Our company is the biggest integrated oil and gas co. in Central Europe with activities like refining, retail (fuel statins), wholesale, gas transmission, HC exploration and produntion, petchem etc. The Group runs these businesess in different portfolio in Hungary, Slovakia, Romania, Austria, Croatia, Slovenia, Ukrania, Poland, Serbia, Pakistan, Yemen, Siria, Russia etc. In this year we are going to initiate some general country audit regarding to some local subsidiaries of the Group. In the past we have alredy carried out lots of process, compliance and requested engagements.

What is the difference between while you preparing a workprogram related to a special business or functional process or you have to prepare a general WP covering all of the processes and major controll points in a company.

Any help or general country adit WP example would be great, because I do not want to write and endless WP.

Regards,
Robert Gyorgyik

Robert,

There are general internal control evaluation questionnaires that you can use that are not industry specific. However if you want to do a comprehensive review of a particular industry you would first need to do a business risk analysis and determine and prioritize all the risks associated with the business. Once you have completed you risk analysis the next step would be an evaluation of each of the business area or control cycles based on your available resources and risk rankings.

You could also see if you could network with other internal auditors in the same industry to find out their audit approach for conducting internal control reviews.

Jim Kaplan
AuditNet.org

Dear Jim,

As a matter a fact, we usually make a risk map on Group level annually, based on interviews, external and internal environment, state of the control framework etc in order to select the critical processes and create our audit plan. That is OK, we have already created it for 2006.

For example; we identified Hydrocarbon exploration and field acquisition as a critical process in Group level and we put it into our 2006 audit plan. According to the schedule, we are going to initiate this audit. Because of our largest (foreign) exploration activity is in Pakistan, so we decided to go there and carry out not just a process related but a complete general control (subsidiary or country) engagament.

You gave me a good idea, because general control questionnaires are sounds good, because there are so many common control points without irrespectively of the type of the process. And the industry related issues can be solved by us.

Thanks for the good idea.
Regards,
RGy