Chapter 3

Question 1

This is a practical method of documenting all the elements of an operational audit review in a form which resembles the traditional internal control questionnaire (ICQ)

Answer 1

Standard Audit Program Guides (SAPGs)

Question 2

What is the focus of SAPGs?

Answer 2

Its focus is on the risk in operational auditing and the control matrix approach to assessing risk and control effectiveness.

Question 3

SAPG documents offer an ideal basis for control self assessment. They raise the right questions and encourage management and staff to consider whether controls are satisfactory to address the issues raised.

Answer 3

TRue

Question 4

Risk and control issues are further divided into two groups, namely:

Answer 4

1. Key issues
2. Detailed Issues

Question 5

These are the more significant and crucial points about the system under review and the aim should be always to take them into account during the audit.

Answer 5

Key issues

Question 6

It takes the user into more of the underlying system considerations, and would be utilized only if there was a potential weakness revealed as a consequence of considering the key issues.

Answer 6

Detailed Issues

Question 7

Purpose of SAPG

Answer 7

to guide the auditor through an examination of the issues specific to the system or activity with the intention of recording the nature of
measures and controls in place to ensure either that business objectives are achieved, or that risks and exposures are successfully avoided

Question 8

Suggested form of the SAPG

Answer 8

title page
the risk/control issues
system interfaces

Question 9

Three separate areas of the SAPG Title page

Answer 9

1. an area which records the details of the subject matter covered by the SAPG and a reference number
2. an area used to record details about the specific audit project
3. a section which describes the control objectives for the relevant system

Question 10

This is the main part of the SAPG and consists of a table based on the headings.

Answer 10

The Risk/Control Issues

Question 11

This page of the SAPG is intended to alert auditors to the likely interfaces between the system or activity being addressed in the SAPG and any others.

Answer 11

System Interfaces

Question 12

It is intended to draw auditors’ attention to systems with input or output connections. These connections may be based solely on data flow or have additional operational implications.

Answer 12

The System Interfaces Table

Question 13

Risk in Operational Auditing

Answer 13

It is unlikely that any activity or system will operate in complete isolation but will need to interact with other data and systems in order to be fully effective.

At a simple level, such interaction could relate to the input of data from a source system and the generation of amended or enhanced data which can be output to the next process.

Question 14

Alternative term for the size dimension of risk

Answer 14

Inherent risk

Question 15

Alternative term for the probability dimension

Answer 15

Control risk or system risk

Question 16

An unwanted event or outcome that management would wish to avoid

Answer 16

Exposure