Types of Audits | Fundamentals of Internal Auditing | Part 4 of 44

Main ideas and concepts

• The video explains four types of internal audits and how auditors approach each:
  1. Compliance audits
  2. Financial audits
  3. IT audits
  4. Operational audits
• A recurring framing idea is to think in terms of a “funnel” (from a book by Paul Sobel): there can be many ways to approach an audit project, so auditors should focus on what risks matter and in what context.

Audit types (what they cover and how they’re oriented)

1) Compliance audits

• Purpose: Verify and evaluate how well the organization meets or exceeds:
  • laws
  • regulations
  • internally imposed policies and procedures
  • contracts
  • other external/internal obligations
• Key lesson: Compliance is not only about following external laws/regulations; it includes internal requirements and externally imposed obligations as well.

---

2) Financial audits

• Purpose: Assess how the organization:
  • spends money
  • accounts for the flow of money and other resources
  • reports financial transactions
• Orientation: Point-in-time / historical focus
  • Looks back at prior periods (e.g., a week, month, year) to understand how the organization arrived at current financial conditions.
• Common internal-auditor focus areas:
  • Authorized vs. unauthorized dispensing/receiving of funds
  • Safeguarding resources (not just cash, but also property and anything with financial impact)
  • Acquisition → safeguarding → use of resources
  • Financial statement preparation and supporting documentation
• Internal vs external audit relationship (key operational point):
  • Internal auditors often support external auditors (e.g., interim work ahead of year-end external testing).
  • This can:
    • reduce cost for external audit work
    • leverage internal auditors’ broader/deeper knowledge of internal systems
    • identify issues sooner so they can be remediated before external auditors find them (avoiding small issues becoming major problems due to time pressure and limited remediation windows)
• Mentioned context: Sarbanes-Oxley increased the volume of testing for publicly traded organizations.

---

3) IT audits

• Purpose: Evaluate information technology systems and how they support business operations.
• Core concerns:
  • Security, safety, and integrity of systems
  • How people interact with technology
  • Whether technology practices are more beneficial or less beneficial
• Technical/operational focus areas discussed:
  • Input/output focus: what goes into the system, how it processes information, and where output goes
  • Redundancy, backup, and recovery plans
  • System security, including awareness of threats like hacking and social engineering
  • Data integrity and where computer facilities/data processing occurs
    • on-site server rooms vs. cloud hosting
  • Processes for building and/or acquiring information systems
    • considering how quickly technology changes and when an organization decides to move toward better/faster/cheaper solutions
• Business dimension explicitly included:
  • Yes—IT audits also consider business decisions such as:
    • what the organization is being charged/what it’s paying for
    • ensuring technology acquisitions don’t lock the organization into longer-term obligations than practical
    • avoiding being stuck with outdated “hardware bricks” due to fast evolution

---

4) Operational audits

• Purpose: Focus specifically on how an organization uses its resources to achieve desired outcomes.
• Resources include:
  • financial resources
  • personnel (knowledge and expertise)
• Orientation: Future-focused
  • Looks at the present to understand how changes could create benefits in the future.
• How it relates to other audit types:
  • Operational audits may include elements of compliance, financial, and IT audits.
• Related concept mentioned: “Administrative audits”
• “Six E’s” framework for operational audits:
  • Economy
  • Efficiency
  • Effectiveness
  • Equity
  • Ecology
  • Ethics

Six E’s—detailed breakdown (as presented)

• Economy

  • Focus: the cost of operations
  • Goal: avoid wasting money; ensure costs are handled responsibly/appropriately
  • Emphasis on numeric/tangible data:
    • comparing planned inputs vs. actual inputs and their cost relationships

• Efficiency

  • Focus: speed and resource use relative to output
  • Goal: compare inputs vs. outputs to evaluate whether processes are done as quickly and effectively as possible
  • Uses baselines/expected measures to evaluate actual performance

• Effectiveness

  • Focus: whether results match expectations
  • Goal: compare planned outputs vs. actual outputs
  • Often evaluated over time against baselines

• Equity

  • Focus: fair and equitable treatment of all parties (vendors, customers, employees)
  • Includes internal fairness such as:
    • equal opportunities
    • promotions/assignments based on merit

• Ecology

  • Focus: environmental impact, given finite planetary resources
  • Business lens:
    • does the organization understand the impact of its activities on local ecology and economy?
  • Example used:
    • packaging decisions—reducing box bulk reduces containers, shipping burden, insurance costs, and waste

• Ethics

  • Focus: “talking the talk and walking the walk”
  • Includes:
    • fairness and consistency with stated identity/values
    • compliance with laws/rules
    • alignment with a code of conduct
  • Link to fraud is discussed conceptually:
    • ethics failures can lead to fraud and corruption

Key benefits of operational audits (summary list)

• Uncover unexpected information, including:
  • undefined or unclear goals
  • overlooked problem areas not previously on anyone’s radar
  • opportunities for improvement (better/faster/cheaper)
• Provide improvement recommendations with “long-ranging” impacts (example: packaging that reduces waste and cost across the supply/shipping cycle)
• Often include related review activities, not isolated from other concerns:
  • compliance review
  • fraud testing
  • other audit work that falls under the operational umbrella

Speakers / sources featured

• Hernan Murdock (host / narrator)
• Kathleen Crawford (guest speaker explaining and comparing audit types)
• Paul Sobel (author referenced for the “funnel” concept)
• ACI Learning (YouTube channel mentioned at the end of the video)
• Sarbanes-Oxley (legal/regulatory framework referenced as a compliance/testing context)