Introduction
Internal audit refers to an independent service to evaluate an organisation’s internal
controls, its corporate practices, processes, and methods. An internal audit helps in
securing compliance with the various laws applicable to an organisation. An
organisation can prepare its accounts and records as per the applicable legal
requirements and reporting.
Understanding Internal Audit
The purpose of an internal audit is to check the effectiveness and operational
standards framed by an organisation. An organisation may have a set of rules for
operations, such as placing orders, accepting deliveries, and making payments. An
internal audit also helps in knowing whether the employees follow the internal
operational standards.
An internal audit helps in identifying problems or inefficiencies and taking necessary
corrective steps. Internal audits can identify any frauds by employees, such
as embezzlement of funds. The audit can also identify whether there are deliberate
cost overruns, whether a particular vendor is getting preference over other low-cost
suppliers.
There may be a need to identify employee rotation between different roles and
functions. An internal audit can check any potential threats or financial losses. An
organisation can plug in financial leakage. The process enables the identification
and correction of a lapse in procedures before the statutory audit.
An internal audit can be on an annual basis or monthly or quarterly. The choice
depends on the need of the organisation. In certain cases, a company should
mandatorily appoint an internal auditor, such as under the Companies Act, 2013.
There are different types of assessment or analysis techniques an
internal auditor may adopt for performing an internal audit.
What is an Internal Audit?
Internal audits evaluate a company’s internal controls, including
its corporate governance and accounting processes. These audits ensure
compliance with laws and regulations and help to maintain accurate and
timely financial reporting and data collection. Internal audits also provide
management with the tools necessary to attain operational efficiency by
identifying problems and correcting lapses before they are discovered in
an external audit.
KEY TAKEAWAYS
An internal audit offers risk management and evaluates the
effectiveness of a company’s internal controls, corporate
governance, and accounting processes..
Internal audits provide management and board of directors with a
value-added service where flaws in a process may be caught and
corrected prior to external audits.
The Sarbanes-Oxley Act of 2002 holds management responsible for
their financial statements by requiring senior corporate officers to
certify in writing that the financials are accurately presented.1
Understanding Internal Audits
Internal audits play a critical role in a company’s operations and corporate
governance, especially now that the Sarbanes-Oxley Act of 2002 (SOX)
holds managers legally responsible for the accuracy of their company's
financial statements. SOX also required that a company's internal controls
be documented and reviewed as part of their external audit.1 Internal
controls are processes and procedures implemented by a company to
ensure the integrity of its financial and accounting information, promote
accountability, and help prevent fraud. Examples of internal controls are
segregation of duties, authorization, documentation requirements, and
written processes and procedures. Internal audits seek to identify any
shortcomings in a company's internal controls.
In addition to ensuring a company is complying with laws and regulations,
internal audits also provide a degree of risk management and safeguard
against potential fraud, waste, or abuse. The results of internal audits
provide management with suggestions for improvements to current
processes not functioning as intended, which may include information
technology systems as well as supply-chain management. Cybersecurity is
becoming increasingly important as companies need to protect their
confidential electronic information from outside attacks.
Internal audits may take place on a daily, weekly, monthly, or annual basis.
Some departments may be audited more frequently than others. For
example, a manufacturing process may be audited on a daily basis
for quality control, while the human resources department might only be
audited once a year. Audits may be scheduled, to give managers time to
gather and prepare the required documents and information, or they may
be a surprise, especially if unethical or illegal activity is suspected.
Internal Audit Process
Internal auditors generally identify a department, gather an understanding
of the current internal control process, conduct fieldwork testing, follow up
with department staff about identified issues, prepare an official audit
report, review the audit report with management, and follow up with
management and the board of directors as needed to ensure
recommendations have been implemented.
Assessment Techniques
Assessment techniques ensure an internal auditor gathers a full
understanding of the internal control procedures and whether employees
are complying with internal control directives. To avoid disrupting the daily
workflow, auditors begin with indirect assessment techniques, such as
reviewing flowcharts, manuals, departmental control policies or other
existing documentation. If documented procedures are not being followed,
direct discussion with department staff may be necessary.
Analysis Techniques
Auditing fieldwork procedures can include transaction matching, physical
inventory count, audit trail calculations, and account reconciliation as is
required by law. Analysis techniques may test random data or target
specific data, if an auditor believes an internal control process needs to be
improved.
Reporting Procedures
Internal audit reporting includes a formal report and may include a
preliminary or memo-style interim report. An interim report typically
includes sensitive or significant results the auditor thinks the board of
directors needs to know right away. The final report includes a summary of
the procedures and techniques used for completing the audit, a description
of audit findings, and suggestions for improvements to internal controls
and control procedures. The formal report is reviewed with management
and recommendations for improvement are discussed. Follow up after a
period of time is necessary to ensure the new recommendations have
been implemented and have improved operating efficiency.
What do internal auditors do?
We have a professional duty to provide an unbiased and objective view. We must be independent from the
operations we evaluate and report to the highest level in an organisation: senior managers and governors.
Typically this is the board of directors or the board of trustees, the accounting officer or the audit
committee.
To be effective, the internal audit activity must have qualified, skilled and experienced people who can work
in accordance with the Code of Ethics and the International Standards.
The nature of internal auditing, its role within the organisation and the requirements for professional
practice are contained within the International Professional Practices Framework (IPPF). The components
and the detailed content of the IPPF are available in the Global professional guidance area of the website.
