Ahnaf Gharib’s Post

Internal audits can be categorized into different types of reviews. During an audit cycle, the following types of internal audits are carried out: 1. Financial Reviews: These audits evaluate the accounting and reporting of financial transactions. This includes commitments, authorizations, receipts, and disbursement of funds. 2. Compliance Reviews: These audits determine the degree of adherence to laws, policies, and procedures. 3. Operational Reviews: These audits examine the means used to identify, measure, classify, and report information. They also review the means for safeguarding assets, identify opportunities for the economy of resources, and review the systems established to ensure compliance with policies, procedures, plans, laws, and regulations. 4. Information System Reviews: These audits evaluate system input, output, and processing controls, backup and recovery plans, and logical and physical security. 5. System Development and Implementation Reviews: These audits provide input into the control aspects of major information systems development projects. This feedback is designed to provide important insight during the formative stages of information systems projects. #internalaudit #financialreviews #compliancereviews #operationalreviews #informationsystemreviews #systemdevelopmentandimplementationreviews

Updates for Working Papers 2024 & Audit International 26.00 ⚡️ We are pleased to announce that updates for users of the English version of Caseware - Working Papers 2024 and Audit International 26.00 are now available! Audit International includes changes and new requirements of ISA 600 (Revised), Special Considerations - Audits of Group Financial Statements (Including the Work of Component Auditors), which are aimed at enhancing the auditor's responsibilities related to the audit of group financial statements. In addition, the documents listed in this update have been enhanced to provide more user-friendly content to optimize the audit workflow based on feedback from users and practitioners/regulators. More information about the update is available at https://lnkd.in/efc32mFY For advice on updating the program, as well as to receive new installation files, please email support@caseware.com.ua.

REVIEW - The Ultimate Guide to Audit & Assurance https://lnkd.in/grQW_Fq5 REVIEW OF OCEG’s recent Guide: ‘The Ultimate Guide to Audit and Assurance’ covers a lot of ground in a surprisingly small number of pages. Written in clear ‘everyman’ language, the Guide breaks difficult and detailed organizational concepts and proposal systems into a very clear ‘how to’ book. Useful for either establishing a new Assurance and Audit Department or building on an existing structure and improving it, the Guide’s eight Chapters and six appendices contain a wealth of well laid out information for any reader building, maintaining, or improving an Audit or Assurance function. The value does not end with those possible readers, however. Anyone working in the first or second ‘lines of defense’ will find this Guide extremely useful in understanding exactly how their contributions add to the overall company Assurance landscape – and will demonstrate and emphasize exactly how critical their often unrealized and unrecognized contributions really are to the evaluation of a company’s operational performance, security risks, financial risks and more. Throughout the guide there are also live links to a great many other related resources, keeping the Guide to a manageable size but easily allowing users to ‘drill down’ on specific concepts and themes which will be of the most use to them. This guide is not only useful, but also motivational in getting people excited about applying a better GRC process to their organizations as well as understanding and leveraging the benefits that proper Assurance can provide to their business activities. Highly recommended. - Michael Major.

Which of the following outlines the overall authority to perform an information systems (IS) audit? A. The approved audit charter B. A request from management to perform an audit C. The audit scope with goals and objectives D. The approved audit schedule

We've recently completed our 1000nd deliverability audit. It's been interesting to observe the changes in quality and processes at MailSoar both internally and externally, from 1st to 1000nd audit. We've developed a more seamless audit experience for our clients, with a strong focus on communication and onboarding. Our documentation and research have also become more thorough and accurate. Here’s a glimpse of our progress: Email Audit: Then: 5-8 page documents Now: Over 30 pages of detailed insights Data Points: Then: 6 key metrics analyzed Now: 35+ data points informing our conclusions and action plans We now do quarterly revisions to incorporate industry updates and client feedback. We're currently on version 13 of our audit document. This is usually how the process goes: 1/ Deliverability audits: the goal here is to develop a plan of action to fix the root cause of the issue. 2/ Implementation of best practices (usually after an audit, we would implement the plan of action with the client over a 3 months period). 3/ Long term support: we monitor deliverability KPIs, meet regularly with the client and troubleshoot issues. The goal is to enable the client to run their marketing ideas while keeping optimal deliverability. But fact is that for many of our clients, a single audit is all it takes to resolve their deliverability challenges. It’s an investment that truly pays off.

The Ultimate Guide to Audit & Assurance https://lnkd.in/grQW_Fq5 REVIEW - OCEG’s recent Guide: ‘The Ultimate Guide to Audit and Assurance’ covers a lot of ground in a surprisingly small number of pages. Written in clear ‘everyman’ language, the Guide breaks difficult and detailed organizational concepts and proposal systems into a very clear ‘how to’ book. Useful for either establishing a new Assurance and Audit Department or building on an existing structure and improving it, the Guide’s eight Chapters and six appendices contain a wealth of well laid out information for any reader building, maintaining, or improving an Audit or Assurance function. The value does not end with those possible readers, however. Anyone working in the first or second ‘lines of defense’ will find this Guide extremely useful in understanding exactly how their contributions add to the overall company Assurance landscape – and will demonstrate and emphasize exactly how critical their often unrealized and unrecognized contributions really are to the evaluation of a company’s operational performance, security risks, financial risks and more. Throughout the guide there are also live links to a great many other related resources, keeping the Guide to a manageable size but easily allowing users to ‘drill down’ on specific concepts and themes which will be of the most use to them. This guide is not only useful, but also motivational in getting people excited about applying a better GRC process to their organizations as well as understanding and leveraging the benefits that proper Assurance can provide to their business activities. Highly recommended. - Michael Major.

Information technology control weaknesses can be reportable in writing. I’m noticing that firms implementing SAS 145 are identifying more IT control weaknesses. What are we required to do when there are deficiencies in general controls or transaction processing controls (both IT control weaknesses)? 1. Consider the impact on your risk assessment and planning 2. Consider whether the control weakness is a significant deficiency or material weakness Many financial statement auditors are well acquainted with traditional control weaknesses such as a lack of segregation of duties. But we may not be as familiar with IT controls and their impact on whether material misstatements might occur. Consequently, we might struggle with assessing risk as it relates to IT control deficiencies. To keep it simple, ask yourself, “Is it reasonably possible that this IT control deficiency could allow a material misstatement?” If yes, then you have a material weakness (which is reportable in writing—either in an internal control letter or in a Yellow Book report). And such a weakness may require additional audit steps (new audit procedures in your audit program). But what additional audit steps, you say? In light of the IT control weakness, ask what misstatements might possibly occur and add steps that would detect those misstatements. Some IT general controls such as passwords can have a pervasive impact on risk. To use a silly example to make a point, suppose your audit client’s personnel all used the same password to access the accounting software. You now have a control weakness that could allow misstatements in many places. Not good. Or what if all accounts payable personnel used the same password. Well now the potential misstatements areas are less (just accounts payable), but it’s still a problem that deserves increased audit procedures (albeit, in accounts payable, in this example). So, I encourage you to consider how IT control weaknesses will affect your risk assessment, audit planning, and reporting of deficiencies. #CPAHallTalk, #ITcontrols

With the onset of audit trail requirements beginning last FY, I’ve incorporated following elements in a SOP to help a company create robust controls and at the same time provide comfort of compliance to the statutory auditors. Looking for some generous inputs and creating a blueprint for everyone’s reference :) (One time activity- by Finance controller) - Identification of softwares affecting books of accounts, on which the audit trail is applicable. - Identification of transactions on which audit trail requirement is applicable. - Review of edit logs to ensure it contains details of (One time activity- by IT Head) - Ensuring audit trail has been activated in system on transaction level - Confirming audit trail is activated on database levels - Ensuring access rights to activate and deactivate audit trail is available with only authorised individuals - Document backup policy, including audit trails in the back ups - In case the software is controlled by a vendor, ensuring appropriate clauses have been incorporated in agreement with the vendor (Periodic activities- by IT Head) - Periodic sign off that audit trail has not been compromised/ deactivated/ modified - Any deactivation/ modification is done only with documented reasons and approvals of IT head. - Review and sign off that back up was done as per policy #audittrail #SOP #controls #internalcontrols

The Phew Audit System is an innovative online auditing solution that will revolutionise the way you and your team operate. Our user-friendly platform streamlines processes, automating the creation, gathering, and reporting of data – saving you precious time and energy. With our system taking care of the manual processes, you can now focus on the more meaningful tasks at hand. It’s no wonder that Dudley Safeguarding People Partnership has seen a 120% increase in audit completions year-on-year, whilst reducing their internal admin time by four weeks! Take a look at this infographic to see just how the system allows you to feel more in control and reclaim valuable time: https://hubs.li/Q02tlmJr0