Supply Chain Audit and Risk Management

Comprehensive vocabulary flashcards covering the key terms, legal frameworks, auditing standards, risk assessment tools, and emerging trends in Supply Chain Audit and Risk Management.

Procurement Audit

An independent examination of an organization's supply chain processes, procedures, and records to determine the true position regarding compliance, financial performance, and effectiveness, and to verify whether they give a true and fair view.

Appropriateness (of audit evidence)

The measure of the quality of audit evidence, specifically its relevance and reliability in providing support for the conclusions upon which the auditor's opinion is based.

Assurance Engagement

An engagement in which a practitioner expresses a conclusion designed to enhance the degree of confidence of intended users (other than the responsible party) regarding the outcome of the evaluation or measurement of a subject matter against established criteria.

Audit Plan

A description of the activities and arrangements for an audit, typically including the specific agenda and scope within the broader audit program.

Audit Risk

The risk that the auditor expresses an inappropriate audit opinion when the financial statements or procurement records are materially misstated; mathematically modeled as $\text{Audit Risk} = \text{Inherent Risk} \times \text{Control Risk} \times \text{Detection Risk}$.

Audit Sampling

The application of audit procedures to less than $100\%$ of items within a population of audit relevance such that all sampling units have a chance of selection, providing a reasonable basis for conclusions about the entire population.

Auditing (ISO 19011:2011 definition)

A systematic, independent, and documented process for obtaining audit evidence and evaluating it objectively to determine the extent to which audit criteria (policies, procedures, or requirements) are fulfilled.

Computer-Assisted Audit Techniques (CAATs)

Applications of auditing procedures using the computer as an audit tool to access, process, and analyze electronic audit data from systems and databases.

Control Risk

The risk that a material misstatement occurring in an account balance or class of transactions will not be prevented, or detected and corrected on a timely basis, by the accounting and internal control systems.

Detection Risk

The risk that the procedures performed by the auditor to reduce audit risk to an acceptably low level will fail to detect a misstatement that exists and could be material, individually or aggregated with other misstatements.

Inherent Risk

The susceptibility of an account balance or class of transactions to a misstatement that could be material, individually or aggregated, assuming that there were no related internal controls.

Residual Risk

The remaining level of risk that persists after risk treatment, control, or mitigation strategies have been implemented.

Walk-through Test

An audit procedure that involves tracing a few transactions through the entire processing system to understand the workflow and verify the design of internal controls.

Sources of Supply Chain Risk (Cranfield Model)

A framework identifying two risk dimensions: external drivers (demand side, environmental, and supply side) and internal drivers (process, control, and mitigation/contingency), which interact to determine vulnerability ($\text{Vulnerability} = \text{Risk} + \text{Exposure}$).

Economy (Three Es)

A performance auditing dimension focused on minimizing the cost of resources acquired and used for an activity while having regard to appropriate quality.

Efficiency (Three Es)

The relationship between the outputs (goods, services, and other results) and the resources (inputs) utilized to produce them, aiming to maximize output per unit of input.

Effectiveness (Three Es)

The extent to which stated objectives are achieved and the actual impact of an activity corresponds to the intended impact.

Article 227 of the Constitution of Kenya

Constitutional provision mandating that public procurement systems be fair, equitable, transparent, competitive, and cost-effective, providing for preferential allotment of contracts to categories of persons disadvantaged by unfair competition or discrimination.

Attribute Standards (IIA IPPF)

A major division of the IIA International Standards that describes the defining characteristics, purpose, authority, and ethical requirements of organizations and individuals performing internal audit services.

Performance Standards (IIA IPPF)

A division of the IIA International Standards that describes the nature of internal audit services, managing audit activity, engagement planning, and provides quality criteria against which to evaluate performance.

Audit Engagement Letter

A written contractual agreement between the auditor and the client confirming acceptance of the appointment, documenting the audit objectives, scope, limitations, management responsibilities, and applicable financial reporting framework.

Working Papers

The complete documentation and records prepared by or obtained by the auditor showing the procedures applied, tests performed, evidence gathered, and conclusions reached during an audit engagement.

Substantive Procedures

Audit tests designed to obtain direct evidence to detect material misstatements, errors, or unauthorized transactions at the assertion level within account balances or transaction classes.

Tests of Control

Audit procedures performed to evaluate the operational effectiveness of internal controls in preventing, or detecting and correcting, material misstatements and deviations throughout the period under review.

Going Concern Concept

The fundamental accounting assumption that an entity will continue in operational existence for the foreseeable future without the intention or necessity of liquidation or significant curtailment of its activities.

Management Representation Letter

A written communication provided by management to the independent auditor confirming oral statements made during the audit, acknowledging responsibility for the presentation of records, and corroborating audit evidence when other evidence cannot reasonably be expected to exist.

Agreed-Upon Procedures

A non-assurance engagement in which an auditor executes specific procedures agreed upon by the auditor, client, and relevant third parties, issuing a report of factual findings without expressing an audit opinion or assurance.

Compilation Engagement

An engagement where a practitioner collects, classifies, and summarizes financial or procurement information into reports without verifying the assertions or providing any assurance on the accuracy of the underlying data.

General Controls (IT)

Policies and procedures that apply to all computerized applications and information technology infrastructure, covering software, physical hardware, data security, computer operations, and system implementation.

Application Controls (IT)

Specific automated or manual controls unique to individual computerized applications (classified into input, processing, and output controls) that ensure authorized, complete, and accurate transaction processing.

Parallel Simulation Testing

An auditing approach where the auditor executes generalized audit software to process identical client data through auditor-controlled logic, comparing the output directly against the client's system output.

Risk Appetite

The amount and type of risk that an organization is willing to pursue, retain, seek, or accept in the pursuit of its strategic and long-term business objectives.

Value at Risk (VaR)

A statistical financial metric that estimates the maximum potential loss that could occur within an investment portfolio over a specified time horizon at a given confidence level.

Kraljic Matrix

A strategic procurement segmentation tool that classifies purchases into four quadrants—Non-critical, Leverage, Bottleneck, and Strategic—based on profit impact versus supply market risk.

Pareto Analysis

A prioritization principle ($80/20$ rule) asserting that roughly $80\%$ of effects, risks, or expenditures arise from $20\%$ of causes, items, or suppliers.

Supply Chain Mapping

A diagrammatic representation of the configuration of a supply chain that details participants, upstream and downstream flows of material, finance, and information, lead times, and structural interdependencies.

Third-Party Risk Management (TPRM)

The systematic process of analyzing, managing, and mitigating risks arising from external business relationships with suppliers, vendors, contractors, and service partners across the contract lifecycle.

Governance, Risk Management, and Internal Control Relationship

A multi-layered governance model wherein governance directs the organization, risk management identifies and treats uncertainties within governance direction, and internal control acts as the execution core within risk management.

Force Majeure Clause

A contractual provision excusing a party from liability for non-performance or delayed performance caused by unforeseeable, unavoidable, and external events beyond their reasonable control (such as natural disasters, war, or civil disorder).

Indemnification Clause

A contractual provision that shifts the burden of financial loss by requiring one party to compensate or defend the other against specified liabilities, damages, or third-party claims.

Risk Register

A living document and management log that systematically captures identified risks, descriptions, root causes, probability, consequence ratings, risk rankings, mitigation controls, and assigned risk owners.

Risk Owner

A designated person or entity within management possessing the formal accountability and authority to manage, monitor, and execute treatment strategies for an assigned risk.

Contingency Planning Framework

A comprehensive recovery structure driven by business impact analysis (BIA) that incorporates incident response planning, disaster recovery planning, and business continuity planning to handle unexpected disruptive events.

Business Continuity Planning (BCP)

The proactive discipline focused on safeguarding critical functions and maintaining the flow of essential business deliverables during and immediately after a severe disruption.

Disaster Recovery Planning (DRP)

A subsidiary component of business continuity planning focused on the specific steps, technical resources, and procedures required to restore and recover damaged systems, data, and physical operations following a catastrophe.

Joint and Several Liability

A legal liability doctrine permitting an injured plaintiff to recover the entirety of awarded damages from any single responsible defendant regardless of their relative degree of fault.

Scienter

A mental state of intent to deceive, manipulate, or defraud, representing knowledge on the part of the person making false representations that the statements were untrue at the time they were made.

Agile Internal Audit

An audit methodology that adapts iterative, collaborative software development principles to internal auditing, prioritizing speed, continuous communication, iterative sprint planning, and rapid focus on high-risk areas.

Integrated Assurance

A holistic approach that aligns, coordinates, and rationalizes assurance activities across the three lines of defense around core drivers of organizational value to eliminate redundant testing and prevent audit fatigue.