Internal
auditors have, for years, been uniquely charged with independently evaluating
and reporting on the adequacy, effectiveness, and efficiency of controls.
VA assists auditors in this task in two ways:
- adding
value to their conclusions by coupling the control evaluations to risk,
and
- creating
efficiencies in their process by giving them leverage to cover more
of their audit universe.
Many internal audit departments think of risk assessments as annual
exercises designed to assist in setting the audit plan for the year.
While this is a valuable exercise for that purpose, it is typically
performed at such a high level, often only using key indicators, that
its usefulness stops there - leaving unaddressed the individual risks
in any one audit area. In using VA to perform the audits, all risks
are continually identified and assessed, thus adding value to audit
committee and senior-management reporting while simultaneously making
available a current, detailed risk assessment of the organization -
whether for audit planning or other purposes.
Many internal audit groups perform their audits by documenting test
procedures in audit work papers, produced either manually or electronically.
In either case, the results of these tests are contained deep within
these work papers. By contrast, VA is a database program that can contain
all work paper information but presented in a way that enables you to
navigate through all these results rather than navigating through the
work papers that contain them. As databases handle information in discrete
units, any individual data element (such as the test result) can be
segregated, compiled, and reported with other data elements, and subsequently
compared and quickly accessed.
Further, VA's analytical tools can help auditors form opinions regarding
control adequacy, effectiveness, and efficiency. For example, each control
within VA can be assigned an importance value and a user-defined range
of possible responses. VA will compute, for any given risk, a control
contribution score, that is, the percentage to which the listed controls
contribute to the mitigation of the risk, given their importance and
the assessment response provided.
The
screen-shot 
helps illustrate this point. These scores get "rolled up"
throughout the assessment giving an overall control contribution score.
While the exposure must still be subjectively determined, the analysis
tool assists the auditor by providing the control contribution score.
If an auditor using VA begins by populating various content templates
with the existing audit test procedures, filling the hierarchy through
the controls, risks and objectives becomes simple and results in a more
complete analysis, more meaningful reporting and greater audit efficiencies.
Work programs can be updated in real time, and audit progress-monitoring
can be done centrally while the field work is being performed.
