Scalable & Integrated Program Audit is an effective Auditing framework for handling large complex programs/ practices in organization, which works on Value Generation, Compliance, capability and Risk evaluation principles.

1. SCALABLE & INTEGRATED
PROGRAM AUDIT (SIPA)
METHOD
Vishnu Varthanan Moorthy12 Jul 17

2. Scope and Applicability
 Scope:
This presentation explains the method of Scalable & Integrated
Program Audit and its benefits in performing audits in large & complex
programs with multiple reference/expectations.
 Applicability:
The framework and explanation is limited to Software Industry,
however the same can be leveraged to other industries with adequate
care.

3. Fitness of Audit programs for Large programs/Engagements
 Challenges in Auditing
 Lack of recognition of complexity in
planning
 Long duration Audit Program
 Inadequate Coverage to give
confidence on report
 Not involving all roles in program
 Audit teams are not composed with
Right capabilities
 Engagement undergo multiple audits
from various teams
 Unclear objectives and ineffective
results
 Auditors’ lost in vastness of
information and Jargons
Large Engagements
Complex governance
Multiple Services offered
Many suppliers
Tools dominance and virtual environments
Legal needs/data protection
Increased Communication channels

4. Scalable & Integrated Program Audits
 Scalable: Audit planning can be ramped up or down based on the Engagement/practice needs.
 Integrated: Multifunctional & multi objective audit performed in co-ordinated manner with shared
values and clear responsibilities
 Program : Covering delivery of services, governance and capabilities to achieve successful results
 Audit: Evaluation of execution of activities as per expected norms/references , on sample basis, to
ensure the management/client/social objectives are met.
Scalable & Integrated Program Audit is an effective Auditing framework for handling large complex
programs/ practices in organization, which works on Value Generation, Compliance, capability and
Risk evaluation principles. This differs from traditional audits interms of ability to handle larger
teams, matrix communications, mammoth information, multiple norms in a systematic manner and
yielding results.

5. SIPA Framework – Value Layers
Audit Execution Layer
Integrated Program Layer
Strategizing & Scaling
Up Layer
• Objective & Value Generation
• Sponsor/mgmt, Practice /Program Lead
Auditor
• Key Focus Areas
• Strategizing Audit Program
• Shared Objectives
• Initial information processing
• Interface &Interactive Points
• Governance & resources
• Conduct & Reporting Norms
• Tactical planning
• Consolidation and Realignment
• Information and evidence processing
• Report development & Agreement

6. SIPA - Framework
Auditor by Fn & Stream
Auditor by Fn & Stream
Auditee by role
Audit
Strategy
& Value
Generati
on
Shared
Objective
s
Stream
Objective
s
Audit
Program
Level
Objective
s
Tactical
Schedule
Prepare Stream Audit Execute Report
Activity 1 Activity 2 Activity 3
Stream 1
Tactical
Schedule
Prepare Stream Audit Execute Report
Activity 1 Activity 2 Activity 3
Stream 2
Tactical
Schedule
Prepare Stream Audit Execute Report
Activity 1 Activity 2 Activity 3
Stream 3
Tactical
Schedule
Prepare Stream Audit Execute Report
Activity 1 Activity 2 Activity 3
Stream N
Daily
Standup
Daily Report
Consolidation
ThreadLog
QueryNotes
Program LA
Functional LA’s
Engagement (or)
Practice Mgmt
ProgramAuditPlan
ObjectiveMapping
Tactical
Schedule
Prepare Mgmt Audit Execute Report
Activity 1 Activity 2 Activity 3
Governance
Tactical
Schedule Prepare Stream Audit Execute Report
Activity 1 Activity 2 Activity 3
3C (Capability, Competency & Communication)
Objective Scope Budget
Value
Generation
Top Management/
Sponsor
Practice LA/Program LA
Practice Level for Multiple Programs

7. Are Both Condition Same?
Engagement with a team of 50 members and its has to have compliance with contractual
requirements and ISO9001 standard. The team is working on Mobile application
development.
Engagement with 900 members and is looking forward to submit to client the report on
compliance to contractual requirements, risks and value addition performed in engagements
and has reference to data security, healthcare and Business continuity aspects. The
Engagement services 4 major type of work (development, maintenance, data center
management, migration of code) and working across multiple domains with virtual
environment and many automation activities are in progress. In addition there is high
dependency with external service provider in maintaining service levels. Also 50 of testers
are working as sub contractor in the engagement. Around 12 certified project managers
handling various activities in engagement.
Unfortunately our Auditing Approach , many a times doesn’t recognize the
difference.

8. Planning in SIPA
• Get Objectives from Management
(and/or) Audit function Head
• Collect the reference compliance norms
• Understand Client and Interested parties
expectations
• Collect information about Engagement/
Practice (multiple engagements) over
people, operations, sites, suppliers ,etc
• Agree on Scope and Objectives
• Provide initial estimation to agree on
Budget and availability on logistics
Finalize Objective & Scoping
• Assess the different Competencies
needed for Audit
• Involve stakeholders to get nominated
Auditors
• Conduct expectation setting session
• Design Structure of Audit teams
• Develop shared vision and norms
• Identify critical components & Areas to
check and share the responsibilities
Design for Outcome
• Prepare detailed Schedule in alignment
with engagement/practice Contact
members
• Ensure Coverage and Scope
• Ensure Auditee Identification at
practice/program/stream level
• Identify if any additional auditee’s are
needed (supplier/extended support)
• Plan the logistics of Program
• Communicate schedule and high level
method
Plan Elements

9. Planning Factors by Level
References/NormsAudit Focus
• Regulatory Audit
• Process Audit
• Financial Audit
• Security Audit
• Functional Audit
• Performance Audit
• Business Continuity Audit
• Domain Based Audit
• Technology/Architecture
Audit
• Standards Readiness Audit
Third party audits are not covered in this method , as they have pre-
defined guidance in most cases.
• Contracts and Annexures
• Quality System
• Policies and procedure
• Org/Practice/guidelines
• Statutory/Regulatory
Requirements
• International & national
Standards
• Best Practices in Industry
• Client Mandates/ Supplier
Standards
• Company Objectives
• Practice/Engagement Roles
& Reporting
• Delivery of Services
• Policies and procedure
• Size of team & Grades of
employees
• Operation sites
• Tools & Technology
• No. of support teams
• Suppliers and type of
Contracts
• Current Activities
• Other Select Information
Characteristics

10. Steps Involved in Planning
Initiation with
Management
Objective
Finalization
Study
Characteristics
Design Value
addition with
Functional Auditors
Develop a Practice
Audit/Program
Audit Plan
Initiate Shared
Vision and Ground
rules
Collect information
on
Practice/Program
Plan Practice level
Schedule(or)
Program Level
Prepare Auditing
Aids
Plan logistics
Plan stream level
Objectives
Collect Information
on Streams
Plan Stream Level
Schedule
Collaborate with
Auditors
Finalize Planning
When Practice Level Audit is required , then multiple program
level Audits can be subset of the Practice level Audit. Each
program audit can have multiple stream level audits.
StrategizeProgramPlanStreamPlan

11. Scalability & Integration in Audit
Practice Level Multiple Programs
Program level Multiple Streams
Quality
Process
Regulatory
Security
Cyber security
Business continuity
Technical
Architecture
Configuration
Other
Additions
Stream : upto 150 member
Program: Upto 900 member or not more than 6 Stream
Practice: upto 5000 member or not more than 6 programs
Not More than 5 focus area
Scalability Integration

12. Execution
Opening Meeting Audit Execution Report Preparation Presentation
Opening
Meeting
Opening
Meeting
Practice Level Program level
Stand up
Meeting
Program level
Program Governance Audit
Stream Level Audit
Stream Level Audit
Stream Level Audit
Daily Report
Consolidate
ThreadLog
Query Notes
Stand up
Meeting Program Governance Audit
Stream Level Audit
Stream Level Audit
Stream Level Audit
Daily Report
Consolidate
ThreadLog
Day N-aDay 1
Practice Level
(As Applicable with Program
connect)
Stand up
Meeting
Daily Report
Consolidate
ThreadLog
QueryNotes
Reporting &
Closing
Reporting &
Closing
Thread Log: Helps auditors to share threads with other auditors in a stream or
governance level. Across programs as required
Query Notes: To be verified items which they want to take it with auditors.
Typically connects the next day standup meeting.

13. Typical Areas to Check
• Client/Management Expectations
• Contract/scope Commitment Mapping
in planning
• Budget provision for Execution
• Management Structure
• Roles and Responsibilities
• Delivery Methodology Identification
• Risk Identification and Management
• RACI/Stakeholder Identification
• Deliverables and Acceptance criteria
• Standards/Regulatory Requirements
• Resource Needs
• Resource& Service Procurement
• Internal/External Service Provider
• Security
• Business Continuity
• Performance Management
• Compliance Checks
• Manage Teams
Governance 3C (Competency, Capability &
Communication)
• Resource Competency Management
• Training and Development
• Motivation and People Performance
• Dynamic Resource need handling
• Assets and Roles alignment with
Commitment
• Develop/maintain Systems and
Tools
• Develop process flows/Processes
• Capability measurement
• Client Expectation Tracing
• Scope/Change Management &
Communication
• Reporting and Sharing
• Decision Sharing
• Internal Team Communication
• External Communication
• Facilities and Infrastructure
• Control of data/Records
• Stream Level Planning
• Resource management
• Risk management
• Deliverable Management
• Traceability of decisions
• Capacity and availability
management
• Back up and Security
• Lifecycle and Validation points
• Budget Consumption and Key
Performance measures
• Client expectations met
• monitoring and control
• Service provider tracking
• Regulatory/Standard
application/compliance
• Resource Onboard/off-board
• Trainings
• Reporting
• Tools/licenses/assets and
Infrastructure
Stream
• Cost Savings
• Quality Improvements
• On-time performance
• Compliance
management
• Operational
Efficiency
• Improvement &
Innovations
• Career path of
resources
• Client Satisfaction
Improvement
• Additional Value
offerings
• Technology
adherence/utilization
• ROI on Key Decisions
• Succession Plan
Value chain

14. ReportingAuditObjective
Practice Evidence
Program Evidence
Stream Evidence
Deviations
Weakness
Strengths
Opportunities for
Improvement
Focus Area 1 Deviation
(Ex: Regulatory/Process)
Focus Area “N”
Deviation
(Ex: Security)
Practice Evidence
Program Evidence
Stream Evidence
Report
Value Chain
Results
Report
consolidation
Draft Report
Preparation
Management
presentation
Final Report
Submission
Practice LA/Program LA
Top Management/
Sponsor
Functional LA’s
Engagement (or)
Practice Mgmt
SharedVision

15. Conclusion
 SIPA gives better control and focus over audits
 Flexibility to scale up to required level and Add multifunctional Auditors leads to
new possibilities
 Audits are not merely compliance focused / Risk assessments instead leads better
Progress and Value addition
 Organized Audits reduces chaos and better plans enable auditee to be in comfort
to do reality check
 Reduces frequent audits on engagement/practices by various functions
 Increases Client /Management confidence in Audits
 Improves effectiveness of Audit and Better Reporting.