David M Griffiths
In 1972, I
In 1972, I finished my chemistry Ph.D. at finished my chemistry Ph.D. at NottinghaNottingham University and joined Pricem University and joined Price Waterhouse as a trainee accountant.
Waterhouse as a trainee accountant.
II qualified in 1976 and mqualified in 1976 and moved to the internal audit deparoved to the internal audit department of the Boots Company PLC,tment of the Boots Company PLC, a
a retail chemists and hearetail chemists and healthcare company (£5bn lthcare company (£5bn turnover), before assistiturnover), before assisting in theng in the introduction of inflation
introduction of inflation accounting.accounting.
II returned to be Head of the internal audireturned to be Head of the internal audit department a year later, in charge of 12 staff.t department a year later, in charge of 12 staff.
Promotion to Head of
Promotion to Head of PharmaceuticPharmaceutical Accounting Services followed, where I wasal Accounting Services followed, where I was responsible for 100 staff in
responsible for 100 staff in payroll, fixed assets, accounts payable and accountspayroll, fixed assets, accounts payable and accounts receivable departments.
receivable departments.
Followin
Following the g the reorganisareorganisation of tion of Accounting ServicesAccounting Services, I , I returned to internal audit, as returned to internal audit, as InternalInternal Audit Manager. During the last few years, I introduced risk based auditing into the
Audit Manager. During the last few years, I introduced risk based auditing into the department, using a database at its core similar to the Excel spreadsheet used on the department, using a database at its core similar to the Excel spreadsheet used on the website. This methodology was used for most
website. This methodology was used for most audits, including computer and systemsaudits, including computer and systems development audits.
development audits.
II have now retired and am spenhave now retired and am spending my spare time as a trustee for an almshouse chding my spare time as a trustee for an almshouse charityarity and trying to keep my web site maintained! I was a
and trying to keep my web site maintained! I was a member of the Institute of Internalmember of the Institute of Internal Auditors (U.K.) Technical Development Committee and was involved in the writing of Auditors (U.K.) Technical Development Committee and was involved in the writing of thethe Guidance Note on implementing RBIA. Hence the similarity of some of the appendices to Guidance Note on implementing RBIA. Hence the similarity of some of the appendices to those which have been on my site for some years. The views expressed in this book, and those which have been on my site for some years. The views expressed in this book, and on the web site, are my own and are
on the web site, are my own and are not endorsed by the Institute.not endorsed by the Institute.
II have whave written a written a websiebsite onte on managing informationmanaging information ((http://www.managinghttp://www.managing- -information.org.uk/
information.org.uk/)) and and an aran article ticle onon auditing informationauditing information for for www.itaudit.orgwww.itaudit.org..
©
©DD MM GrGriiffffitithhss 15-Mar-200615-Mar-2006 PaPagege 4646
8
8 A Ap pp pe en nd di ic ces es
Du
Duee toto spspacacee coconsnstrtraiaintntss itit isis nonott popossssibiblele toto shshowow fufullll exexamamplpleses ooff ththee spsprereadadshsheeeetsts.. ThThesesee araree avavaiailalablblee asas aa sesepapararatete ExExcecell fifilele frfromom www.internalaudit.biz
www.internalaudit.biz ..
Th
Thee apappependndiciceses arare:e:
A
Appppeennddiix Ax A SSccoorriinng rg riisskkss AAddvviicce oe on tn thhe se sccoorriinng og of rf riisskkss
A
Appppeennddiixx BB RRiisskk RReeggiisstteerr AAnn eexxaammppllee rriisskk rreeggiisstteerr iinn tthhee oorrddeerr ooff tthhee pprroocceesssseess iinn aappppeennddiixx DD.. IInn tthhiiss rriisskk map
map A
Appppeennddiixx CC AAsssseessssiinngg rriisskk mmaattuurriittyy MMaattrriixx ggiivviinngg tthhee rreeqquuiirreemmeennttss ffoorr tthhee ffiivvee ccaatteeggoorriieess ooff rriisskk mmaattuurriittyy aanndd sug
suggesgestedted audiauditt testeststs A
Appppeennddiixx DD PPrroocceessss mmaapp AAnn eexxaammppllee pprroocceessss mmaapp ffoorr aa ccoommppaanny my maannuuffaaccttuurriinngg aanndd rreettaaiilliinngg
A
Appppeennddiixx EE AAuuddiitt UUnniivveerrssee LLiisstt ooff aallll aauuddiittss aann oorrggaanniissaattiioonn ccoonnssiiddeerrss iitt rreeqquuiirreess ttoo pprroovviiddee aassssuurraannccee oonn ri
risksk manmanagagemeementnt.. ItIt isis nonott esessesentntialial,, bubutt asassisiststss ththososee orgorgananisisatatioionsns wiwishishingng toto en
ensusurere auaudiditsts hahaveve papartrticiculularar chchararacacteteririststicics,s, susuchch asas lelengngthth ofof auaudidit.t. ItIt cacann ononlyly be
be coconsnsididerereded cocompmpleletete whwhenen alalll ririskskss hahaveve bebeenen asassisigngneded toto auaudiditsts,, sisincncee so
someme auaudiditsts mamayy bebe mimissssiingng frfroomm tthehe plplanan..
A
Appppeennddiixx FF RRiisskk aanndd aauuddiitt uunniivveerrssee (RAU)
(RAU)
Th
Thee cocompmpleletete lilistst ofof scscororeded ririskskss anandd ththee auaudiditsts ththatat wiwillll chchececkk ththeieir r management.
management.
A
Appppeennddiix Gx G CCoolluummn kn keeyy DDeettaaiills os of tf thhe ce coolluummnns is in tn thhe Re RAAUU
A
Appppeennddiix Hx H AAuuddiit pt pllaann TThhe ae auuddiit pt pllaan dn deerriivveed fd frroom tm thhe Re RAAUU
A
Appppeennddiixx II PPrroocceessss mmaapp -- ppuurrcchhaasseess AAnn eexxaammppllee pprroocceessss mmaapp ffoorr tthhee pprroocceesssseess uusseedd ttoo pprrooccuurree aannyy iitteemm ffoorr tthhee organisation
organisation A
Apppepenndidixx JJ EExxppeennssee ppuurcrchhaasseess dadattababasasee ThThee aauuddiitt ddaatatababasese uusseedd foforr tthhee auauddiitt ooff eexpxpenenssee ppuurrchchaasseess
A
Appppeennddiixx KK CCoonncclluussiioonnss GGuuiiddaannccee ffoorr pprroovviiddiinngg aassssuurraannccee oonn aann iinnddiivviidduuaall aauuddiitt
I
Imm lleemmeennttiinn RRBBIIAA––AA eennddiicceess
8
8. .1 1 A A – – S Sc co or ri in ng g r ri is sk ks s
IIff tthehe coconsnseqequeuencncee whwhenen ththee ri
risksk ococcucursrs isis:: ORORththee lilikelkelihoihoodod of of
th
thee ririsksk ococcucurrrriningg isis::
Th
Thenen ththee mmeaeasusurere isis de
defifinenedd toto bebe::
A
A cacatataststrorophphicic imimpapactct onon ththee orga
organisanisationtion,, threthreateateningning itsits existence
existence
Alm
Almostost cercertaintain
Ca
Cashsh atat risrisk>k> £1,£1,000000,0,00000 To
To prepreveventnt ththee orgorganianisasatiotionn ac
achihieveviningg alall,l, oror aa mmajajoror papartrt,, ofof ititss ob
objjecectitivevess foforr aa lolongng titimme.e.
Probable Probable
Ca
Cashsh atat risriskk <£1<£1,0,000,00,000000
>£100,000
>£100,000 To
To ststopop ththee orgorganianisasatiotionn acachiehievivingng it
itss obobjjecectitivevess foforr aa lilimmititeded pepeririodod..
Possible Possible
Ca
Cashsh atat risriskk <£1<£10000,00,0000 >£>£3030,00,0000 To
To ststopop ththee orgorganianisasatiotionn acachiehievivingng it
itss obobjjecectitivevess foforr aa lilimmititeded pepeririodod..
Unlikely Unlikely
Mo
Modederaratete(3(3))
Mi
Minonorr (2(2)) Cat
Catatratrophophicic(5)(5)
Ma Majojorr(4(4))
©
organisanisationtion,, threthreateateningning itsits existence
existence
Alm
Almostost cercertaintain
Ca
Cashsh atat risrisk>k> £1,£1,000000,0,00000 To
To prepreveventnt ththee orgorganianisasatiotionn ac
To ststopop ththee orgorganianisasatiotionn acachiehievivingng it
To ststopop ththee orgorganianisasatiotionn acachiehievivingng it
To cacaususee miminornor incincononvevenieniencnce,e, nonott aff
affecectintingg ththee acachiehievevemmenentt of of objectives
Insignifgnificanicantt(1)(1) Mo
Modederaratete(3(3))
Mi
Minonorr (2(2)) Cat
Catatratrophophicic(5)(5)
Ma
Merchachandindisinsingg DefiDefinene objeobjectivctiveses for
for seselllliningg googoodsds The
The obobjejectctiviveses of of th
thee prproceocessessess fofor r sel
sellinlingg areare defined defined
The
The obobjejectctiviveses wiwillll no
nott dedeliliveverr ththee organisation's organisation's objectives objectives effe
effectictivelyvely andand efficiently
Merchandisendise DirectDirector or ou
outltlinineses ththee acactitionon toto bebe ta
takekenn toto acachihievevee ththee tatargrgetets.s.
Se
Seee alalsoso ststratrategyegy cocontrntrololss Mo
storesres opeoperateratedd by
by ththee org
organianisatsationion,, or or franchised
custstomeomersrs wawantnt toto buy
Merchachandindisinsingg DirDirectectoror andand st
Focusus GrouGroupsps
Qua
Quarterrterlyly prepresentsentatioationn toto Boa
Boardrd byby MerMerchanchandisdisinging Di
Direrectctoror onon marmarketket trtrenendsds
M
Meerrcchhaannddiissiinngg SSeellll iinn ssttoorreess SSeellll ggooooddss iinn sto
storesres opeoperateratedd by
by ththee org
organianisatsationion,, or or franchised franchised
Fa
Failil toto antanticicipipateate the
the competicompetitions'tions' in
campaigaignsns areare monimonitortored,ed, wi
withth aa wweeeeklklyy rerepoportrt toto ththee Mercha
Merchandisinndisingg DirectDirector.or.
None None
M
Meerrcchhaannddiissiinngg SSeellll iinn ssttoorreess SSeellll ggooooddss iinn PrPriciceses araree nonott MerchandiseMerchandise 55 55 2255 ttrreeaatt CCoommppeettiittoorrss' p' prriiccees as arree NoneNone
©
Merchachandindisinsingg DefiDefinene objeobjectivctiveses for
for seselllliningg googoodsds The
The obobjejectctiviveses of of th
thee prproceocessessess fofor r sel
sellinlingg areare defined defined
The
The obobjejectctiviveses wiwillll no
nott dedeliliveverr ththee organisation's organisation's objectives objectives effe
effectictivelyvely andand efficiently
Merchandisendise DirectDirector or ou
outltlinineses ththee acactitionon toto bebe ta
takekenn toto acachihievevee ththee tatargrgetets.s.
Se
Seee alalsoso ststratrategyegy cocontrntrololss Mo
storesres opeoperateratedd by
by ththee org
organianisatsationion,, or or franchised
custstomeomersrs wawantnt toto buy
Merchachandindisinsingg DirDirectectoror andand st
Focusus GrouGroupsps
Qua
Quarterrterlyly prepresentsentatioationn toto Boa
Boardrd byby MerMerchanchandisdisinging Di
Direrectctoror onon marmarketket trtrenendsds
M
Meerrcchhaannddiissiinngg SSeellll iinn ssttoorreess SSeellll ggooooddss iinn sto
storesres opeoperateratedd by
by ththee org
organianisatsationion,, or or franchised franchised
Fa
Failil toto antanticicipipateate the
the competicompetitions'tions' in
campaigaignsns areare monimonitortored,ed, wi
withth aa wweeeeklklyy rerepoportrt toto ththee Mercha
Merchandisinndisingg DirectDirector.or.
None None
M
Meerrcchhaannddiissiinngg SSeellll iinn ssttoorreess SSeellll ggooooddss iinn sto
storesres opeoperateratedd by
by ththee org
organianisatsationion,, or or franchised
monititororeded eveveryery weweek,ek, wiwithth re
repoportrtss gogoiningg toto apappropropripriateate He
Headadss ofof MeMerchrchanandidisese Departments
storesres opeoperateratedd by
by ththee org
organianisatsationion,, or or franchised franchised
Sto
Storere laylayoutout confuses
Key characharacteriscteristicstics NoNo forformalmal
approach approach dev
develoelopedped for for risk
risk
management management
Sca
Scattetteredred silsiloo bas
baseded appapproacroachh to
to ririsksk management management
St
Strarategtegyy anandd polpoliciicieses inin pl
placacee anandd communi
communicated.cated. RiskRisk app
appetitetitee defidefinedned
Ent
Enterprerpriseise apprapproachoach toto risk
risk manamanagemgementent dev
develoelopedped andand communicated communicated
Ris
Riskk manamanagemegementnt and
and intinternernalal con
controltrolss fullfullyy emb
Are thethe orgaorganisnisatiation'on'ss object
objectivesives definedefined?d?
Che
Checkck thethe orgorganianisatisation'on'ss objeobjectictivesves ar
aree dedetetermrminineded byby ththee boboarardd anandd ha
haveve bebeenen cocommmmununicicatateded toto alalll st
stafaff.f. ChChececkk ototheherr obobjejectctiviveses anandd ta
targrgetetss areare coconsnsisistententt wiwithth ththee org
organianisatsationion's's objobjectiectivesves.. (1)(1) Ha
Haveve manmanagagemeementnt hahaveve be
beenen tratrainineded toto unundederstrstanandd wh
whatat ririskskss arare,e, anandd ththeieir r resp
responsonsibiibilitylity forfor thethem?m?
In
Intetervrviewiew manmanagagererss toto coconfinfirmrm ththeieir r un
assesessissingng ririskssks bebeenen defined?
defined?
Ch
Chececkk ththee scscororiningg sysyststemem hahass bebeenen ap
apprprovoved,ed, cocommummuninicacatetedd anandd isis us
useded.. (2(2)) Ha
Haveve prprococesessesess beebeenn
No No part part In In Yes Yes
ExaExaminminee ththee proprocescessesess toto enensusurere©
Key characharacteriscteristicstics NoNo forformalmal
approach approach dev
develoelopedped for for risk
risk
management management
Sca
Scattetteredred silsiloo bas
baseded appapproacroachh to
to ririsksk management management
St
Strarategtegyy anandd polpoliciicieses inin pl
placacee anandd communi
communicated.cated. RiskRisk app
appetitetitee defidefinedned
Ent
Enterprerpriseise apprapproachoach toto risk
risk manamanagemgementent dev
develoelopedped andand communicated communicated
Ris
Riskk manamanagemegementnt and
and intinternernalal con
controltrolss fullfullyy emb
Are thethe orgaorganisnisatiation'on'ss object
objectivesives definedefined?d?
Che
Checkck thethe orgorganianisatisation'on'ss objeobjectictivesves ar
aree dedetetermrminineded byby ththee boboarardd anandd ha
haveve bebeenen cocommmmununicicatateded toto alalll st
stafaff.f. ChChececkk ototheherr obobjejectctiviveses anandd ta
targrgetetss areare coconsnsisistententt wiwithth ththee org
organianisatsationion's's objobjectiectivesves.. (1)(1) Ha
Haveve manmanagagemeementnt hahaveve
Haveve manmanagagemeementnt hahaveve