2010-01-AU Limited Scope Performance Audit of Department of Water Supply's Internal Controls for Cash Handling and Financial IT Systems

Home

CHAPTER 1: AUDIT PLAN Government Auditing Criteria Government Auditing Standards (July 2007 Revision), referred to as the "Yellow Book ", published by the United States Government Accountability Office, by the Comptroller General of the United States: Government Auditinq Standards, Section 1.30, Performance Audits: "Internal control comprises the plans, policies, methods and procedures used to meet the organization's mission, goals and objectives... Examples of audit objectives related to internal control include an assessment of the extent to which internal control provides reasonable assurance about whether: (a) organizational missions, goals, and objectives are achieved effectively and efficiently; (b) resources are used in compliance with laws, regulations, or other requirements; (c) resources, including sensitive information accessed or stored outside the organization's physical perimeter, are safeguarded against unauthorized acquisition, use, or disposition; (d) management information, such as performance measures, and public reports are complete, accurate, and consistent to support performance and decision making; (e) the integrity of information from computerized systems is achieved; and (f) contingency planning for information systems provides essential back -up to prevent unwarranted disruption of the activities and functions that the systems support." Government Auditina Standards. Section 7.20. Internal Control: "... Controls over the safeguarding of assets and resources include policies and procedures that the audited entity has implemented to reasonably prevent or promptly detect unauthorized acquisition, use, or disposition of assets and resources. " Government Auditing Standards, Section 7.21, Internal Control: "In performance audits, a deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, detect, or correct (1) impairments of effectiveness or efficiency of operations, (2) misstatements in financial or performance information, or (3) violations of laws and regulations, on a timely basis. A deficiency in design exists when (a) a control necessary to meet the control objective is missing or (b) an existing control is not properly designed so that, even if the control operates as designed, the control objective is not met. A deficiency in operation exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the D