Five practices every team should implement now to improve audit integration

How much do the IT auditors on your audit team understand the client’s business processes? How much do financial auditors on your audit team understand systems and IT considerations? Too often, financial auditors and IT auditors, or specialists perform their procedures in a silo, often with too little communication. The question is if neither understands the full picture of the business process how can you ensure all the risks in the business processes are addressed? The following integrated activities will make an immediate impact on the audit team’s integration and help amplify audit quality.
1. Integrated Walkthroughs
Integrated walkthroughs include all the audit team participants, including IT auditors, specialists, experts, contractors, or other resources that support the audit of a specific business process. An integrated walkthrough will help audit teams:
- Understand the business and associated risks with the initiation, process, and procedures used to record and report the transactions of the company;
- Identify controls that occur throughout the process, including controls that an IT auditor or a specialist may be aware of that other team members might not identify;
- Analyze the manual and automated attributes or components of the controls;
- Trace the data lineage through the business process and identify all reports and other information produced by the entity (IPE) used in the execution of controls; and
- Inventory all systems (Applications, Databases, and Operating Systems) and tools (i.e. Software Audit Tools) used in the execution of controls.
When walking through a process to identify "what could go wrongs", work as a team to identify the controls that address each likely source of misstatement. Performing the walkthrough as an integrated team can help to identify design deficiencies, missing controls, redundant controls, or automated controls that address risks that may eliminate the need to test certain manual controls.
Note: Taking a fresh look at each process is an important step that drives audit quality.
In other words, do all the audit team participants, including IT auditors, Tax team members, specialists, experts, contractors, or other resources that support the audit of a specific business process understand all the components listed in Figure 1- Components of the Business Process below within the business process and how they all fit together?

Figure 1 Components of the Business Process
Common audit deficiencies this integration practice addresses: |
---|
• Failure to identify key controls that address “what could go wrongs” and related assertions; |
• Failure to understand and test the design and operating effectiveness of the manual and automated components of controls; |
• Failure of an IT auditor or other specialist to sufficiently test the control attributes that address the “what could go wrongs” in the business process; |
• Failure to identify key reports, data or other IPE used in the operation of a control; and the |
• Failure to identify key applications or tools that are the source of key reports, data, or other IPE used in the operation of a control. |
2. Integrated Key Business Process Discussions
An integrated walkthrough is a strongly recommended process for higher risk or complex business processes (see activity 1 above). If the financial auditors already performed the walkthroughs on their own the team should schedule and integrated team discussion of the key business processes. The walkthrough of the business process with the client is a key step, but we have found an integrated team discussion where the team discusses the processes, risks, and controls is even more impactful on audit quality. Again, this doesn’t necessarily have to be held for every process. The integrated walkthrough should include all the audit team participants including IT auditors, specialists, experts, contractors, or other resources that support the audit of a specific business process. This allows the team to really dig into the process and determine where the critical risks and controls exist, identify potential control gaps, and strategize how the design and operating effectiveness of controls should be tested.
These discussions can occur naturally as part of the audit fieldwork procedures. Set the expectation that team members should be prepared for the discussion by reviewing available information and documentation. Then plan a common meeting place: audit room, virtual room, or office conference room are some common logistical ideas. During the discussion use whiteboards and projectors to share information and collaborate on individual understandings. We have found individual audit team members know unique aspects of the business processes and these collaborative discussions bring together all these unique understandings
Common audit deficiencies this integration practice addresses: |
---|
• Failure to sufficiently test the design or operating effectiveness of controls |
• Failure to identify deficiencies when testing the design or operating effectiveness of controls; |
• Failure to identify key reports, data, or other IPE used by the audit team to test the design or operating effectiveness of controls; and |
• Even though it is not an audit deficiency, an audit team may test controls that are redundant or otherwise not needed; or perform unnecessary procedures that aren’t needed to address the “what could go wrongs” in the business process. |
3. Integrated Application scoping
Once we identify the controls in the integrated walkthroughs and integrated business process discussions, the integrated team can work together to identify or finalize the scoping of the following IT components:
- IT systems (Applications, Databases, and Operating Systems)
- Interfaces
- IT Application Controls
- Key Reports & Data
In more complex environments with multiple systems, the audit team should whiteboard or draw the system data flow, which can help scope the items above, as well as help trace key data through the applicable systems. When we discuss potential root causes of why key controls or systems were missed, it’s often a result of not understanding the data flow. For example, the data may flow through an intermediate system that extracts the data from the source and transforms it to load into the destination system, or the true source data used in a control may be generated from a data warehouse or other reporting database the team may not have previously identified. We commonly see companies use a mix of on premises and hosted IT environments, and these system components may not be properly identified and tested unless the data flow is understood.
When finalizing decisions on scoping of systems, consider:
- Significance of the accounts or transactions related to the application
- Volume and complexity of transactions in the system
- Significance of IPE stored in, generated from, processed in the system used in other controls
- Extent of other non-automated (i.e., fully manual) controls that address relevant WCGWs
Other Considerations:
- Significant changes to systems
- System migrations / conversions
- Third-party hosting
Refer to the Figure 1- Components of the Business Process diagram above, and work from the top down and ensure that the team has a complete understanding of how the traditional IT Audit procedures support the traditional financial statement audit procedures that address the business processes. This is a helpful tool to maximize the understanding of the business process and the associated audit strategy.
Common audit deficiencies this integration practice addresses: |
---|
• Failure to identify or test controls for interfaces between IT systems and data; |
• Failure to identify key reports, data or other IPE used in the operation of a control; and the |
• Failure to identify key applications or tools that are the source of key reports, data, or other IPE used in the operation of a control. |
4. Integrated IT environment understanding & risk assessment
Multiple applications, data warehouses, report writers, and layers of supporting IT infrastructure (database, operating system, and network) are likely involved in the business process, from initiation of a transaction to its recording in the general ledger. Such transactions ultimately lead to reporting in the financial statements, and therefore, these systems and IT infrastructure layers are likely relevant to the audit.
To complete your understanding of the IT environment, refer to the Figure 1-Components of the Business Process diagram above, and include the following activities to address risks in the IT environment:
- Consider the risk over significant accounts and which systems, interfaces, application controls, and key reports are used in the financial reporting over these accounts.
- For instance: If the valuation of the Allowance for Loan Losses is considered a significant risk, then the system used to calculate the Allowance for Loan Losses is inherently linked to this significant risk.
- Separately consider each system and assess risk.
- Is it hosted (covered by a SOC1) vs. internally managed?
- To what extent is it hosted?
- Vendor developed/provided vs. custom in-house system?
- Access to source code / changes?
- The same “linkage” and risk factors considered in the activities 1-3 above are going to be the same considerations that the engagement team (financial and IT auditors) consider in evaluating all deficiencies identified in the testing of IT controls (whether IT application controls, ITGC, interfaces, etc.). In general, given the pervasive nature of IT in controls, IT deficiencies are difficult to evaluate but often more significant than we want to acknowledge.
- Another angle would be to consider the impact to the audit if the ITGC components (logical access, change management, computer operations, system development lifecycle) or infrastructure components (database, operating system, network) were found to be to be ineffective?
Common audit deficiencies this integration practice addresses: |
---|
• Failure to perform sufficient testing procedures resulting from an improper system risk assessment; |
• Failure to appropriately test an embedded, configured, or custom developed IT application control; |
• Failure to identify and test SOC reports that support controls outsourced to a service provider; |
• Failure to scope in (or out) ITGC components that support the design and operation of ITGC controls; and the |
• Failure to scope in (or out) infrastructure components that support the design and operation of ITGC controls; |
5. Communication….Communication…Communication
What is your communication plan with the integrated team? Is the discussion focused on hours and status, or does it include current issues, challenges, and results as an integrated team? We see audit teams get stuck in various stages of teaming model – Forming, Storming, Norming, and Performing (see “Developmental Sequence in Small Group” by Bruce Tuckman). Engagement teams should have a manager or partner monitoring how the team is working together to maximize effective performance of the team.
Schedule a regular weekly, bi-monthly, or monthly meeting as in integrated team and make it more than just a status and budget meeting. What are you seeing? Where are the challenges? Remember your responsibility of professional skepticism and challenge each other to identify shortcomings and address them as a team.
Common audit deficiencies this integration practice addresses: |
---|
Failure to identify deficiencies timely and sufficiently consider the necessary adjustments to the audit strategy; |
• Failure to identify deficiencies timely that may impair or eliminate the opportunity for the client to remediate the deficiency and test that the remediated (or compensating) control is operating effectively; |
• Failure of the team to sufficiently test controls or perform substantive testing due to a lack of communication about key issues or new information impacting a business process; and the |
• Failure to meet budgeted audit hours due to rework or additional procedures that could have been eliminated with better communication. |
As you work through this year’s audits keep these five items in mind and deploy them as necessary to break down silos within your audit. This is not a set it and forget it exercise rather integration of all team members takes regular maintenance and attention. A key aspect of audit quality is gaining a cohesive understanding of the business.









