An audit program is…
An audit program is a document that links the audit objective to the related methodologies and to the documents where the methodologies were performed. Man, that is a long sentence.
Let’s try that another way. An audit program, at a minimum, links these three items:
- The audit objective
- The methodologies (or audit tests) for that objective
- A reference to where the methodologies were performed and documented
Want to trick out your audit program?
If you want to trick out your program, you can also add:
- Initials of the auditor
- Initials of the reviewer
- Results of the methodologies
- Conclusions against the audit objectives
- Types of evidence gathered (physical, documentary, testimonial)
What does one look like?
Audit programs are commonly presented in a grid or matrix.
Most commonly, audit programs are presented in a grid that looks something like this:
|Audit objective: Determine if….|
|METHODOLOGIES||REFERENCE TO DOCUMENT WHERE METHODOLOGY WAS SATISFIED||INITIALS OF AUDITOR AND DATE||INITIALS OF REVIEWER AND DATE|
|Methodology: sample x for x attribute||A-1||LAH 1/30/2022||BR 2/3/2022|
|Methodology: verify that x matches x||A-2||LAH 2/3/2022||BR 2/8/2022|
|Methodology: confirm with x that x is valid…||A-3||LAH 2/7/2022||BR 2/9/2022|
Why is it called an audit program?
I assume the term ‘program’ is used because it is similar to a program in a play. You know:
- ACT 1: Scene 1: Doris gets her oats
- ACT 2: Scene 2: Sargent Pepper inspects the Yellow Submarine
Why do we use it?
An auditor program is a great place for a reviewer view – on one document – how an auditor’s working papers fit together. An audit program gives a succinct overview of what the auditor is doing to satisfy the audit objective.
For auditors, it helps keep them organized and on track.
Audit programs aren’t always mandated
The AICPA audit standards and the IIA IPPF require audit programs. The GAO’s GAGAS does not require performance auditors to create an audit program.
Why doesn’t the GAO require an audit program? Well, they do mandate that you have an audit objective and that you document your methodologies. So the elements of an audit program do have to be in the audit documentation, they just don’t mandate that all of these elements show up in the same place on the same document.
I think this approach makes a lot of sense given that most audit shops use electronic working papers and can generate something that gives the reviewer an overview of the content of the audit documentation with a click of a button.
Want to learn more: Attend our Audit Reporting Clinic in September.