IIA Government Auditor Conference San Diego California March 11 th 2015 The Secrets of Audit Project...

IIA Government Auditor ConferenceSan Diego California

March 11th 2015

The Secrets of Audit Project Management for Government Auditors

STRONGHOLD

Kenneth Mory CISA, CIA, CPA, CRM

Ken is a recognized speaker at professional seminars. He has over 30 years experience in audits, IT, finance, operations, and strategic planning. He has worked in both the public and private sectors. He has extensive experience in IT auditing, governance, project planning, systems development, operations, security and DR/CP.

Previously, Ken was the City Auditor for Austin Texas, Chief of Audits for the County of San Diego and the CFO for several companies, including Bellsouth Wireless Data, RAM Mobile Data, TelCel Cellular, SA, and Link Telecommunications. He also worked for BellSouth Corporations’ General Internal Audits and began his career with Arthur Young & Company, CPAs.

Currently he serves on the GAO’s Green Book Advisory Committee, IIA’s Advisory Committee for the American Center for Government Auditing and IIA’s Editorial Advisory Committee, ALGA’s Professional Issues Committee and was 2013 Chair of the IIA’s Public Sector Committee. Ken has an MS from the University of Pennsylvania and MBA from University of Alabama – Birmingham.,

Kenneth J. Mory - CISA, CIA, CRMA, CPAKenneth J. Mory - CISA, CIA, CRMA, CPA

STRONGHOLD

I. INTRODUCTION & OBJECTIVES

THE SECRETS OF AUDIT PROJECT MANAGEMENT

Failing to deliver audit projects on time and on budget is the bane of auditors and audit managers. Late delivery and cost overruns can significantly impact the credibility and value of the audit entity and the auditor.

What most auditors fail to clearly understand is that an audit is just a project and that the same skill sets that a good project manager acquires are what is needed for managing an audit.

The Secrets of Audit Project Management for the Public Sector

Upon the completion of The Secrets of Audit Project Management, participants will be able to:

• Understand the basics of Project Management (PM)

• Identify the differences and similarities between Public Sector Auditing - Project Management (PSA-PM)

• Understand project planning, scheduling, control, and decision support concepts and methodologies

• Identify ways to fail and ways to succeed

• Learn to apply these techniques to improve productivity: improving cost control, resource use, and timelines

• Understand how to apply using audit-specific real world examples and techniques


Three things you would like to get out of this seminar.

Three obstacles to your making becoming a skilled audit project manager


II. BASICS OF PROJECT MANAGEMENT


The Basics

•What is a project?•Define project management and the project management process•Why project management for audits?•Expanding project management key competencies •Why do projects succeed? Why do they fail? Exercise - Take the test


Exercise 1 – Take the TestTo do the audit right:•I always get all the resources I need •I always know the objective (s) of the audit•I get all of the work time required •I get all of the schedule time required•I have the necessary authority

In your groups select a presenter and a scribe and answer the following1.Discuss the why of your answers.2.How does this affect the success or failure?3.How would you resolve any challenges identified?


Project Management A project is a temporary endeavor undertaken to

create a unique product, service or result


Priorities Management -

separation of urgent from the important

Program Management – has

no end and is ongoing and

indefinite

A Comparison

Definition of an Audit [IAPPF]

… it helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes…


Key Competency Areas

1. Managing Others2. Focus Areas

• Focus on communication• Motivation• Problem solving & Root Cause

Analysis

3. Key attributes4. Major responsibilities5. Ways to succeed6. Ways to fail


Why do Projects Fail?• Procrastinate on issues• Politicized• Constant rescheduling• Focus on administration not

real management• Micromanage qualified staff• Focus on new instead of

needed tools• Fail to monitor project


Exercise 2 - Why do Projects Succeed?


Effective Project/Audit Managers:• Use PM effectively• Open to being and expecting

honesty• Flexible in approach• Are good time managers• Are great communicators • Maintain a healthy perspective• Have effective decision making

skills.


III. MAJOR PROJECT & AUDIT PROCESSES


Compare Major Processes in the Life of a Project vs. Life of an Audit

Processes of a project compared to audit How is project management relevant to

audit? The “constraint” triangle 9 knowledge areas of project

management Identifying problems early in the process


Major processes in the project life cycle

1)Initiating2)Planning3)Executing4)Monitoring and

Controlling 5)Closing


Major processes in the audit life cycle

1) Identify risk area*2) Identify stakeholders*3) Prepare for the audit4) Preliminary survey5) Internal control

documentation/fieldwork 6) Observations and recommendations7) Closing8) Evaluation9) Follow-up *


Exercise 3: Compare Audit to Project Steps Worksheet


Project Processes

Aud

it P

roce

sses

Entity or sub entities

1) Initiating

2)Plan

ning

3)Ex

ecuting

4)M

onito

ring

and

Cont

rolling

5)Closing

1)Identify risk area

Aud

it P

roce

sses

2)Identify stakeholders3)Prepare for the audit4)Preliminary survey5)Internal control documentation fieldwork 6)Observations and recommendations7)Closing8)Evaluation9)Followup

Aud

it P

roce

sses

Exercise 2: Drawing parallels1. Which audit steps are most

like the project steps?2. What gaps exist if any?3. Does the PS environment

impact the steps?

Select a presenter and a scribe from your group.


Relevance of PM to PSA

•Identifying the benefits of adopting a PM focus•The relationship of planning to control•Key factors in PM•Common workflow problems•Considering changing risk horizon and vulnerabilities? •Realistic time estimates•The right mix of resources


Project management is like juggling a dozen balls. You'd have to keep your eye on all of them, and know when to catch each one. If you missed just one, this could spoil your

whole performance.


Ava

ilabl

e R

esou

rces

Scope

Work &

Elapsed Time


The Audit Project Constraint Triangle!

PROJECT MANAGEMENT STANDARDS• Defines Project

Management• Project Management’s 9

Knowledge Areas• Integration• Scope• Time• Cost• Quality• Resource• Communicatio

ns• Risk• Procurement

Phase 0 Phase 1 Phase 2 Phase 3 Phase 4 Phase 5Audit Initiation/

Concept exploration and

need

Identify Risks and Controls/ Clarify Overall

Objective

Risk Assessmnent/

Refine Obejective/ Identify Audit Procedures

Fieldwork/ Develop Findings

Message Approach/Conduct

Additional Fieldwork

Reporting/ Issue

Messages

Approval

Determination of Need/SAP or

Request

Representative Life Cycle of an Audit Project

Milestone 0Audit Concepts Preliminary Research StudyMgt Approval

Milestone 2Approval

Milestone3FieldworkManagementApproval

Milestone 1Audit Concepts ApproachApproval

Milestone 4Major ModificationApproval

Milestone 4Major ModificationApproval


Exercise 4: What does a successful audit look like? (hint: outcomes and quality.)

From the PS entities perspective?From the auditors perspective?From the auditee’s perspective ?

Compare the steps in an audit to steps in a project. Select a presenter and a scribe from your group


III. COMPETENCY


Key Attributes of an Audit Project Manager

1. Leadership2. Communication Skills3. Problem/Risk Analysis4. Root Cause Analysis5. Management perspective 6. Professional standards/

operating environment


Manager “Gets It”

•“why”?•“what is”?•“what is to be”? •the “Gap?•where?•who?•how?•when?


RCA PROBLEM DEFINITION

04/19/23 32


How do I do that?– Creative– Knowledgeable– Owns it– Curious– Technically skilled– Disciplined– Organized – Risk taker


Communication Skills

1.Effective written and oral2.Able to articulate3.Body language4.Listening


http://www.wikihow.com/images/c/ca/14.WhatSay.Self.SW.WDC.28nov05.jpg

Problem Solving

… the ability to visualize, understand, articulate and solve both complex and uncomplicated problems and concepts and make logical decisions that are sensible and based on available information.


RCA PROBLEM DEFINITION GUIDELINES

often more than one root cause

approach must have integrity

stop talking = listen

find cost benefit point

systematic approach

knowledge of business process

part of audit plan does not prevent

problem from happening…

a double loop solution to correct

04/19/23 37


RCA & 5 Elements of a Finding

04/19/23 38

Criteria(What

should be)

Criteria(What

should be)

Condition(What is)

Condition(What is)

Effect(Risk or

potential impact)

Effect(Risk or

potential impact)

Recommendation(How to realign)

Recommendation(How to realign)

Criteria(What

should be)

Criteria(What

should be)- = + =

Cause(Why the difference exists – root cause)

Cause(Why the difference exists – root cause)

Process(Methods, Tools,

etc..)

Communication (Mgt attitude, etc.)

Criteria(Appropriateness, knowledge, clarity,

written, verbal, etc..)

Skill Level(Hiring, training, staff

fit, etc..)

Analysis of a Cause

Quantitative

Cause

Effect

Qualitative

& Vs.

Evidence


Management Perspective

•Conceptualize: See the “Big Picture”… Provide Insight… and translate to key details•Who cares? Know overall priorities for Stakeholders•Ability to focus on key problem(s)•Understand “tipping points”

[That is: foresee, analyze, focus, externalize, grasp, visualize, etc.….]


COURSE OUTLINE (Cont’d):

IV. Improving Audit Productivity

•VII. Resources

Your audit plan and horizon risk issues


Project PMP Accepted Archived Charter Deliverables DocumentsAudit Project Management Outputs

Analysis of Costs & Influence


COURSE How to Improve Productivity?

• Defining the audit project• Identifying changing risk horizons and

vulnerabilities• Optimizing planning • Developing a work breakdown structure• Developing early warning systems• Optimizing fieldwork effort• Effective & timely reports

•VII. Resources



An Audit Project Process Flowchart


PS Risk Assessment Identifying Problems Early in

Process


Optimizing Planning Memo

• Environmental scan (360o Plus)• Critical information (i.e.,

criteria)• Key resources (staff, SME,

other)• Audit program• Audit Staff• Budget/schedule• Buy in & approval


Optimizing Planning Questions

•What audit needs to be done? (type, scope, criteria, real project)

•Why risk requires it be done? •How should we conduct it?•What the critical path or sequence ?•Where does the audit need to be conducted?•Who should do the work? (staff/sme/other)

•How do we measure progress?


WBS as Task List


Task # Description Duration Predecessors123456789

101112131415


Work Breakdown Structure - WBS

Level 2

Sub Task

Major Task Major Task

Audit Project

Sub TaskSub TaskSub Task

Level 2Level 2Level 2 Level 2

Timeline


DATE MILESTONE POSITION

1/23/2012 Project Start 25

2/24/2012 Milestone 1 10

2/24/2012 Milestone 2 -10

3/1/2012 Milestone 3 15

3/15/2012 Milestone 4 -15

5/15/2012 Milestone 5 15

DATE MILESTONE POSITION

6/15/2012 Milestone 6 -15

6/30/2012 Milestone 7 15

7/15/2012 Milestone 8 -20

7/30/2012 Milestone 9 20

10/23/2012 Milestone 10 -15

12/31/2012 Project End 15

Examples of Project Management Software

ManagePro

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.tenrox.com/TopTenReview/projectworkforce_online.asp&p_id=48155&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.attask.com/?aid=9&p_id=2522&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.clarizen.com/Product/Pricing.aspx&p_id=2524&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.geniusinside.com/&p_id=48156&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.projectmanager.com/?AID=dMAKQ&p_id=48157&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.projectinsight.net/RequestInfo/default.aspx&p_id=2532&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.projecturf.com/rep.asp?rc=tt&p_id=2526&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.myintervals.com/?cmp=ttr&p_id=3197&param=&q_delimit=0

http://www.toptenreviews.com/scripts/trans_id.php?url=http://www.celoxis.com/hosted.php&p_id=2525&param=&q_delimit=0

http://www.microsoft.com/project/en/us/default.aspx

http://www.clipartof.com/details/clipart/16397.html

http://www.liquidplanner.com/


5 Guidelines for Estimates

1. Ownership (buy in)2. Level of detail (accuracy)3. Distribution4. Staff productivity 5. Time/cost/scope tradeoffs



Guidelines for Estimates

Distribution•Don’t politicize•Be honest•Clear requirements first•Probable - not “best or worse case”



Again “Don’t politicize, Be honest,

Probable - not ‘best or worse case’ ”


The Worstest Case


Don’t Over Do It

• VII. Resources



Don’t UNDER Do It



Productivity•Competency•Buy in•Number of activities or tasks•Interruptions•Errors•Administrative & personal time




Trade-offs:• Adding staff can

be counterproductive

• Multiple assignments lead to increasing drops in productivity


V. Project Controls• VII. Resources




ManagePro

UNDERSTANDING PROJECT CONTROL?

•What is it?•Course correction•Controlling what?•Elements of good control•Needed information•Actual vs plan work (GANTT Chart)

•Efficiency •VII. Resources



WHAT IS PROJECT CONTROL?

A project management function that involves comparing actual performance with planned performance and taking appropriate corrective action (or directing others to take this action) that will yield the desired outcome in the project when significant differences exist.”

“


Course Correction

• Are you where your suppose to be?• What can affect you in the future?• Will you end up where you are

suppose to?• Focus is to minimize navigational

error!• VII. Resources



Project Initiation Document Checklist


PID ItemSection 1: What is the audit project all about?

TitleBackgroundPurpose, objectives & measurementsScope, constraints & exclusionsDeliverablesMilestones

Section 2: Why should the audit project be completed?Business case (benefits, options, cost, time)Risk Analysis ( Identification, prevention, management, Monitoring)

Section 3: Who will work on the audit project?Roles & responsibilities (sponsor, manager, team)

Audit organization charter and structure

Section 4: How and when will the audit project be delivered?Initial project plan)Assignments & milestonesSchedule (i.e. Gantt Chart)Personell RequirementsProject ControlQuality

Controlling what? Consumption of

resources Schedule Work effort Other

Deliverables Requirements Quality


Elements of good audit project control

• Measurement baseline• Processes and procedure for gathering

data• Good data• Ability to analyze past, current and

future !• VII. Resources



Data needed for scheduling• Scheduled start & finish dates• Actual start & finish dates• Dates of activities underway:

• Anticipated start• Actual start• Originally scheduled completion• Estimated completion

• Description of progress• VII. Resources



What is good data?• Relevant• Reliable• Accurate• Useful & understandable• Timely• Sufficient• Appropriate• Appropriately reported


Exercise 5: Dearly Departed: The audit was planned by an auditor who had 20 years experience in auditing with over 15 as an Auditor in charge. He had initiated and completed the audit plan for contract compliance with respect to federal grants. This included the planned methods and procedures necessary to conduct the fieldwork.

With very short notice he retired from the entity and was not forth coming in transferring his knowledge and also to sign off on work he had completed. He indicated he was not comfortable in signing off on his work.

The new auditor in charge had been with the audit entity for less than 3 months. She accepted the work performed by the exiting AIC without verifying its appropriateness and sufficiency of the documentation received but did do a cursory review. The audit director had prepared an aggressive audit plan that required the staff to finish projects on budget in order to meet productivity goals. The new AIC and her manager decided to rely on the work already performed and complete the audit.

At the end of field work the AIC presented the preliminary draft report to the auditee. The auditee became agitated stating that the conclusions reached were just not true. When addressing the auditees concerns the auditors determined that there was incomplete and missing documentation in the planning phase which led to erroneous findings and conclusions. The rework of the audit caused its conclusions and reporting to be delayed and caused the credibility of the auditor’s office to be significantly damaged with the auditees.

Get together in your group to answer the following questions. Select a scribe and presenter.1.Why did this happen?2.What could the AIC have done to prevent ?3.What could the Manager have done to prevent it


VI. Critical Path Analysis & Gantt Charts•VII. Resources



Multiple activities often feed into other activities.

Gantt Charts: Some Key PointsCritical Path Analysis is an effective and powerful method of assessing:

What tasks must be carried out? Where can parallel activity can be performed? The shortest time in which you can complete a project Resources needed to execute a project The sequence of activities, scheduling and timings Task priorities

The most efficient way of shortening time on urgent projects

Gantt charts are also useful for monitoringa project's progress once it's underway.

See what should have been achieved by a certain date

You can take action.

Gantt Charts: Some Key Points

Gantt Charts: Some Key Points

AUDIT

Program Evaluation Review Technique (PERT) chart for a project with five milestones (10 through 50) and six activities (A through F). The project has two critical paths: activities B and C, or A, D, and F – giving a minimum project time of 7 months with fast tracking. Activity E is sub-critical, and has a float of 1 month.

Program Evaluation Review Technique (PERT) chart for a project with five milestones (10 through 50) and six activities (A through F). The project has two critical paths: activities B and C, or A, D, and F – giving a minimum project time of 7 months with fast tracking. Activity E is sub-critical, and has a float of 1 month.


Simple PERT Chart

A network map of a project, tracing the work from a departure point to the final

completion objective. An activity is represented by a line or arrow. This line or arrow connects two events. Each event is a

specific point in time, marking the beginning and/or end of an activity.

Project Network Map (Critical Path)

Gantt Charts


In Gantt charts, there are three main relationships

between sequential tasks:

Finish to Start (FS) – FS tasks can't start before a previous (and related) task is finished. However, they can start later.

Start to Start (SS) – SS tasks can't start until a preceding task starts. However, they can start later.

Finish to Finish (FF) – FF tasks can't end before a preceding task ends. However, they can end later.A fourth type, Start to Finish (SF), is very rare.

Gantt Chart – Task List


.Task Length Type*

Dependent on...

A. High level analysis 1 week S

B. Selection of server hosting 1 day S A

C. Configuration of server 2 weeks S B

D. Detailed analysis of core modules

2 weeks S, P to B, C A

E. Detailed analysis of supporting modules

2 weeks S, P to F D

F. Development of core modules 3 weeks S, P to E D

G. Development of supporting modules

3 weeks S, P to H, J E

H. Quality assurance of core modules

1 week S, P to G F

I. Quality assurance of supporting modules

1 week S G

J. Initial client internal training 1 day S, P to G C,H

K. Development and QA of accounting reporting

1 week S E

L. Development and QA of management reporting

1 week S E

M. Development of MIS 1 week S L

N. Client internal user training 1 week S I, J, K, M

* P: Parallel, S: Sequential* P: Parallel, S: Sequential

THE SECRETS OF AUDIT PROJECT MANAGEMENT PLAN PLAN ACTUAL ACTUAL PERCEN

T

ACTIVITY START

DURATION START DURATION

COMPLETE

PREDECESSORS

1Select Audit 0 1 1 1 100% 02Plan the Audit (review available information for a high level risk assessment)

1 2 2 3 100% 1

3Kick Off/Engagement 2 1 7 4 100% 1,24Detailed Planning (performing planning tasks to identify risks/controls)

1 6 9 5 80% 1,2,3

5Document risks/control information 7 2 0 0 0% 4

6End of Planning Meeting 7 3 0 0 0% 4,5

7Perform Fieldwork 8 5 0 0 0% 5,6

8Develop/Verify Findings 13 4 0 0 0% 7

9Message Meeting with Report Outline 3 16 0 0 0% 2,4,6,8

10Any additional FW/Message Adjustment 0 0 0 0 0% all

11Write Draft Report, Brief, PPT 19 1 0 0 0% 9,10

12Exit Conference 6 17 0 0 0% 4,5,8,9,11

13Mocks 7 17 0 0 0% 4,5,8,9,11

14Final Report, Brief, PPT 20 5 0 0 0% 11,12,13

15AFC 20 7 0 0 0% 4,5,8,9,11,13

16Close-out 0 0 0% all

PSA GANTT Task List

Simple Gantt Charts … show the relationship between the tasks. Tasks will to be completed before starting the next one, and others can't end until preceding ones have ended. For example, if you're doing an audit, you need to finish the plan before you can complete field work.


"harmonogram"

Exercise 6: Critical Path The audit was requested by governmental entity’s police department and planned by a manager who had been with the audit entity for 1month. He had initiated and completed the audit plan for the audit. He designed a survey and identified police organizations to be surveyed to obtain information to determine the appropriate benchmark criteria. The survey was issued and follow up, telephone calls were placed. The response was minimal and was not sufficient to establish a criteria.

They continued to pursue the information for over 3 months before discussing it with the CAE. They were instructed to cease and desist their activities. The CAE was concerned that there had been no communication concerning the lack of cooperation, especially since the audit could not go forward even though the field work on the condition was almost complete. On his instruction they were directed to find a different criteria to use. They found the strategic planning steps promulgated by the Government Finance Officers’ Association (GFOA criteria). They used these 15 steps as criteria which resulted in findings based on initial discussion with audited staff. It appeared that most of the steps were not being followed. At the exit conference the auditee was upset over the findings especially since they had not been informed of the auditor’s decision to use the GFOA’s criteria. They were also upset that the audit had taken so long… in fact it had a birthday. They stated that almost all of the criteria had been met. Upon auditor rework the auditors were able to determine, based on documentation provided, that in fact most of the criteria had been generally met.

As a result of these issues, the audit office was over 8 months late in issuing the report, went over work time budget by 50%, lost cooperation of the police department, and significantly affected its credibility.

Get together in your group to answer the following questions. Select a scribe and presenter.1.Why did this happen?2.What could the AIC have done to prevent ?3.What could the Manager have done to prevent it

VIII. MORE TOOLS AND TECHNIQUES



More Tools & Techniques

• Planning Tools by Steps• “Six Thinking Hats”• Project Charter PID

•VII. Resources


Planning Tools by Steps


Failure:Assign the right personsTo obtain buy-inToo many auditsTo communicateTo define scopeTo manage changeNot micromanage


Optimistic timelinesBe flexibleTo manage changeNot micromanageExpect system to fix issuesHave metric to define success

More Common Mistakes

6 THINKING HATS

The “Six Thinking Hats”.


The “Six Thinking Hats” Benefits (cont’d)


Maximize productive collaboration and minimize counterproductive interaction/behaviorConsider issues, problems, decisions, and opportunities systematicallyUse Parallel Thinking as a group or team to generate more, better ideas and solutionsMake meetings much shorter and more productiveReduce conflict among team members or meeting participantsStimulate innovation by generating more and better ideas quickly

The “Six Thinking Hats” Benefits


Create dynamic, results oriented meetings people want to participateGo beyond the obvious to discover effective alternate solutionsSpot opportunities where others see only problemsThink clearly and objectivelyView problems from new and unusual anglesMake thorough evaluations See all sides of a situationKeep egos and "turf protection" in checkAchieve significant and meaningful results in a less time

Exercise 7: The “Six Thinking Hats”


Maximize collaboration…Consider issues…Use Parallel Thinking …Make meetings …Reduce conflict …Stimulate innovation …Create dynamic people…Go beyond the obvious… Spot opportunities where …Think clearly and objectively …View problems …Make thorough evaluations … See all sides …Keep egos in check …Achieve results in a less time …

Meet with your group and match the attributes to the Hat.Be prepared to present and discuss. Select a scribe and presenter.

The “Six Thinking Hats” Benefits


Maximize productive collaboration and minimize counterproductive interaction/behaviorConsider issues, problems, decisions, and opportunities systematicallyUse Parallel Thinking as a group or team to generate more, better ideas and solutionsMake meetings much shorter and more productiveReduce conflict among team members or meeting participantsStimulate innovation by generating more and better ideas quickly

Instructor

IIA Government Auditor Conference San Diego California March 11 th 2015 The Secrets of Audit Project...

Documents

Transcript of IIA Government Auditor Conference San Diego California March 11 th 2015 The Secrets of Audit Project...