An operational audit evaluates an organization's operations and processes to assess effectiveness and efficiency in meeting goals. It analyzes structure, controls, procedures, and performance. The audit provides recommendations to improve and a report to management. The 6-phase process includes risk assessment, control identification, testing, reporting, and issuing a final report to managers and oversight bodies. The objective is to understand responsibilities, risks, controls, and provide an understanding of reliability, efficiency, and compliance.

1. AY
Abdoulaye M Yansane
Operational Audit: Evaluation made of management's performance and conformity with
policies and budgets. The organization and its operations are analyzed, including appraisal of structure, controls,
procedures, and processes. The objective is to appraise the effectiveness and efficiency of a division, activity, or operation
of the entity in meeting organizational goals. Recommendations to improve performance are also made. The primary user
of an operational audit is management. However, an operational audit is slightly different from a Management Audit since
it concentrates on the organization. Many companies maintain internal audit staffs for the sole purpose of performing
operational audits on a recurring basis. For each review, management receives a report from the audit team that will
indicate how well the activities are performed, suggest improvements, and offer other conclusions drawn from the work.
Operational Audits
An Operational Audit Process [.pdf] is designed to:
understand the responsibilities and risks faced by an auditable faculty, department, unit or process (Hierarchy of
Concerns for Audit [.pdf]) and (Risk Assessment Overview Chart [.pdf]);
assess the level of control exercised by management;
identify, with management participation, opportunities for improving control;
provide senior management of the University and the Audit Committee of the Board of Governors (and thus the
Board of Governors) with an understanding of the degree to which management has achieved its responsibilities
and mitigated the risks associated with the operation of the University. This includes:
o reliability and integrity of financial and operational information;
o effectiveness and efficiency of operations;
o safeguarding of assets;
o compliance with laws, regulations, and contracts.
Normally, this involves the following six phases:
1) Pre-audit process
The process normally begins with an introductory meeting to inform the unit's senior management that an audit will take
place, to explain the process, and to gather background information.
Following the introductory meeting, the auditor performs a preliminary gathering of information using various sources of
information (for example, the unit's web site) to identify the possible components and concerns. At the end of this stage,
a binder is prepared and is used in the risk assessment meeting with the auditees.
2) Risk assessment meeting with auditee
The risk assessment meeting involves the key managers of the department or faculty or unit to be audited. One objective
of the risk assessment meeting is to obtain confirmation of the components (i) and major concerns of the unit (ii).
The key managers also perform an assessment of the importance of each concern (low, medium or high) for each
component. They are also requested to perform a voting exercise to compare and rank the components and concerns.
This step is preferably completed during the meeting, but may be completed separately with each manager.
The result is a risk template. The high-risk areas identified by management will then provide the focus for the audit
project.
3) Control matrix
The auditor meets with the managers of the high-risk areas to identify the key management objectives and the key control
activities (iii) performed. After these meetings, the auditor documents the key management objectives and the key
controls.
The lack of key controls identified, referred to as control design issues, is also documented in the matrix.
Once the first draft of the control matrix is completed, it is sent back to the managers for confirmation and validation.
The lack of key controls (control design issues) is also discussed with management.
The key controls identified in the matrix represent the controls to be tested in the next phase.
4) Test design
Once the matrix has been agreed upon with management, the auditor designs the test procedures for the identified key
controls. The auditor prepares a test design for each key control activity identified in the matrix.
The testing plan is reviewed before the testing phase begins. The testing phase usually requires the auditor's presence in
the department to conduct interviews, examine documents, and obtain explanations.
The auditor documents the results of the tests, the conclusion, and any proposals. During testing, the auditor also
discusses preliminary findings with individual managers.
The test results become the basis for the first draft of the audit report.

2. 5) Report drafting
After the previous stages have been completed, the auditor can produce a draft report to be presented and discussed with
management. The draft report uses the following standard structure:
Memo
Conclusion
Background information
Scope
Objectives
Proposals
Risk template and key controls as an appendix
Other appendices
The report review and discussion process is designed to arrive at agreed action plans to resolve identified issues. Any
management-accepted risks and differences of opinion are also reported.
The report drafting process involves meetings with increasingly senior levels of the management hierarchy until the report
has both the moral and monetary (if needed) support for the issues raised.
6) Final audit report
The final report is distributed to all managers of an audited unit, the relevant members of senior management, the Vice-
Principal, (Administration and Finance), the Chair of the Audit Committee of the Board, and the external auditors.
(i) Components: Represent the principal deliverables of the unit (products, services or processes.
(ii) Concerns: Represent the events that could prevent the audited unit from achieving its objectives.
(iii) Controls: Any action taken by management, the board, and other parties to enhance risk management and increase
the likelihood that established objectives and goals will be achieved. Management plans, organizes, and directs the
performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.