audit objectives
(Appendix 6) and should be rational and based on specific standards and criteria.
Audit findings compare the conditions (factual and evidentiary conditions such as the
current state/practices or what is obtaining, and their effects) with the audit criteria, and
determine the causes. Once an audit finding has been identified, two complementary forms
of assessment take place: the assessment of the significance of the findings and the
determination of the probable cause/s and the root cause/s. All audit findings should be
formulated based on the 4Cs.
Audit findings on probable cause of illegality of a transaction constitute a violation of law,
while irregularity constitutes a violation of regulations.
4.5.2 Develop Audit Recommendations
Much of the work of internal audit is judged on the quality of the final audit report,
including its analyses, findings, and recommendations. The recommendations provide
courses of action as the basis for improving internal controls.
Workable recommendations are clear, based on science of facts, conditions and evidence
and on practicable, incontestable, and workable solutions that can stand alone and address
the issue(s) at hand.
IASSOPPM 20
Audit Process
Audit recommendations are management/legal remedies to avoid occurrence (preventive
action) or avoid recurrence (corrective action) of control weaknesses and incidences.
The issues to consider in developing recommendations are as follows:
a. Recommendations are submitted to the President as the official primarily
responsible. The recommendations should identify the probable/root cause of the
gaps or deficiencies/breakdowns. The IAS should not address the probable/root
cause; instead, it should recommend courses of realistic action wherein the
responsible units will take preventive (avoid occurrence) and corrective (avoid
recurrence) measures.
b. Recommended realistic courses of action to indicate what needs to be done, but not
how to do it. The “how” of it is the responsibility of the unit and/or management
concerned.
c. The circumstances that aid or hinder the organization in achieving the criteria
should be identified.
d. The feasibility and cost of adopting a recommendation, with the benefit of a
recommendation outweighing the costs.
e. Alternative courses for remedial actions.
f. Effects of the recommendation (positive and negative).
4.5.3 Prepare the Draft Audit Report
The draft audit report (Appendix 7) is prepared by laying out and analyzing the pieces of
evidence gathered to arrive at preliminary audit findings and recommendations.
Recommendations for action necessary to address those concerns are included in the
report and are addressed to the unit and/or management concerned with a copy given to
the President.
When preparing a draft audit report, the auditor should:
a. Delineate the objectives and scope and report within that scope, unless other
issues of substance are identified;
b. Identify all criteria;
c. Report significant matters – positive or negative;
d. Describe the context and background of the reported matter only as far as is
necessary to provide an understanding of the issue;
e. State initial findings, management’s comments and team’s rejoinder, if any;
f. Present the audit findings in a manner that is concise, fair and objective; and
g. State the recommendations so that they indicate what needs to be done but not
how to do it.
When audit recommendations are made, a written management response to each
recommendation is required. The response should include an agreement or disagreement
with the audit findings and potential recommendation. The unit head should coordinate
the development of these responses with appropriate staff and management.
IASSOPPM 21
Audit Process
Written responses are due within seven (7) business days of a recommendation being
issued. In cases where a fully developed action plan requires further study and analysis,
management may indicate this in their action plan. Management personnel to whom audit
recommendations have been directed are responsible for ensuring that corrective action
is taken. If a plan for action is reported, a date for implementation is to be included. This
response should be provided to the attention of the audit director and to the responding
party’s immediate supervisor. When management declines to respond to a
recommendation, a written statement to that effect should be provided.
If unit management and IAS do not reach agreement on the recommendations, the
unresolved issues will be provided to senior management and/or the President for
additional discussion and final decision. Unresolved recommendations can only be
resolved by senior management and/or the President. In this instance a written
statement of intent to resolve or acceptance of risk must be documented in the audit file.
The responses are incorporated into the audit report and sent to unit management for
final review and concurrence before the report is issued as a final document.
4.5.4 Prepare the Final Audit Report
The draft report may then be finalized (Appendix 8) and presented to the President who
decides on the distribution of the audit report based on the recommendation of the audit
director. An executive summary should be prepared and addressed to the President.
Both the final report and the executive summary should be submitted to the audit director
for review/approval. If no changes are needed, the audit director will review both
documents and sign them.
Follow-up reviews will be scheduled by the audit director during the annual audit plan
preparation process. The audit director will develop the most effective method to perform
follow-up reviews.
4.6 Audit Follow-Up

Follow-up is a monitoring and feedback activity undertaken to ensure the extent and
of preventive/corrective actions taken by the Management to address the inadequacies
identified during the audit. It aims to increase the probability that recommendations will
be implemented. IAS will verify that items reported as resolved are implemented during
the follow-up review process. IAS will issue individual, follow-up review reports on the
verification of implemented recommendations. If a significant number of the items
reported as resolved are not resolved, this will be communicated to senior management
for follow-up action.
IASSOPPM 22
Audit Process
PLANNING
How to Audit
EXECUTION What to Audit
1. Monitor implementation of approved audit

findings and recommendations
2. Resolve non-implementation/inadequate
implementation of audit recommendations
3. Prepare audit follow-up report
Figure 4-5 Audit Follow-Up Flow Diagram
4.6.1 Monitor Implementation of Approved Audit Findings and Recommendations

It is a sound practice to monitor the implementation of approved recommendations
(management/legal remedies) to avoid the occurrence (preventive measures) and
recurrence (corrective measures) of control weaknesses/incidences after a reasonable
period from the report submission date. The benefits of internal audit report
recommendations are reduced, and deficiencies remain, if recommendations are not
implemented within the specified timeframe.
It is management’s responsibility to implement approved findings and recommendations,
but the internal audit is in a good position to monitor the progress of implementation of
the recommendations.
4.6.2 Resolve Non-Implementation/Inadequate Implementation of Audit
Recommendations
In the event of non-implementation of recommendation/inadequate action, the IAS

recommends appropriate legal and/or management remedies for non-implementation of
recommendation and inadequate preventive/corrective actions.
4.6.3 Prepare Audit Follow-up Report
Results of the audit follow-up should be recorded and reported to apprise the President of
the status of actions on the approved recommendations. The reasons for the lack of action
or non-completion of action on any recommendation should be documented and further
action considered on significant recommendations that have not been acted upon. The
report in the form of a memorandum order/letter should:
a. Describe the results of the auditor’s analysis of actual against projected benefits
for the period under review;
b. Summarize the extent of implementation of the approved recommendations;
IASSOPPM 23
Audit Process
c. Highlight cases where auditee’s performance in implementing recommendations
have been particularly inadequate; and
d. Describe the actions, if any, that the auditor intends to take in relation to
inadequate auditee’s actions.
Follow-up of audit recommendations serves four main purposes:
a. Increase the effectiveness of audits – the prime reason for following-up audit
reports is to increase the probability that recommendations will be implemented;
b. Assist the government – following-up may be valuable in proposing some
necessary actions to the President and other officials;
c. Evaluate the IAS performance – follow-up activity provides a basis for assessing
and evaluating the IAS performance; and
d. Create incentives for learning and development – follow-up activities may
contribute to better knowledge and improved practice.
IAS will utilize the following procedures for follow-up reviews:
A. Scheduling Follow-up Activities - The audit director is responsible for scheduling
follow-up activities as part of the annual audit plan and the current audit schedule.
The budget hours allocated to follow-up will be estimated and included in the audit
planning process.
B. Definition and Objective of Follow-up Review - IAS will determine if corrective action
taken is achieving the desired results, or that management has assumed the risk of not
taking corrective action on reported findings.
C. Planning and Scheduling a Follow-up Review - The following steps should be taken
in planning and scheduling a follow-up review:
1. The “Status of Audit Recommendations” spreadsheet from the original audit
should be used as the basis for planning the follow-up review. The auditor
should note the recommendations and corresponding management responses
from the original audit.
2. A follow-up review engagement letter should be sent to management, to (a)
explain the objective of the review, (b) schedule a time for follow-up fieldwork,
as applicable and (c) request a report, or appropriate document outlining the
current status of the actions agreed upon in response to the original audit
report recommendations (along with supporting documentation). It is
advisable to correspond with the auditee/management by phone or in person
prior to sending the letter.
3. Follow-up reviews will not include an opening and closing conference, and the
scope should be limited to the findings included in the original audit report
and any nonreportable conditions resulting from the original audit.
D. Management Responsibility - Management is responsible for deciding the appropriate
action to be taken in response to reported audit findings.
IASSOPPM 24
Audit Process
Management has an ethical responsibility to address the recommendations agreed
upon in the management response section of the original audit report. IAS is
responsible for assessing management action for timely resolution of the issues
reported.
E. Follow-up Report - A formal follow-up report or memorandum will be issued in draft
form and distributed to the original audit report recipients, as applicable. The status
of corrective action or management’s waiver of resolution will be included in the
report. Once the draft report, or memorandum is issued, procedures outlined for
issuing audit reports should be followed.
F. Non-reportable Matters (Observations) - During the follow-up, the auditor will also
perform procedures to determine if any nonreportable items that existed during the
original audit have been satisfactorily resolved. If these matters have not been
resolved, a reportable condition may be included in the follow-up audit report.
G. Conditions Still Exist - If the conditions still exist as a result of the follow-up review,
the audit director will elevate the concerns to the President.
4.7 Summary of Outstanding Recommendations

IAS will issue inventories of open recommendations quarterly to remind Management of
the open items. Management is expected to review the list and communicate progress on
items due/overdue or delays in progress for items not yet due to IAS within ten (10)
business days. IAS will maintain an inventory of items reported by management as
resolved. Open recommendations will be reviewed periodically with the President.
A summary of outstanding recommendations report (Appendix 9) is presented by the
audit director at each quarterly scheduled meeting with the President. This report lists
the audit recommendations that have not been fully implemented. If the quarterly reports
indicate management is not making the planned progress, IAS will report this to senior
management for follow-up action.
The summary report takes the form of a color-coded summary of the outstanding issues,
as follows:
Green: Recommendation is fully implemented
Yellow: Implementation of the recommendation is in progress and a revised date for
completion has been agreed.
Red: Recommendations are either: a) not in progress, or b) not fully implemented
and ‘past due’ following a second or later follow-up review. To the extent
that past due issues give rise to special concern, a progress report to the
President may be required from the unit head.
IASSOPPM 25
Workpapers
5.0 IAS Workpapers
5.1 Qualities of Good Workpapers
All relevant information will be documented and maintained in a file that will be reviewed
and approved by the appropriate audit management. All workpapers, including schedules,
analyses, documents, flow charts, and narratives should be filed in a standard department
binder. The following factors describe a good workpaper:
• Complete – Workpapers must be able to “stand alone.” This means that all questions
must be answered, all points raised by the reviewer must be cleared, and a logical, well-
thought-out conclusion must be reached for each audit segment.
• Concise – Workpapers must be confined to those that serve a useful purpose.
• Uniform – All workpapers should be of uniform size and appearance. Smaller papers
should be fastened to standard workpapers, and larger papers should be folded to conform
to size restrictions of the binder.
• Neat – Workpapers should not be crowded. Allow for enough space on each schedule so
that all pertinent information can be included in a logical and orderly manner. At the
same time, keep workpapers economical. Forms and procedures should be included only
when relevant to the audit or to an audit recommendation. Also, try to avoid unnecessary
listings and scheduling. All schedules should have a purpose, which relates to the audit
procedures or recommendations.
5.2 Retention
Workpapers will be retained for seven (7) years from the date of the audit report. The most
recent set of workpapers for each project will be maintained in IAS’ files. All prior workpapers
are to be filed in sealed boxes and maintained at the university’s warehouse facility.
5.3 Workpaper Techniques

A. Descriptive Headings/Footers
All workpapers should include the university name, the area/function being audited
and the title or brief description of the workpaper in the page heading. In the bottom
right corner of the page, next to the index reference number, the auditor should also
include their initials, the date the workpaper was completed, and a space for audit
management’s approval.
B. Tickmarks
The auditor makes frequent use of a variety of symbols to indicate work that has been
done. These symbols are commonly referred to as tickmarks. As these tickmarks have
no special or uniform meaning by themselves, an explanation of each tickmark should
be made on the schedule on which it appears. If necessary, a separate tickmark sheet
can be prepared and attached to the applicable schedule.
IASSOPPM 26
Workpapers
C. Cross-referencing
Cross-referencing within workpapers should be complete and accurate.
D. Indexing
Workpaper indexing should coincide with the audit program.
E. Carry Forward
The auditor should make full use of the workpapers developed in the prior audit
flowcharts, system descriptions, and other data may still be valid. Those papers, which
remain useful, should be made a part of the current workpapers. They should be
updated with current information, renumbered, referenced, and initialed and dated by
the current auditor.
5.4 Types of Workpaper

A. Electronic
For electronic workpapers, a separate directory should be created for each audit.
Subdirectories should be used for each separate section of the audit. Any manual work
papers produced should be maintained in binders, fully cross-referenced into the
electronic files and vice-versa.
B. Interviews
Most verbal information is obtained through informal or formal interviews conducted
either in person or by telephone. Formal interviews are most desirable because the
interviewers know they are providing input to the audit; however, impromptu
interviews, or even casual discussions, can often provide important information. Any
verbal information which is likely to support a conclusion in the audit workpapers
should be documented. Interviews are useful in identifying problem areas, obtaining
general knowledge of the audit subject, collecting data not in a documented form, and
documenting the audit customer's opinions, assessments, or rationale for actions.
Interview notes should contain only the facts presented by the person interviewed,
and not include any of the internal auditor’s opinions.
In preparing interviews for workpapers, consider the following suggestions:
• Be sure to include the name, department, and position title of all persons from
whom information was obtained. This includes data gathered during casual
conversations.
• Indicate when and where the meeting occurred.
• Organize notes by topic wherever possible.
• Identify sources of information quoted by interviewee
IASSOPPM 27
Workpapers
C. Observations
What IAS observed can serve the same purposes as interviews. If observations can be
used to support any conclusions, then they should be documented. They are especially
useful for physical verifications.
Observations used as supporting documentation should generally include:
• Time and date of the observation.

• Where the observation was made.
• Who accompanied the auditor during the observation?
• What was observed? When testing is involved, the workpapers should include
the sample selections and the basis of the sample.
D. Findings
All audit findings should be documented in the workpapers. Findings should be
summarized on an Audit Finding Data Sheet (Appendix 14) whether or not they are
to be included in the audit report. All findings should be documented immediately by
the auditor discovering the situation.
5.5 Workpaper Organization

All workpapers should be placed into an expandable type binder. The sequence of
workpapers should be as follows:
In the first segment, right-hand side, place the following in order:
1. Executive summary
2. Final audit report
3. Draft audit report
4. Audit inquiries and document requests with management responses
5. Survey and management response
In the first segment, left-hand side, place the planning packet, displaying the audit
program on top of the packet. Use the remainder of the folder for the audit workpapers.
5.6 Security and Control of Workpapers

A. Ownership
The audit workpapers are owned by the internal audit services department.
B. Physical Control/Access
• Workpapers are the IAS' property and should be kept under their control.
• Workpapers may contain confidential data as well as data related to internal audit
concerns and development of recommendations that should be considered
confidential.
IASSOPPM 28
Workpapers
• Access to electronic workpapers should be controlled via security controls
(passwords, shared file controls, etc.), and portable computers should be subject to
careful physical security measures. IAS auditors should maintain close control of
any manual workpapers and supporting documents during the audit. When not
in use, they should be kept in a locked file or otherwise secured so they are not
readily available to persons unauthorized to use them.
• The Auditor-in-Charge (AIC) should obtain approval of the IASD prior to
releasing work papers to external parties.
IASSOPPM 29
IAS Management
6.0 IAS Management
6.1 Audit Monitoring
As and when the audit progresses the AIC should monitor the progress of the audits under
his responsibility and fill in an Audit Monitoring Sheet (Appendix 10).
6.2 Time Reports

The time report lists all projects worked on during the month and the number of hours
worked. It also includes all general administrative time such as training, staff meetings,
special research assignments, etc., and leave hours such as vacation, sick and casual leaves. It
is the responsibility of the audit staff to complete Time Report (Appendix 14) at the end of
each day and submit for review by the appropriate AIC at the end of each month.
Time reports should be reviewed by the appropriate AIC and submitted to the IASD by the
fifth day of each month.
6.3 Progress Reports

It is the responsibility of each AIC to complete Monthly Progress Report (Appendix15) at
the end of each day and submit for review by the IASD by the fifth of the following month.
Whenever an AIC, is proceeding on long leave, (vacation, leave without pay, maternity leave
etc.) he/she should inform the IASD in writing.
AIC should prepare Quarterly Return (Appendix 16) of all audit activities carried out during
the period and submit to the IASD by the seventh day of the following month.
6.4 IAS Meetings

The department shall hold quarterly audit staff meetings. The meetings shall be scheduled
and called by the IASD. At the meeting, audit assignments shall be discussed, and any other
problem encountered by auditors in the course of their work. The minutes of such meetings
shall be recorded and confirmed at the next meeting. All members of staff shall receive a
copy of the minutes.
6.5 Decision Making Procedures

To enhance the efficient running of the department, there is need to have a clear
communication system. The following decision-making procedures shall be followed:
• The IASD shall constitute an internal committee in which all AIC will be members.
• The IASD shall be the chairman to this committee which shall hold meetings on need
basis.
• The committee will deliberate on issues relating to administration, operations and
functions of the department.
IASSOPPM 30
IAS Management
The final authority however is vested on the IASD. The AIC shall also hold meetings with
their unit staff regularly to communicate decisions made in such meetings.
6.6 Performance Evaluations

A. Evaluation of Internal Audit Staff
Performance evaluation shall be based on the performance contracts signed with
management. Performance evaluation of staff should take account of the time budget,
quality of work and attitude towards work.
The IASD shall do semi-annual reviews and prepare a documented evaluation of the
auditor’s performance (Appendix 17). Strengths and weaknesses should be noted and be
supported by specific instances. In this way, the auditor should receive the most objective
assessment and at the same time focus on specific areas for improvement.
The evaluation will be based on the officers’ overall performance and the quality of the
work that was accomplished. Some of the items considered when making the evaluation
for auditors are:
• The ability to identify and raise quality issues in an audit

• Good and well-reasoned audit recommendations
• Audit completion dates versus the promised completion dates
• Communication skills
• Report writing skills.
If the IASD identifies weaknesses, an action plan shall be developed to assist in making
the necessary improvements to achieve a satisfactory level of performance. Training
needs shall also be identified to address areas to be strengthened.
B. Evaluation of Internal Audit Services – Management

Ongoing monitoring activities should also be incorporated into daily operations of the
IAS activity. This will provide assurance that the processes in place are working effectively
to ensure quality is delivered on an engagement-by-engagement basis. A management
assessment (Appendix 19) must be performed every after engagement and results shall
be compiled, summarized and submitted to the President annually.
6.7 Periodic Review of Policies and Procedures

A. Minor Amendments
Minor amendments (e.g., to reflect changes in position titles or nomenclature of
organizational units) which do not otherwise affect the policy content can be incorporated
in another amendment to the document in the near future.
IASSOPPM 31
IAS Management
B. Major Amendments
In order to enhance the IASSOPPM, a periodic review of policies and procedures will be
undertaken every two (2) years to ensure they are still current. The need to amend the
policies and procedures may be prompted by feedback from department specific and
governing bodies’ internal audit implementation insights; changes in laws, policies,
guidelines and regulations; and requisites for enhancing work practices.
Where review will result in a major overhaul of a policy, development of a brief review
and approval plan may be advisable. The plan should outline relevant steps associated
with the review, including consultation, review by relevant committees, and target dates
for final approval by the University President.
At the end of the review, an Amendment History table will be completed and made part
of the IASSOPPM.
Amendment History:
1. xxxxxxxxxxxxxxxxxxxxxxx
Contact Officer
Approval Date
Updated to New Standard
Improvement and Clarification
Approval Authority
Date of Next Review
Printed Copy
Electronic Copy
IASSOPPM 32
Glossary
7.0 Glossary
Accountability. The obligation of an individual or institution to account for its activities,
accept responsibility for them, and disclose the results in a transparent manner.
Add Value. The internal audit activity adds value to the organization (and its stakeholders)
when it provides objective and relevant assurance, and contributes to the effectiveness and
efficiency of governance, risk management, and control processes.
Assurance Services. An objective examination of evidence for the purpose of providing an
independent assessment on governance, risk management, and control processes for the
organization. Examples may include financial, performance, compliance, system security, and
due diligence engagements.
Auditee. The public official responsible for the subject of the audit. The auditee for each audit
is the senior manager with overall responsibility for the organizational area being reviewed.
The NGICS prohibits the auditor to have a client/customer relationship with the auditee.
Board of Regents. The University’s governing body to whom the President functionally
report.
Charter. The internal audit charter is a formal document that defines the internal audit
activity’s purpose, authority, and responsibility. The internal audit charter establishes the
internal audit activity’s position within the organization; authorizes access to records,
personnel, and physical properties relevant to the performance of engagements; and defines
the scope of internal audit activities.
Code of Ethics. The Code of Ethics of The Institute of Internal Auditors (IIA) are Principles
relevant to the profession and practice of internal auditing, and Rules of Conduct that describe
behavior expected of internal auditors. The Code of Ethics applies to both parties and entities
that provide internal audit services. The purpose of the Code of Ethics is to promote an ethical
culture in the global profession of internal auditing.
Compliance. Adherence to policies, plans, procedures, laws, regulations, contracts, or other
requirements.
Compliance Audit. Review of the degree of adherence with laws, regulations, managerial
policies and operating procedures of government, including compliance with accountability
measures and ethical standards and contractual obligations. It is a necessary “first step” to,
and part of management and operations audits.
Conflict of Interest. Any relationship that is, or appears to be, not in the best interest of the
organization. A conflict of interest would prejudice an individual’s ability to perform his or
her duties and responsibilities objectively.
IASSOPPM 33
Glossary
Consulting Services. Advisory and related client service activities, the nature and scope of
which are agreed with the client, are intended to add value and improve an organization’s
governance, risk management, and control processes without the internal auditor assuming
management responsibility. Examples include counsel, advice, facilitation, and training.
Control. Any action taken by management, the board, and other parties to manage risk and
increase the likelihood that established objectives and goals will be achieved. Management
plans, organizes, and directs the performance of sufficient actions to provide reasonable
assurance that objectives and goals will be achieved.
Control Environment. The attitude and actions of the board and management regarding the
importance of control within the organization. The control environment provides the
discipline and structure for the achievement of the primary objectives of the system of internal
control. The control environment includes the following elements:
• Integrity and ethical values.
• Management’s philosophy and operating style.
• Organizational structure.
• Assignment of authority and responsibility.
• Human resource policies and practices.
• Competence of personnel.
Control Processes. The policies, procedures, and activities that are part of a control
framework, designed to ensure that risks are contained within the risk tolerances established
by the risk management process.
Engagement. A specific internal audit assignment, task, or review activity, such as an
internal audit, control self-assessment review, fraud examination, or consultancy. An
engagement may include multiple tasks or activities designed to accomplish a specific set of
related objectives.
Expert. Person who is knowledgeable in a specialized field, that knowledge being obtained
from either education or personal experience. He/she is one who by reason of education or
special experience has knowledge respecting a subject matter about which persons having no
particular training are incapable of forming an accurate opinion or making a correct
deduction.
Four Cs in Audit Findings. Stands for criteria, condition, cause and conclusion.
• Criteria are the standards against which a condition is compared; standards can be laws,
rules, regulations, policies, orders, guidelines, procedures, plans, targets, best practices,
etc.
• Condition is a fact, backed up by a substantial evidence (includes consequence, effects or
impact); this is also referred to as the “finding of facts” which is defined as the written
statement of the ultimate facts essential to support the audit findings.
IASSOPPM 34
Glossary
• Cause refers to the probable cause, in case of compliance audit; or root cause, in case of
management audit or operations audit. Relatedly, a finding of probable cause needs only
to rest on evidence showing that more likely than not the act/s or omission/s of the
person responsible had caused the non-compliance which may warrant the conduct of
administrative proceeding by the disciplining authority. Root cause is a structured
investigation that aims to identify the true cause of the control weaknesses or incidences
and the actions necessary to eliminate it.
• Conclusion is the evaluation of the criteria and the conditions that could either result in
compliance or non-compliance with laws, regulations and policies, as supported by
substantial evidence; control effectiveness; determination of adequacy or inadequacy of
controls; determination of the efficiency, effectiveness, ethicality, and economy of agency
operations; this is also referred to as the “conclusion of facts” which is defined as an
inference drawn from the subordinate or evidentiary facts.”
Four Es of Operations. Stands for efficient, effective, economical and ethical.
• Efficient refers to “doing things right” given the available resources/inputs and within a
specified timeframe. This is about delivering a given quantity and quality of outputs with
minimum inputs or maximizing outputs with a given quantity and quality of inputs.
• Effective refers to “doing the right things”. Effective operations mean that operating
units are able to deliver their major final outputs and outcomes and able to achieve the
expected results and contribute to the achievement of the sectoral and societal goals.
• Economical refers to the performance of functions and tasks using the least amount of
resources/inputs within a specific timeframe. It implies that the resources/inputs should
be acquired at the right cost, at the right time, at the right place, in the right quantity and
of the right quality.
• Ethical refers to conformity with the norms of conduct and ethical standards as
contained in RA 6713, otherwise known as the “Code of Conduct and Ethical Standards
for Public Officials and Employees”.
Fraud. Any illegal act characterized by deceit, concealment, or violation of trust. These acts
are not dependent upon the threat of violence or physical force. Frauds are perpetrated by
parties and organizations to obtain money, property, or services; to avoid payment or loss of
services; or to secure personal or business advantage.
Governance. The combination of processes and structures implemented by the board to
inform, direct, manage, and monitor the activities of the organization toward the achievement
of its objectives.
Impairment. Impairment to organizational independence and individual objectivity may
include personal conflict of interest, scope limitations, restrictions on access to records,
personnel, and properties, and resource limitations (funding).
Independence. The freedom from conditions that threaten the ability of the internal audit
activity to carry out internal audit responsibilities in an unbiased manner.
IASSOPPM 35
Glossary
Internal Audit. The evaluation of management control and operations performance and the
determination of the degree of compliance with laws, regulations, managerial policies, and
contractual obligations. It is the appraisal of the plan of organization and all the coordinate
methods and measures to recommend courses of action on all matters relating to
management control and operations audit.
Internal Audit Annual Work Plan. It contains the coverage of the audit for a given calendar
year and approved by the President. The plan should outline the deficiencies in internal
control and vulnerability being addressed, audit title, specific audit area, type of audit,
summary description of the audit, expected benefit, priority and resources to be used,
estimated duration and cost, and proposed timing of the audit, among others.
Internal Audit Services Director (IASD). The highest official in the Internal Audit Service
of the University. He has overall responsibility for auditing the organization, managing the
entire audit cycle and a team of internal auditors, and ensuring the quality of audit products
produced by the team.
International Organization of Supreme Audit Institutions (INTOSAI).
It is a non-governmental organization with special consultative status with the Economic and
Social Council (ECOSOC) of the United Nation. Operates as an umbrella organization for the
external government audit community.
Management Audit. The separate evaluation of the effectiveness of the internal controls
adapted in the operating and support services units/systems, whether it achieves the control
objective over a specific date or period of time. It is a review and appraisal of systems and
processes, organizational structure and staffing, operations and management practices,
records, reports and performance standards of the agencies/units covered. It includes the
determination of the extent of compliance with laws, rules, regulations, managerial policies,
operating procedures, accountability measures and contractual obligations covering specific
timeframes. Examples of support services systems are human resource management system,
financial management system, quality management system, risk management system and
their sub-system; while operating systems of bureaus, regional offices and local government
units include, among others, the rules of engagement in the conduct of arrest, search and
seizure and rules on vaccination and immunization.
Objectivity. An unbiased mental attitude that allows internal auditors to perform
engagements in such a manner that they believe in their work product and that no quality
compromises are made. Objectivity requires that internal auditors do not subordinate their
judgment on audit matters to others.
Operations Audit. The separate evaluation of the outcome, output, process and input to
determine whether government operations, including management and personnel structure
in programs/projects are effective, efficient, ethical and economical. Operations audit of
organizations, programs, and projects involves an evaluation of whether or not expected
results were achieved and targets were attained.
IASSOPPM 36
Glossary
Philippine Government Internal Audit Manual (PGIAM). The documentation of the
standards and procedures for conducting management and operations audits. It serves as a
friendly tool to internal auditors in appraising the internal control systems of the public
entities (agencies). It provides details on the nature and scope of internal audit in the
Philippine public sector, including the institutional arrangements of the internal audit
function, as well as the protocols and processes for the conduct of internal audit.
The PGIAM is divided into two parts. Part I - Guidelines (PGIAM I) outlines the basic
concepts and principles of internal audit, and the policies and standards that will guide
government agencies in organizing, managing, and conducting an effective internal audit.
Part II – Practices (PGIAM 2) contains tools, techniques, and approaches that will facilitate
the conduct of internal audit activities.
Risk. The possibility of an event occurring that will have an impact on the achievement of
objectives. Risk is measured in terms of impact and likelihood.
Risk Appetite. The level of risk that an organization is willing to accept.
Risk Assessment. The process of identifying, analyzing and evaluating relevant risks to the
achievement of the control objectives and determining the appropriate response. In other
words, it is the identification, analysis and evaluation of what could go wrong and how to
address it.
Risk Management. A process to identify, assess, manage, and control potential events or
situations to provide reasonable assurance regarding the achievement of the organization’s
objectives. Risk management is part of the responsibilities of management and an integral
part of all organizational processes.
Root Cause Analysis. A method that is used to address a deficiency in order to get the “root
cause” of the problem. It is used in order to correct or eliminate the cause and prevent the
problem from recurring. It attempts to identify the root or original causes instead of dealing
with the immediately obvious symptoms. It is a structured review and evaluation that aims to
identify the true cause of the deficiency and the courses of action necessary to address it.
RCA is continuing to ask why the control deficiency occurred until the fundamental process
element that failed is identified.
Significance. The relative importance of a matter within the context in which it is being
considered, including quantitative and qualitative factors, such as magnitude, nature, effect,
relevance, and impact. Professional judgment assists internal auditors when evaluating the
significance of matters within the context of the relevant objectives.
Stakeholder. A person or organization that can affect, be affected by, or perceive themselves
to be affected by a decision or activity. The IAS relates with both internal and external
stakeholders.
Standard. A professional pronouncement promulgated by the Internal Audit Standards
Board that delineates the requirements for performing a broad range of internal audit
activities, and for evaluating internal audit performance.
IASSOPPM 37
Appendices
8.0 Appendices
Appendix Form
Title Page
No. No.
1 001 Annual Audit Plan (AAP) 39
2 002 Audit Work Program (AWP) 40
3 003 Risk and Control Matrix (RCM) 41
4 004 Entry Conference (ENC) 42
5 005 Exit Conference (EXC) 43
6 006 Audit Finding Data Sheet (AFDS) 44
7 007 Draft Audit Report (DAR) 45
8 008 Final Audit Report (FAR) 46
9 009 Summary of Outstanding Recommendations (SOR) 47
10 010 Audit Monitoring Sheet (AMS) 48
11 N/A Flowchart Symbols 49
12 N/A Audit Process Flowchart (APF) 50
13 N/A Summary of Audit Process Flowchart (SAPF) 51
14 011 Time Report (TR) 52
15 012 Monthly Progress Report (MPR) 53
16 013 Quarterly Return (QR) 54
17 014 Evaluation of Internal Audit – Self Assessment 55
18 N/A Code of Ethics 56
19 015 Evaluation of Internal Audit – Management 57
IASSOPPM 38
References
9.0 References
1. Administrative Order (AO) No. 278, “Directing the Strengthening of the Internal
Control Systems of Government Offices, Agencies, Government-Owned and/or
Controlled Corporations, Including Government Financial Institutions and Local
Government Units, in Their Operations”, 28 April 1992.
2. AO No. 70, “Strengthening of the Internal Control Systems of Government Offices,
Agencies, Government-Owned and/or Controlled Corporations, Including Government
Financial Institutions, State Universities and Colleges and Local Government Units”, 14
April 2003.
3. Civil Service Commission (CSC) Memorandum Circular (MC) No. 27, “Policy on
Consultancy Contracts”, 24 June 1993.
4. CSC MC No. 1, s.2007, “Repeal of CSC MCs No. 17, s. 2002 also known as the Policy
Guidelines for Contracts of Service” and CSC No. 24, s. 2002 also known as the
“Clarification of Policy Guidelines for Contract of Service”, 12 January 2007.
5. CSC MC No. 12, s.2006, “Qualification Standards for IAS Positions”, 22 June 2006.
6. CSC MC No. 40, s.1998, “Revised Omnibus Rules on Appointments and Other Personnel
Actions”, as amended by CSC MC. No. 15, s. 1999, “Additional Provisions and
Amendments to CSC MC No. 40, s. 1998” and CSC MC No. 21, “Policies on Detail”, 26
September 2002.
7. CSC MC No. 95-092, “AO of the President date 28 April 1992,”23 August 1995.
8. Commission on Audit (COA) Circular No. 93-214-A, “Government Contracts for
Internal Audit Services”, 4 March 1993.
9. Department of Budget and Management (DBM) Budget Circular 2004-4,
“Guidelines in the Organization and Staffing of Internal Auditing Units”, 22 March 2004.
10. DBM Circular Letter Nos. 2008-05, “Guidelines in the Organization and Staffing of an
Internal Audit Service/Unit and Management Division/Unit in Departments/Agencies/
GOCCs/GFIs Concerned”, 14 April 2008.
11. DBM Circular Letter No. 2008-8, “National Guidelines on Internal Control Systems
(NGICS)”, 23 October 2008.
12. DBM-CSC Joint Resolution No. 1, “Rationalization Program’s Organization and

Staffing Standards and Guidelines”, 12 May 2006.
13. Executive Order (EO) No. 292, “Administrative Code of 1987”, 25 July 1987.
14. EO No. 605, “Institutionalizing the Structure, Mechanisms and Standards to Implement
the Government Quality Management Program Amending for the Purpose
Administrative Order No. 161, s. 2006”, 23 February 2003.
IASSOPPM 58
Glossary
15. International Organization of Supreme Audit Institutions (INTOSAI). Guidelines
for Internal Control Standards for the Public Sector [online]. 16 October 2004. Available
from World Wide
Web:<intosai.connexcchosting.net/blueline/upload/1guicspubsece.pdf>.
16. Malacanang Memo Circular No. 89, 18 August 2005.
17. Office of the President Memorandum. “Paper on the Doctrine of Completed Staff
Work”. 3 August 1993. MC No. 110, 23 August 2006. MC No. 68, 17 September 2004;
MC No. 24, 7 August 2002; and Memorandum from the President dated 10 June 1999
signed by President Joseph Estrada.
18. Philippine Government Internal Audit Manual, DBM Circular Letter No. 2011-5, 19
May 2011.
19. Presidential Decree No. 1445, “Government Auditing Code of the Philippines”, 11 June
1978.
20. Republic Act (RA) No. 6713, “Code of Conduct and Ethical Standards for Public
Officials and Employees” and its IRR, 20 February 1989.
21. Republic Act (RA) No. 3456, “Internal Auditing Act of 1962, 16 June 1962.
22. Republic Act (RA) No. 4177, “Amendments to Internal Auditing Act of 1962, 26 March
1965.
23. The Institute of Internal Auditors. International Professional Practices Framework
(IPPF). USA: The Institute of Internal Auditors, January 2009.ISBN 978-0-89413639-9.
IASSOPPM 59

Sample IRR

Uploaded by

Copyright:

Available Formats

Sample IRR

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sample IRR

Uploaded by

Copyright:

Available Formats

Republic of the Philippines

Ramon Magsaysay Technological University

Internal Audit Services

Standard Operating Policies and Procedures Manual

2.5 Core Values

• INTEGRITY – We exhibit fairness, honesty and ethical behavior in our service to

2.7 Responsibilities and Accountabilities

• Conduct management/operations performance audit of activities of the department

2.9 Auditees’ Responsibilities

2.10 Special Assignments

Prepared by: Date:

Approved by: Date:

INTERNAL INTERNAL AUDITING INTERNAL

3.2 Conduct of Internal Audit

Table 1 - Director/Head of Internal Audit

Table 2 - Internal Auditor

3.4 Training and Professional Development

3.5 Personnel Performance Evaluation

Figure 4-1 Audit Process Flow Diagram

4.2 The Annual Audit Plan (AAP)

4.3 Audit Engagement Planning

• Understanding the control environment and the organization;

1. Document understanding of the program and

EXECUTION What and How to Report

REPORTING How to Audit

Figure 4-2 Audit Engagement Planning Flow Diagram

4.3.1 Document Understanding of the Program and Project

i. Preliminary gathering of documents/information;

i. Are the control components sufficient to safeguard the assets?

4.4 Audit Execution

PLANNING What to Audit

EXECUTION How to Audit

REPORTING What and How to Report

FOLLOW-UP What to Follow-up

Figure 4-3 Audit Execution Flow Diagram

4.4.1 Entry Conference

4.5 Audit Reporting

EXECUTION How to Audit

REPORTING What and How to Report

1. Develop audit findings

FOLLOW-UP What to Follow-up

Figure 4-4 Audit Reporting Flow Diagram

4.6 Audit Follow-Up

EXECUTION What to Audit

REPORTING What and How to Report

FOLLOW-UP What to Follow-up

1. Monitor implementation of approved audit

Figure 4-5 Audit Follow-Up Flow Diagram

4.6.1 Monitor Implementation of Approved Audit Findings and Recommendations

In the event of non-implementation of recommendation/inadequate action, the IAS

4.7 Summary of Outstanding Recommendations

5.3 Workpaper Techniques

5.4 Types of Workpaper

• Time and date of the observation.

5.5 Workpaper Organization

5.6 Security and Control of Workpapers

6.2 Time Reports

6.3 Progress Reports

6.4 IAS Meetings