Yu Ming Keung

In my opinion, nobody is perfect and nobody knows everything, including auditors. I would consider “the faker” would be the worst type from the standpoint of an auditee. We have been taught that we cannot say “I do not know” when we are asked to provide an answer or opinion. If we do, the auditee may think the auditor is unprofessional. However…[Read more]

In my opinion, there is no conflict between depth of knowledge in technology, or its impact on the enterprise. They are both important at the same level because they support each other. With that said, depth of knowledge in technology can cause either good/bad impact on the enterprise. And impact on the enterprise can motivate people to obtain…[Read more]

I totally agree with you. Risk assessments are very useful to determine what controls need to be determined and what controls need to be automated or manual. I think it is better for organizations to controls the risk assessments every 1/2 year to look for new risks and controls the company might need to consider to add. Either way, organizations…[Read more]

Great post, Alex. As auditors, we need to use our own judgement when we are undergoing any special situation, which means we have to remain objective throughout the audit process. If we fails to remain objective based on our integrity, the results of the audit would be skewed and therefore our opinions of the result of the audit will not represent…[Read more]

You are absolutely right about having strong technical and ethical characteristics. As auditors, we are using our professionals skills to audit and study our clients, who may intend to bribe the auditors so that ethical characteristics are absolutely important to keep us clear and stay away from any business fraud.

12. In the Real World Control Failures, we’ve reviewed, describe the character of the leaders involved.  Is it a root of the control failures?

In my case, the CFO and CEO who were involved in the case cooked the book to make its annual report look better than it was supposed to. I think the characters of the leaders are greed and a heart of am…[Read more]

How much of automated controls should be desired? Is it beneficial to consider controls at the initial design phase or controls are introduced as and when needs arise?

I think the amount of automated controls desired by organizations should depend on the type and size of the organizations. Automated controls are the ideal control because…[Read more]

Cant agree more with the customization options, it can create the real SAP that fits what an organization really needs Users will be much easier to access SAP. Think about an SAP software where an organization just use a few functions and features, it sometimes confuses the users with too many functions. If SAP can let user customize what they…[Read more]

I really like the idea that you suggested. If any enterprise can run an automated controls to check if they are complying with the compliance. If an enterprise knows what they are violating, they can immediately address the issue!

4 What aspect of compliance should an organization put the most effort into ensuring their controls are adequate?  What factors about an organization (it’s industry, profit / non-profit, international, …) would drive this answer?

The aspect of compliance that an organization should put the most effort into ensuring their controls are adeq…[Read more]

When is the cost of implementing a compliance control higher than the benefit obtained? What should an organization do to ensure efficiency and profitability?

The cost of compliance expected to rise, organizations must find ways to streamline compliance spending to maintain IT operations and IT security service levels. Having the right…[Read more]

The ERP systems market is very competitive.  What should SAP and other ERP systems providers be focusing on to make their systems more competitive in the future?’

1. Ease of use – make the SAP system easier to use and make SAP users understand the entire systems.
2. Customization – deliver what the customer needs and avoid what they don’t…[Read more]

1 (Updated Nov 30) SAP is a world class ERP system provider.  If you are an SAP customer – what would you expect them to provide to support your company’s internal controls?

As an SAP customer, I would expect SAP to provide some clear advice on the audit process of SAP because a good internal control audit can help the business itself monit…[Read more]

Good point Priya, I completely agree with you. Auditors verify that internal controls and procedures are in place for companies they audit. They identify critical areas that may need improvement, and they test the performance, In order to give independent opinion, they auditor should stay unbiased whenever they are selecting sample, simples size,…[Read more]

Very good point Abhay, the internal auditor has to be unbiased in their opinions because they are examining issues related to company business practices and risks and he or she will be reporting to the audit committee and the full board. Rules to minimize bias focus on eliminating conflicts of interest. Companies may need to hire external auditor…[Read more]

When is the cost of implementing a compliance control higher than the benefit obtained? What should an organization do to ensure efficiency and profitability?

The cost of compliance expected to rise, organizations must find ways to streamline compliance spending to maintain IT operations and IT security service levels. Having the right…[Read more]

2. How is independence maintained when working for the company as an internal auditor?

The internal auditor position is always controversial because he or he is ‘employed’ by management, but is also expected to review the conduct of management. This can create significant tension.

Senior management should ensure that the internal audit dep…[Read more]

In your company, do you use any blueprints as documentation?  Why are process blueprints important in the documentation?

Unfortunately, in my previous organization, I did not have any experience with blueprints as documentation. A blueprint process. A blueprint is used to guide its priorities, projects, budgets, staffing and strategies by…[Read more]