how to audit such department ? audit the software against what ?!!!!
For a start, as Sidney has said, don't audit a department, audit one or more
processes.
I'd start by:
1. Finding out what the 'quality' objectives are for this Department and how they are measured/monitored. What are they? What are the metrics? How do these relate to the higher level company objectives and contribute to the company meeting its quality policy?
2. Finding out what the main
processes are that this Accounting Dept either does, owns or contributes to. They're not just 'there because they're there', they have some reason for being which enables this company to fulfil its objectives. What is it or them?
By now, I'd expect to have seen something written for 1. (eg, department plan, company plan or similar); something may or
may not exist in a 'written form' for 2. But in that case I'd expect at least the manager of the area to be able to explain it clearly.
3. What about competency and organisation? Do they have defined responsibilities & authorities? Evidence of competency of personnel? Here I'd be going back to what the company requirements are.
4.
Now I'd have some understanding of what they aim to do, and broadly speaking how they go about it. Now I can look for, and ask for evidence, of whether their processes and activities are meeting the requirements, delivering 'the goods'... or not. You don't audit 'the software', you have to focus on what the aim is (what are they setting out to achieve?) and look to see that they are achieving those aims; eg, if they're supposed to be accurately processing receivables by date x of each month, and the metric is accurate financial statements provided by date y of the month, are they doing that on time? Are there any complaints about accuracy? Customer dissatisfaction/complaints/negative feedback? Or compliments? Because if they're fulfilling their objectives and the evidence suggests they're doing it well, then why would they need procedures?
You see, they don't
necessarily need written procedures. Having a written procedure is not the be-all and end-all of quality! (And in any case, procedures only ever make sense in the context of a
process.) Always look for the processes first, don't start off by looking for written procedures.