Explain operational planning and control,online video hosting 365,movie maker windows xp magyar let?lt?s,internet advertising agencies in india mumbai - 2016 Feature

12.11.2013
Learn how to develop disaster recovery strategies as well as how to write a disaster recovery plan with these step-by-step instructions.
Formulating a detailed recovery plan is the main aim of the entire IT disaster recovery planning project. Once this work is out of the way, youa€™re ready to move on to developing disaster recovery strategies, followed by the actual plans. Once you have identified your critical systems, RTOs, RPOs, etc, create a table, as shown below, to help you formulate the disaster recovery strategies you will use to protect them. Youa€™ll want to consider issues such as budgets, managementa€™s position with regard to risks, the availability of resources, costs versus benefits, human constraints, technological constraints and regulatory obligations. Once your disaster recovery strategies have been developed, youa€™re ready to translate them into disaster recovery plans. From Table 2 you can expand the high-level steps into more detailed step-by-step procedures, as you deem necessary.
In addition to using the strategies previously developed, IT disaster recovery plans should form part of an incident response process that addresses the initial stages of the incident and the steps to be taken. Note: We have included emergency management in Figure 2, as it represents activities that may be needed to address situations where humans are injured or situations such as fires that must be addressed by local fire brigades and other first responders.
The following section details the elements in a DR plan in the sequence defined by ISO 27031 and ISO 24762. Important: Best-in-class DR plans should begin with a few pages that summarise key action steps (such as where to assemble employees if forced to evacuate the building) and lists of key contacts and their contact information for ease of authorising and launching the plan. In parallel to these activities are three additional ones: creating employee awareness, training and records management.
The Institute of Internal Auditors (IIA) has kindly permitted the IIA International Standards for the Professional Practice of Internal Auditing (including elements of the glossary of terms) to be reprinted in this guide. The Treasury Board of Canada's (TB) Policy on Internal Audit is designed to ensure that internal audit provides the Deputy Minister with added assurance, independent from line management, on risk management, control, and governance processes. The Treasury Board of Canada's (TB) April 1, 2006 Policy on Internal Audit (the TB Policy) is designed to ensure that internal audit and audit committees provide deputy heads and the Comptroller General with added assurance, independent from line management, on risk management, control, and governance processes. Under the TB Policy, the Deputy Minister of Indian and Northern Affairs Canada is responsible for establishing an internal audit function that is appropriately resourced and that operates in accordance with the Policy and professional internal auditing standards and for establishing an independent audit committee that includes a majority of external members who are not currently in the federal public service.
The Institute of Internal Auditors (the world-wide professional organization for internal auditing) (the IIA) defines the internal audit activity as "A department, division, team of consultants, or other practitioner(s) that provides independent, objective assurance and consulting services designed to add value and improve an organization's operations. While the IIA definition includes consulting services, TB Policy does not extend the definition of internal audit to include consulting services. This Internal Audit Manual is intended to provide members of the Indian and Northern Affairs Canada's (INAC) Audit and Evaluation Sector (AES) with practical guidance, tools and information for managing the internal audit activity and for planning, conducting and reporting on internal auditing assurance engagements. Users of this Manual are assumed to possess at least basic knowledge and understanding of management frameworks and controls and to be capable of exercising sound professional judgment.
Users of the Manual are expected to draw upon the information provided to form their own judgments on the most suitable approaches to fulfilling the specific responsibilities that they have been assigned in the context of continuously striving for the most effective internal audit activity possible. While the Audit and Evaluation Sector is also responsible for providing evaluation services, this Manual is intended to facilitate the performance of internal auditing engagements with the rigour and professional due care necessary for the provision of assurance (as envisioned in the TB Policy on Internal Audit and related directives and in the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing (the IIA Standards)).
To demonstrate links with the TB Policy or the IIA Standards, related references are cited at the beginning of certain sections.
Establishes the rationale, context, and role for the internal audit activity in general, i.e. Identifies the organizational structure of AES, assigns generic responsibilities for the fulfillment of the tasks necessary to an effective internal audit activity, identifies the competencies required to fulfill those tasks, and establishes resourcing strategies to ensure that those competencies are available.
Outlines the processes that are followed to identify the most appropriate internal audit engagements to be undertaken and to report upon the results of those engagements. Describes the steps that are normally to be followed in planning, conducting and reporting upon an individual internal auditing engagement. Provides brief descriptions of the most commonly used tools and techniques and of the circumstances under which each is most appropriate.
Summarizes expectations and activities for quality assurance during the performance of individual internal auditing engagements and at periodic intervals with respect to the overall internal audit activity. To supplement the descriptions and explanations in this Manual, a Glossary of Terms is provided in Appendix C.
As noted above, the TB Policy on Internal Audit is designed to ensure that internal audit provides deputy heads with added assurance, independent from line management, on risk management, control, and governance processes.
The Federal Accountability Act (FAA) (2006) designated Deputy Ministers as accounting officers. The Treasury Board Policy on Internal Audit strengthens public sector accountability, risk management, resource stewardship and good governance by reorganizing and bolstering internal audit on a government-wide basis.
The objective of the April 2006 Treasury Board Policy on Internal Audit is to strengthen public sector accountability, risk management, resource stewardship and good governance by reorganizing and bolstering internal audit on a government-wide basis. Ensure that management action plans are prepared that adequately address the recommendations and findings arising from internal audits and that the action plans have been effectively implemented.
Ensure that completed audit reports are issued in a timely manner and made accessible to the public with minimal formality. Internal Auditing Standards for the Government of Canada is a directive included in the TB Policy suite of direction and guidance. Internal audit functions are expected to provide a holistic opinion on the effectiveness and adequacy of risk management, control and governance processes. The Professional Practices Framework, developed and maintained by The IIA, offers practitioners a full range of internal audit guidance. The purpose of the IIA's Code of Ethics is to promote an ethical culture in the profession of internal auditing. The International Standards for the Professional Practice of Internal Auditing (the IIA Standards) provide guidance for the conduct of internal auditing at both the organizational and individual auditor levels. The IIA also issues occasional Practice Advisories related to specific standards when it wishes to provide clarification on particular issues. To ensure that the most recent versions of the standards and practice advisories are available to the internal auditing community, they can be accessed electronically through the IIA. Treasury Board's Policy on Transfer Payments   sets out a number of key requirements for the management of Transfer Payments.
Under Treasury Board's Integrated Risk Management Framework  , an expectation is created that departments and agencies will establish practices to continuously, proactively, and systematically assess and manage risks on an organization-wide basis. A primary goal of internal audit, per the TB Policy, is to provide sufficient and timely assurance services on risk management. It is important that the internal auditing activity be familiar with the requirements of the Policy in order to respect it should the activity identify issues of public interest that should be communicated to senior management of INAC and the Treasury Board Secretariat.
Aligned to the vision of Results for Canadians, the Management Accountability Framework (MAF) is a set of 10 statements summarizing the Treasury Board of Canada Secretariat's (TBS) expectations for modern public service management.
As these expectations constitute critical standards for the success of INAC, the internal auditing activity must take them into consideration when determining annual and longer-term internal audit (and evaluation) plans and when conducting specific engagements. IIA Standard 1000 – Purpose, Authority, and Responsibility - The purpose, authority, and responsibility of the internal audit activity should be formally defined in a charter, consistent with the Standards, and approved by the board. IIA Standard 1000.A1 - The nature of assurance services provided to the organization should be defined in the audit charter.
Within INAC, the internal audit activity is solidly founded upon an Internal Audit Charter and an Audit and Evaluation Committee Terms of Reference. The INAC Internal Audit Charter (April 2008), Appendix A defines the roles and responsibilities of the Deputy Minister, the Audit and Evaluation Committee, the Chief Audit and Evaluation Executive, the INAC Management and the Comptroller General of Canada for establishing an internal audit function that is appropriately resourced and managed in accordance with this policy and professional internal auditing standards. The Audit and Evaluation Committee Terms of Reference (June 2007), Appendix B, defines the role, mandate, composition, and accountability of the Audit and Evaluation Committee and prescribes the requirements for the convening and conduct of meetings. The Audit and Evaluation Committee Terms of Reference (June 2007) defines the role, mandate, composition, and accountability of the INAC Audit and Evaluation Committee.
Review and comment on the plans and reports of external agencies (including the Auditor General and the Treasury Board Secretariat) and any proposed actions to be taken by Indian and Northern Affairs Canada. IIA Standard 2000 – Managing the Internal Audit Activity - The chief audit executive should effectively manage the internal audit activity to ensure it adds value to the organization. IIA Standard 2030 – Resource Management - The chief audit executive should ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan. IIA Standard 1230 – Continuing Professional Development - Internal auditors should enhance their knowledge, skills, and other competencies through continuing professional development. In terms of generic responsibilities, the positions of FI-04 and AS-07 will normally function as audit managers while the positions of FI-03, AS-06, AS-05, AS-04, AS-03, AS-01 will function as team leaders, auditors or team members. Specific roles and responsibilities of the CAEE and the Director, Audit and Assurance Services and generic roles and responsibilities of the audit manager, team leader, and auditor are described below. Through the delegation of authority and accountability, the Director, Audit and Assurance Services, holds responsibilities very similar to those of the CAEE. Audit managers are responsible for implementing a set of assigned engagements over the course of a year. Engagements are assigned taking into consideration the need to match the knowledge, skill and experience requirements of the engagement to the demonstrated competencies of the individual audit manager. The audit manager is responsible for all phases of project management, including the preparation of the Statement of Work, the selection of the contractor, the oversight of the contractor, and the finalization and presentation of audit findings, including debriefings and reports. Team leaders are assigned to supervise a team of auditors in the performance of the audit engagement in one or more locations, following the approved audit program.
Auditors may on occasion be invited to work alongside contracted auditors or audit teams as a means to further their professional development or contribute expertise to a particular engagement.
As professionals, internal auditors must demonstrate proficiency in terms of the key knowledge, skills and abilities required to effectively conduct internal audit assurance engagements. To ensure that it collectively possesses the required skills and abilities to provide superior service, AES prepares an annual Human Resources Plan. In addition, AES fully encourages and supports staff members to increase their professionalism and credibility through the acquisition of professional certifications. As a means of formally attesting to their objectivity and independence in the performance of their duties, all members of the Audit and Assurance Services Branch are required to annually sign an Audit and Evaluation Sector Code of Ethics Report that confirms that they will respect the Code of Ethics of the Institute of Internal Auditors and that they have no potential conflicts of interest. IIA Standard 2010 – Planning - The chief audit executive should establish risk-based plans to determine the priorities of the internal audit activity, consistent with the organization's goals. IIA Standard 2010.A1 - The internal audit activity's plan of engagements should be based on a risk assessment, undertaken at least annually. IIA Standard 2110 – Risk Management - The internal audit activity should assist the organization by identifying and evaluating significant exposures to risk and contributing to the improvement of risk management and control systems. IIA Standard 2110.A1 - The internal audit activity should monitor and evaluate the effectiveness of the organization's risk management system. IIA Standard 2120 – Control - The internal audit activity should assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement.
IIA Standard 2060 – Reporting to the Board and Senior Management - The chief audit executive should report periodically to the board and senior management on the internal audit activity's purpose, authority, responsibility, and performance relative to its plan. To be consistent with the TB Policy on Internal Audit and IIA Standards, AES undertakes an annual risk-based planning process to determine the internal audit priorities for the upcoming year and, notionally, for an additional two years. The annual planning process in the AES employs a collaborative and consultative risk-based approach relying heavily on the internal audit group's professional judgment and experience to identify areas of greatest audit priority. Strategic, risk-based plans are designed to ensure that audit resources are allocated to areas that will help achieve strategic outcomes and reduce the possibility that the department will be exposed to significant risks. The model below illustrates the principal components of the AES risk-based audit planning methodology. All mandates, authorities, programs, corporate functions, organizational units, systems, assets, resources and processes of INAC are identified that are within the potential scope of internal audit. All the potential universe entities and elements are grouped into units that would likely produce meaningful findings for senior departmental management and that would be of such size and scope that an audit engagement could be practically conducted within a reasonable timeframe or cycle of coverage. Each auditable unit is assessed, using a scale of 1 to 5 where 1 is low and 5 is high, in terms of risk related to its significance to achievement of INAC objectives, its complexity in terms of ensuring that intended outcomes are achieved, and its sensitivity in terms of the public or the intended beneficiaries.
Audit projects are proposed that would be most appropriate to address the highest risk areas of the manageable audit units on a priority basis. The annual plan outlines a prioritized list of proposed engagements including the initial objectives and scope for each engagement, an estimate of required resources and an identification of the most suitable timing for specific engagements. To fulfill the requirements of the Treasury Board Policy on Internal Audit, including that for an annual holistic opinion, AES prepares an annual report. IIA Standard 1200 – Proficiency and Due Professional Care - Engagements should be performed with proficiency and due professional care. IIA Standard 1220 - Due Professional Care – Internal auditors should apply the care and skill expected of a reasonably prudent and competent internal auditor. Relative complexity, materiality, or significance of matters to which assurance procedures are applied.
IIA Standard 2200 – Engagement Planning - Internal auditors should develop and record a plan for each engagement, including the scope, objectives, timing and resource allocations.
The objectives of the activity being reviewed and the means by which the activity controls its performance. The significant risks to the activity, its objectives, resources, and operations and the means by which the potential impact of risk is kept to an acceptable level. The adequacy and effectiveness of the activity's risk management and control systems compared to a relevant control framework or model.
The opportunities for making significant improvements to the activity's risk management and control systems.


IIA Standard 2210 – Engagement Objectives - Objectives should be established for each engagement. IIA Standard 2220 – Engagement Scope - The established scope should be sufficient to satisfy the objectives of the engagement.
IIA Standard 2240 – Engagement Work Program - Internal auditors should develop work programs that achieve the engagement objectives.
IIA Standard 2240.A1 - Work programs should establish the procedures for identifying, analyzing, evaluating, and recording information during the engagement. IIA Standard 2300 – Performing the Engagement - Internal auditors should identify, analyze, evaluate, and record sufficient information to achieve the engagement's objectives. IIA Standard 2320 – Analysis and Evaluation - Internal auditors should base conclusions and engagement results on appropriate analyses and evaluations.
IIA Standard 2330 – Recording Information - Internal auditors should record relevant information to support the conclusions and engagement results. IIA Standard 2400 – Communicating Results - Internal auditors should communicate the engagement results. IIA Standard 2420 – Quality of Communications - Communications should be accurate, objective, clear, concise, constructive, complete, and timely. At the most fundamental level, the audit manager must establish what is going to be audited (planning), ensure that the approved plan is implemented (conduct), and communicate the results achieved (reporting). Once the engagement has been identified in the Risk-based Audit Plan, it must be effectively planned in order to determine the specific objectives, scope, audit criteria, and methodology.
At the outset of the planning phase, the audit engagement is usually defined in very broad terms. At the end of the planning phase, the audit manager will be able to clearly articulate what will be audited, why it will be audited, and how it will be audited.
The initial communication with the auditee is normally drafted by the audit manager and issued by the Director, Audit and Assurance Services.
Before any work formally commences on an audit, AES informs the auditee in writing normally via a bilingual e-mail message, with terms of reference attached.
Shortly after the formal communication has been issued, the audit manager or Director should follow-up by telephone, if necessary, to ensure that the auditee has received the notification and taken the appropriate steps to schedule the opening meeting or otherwise facilitate the audit commencement. During an opening meeting, the audit manager should clarify with the auditee the known details of the program, activity or organization to be audited, e.g. If the auditee has any suggestions for the audit objectives or scope, or has raised any concerns that the audit might address, these can be discussed at this time. The planning phase normally consists of three distinct, but often overlapping, activities, i.e. The audit manager needs to develop a sound understanding of the program, activity, organization or initiative being audited, including its management practices, business processes, policies and procedures, and external and internal environments.
Specifically, to be compliant with the TB Policy on Internal Audit, the audit manager needs to be focused on all important aspects of risk management, control, and governance processes for the program, activity, organization or initiative being audited. In addition to reviewing documentation and analyzing financial and non-financial performance information, the audit manager may also want to consider visiting sites and observing operations, interviewing management, field staff, central agency representatives or subject matter experts, and reviewing any available internal controls documentation. To consolidate and confirm the understanding acquired, the audit manager should prepare a summary of the program, activity, organization or initiative in the form of an auditable unit or auditee profile.
The risk assessment process provides a structured means of evaluating information and applying professional judgment as to the most important areas for audit examination. A detailed risk assessment is undertaken during the planning phase of the engagement to confirm that the lines of enquiry and the initial objectives have indeed focused on the most important risks associated with the program or activity being audited. The objective statements for the audit, as outlined in the Risk-based Audit Plan, may need to be amended if the more detailed risk assessment reveals additional risks or assigns higher or lower risk scores to those risks already identified. Plan to focus audit objectives and scope on testing the existence or adequacy and effectiveness of key controls over areas of greatest risk.
The Risk Based Audit Frameworks (RBAFs) that must be prepared to obtain Treasury Board approval of transfer payment programs can provide valuable insight to the internal auditor in overall audit planning or in engagement planning as to the risks that program management identifies as being relevant to the program and as to the control mechanisms that program management has put in place, or is intending to put in place, to manage those risks, including the auditing of recipients. Whether the risk assessment is developed alone by the audit manager or with the participation of the auditee, the audit manager will want to ensure that the auditee understands the significance of the completed product as the audit manager employs it in developing the audit plan. The audit manager must be sensitive to situations where management may have undertaken a risk assessment and made decisions with which the audit manager may not be comfortable. Simply stated, control is making sure that what happens is what is supposed to happen and that, to the extent practical, undesirable results do not occur. Detective controls are intended to detect unintended consequences after they have occurred. Many models of internal control will prescribe specific criteria against which the internal control framework, and its components, can be assessed. The audit manager who has gained an understanding of the auditee's objectives and control environment and has identified the key risks to the achievement of objectives is now in a position to identify and assess the related controls and their likely effectiveness in mitigating risks. Once an understanding of the program or activity has been acquired and the assessment of risks has been completed, including any limited testing of controls, the audit manager recommends the specific objectives and scope for the audit. The scope statement clearly describes the areas, processes, activities, or systems that will be the subject of the audit and to which the conclusions will apply. The scope will also describe the time period covered by the audit, for example, the period or fiscal year during which files or transactions to be examined were originally prepared.
Audit criteria are reasonable and attainable standards of performance and control against which compliance, the adequacy of systems and practices, and the economy, efficiency and cost effectiveness of operations can be evaluated and assessed. In identifying relevant and reliable criteria, AES can usually rely upon acts and regulations, policy, guidelines or standards, and recognized experts. The Audit and Evaluation Sector has developed a specific set of expected controls for INAC's grants and contributions programs in the form of a publication entitled Grants and Contributions Audit Criteria. The audit manager must review and discuss the proposed audit criteria with the auditee, particularly when there are no generally accepted criteria, to obtain an acknowledgement that the criteria are suitable for the audit. Once the audit objectives, scope and criteria have been clearly established, the audit manager needs to design an approach to carrying out the audit that will provide the most meaningful result in the most cost-effective manner. The purpose of articulating the audit approach is to ensure that sufficient, appropriate audit evidence is collected to enable the drawing of a conclusion with respect to each of the audit objectives.
Using professional judgment, the audit manager develops the approach and methodology based on the nature and extent of evidence needed to reach a conclusion with a high degree of assurance and the most appropriate and cost-effective mix of audit tests and procedures to gather that evidence. An effective approach will normally incorporate a variety of auditing tools and techniques. At the end of the planning phase, the audit manager will prepare a Preliminary Survey Report or Terms of Reference to document the results.
Once approved by the Director, Audit and Assurance Services or, if necessary, by the Audit and Evaluation Committee, the document serves as the basis for conducting the audit. On occasion, the planning phase may result in a recommendation to suspend additional audit activity. In these circumstances, the audit manager should prepare for the CAEE, a recommendation to defer or cancel the engagement, or to revisit the objectives, so that the necessary senior management approval may be obtained administratively or via a formal recommendation to the AEC. The audit program specifies who is doing what, why it is being done, how it is to be done, when it is to be done and where it is to be done, while allowing some flexibility for the use of initiative and sound judgment in deviating from prescribed procedures or extending the audit work where warranted. Audit programs document and detail the audit tests and procedures that the audit manager has designed as the approach to collect and analyze audit evidence in the most cost-effective manner while ensuring objectivity, independence and uniformity. A vehicle to document the exercise of due care and compliance with professional standards and policies. Once the objectives and scope have been determined, the efficiency and effectiveness of an audit depend largely on how well the audit program has been designed and executed. The purpose of the conduct phase of the audit is to gather sufficient, appropriate audit evidence to reach a conclusion on each of the objectives identified in the planning phase. An entrance meeting will normally be held on the first day of fieldwork with the audit team and the manager and supervisors directly responsible for the program, activity or organization being audited. After the entrance meeting audit team members will normally meet individually with the supervisor responsible for the activity, organization or program that they have been assigned.
Once the entrance meeting has been held, the team members proceed to carry out their assigned parts of the audit program.
The Multilateral Organisation Performance Assessment Network (MOPAN) is a group of 16 donor countries that have joined forces to assess the performance of the major multilateral organisations which they fund. In 2011, an evaluative report was disseminated by the International Monetary Fund (IMF) regarding its performance leading up to the global financial and economic crisis. The Center for Effective Philanthropy developed a conceptual framework for assessing the performance of foundations. A number of models or frameworks for conducting an organisational performance assessment exist. One of the most comprehensive frameworks for Organisational Performance Assessment (OPA) is the Institutional and Organisational Assessment Model (IOA Model) elaborated by Universalia and the International Development Resource Centre (IDRC).
Key resource: As highlighted above, the Reflect and Learn website presents a range of frameworks for conducting organisational performance assessments. A key decision that an organisation needs to make when undertaking an organisational assessment is whether to self-assess its performance, to commission an external assessment, or to use a combination of both approaches. It is in these plans that you will set out the detailed steps needed to recover your IT systems to a state in which they can support the business after a disaster. Then, youa€™ll need to establish recovery time objectives (RTOs) and recovery point objectives (RPOs).
Here wea€™ll explain how to write a disaster recovery plan as well as how to develop disaster recovery strategies.
Areas to look at are availability of alternate work areas within the same site, at a different company location, at a third-party-provided location, at employeesa€™ homes or at a transportable work facility.
Youa€™ll need to identify and contract with primary and alternate suppliers for all critical systems and processes, and even the sourcing of people. Be prepared to demonstrate that your strategies align with the organisationa€™s business goals and business continuity strategies. Procedures should ensure an easy-to-use and repeatable process for recovering damaged IT assets and returning them to normal operation as quickly as possible. This process can be seen as a timeline, such as in Figure 2, in which incident response actions precede disaster recovery actions. The next section should define roles and responsibilities of DR recovery team members, their contact details, spending limits (for example, if equipment has to be purchased) and the limits of their authority in a disaster situation. During the incident response process, we typically become aware of an out-of-normal situation (such as being alerted by various system-level alarms), quickly assess the situation (and any damage) to make an early determination of its severity, attempt to contain the incident and bring it under control, and notify management and other key stakeholders.
Based on the findings from incident response activities, the next step is to determine if disaster recovery plans should be launched, and which ones in particular should be invoked. A section on plan document dates and revisions is essential, and should include dates of revisions, what was revised and who approved the revisions.
Once the plan has been launched, DR teams take the materials assigned to them and proceed with response and recovery activities as specified in the plans. Located at the end of the plan, these can include systems inventories, application inventories, network asset inventories, contracts and service-level agreements, supplier contact data, and any additional documentation that will facilitate recovery. These are essential in that they ensure employees are fully aware of DR plans and their responsibilities in a disaster, and DR team members have been trained in their roles and responsibilities as defined in the plans.
If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. The Manual brings to the attention of users major items that should be considered when managing the internal audit activity, when identifying internal auditing engagements that will strengthen INAC's management control framework, and when planning, conducting and reporting upon an internal auditing engagements. If users encounter situations where they believe that the guidance provided in the Manual is in conflict with what they believe to be the most effective approach, they should consult with more senior AES officers. Only engagements conducted with due care and rigour in accordance with professional standards and the process described herein provide the foundation for the provision of assurance services. The IIA's International Standards for the Professional Practice of Internal Auditing (adopted as the Internal Auditing Standards for the Government of Canada in the absence of specific direction) describes assurance services as "An objective examination of evidence for the purpose of providing an independent assessment on risk management, control, or governance processes for the organization. Deputy Ministers are now accountable before the appropriate Committee of Parliament, and are required to establish appropriate internal audit capacity and audit committees. It indicates that the Government of Canada has adopted the Institute of Internal Auditors' Professional Practices Framework (a full range of internal audit guidance including a code of ethics, standards, and practice advisories) and that departments are required to meet the IIA Standards in undertaking their internal auditing responsibilities, unless the Standards are in conflict with the Treasury Board Policy on Internal Audit or any related directives or guidelines provided by the Comptroller General or Treasury Board. The core elements of this Framework are the Code of Ethics and a set of professional standards.
A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, control, and governance. These rules are an aid to interpreting the Principles into practical applications and are intended to guide the ethical conduct of internal auditors. They are the result of careful study, consultation, and deliberation about the basic principles for providing internal audit services. The Practice Advisories deal with most aspects of planning, conducting and reporting the internal auditing engagement, as well as with governance and management aspects of the internal audit activity. Considering that over 90% of INAC's budget is transferred in the form of grants and contributions, it is critical that internal auditing focus on providing assurance that the management control framework governing those transfers is effective and efficient and that transfer payment programs are managed and delivered in compliance with the Policy. It is important, therefore, that the internal auditing activity in INAC be familiar with the expectations of the Policy and the Department's initiatives and progress in instituting a rigorous and integrated framework for management of risk. Managers are responsible to conduct active monitoring and warn senior management of INAC and the Treasury Board Secretariat of potential issues of public interest. It was developed to provide public service managers with a clear list of management expectations within an overall framework for high organizational performance.


If assurances are to be provided to parties outside the organization, the nature of these assurances should also be defined in the charter.
The INAC Internal Audit Charteralso addresses the objectivity and independence of the internal audit function and its authority to access departmental records and employees.
The internal audit activity collectively should possess or obtain the knowledge, skills and other competencies to perform its responsibilities.
Specific positions or individuals may be assigned additional responsibilities related to the management of the internal audit activity and may be requested from time to time to assume generic responsibilities branch-wide, e.g. Audit managers are normally responsible for the planning of each engagement and for ensuring the effective and efficient conduct and reporting of each engagement. Team leaders may be involved in the planning phase and may be involved in developing the audit program.
Auditors are assigned to complete portions of the audit program under the guidance of the team leader. Training is provided, either formally or on-the-job, when a need or opportunity is identified to acquire additional skills or knowledge that can be applied directly to the conduct of internal audit engagements or to the performance of supporting activities, e.g.
Among those supported are the Certified Internal Auditor (CIA), the Certified Government Auditing Professional (CGAP), the Certification in Control Self Assessment (CCSA), the Certified Financial Services Auditor (CFSA), the Certified Information Systems Auditor (CISA) and the Certified Fraud Examiner (CFE). Reporting should also include significant risk exposures and control issues, corporate governance issues, and other matters needed or requested by the board and senior management. The following sections describe the steps in the planning process and identify some of the key factors that must be taken into consideration in developing effective plans. The annual report describes the audit activities planned and undertaken for the fiscal year, identifies major findings of interest to INAC senior management, and offers a holistic opinion on controls, governance and risk management.
The work program should be approved prior to its implementation, and any adjustments approved promptly. Since it is neither practical nor cost-effective to audit everything, the audit manager must identify the risks associated with the audit entity, formulate meaningful objectives and establish an appropriate scope. The auditee is normally the most senior manager directly responsible or accountable for the program, activity, organization or initiative.
In the event of highly sensitive audit engagements the CAEE may be called upon to issue the announcement. The audit manager can also address any questions that the auditee may have concerning the audit. Such a profile should be reviewed with the auditee in order to confirm the audit manager's understanding of the auditee's business. For example if a program has had to recently complete a Risk-Based Audit Framework for a Treasury Board submission, the audit manager may be able to rely upon the completed risk assessment, although the audit manager must be satisfied that the process was as complete and impartial as possible and that the results can be relied upon.
Since management can choose to accept, transfer, eliminate, reduce or mitigate risks, the audit manager may encounter situations where the auditee does not view a given risk with the same degree of concern that the audit manager might. A control is any action taken by INAC management or staff to enhance the likelihood that established goals and objectives will be achieved while eliminating or mitigating the impacts of risks and protecting assets, including money, reputation, physical property, and human resources. As implied by the name, preventive controls are intended to prevent unintended consequences occurring, i.e. Some examples of detective controls are reports which detail the information accessed by an employee from a department or agency's systems, reconciliation of an inventory listing to the actual physical materiel, and monitoring (or auditing) contribution recipients to ensure that funds have been used for the purposes intended.
In that sense, the models serve as criteria against which internal control frameworks and individual controls can be assessed. In essence, the audit manager will document the process or activity for which the control is intended, evaluate the expected effectiveness, efficiency and cost effectiveness of the control, and test whether it is working as intended. Objectives should be carefully considered and clearly stated in such a way that a conclusion with respect to each is possible.
If there are numerical or geographic limitations to the scope of the audit, these should be specified, e.g. Audit criteria provide a basis for developing audit observations and formulating conclusions. The failure to identify and obtain acceptance by the auditee or by the Audit and Evaluation Committee of criteria suitable to the audit may result in inappropriate, or highly contested, conclusions being drawn by the internal auditor. In the absence of such criteria, the audit manager can draw upon a wide variety of potential sources for audit criteria, e.g. If agreement on the audit criteria cannot be reached, this should be reflected in the planning documentation, with an explanation as to why the audit manager believes the criteria remain appropriate. Appendix I provides in the form of a Template for an Audit and Engagement Plan, a checklist as to the key elements to be addressed in the document detailing the results of the planning phase. For example, if there is an absence of even basic controls and the auditee accepts the need for immediate improvement action, AES may recommend the auditee seek assistance to establish the basic elements of a management control framework. The key component of an effective audit program is the tests and procedures (Section 6.0) to be followed in gathering and analyzing audit evidence. Fieldwork is generally regarded as the beginning of the conduct phase and is interpreted as the point at which the audit team is implementing the audit program, usually on site with the auditee. Where practical, the Director, Audit and Assurance Services will attend the meeting, especially if the meeting includes executive heads responsible for the program, activity, or organization being audited.
This meeting can be used to gain an understanding of how the supervisor's responsibilities are carried out, to obtain access to required documentation, and to meet other staff. As activities are completed there will be ongoing processes of analyzing and evaluating evidence (Section 6.1 provides guidance on audit evidence) and formulating, discussing, presenting and refining observations and findings.
This framework provides a way for a foundation to infer the social benefit created by its activities relative to the resources it invests, and aims to allow its leaders to understand the performance of their organisation over time and in relation to other foundations.
The choice of which framework (or combination of frameworks) to use depends on the nature of the organisation, on the purpose of the assessment, and on the context in which the assessed organisation operates. The site also introduces the process and management of OPAs and provides a database of concrete tools that organisations can use to carry out assessments. Then consider site security, staff access procedures, ID badges and the location of the alternate space relative to the primary site. Key areas where alternate suppliers will be important include hardware (such as servers, racks, etc), power (such as batteries, universal power supplies, power protection, etc), networks (voice and data network services), repair and replacement of components, and multiple delivery firms (FedEx, UPS, etc).
Then define step-by-step procedures to, for example, initiate data backup to secure alternate locations, relocate operations to an alternate space, recover systems and data at the alternate sites, and resume operations at either the original site or at a new location. Here we can see the critical system and associated threat, the response strategy and (new) response action steps, as well as the recovery strategy and (new) recovery action steps. If staff relocation to a third-party hot site or other alternate space is necessary, procedures must be developed for those activities.
This section should specify who has approved the plan, who is authorised to activate it and a list of linkages to other relevant plans and documents. If DR plans are to be invoked, incident response activities can be scaled back or terminated, depending on the incident, allowing for launch of the DR plans.
The more detailed the plan is, the more likely the affected IT asset will be recovered and returned to normal operation. And since DR planning generates a significant amount of documentation, records management (and change management) activities should also be initiated.
The Standards were recently updated with relatively minor changes taking effect in January 2007. Reporting to the Director, Audit and Assurance Services are an FI-04 and a number of AS-07 positions). The audit manager is responsible for the preparation and approval of the planning document and for the identification and presentation of key audit findings. Team leaders are primarily responsible for ensuring the performance of the audit in accordance with the audit program and budget and professional standards.
Auditors are responsible for completing all work according to professional standards and for communicating any critical or potentially significant findings to Team Leaders on a timely basis. The CIA, CGAP, CCSA and CFSA certifications are offered through the Institute of Internal Auditors and further information can be found at their website. In so doing, the audit manager can ensure that audit resources and effort are devoted to a relatively few key areas that can have a significant impact on the performance and results of the program or activity being audited. In some cases, there may be a shared accountability or an intersection of line and functional authority, e.g. The communication specifies information known at the outset of the engagement such as the initial objectives and scope, any specific considerations or concerns, and the names of the auditors assigned to the audit. The audit manager can request copies of documents deemed to be important to acquiring a good understanding of the auditee's activities.
For example, if the auditee has chosen to accept the risks associated with not developing and implementing a recipient audit plan, the audit manager may need to express, and be prepared to defend, an opinion that that course of action is inappropriate. Detective controls may also be thought of as monitoring controls in the sense that they operate above of or outside of routine processes or activities and their preventive controls. In testing controls, the audit manager will pay particular attention to the extent to which it might be possible to rely upon detective, or monitoring, controls, as these may reduce the necessity for extensive testing of preventive controls. If necessary to the successful completion of the audit, the Director may need to seek approval of the criteria by the AEC.
For example, one may require a high degree of technical skill while another a high degree of interpersonal skill; one may be expensive but reliable, another inexpensive but less reliable. Alternatively, the planning phase, including limited testing of controls, may reveal that there are no significant risks that are not apparently well mitigated by established control processes. The tests and procedures should be structured and described so that it is clear to which criterion and to which audit objective each procedure is directly linked. To better understand what they can or should change to improve their ability to perform, organisations can conduct organisational assessments.
The Reflect and Learn website presents details on the rationale and particularities of various frameworks.
The framework also posits that organisational performance should be examined in relation to the organisation’s motivation, capacity and external environment. However, drawbacks of the self-assessment approach are that external stakeholders may question the independence or validity of the findings and may fear that hard issues will not be tackled, due to potential sensitivities within the organisation. This section defines the criteria for launching the plan, what data is needed and who makes the determination.
Technology DR plans can be enhanced with relevant recovery information and procedures obtained from system vendors. If your organisation already has records management and change management programmes, use them in your DR planning.
For example, an audit manager may be assigned to work as an audit team member on a particularly urgent or sensitive engagement. This includes the coordination of team member efforts and the assurance that audit files support the findings and conclusions. The communication could request the scheduling of an opening meeting and the identification of a primary contact to facilitate the coordination of the audit work if an Audit and Evaluation Coordinator has not been identified to do so. In other situations, the audit manager may need to proceed with testing to demonstrate that a chosen course of action to address a risk may be insufficient or unnecessary.
For example, a manager may have established a quality review team to review a sample of files or transactions on a regular basis.
The format should also include a provision for recording cross-references to working papers. As highlighted in a paper presented on the Impact Alliance website, it is important to note that different frameworks are underpinned by different philosophies and theories of organisational change; an organisation should choose a framework that is congruent with its own management beliefs and culture, to ensure that it fully engages in the process and truly benefits from the assessment. Included within this part of the plan should be assembly areas for staff (primary and alternates), procedures for notifying and activating DR team members, and procedures for standing down the plan if management determines the DR plan response is not needed. Check with your vendors while developing your DR plans to see what they have in terms of emergency recovery documentation. In the event that serious disagreements arise with the auditee, the audit manager may need to seek assistance from the Director, Audit and Assurance Services or the CAEE in pursuing discussions with the auditee and their more senior management. Preventive controls are intended to trigger an obstacle that prevents the routine processing of a particular transaction, e.g. If this activity is reliable as a control, it may eliminate the necessity for the audit to test as many original files or transactions. Appendix J provides a Template for Presenting an Audit Program, Appendix K, a Checklist for Reviewing an Audit Program (e.g. The book Organisational Assessment: A Framework for Improving Performance by Lusthaus et al.
The individuals identified in regions as the Audit and Evaluation Coordinators should be copied on the communication. Some examples of preventive controls are providing (and reinforcing) training of employees on how to do the job correctly, segregating duties to reduce the opportunity for intentional wrongdoing, creating physical deterrents such as locks, alarms and building passes to deter theft, and convening peer review committees or expert panels to review project proposals and recommend funding.
Meanwhile, Enhancing Organisational Performance: A Toolbox for Self-Assessment by Lusthaus et al. Preventive controls may also be thought of as application controls in the sense that they are embedded in the intended transaction, process, or activity.



Making a movie with powerpoint 2010
Free website builder reviews uk
Create marketing plan pdf


Comments to «Explain operational planning and control»

  1. Roni_013 writes:
    Get power over the way has begun realizing the importance.
  2. SEBINE_ANGEL writes:
    Socratic knows the way to achievement mentioned that there have each a steady.
  3. Narkaman_8km writes:
    Trigonometry with calculus, mathematical computation, pre-calculus, analytic geometry, initial year removed areas became.
  4. crazy_girl writes:
    Following you see a Duracell brand.