Financial vs. Operational vs. Integrated Audits

Same company, different questions

Picture a company that sells furniture online. Auditors could ask many different questions about it:

• Are its accounts right?
• Is its warehouse process efficient?
• Does it follow the card payment rules?
• Are its systems secure?

Each question is a different type of audit. The type is simply named after the question being asked.

The main types

Type	The question it answers	Where IT comes in
Financial audit	Are the financial statements fairly presented?	Only as far as systems affect the numbers: IT general and application controls
Operational audit	Are processes and their controls effective and efficient?	Can cover IT processes such as operations or service management
Integrated audit	A combined view of one business process or asset	Business and IS auditors work together
Compliance audit	Does the organisation follow a specific law, regulation, contract or policy?	Privacy, PCI DSS, software licensing, sector rules
Administrative audit	Is a function run efficiently and productively?	Office or process productivity
IS audit	Are systems and data protected, reliable and well managed?	The main focus

The integrated audit

Imagine three separate teams auditing how the furniture company pays its suppliers: the financial auditors check the invoices, the operational auditors check the process, and the IS auditors check the ERP system. They’d interview the same people three times and test overlapping things.

An integrated audit puts them together. The team looks at the business risks and the IT controls those risks depend on, tests everything once, and writes one report.

Example. An integrated audit of “procure to pay” covers the purchase approval workflow, the ERP’s three-way match (order, delivery, invoice), changes to supplier bank details, and who has access to the purchasing module, all in one engagement.

Benefits the exam looks for:

• a broader view of risk across business and IT
• no duplicated testing
• one report for management

Compliance audit vs compliance testing

The words are similar, which is the trap.

• A compliance audit is a type of audit: does the organisation follow PCI DSS, a privacy law, or a software licence?
• Compliance testing is a type of test inside any audit: does a particular control work as designed?

Other audits you’ll see named

• Third-party service audits, such as SOC 1 and SOC 2 reports on outsourced providers
• Fraud audits, focused on detecting and investigating fraud
• Forensic audits, gathering evidence to a legal standard (covered in the next topic)

How the exam asks about it

If the scenario describes…	It’s a…
Assessing the fairness of financial statements	Financial audit
Evaluating whether a process is efficient and achieving its goals	Operational audit
Business and IT auditors reviewing one process together	Integrated audit
Checking adherence to a regulation or contract	Compliance audit
Evidence gathered for possible legal proceedings	Forensic audit
The main benefit of an integrated audit	A broader view of risk with less duplicated work

In short

• An audit's type is defined by its objective: the question it's trying to answer.
• Financial audit: are the financial statements fairly presented? IT is looked at only as far as it affects them.
• Operational audit: are processes and their controls effective and efficient?
• Integrated audit: financial, operational and IS audit work combined to look at one business process end to end.
• Compliance audit: does the organisation follow a specific law, regulation, contract or policy?
• Administrative audits look at efficiency and productivity; IS audits look at systems, controls and data.
• Forensic audits gather evidence to a legal standard.

Exam traps

• An integrated audit combines audit TYPES on one process. It doesn't mean auditing the whole company.
• Compliance AUDIT (a type of audit) and compliance TESTING (testing controls) are different things.
• A financial audit doesn't assess whether IT is efficient; it only looks at IT as it affects the financial statements.

Slides

Click the slide and use the arrow keys. F toggles full screen.