Day 5 (21 Oct 2022)

Today, my mentor Thao send me several files and ask me to go through it before she explain it to me, there are two documents I need to go through they are called as ‘audit working paper’ and another one they call is as management letter. After going through the two documents, I can say I am not really understand the contents and what shoud I need to fill up when I am doing the audit task, then my mentor briefed me all the contents patiently, content by content, word by word to explain to me so that I can have a better understanding on it. First of all, we need to know that the purpose for the working paper is to document our evaluation of the design and implementation and the testing of te operating effectiveness of the IT general controls. The audit working paper generally will be grouped into four main areas which are: access to programs and data, program change that include maintenance to existing operating systems and IT applications, program development for new IT applications and computer operations. Completion of the audit working paper is necessary all the four areas can tally with the materials we request from the document request list, in other words, the materials are requested for audit purpose, after the audit, the result can be classified into the four areas listed in the audit working paper. Another thing I learnt from it is, the term ‘preparer’ will be used for the Executive that in charge to prepare the audit working paper, then the audit working paper will be reviewed by either the manager or director and then the partner.

In the audit working paper, the layout is as below:

At the end of it, we will list down the result, whether there is any deficiency that we need to inform client or the control is all good.

Another document Thao showed me is the so called management letter, it is a like a formal document to summarize the deficiency that we found through the audit process, the audit working paper is detailed as it show what we have done along the audit while the management letter is brief and just to point out the deficiencies that need client to notice about it. The contents included in the management letter are as follow:

Under the section 4.0 Detailed observation and recommendations, auditor will document the observation they found out and also what is the extimated risk for that particular deficiency, what is the recommendation and how management response to it, last it come out with the assessment level which is to indicate how important it is to the company. After completing the management letter, it will be sent together with the audit working paper for the director and partner to review, after being reviewed, the auditor will conduct an exist meeting with client to present the findings, in here the management letter will be used.

After Thao have briefed me regarding these two documents, I go through again to have a better understanding of it.

---

Main things that have learnt

• Go through audit working paper

• Go through management letter

---

Comment/idea/opinion

I studied the audit working paper a few time, but I would say still there are things that I am not really understand clearly, one of them is the difference between the design & implementation and the operating effectiveness. I am not sure what are the difference between two of them as for me both are referring to the area that we need to audit, so how to classify our audit work into these two groups. However, I believe when in future when I have been assigned the task, I am confident that I will have a better understanding on it. Looking forward on it!