Chapter 5

Internal audit
• Internal audit and corporate governance
• Distinction between internal and external audit
• Scope of the internal audit
function
• Internal audit assignments
• Internal audit reports
• Outsourcing the internal audit function

00
M
O
NT
H

00
00
BPP LEARNING MEDIA

Syllabus learning outcomes 1

• Discuss the factors to be taken into account when assessing
the need for internal audit.
• Discuss the elements of best practice in the structure and
operations of internal audit with reference to appropriate
international codes of corporate governance.
• Compare and contrast the role of external and internal audit.
• Discuss the scope of internal audit and the limitations of the
internal audit function.
• Explain outsourcing and the advantages and
disadvantages of outsourcing the internal audit
 function.
• Discuss the nature and purpose of internal audit assignments
including value for money, IT, financial, regulatory
compliance, fraud investigations and customer experience.
Thảo luận về các yếu tố cần tính đến khi đánh giá nhu cầu
kiểm toán nội bộ.
• Thảo luận về các yếu tố của thông lệ tốt nhất trong cơ cấu và
hoạt động của kiểm toán nội bộ có tham khảo các quy tắc
quản trị doanh nghiệp quốc tế phù hợp.
• So sánh và đối chiếu vai trò của kiểm toán bên ngoài và kiểm
toán nội bộ.
• Thảo luận về phạm vi kiểm toán nội bộ và những hạn chế của
chức năng kiểm toán nội bộ.
• Giải thích việc thuê ngoài và những ưu điểm và nhược điểm
của việc thuê ngoài chức năng kiểm toán nội bộ.
• Thảo luận về bản chất và mục đích của nhiệm vụ kiểm toán
nội bộ bao gồm giá trị đồng tiền, CNTT, tài chính, tuân thủ
quy định, điều tra gian lận và trải nghiệm của khách hàng.
BPP LEARNING MEDIA

Syllabus learning outcomes 2

• Discuss the nature and purpose of operational
internal audit assignments.
• Describe and explain the format and content of internal audit
review reports and make appropriate recommendations to
management and those charged with governance.
• Discuss the responsibilities of internal and external
auditors for the prevention and detection of fraud
and error
Thảo luận về bản chất và mục đích của nhiệm vụ kiểm
toán nội bộ hoạt động.
• Mô tả và giải thích hình thức và nội dung của các báo
cáo soát xét kiểm toán nội bộ và đưa ra các khuyến
nghị phù hợp cho ban giám đốc và những người
chịu trách nhiệm quản trị.
• Thảo luận về trách nhiệm của kiểm toán viên nội bộ
 và bên ngoài đối với việc ngăn ngừa và phát hiện
gian lận và sai sót.

BPP LEARNING MEDIA

Internal
BPP LEARNING MEDIA

Internal audit and corporate governance 1

Internal audit is an appraisal or monitoring activity
established by management and directors, for the review of
internal control as a service to the entity. It functions by
examining, evaluating and reporting to management and the
directors on the adequacy and effectiveness of internal
control.
Internal audit is a key element of effective corporate governance.
Remember we earlier highlighted the need for companies to
maintain good systems of internal control in order to manage
 the risks they face.
Internal audit can play a key role in assessing and monitoring
internal control policies and procedures.

BPP LEARNING MEDIA

Internal audit and corporate governance 2

An internal audit function can also assist the board by:
• Acting as auditors for board reports not otherwise audited
by the external auditors
• Being experts within the company in fields such as auditing
and accounting standards, and assisting in the
implementation of new standards
• Liaising with external auditors, particularly where external
 auditors can use the work of internal audit and thereby
reduce the length and cost of the external audit

BPP LEARNING MEDIA

Internal audit and corporate governance 4

IIA definition of internal auditing
“An independent, objective assurance and consulting activity
designed to add value and improve an organization's
operations…(that) helps an organization accomplish its
objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management,
control, and governance processes.”
BPP LEARNING MEDIA

Distinction between internal and external audit 1

BPP LEARNING MEDIA

Distinction between internal and external audit 2

• Internal auditors are not regulated in the same way as
external auditors.
• There are no legal requirements associated with becoming an
internal auditor.
• Scope and nature of work is usually set by company policy,
rather than any external guidelines – although the
Institute of Internal Auditors does issue Standards for the
Professional Practice of Internal Auditing.
• Internal auditors are not required to be members of a
professional body, although many are.
BPP LEARNING MEDIA

Question: 2014 Specimen Paper (Sec B,

Q1b)
Required:
(b) Distinguish between internal and external audit. (4 marks)
BPP LEARNING MEDIA

Approach: 2014 Specimen Paper (Sec B,

Q1b)
• This is a very simple requirement which affords you four
easy marks.
• Note the mark allocation – four marks means that you
need to discuss four differences between internal and
external auditors.
• The best way to present your answer would be in a tabular format.
BPP LEARNING MEDIA

Answer: 2014 Specimen Paper (Sec B, Q1b)

Purpose Scope Relationship to company Reporting

Internal audit To enable Work is limited to Independent of Auditor's

auditors to the financial the company and report
express an statements and its management. addressed to
opinion on the underlying Appointed by the shareholders and
truth and fairness financial records shareholders is publicly
of the financial Often employees Reports to available to all
statements of the senior
Work is wide organisation, management and
ranging and although audit
External audit relates to the sometimes committee
To add value and operations of the outsourced and reports are
improve an organisation internal to the
organisation's company only
operations

BPP LEARNING MEDIA

 Question: 2016 Specimen Paper (Sec A, Q4)
[Please refer to slide 194 for the question scenario]
Following management’s request for information regarding the
different roles of internal and external audit, you have collated
a list of key characteristics.
1) Appointed by audit committee
2) Reports are publicly available to shareholders
3) Review efficiency and effectiveness of operations to
improve operations
4) Express an opinion on the truth and fairness of the
financial statements

BPP LEARNING MEDIA

 Question: 2016 Specimen Paper (Sec A, Q4)
Which of the following options correctly allocates the
above statements to the relevant auditor?
External Internal
A 2, 3 and 4 1 only
B 1 and 4 2 and 3
C 2 and 4 1 and 3
D 2 only 1, 3 and 4

BPP LEARNING MEDIA

 Answer: 2016 Specimen exam (Sec
A, Q4) C
Internal audit are appointed by the audit committee (external
audit usually by the shareholders) and it is the role of internal
audit to review the effectiveness and efficiency of internal
controls to improve operations. External audit looks at the
operating effectiveness of internal controls on which they
may rely for audit evidence and a by product may be to
comment on any deficiencies they have found but this is not
a key function of the role.
Therefore statements 1 and 3 relate to internal audit.
The external auditor’s report is publicly available to the
shareholders of the company (internal audit reports are
addressed to management/TCWG) and the external auditor
provides an opinion on the truth and fairness of the financial
statements.
Therefore statements 2 and 4 relate to
external audit. C is therefore the correct
answer.
BPP LEARNING MEDIA

Scope of the internal audit function 1

Key roles of internal audit
• To ensure the company's risk management system
operates effectively
• To ensure that strategies implemented in respect of
business risks operate effectively
BPP LEARNING MEDIA

Scope of the internal audit function 2

What is business risk?
Business risk is a risk resulting from significant conditions,
events, circumstances, actions or inactions that could adversely
affect an entity's ability to achieve its objectives and execute its
strategies, or from the setting of inappropriate objectives and
strategies.
BPP LEARNING MEDIA

Scope of the internal audit function 3

• Business risk can never be eliminated, but it must be managed
by the company.
• Designing and operating internal control systems is a key part
of a company's risk management strategy. Internal controls
can help to mitigate the business risks faced by a
company.
• In turn, internal audit has a key role in monitoring and
assessing internal controls and systems established by
management, to ensure they meet their objectives and
operate effectively.
• Therefore, internal audit has a key role in the
management of business risk.
BPP LEARNING MEDIA

Scope of the internal audit function 4

The three elements of business risk
1. Financial risk: risks arising from the financial activities or
financial consequences of an operation
2. Operational risk: risks arising from the entity's operations 3.
Compliance risk: risks arising from non-compliance with
regulations
BPP LEARNING MEDIA

Scope of the internal audit function 5

Examples of business risk factors
• Emergence of new competitors
• Foreign exchange rates
• Laws and regulations
• Raw material price increases
• Loss of major customer or supplier
• Fall in demand/economic downturn
• Technological obsolescence
• Political unrest
• Natural disasters
Can you think of any others? Can you classify them into
the three elements of business risk (financial,
 operational, compliance)?

BPP LEARNING MEDIA

Scope of the internal audit function 6

Responsibility for fraud and error
• Fraud is a key business risk faced by companies.
• But who is responsible for preventing and detecting fraud?
• It isn't the responsibility of the external auditors to prevent and
detect fraud!
• It is the responsibility of the directors.
• Internal audit may therefore have a role in the prevention and
detection of fraud (eg by assessing the adequacy and
effectiveness of control systems).
BPP LEARNING MEDIA

Scope of the internal audit function 7

There are limitations of the internal audit function:
• Internal auditors are employed by the organisation, so have
less independence and objectivity (eg will they report an
error if doing so might threaten their continued employment
in the company?)
• There may not be a dual reporting relationship (ie
management and those charged with governance) in place.
• No professional qualifications required, so there may be
limitations to their knowledge and technical expertise.
BPP LEARNING MEDIA

Real World Example: WorldCom

From 1999 to 2002, key staff at WorldCom, including the
CEO and CFO, used fraudulent accounting methods to
hide WorldCom's declining earnings in order to maintain its
share price.
The fraud was discovered by a small group of internal
auditors at WorldCom, who secretly uncovered $3.8
billion worth of fraud.
The fraud was reported to the audit committee with
serious consequences for both those involved and
the company … .
BPP LEARNING MEDIA

Internal audit assignments 1

• Value for money (VFM) audits
• Examine economy, efficiency and effectiveness of
activities and processes.
• VFM audits carried out mainly in not-for-profit organisations
such as charities, local authorities, hospitals etc.
• VFM can often only be judged by comparison: how do present
methods of operation, or uses of resources, compare to
alternatives?

We look at not-for-profit organisations in more detail in Chapter 17.

BPP LEARNING MEDIA

Internal audit assignments 2

Economy
Attaining the appropriate quantity and quality of physical,
human and financial resources (inputs) at lowest cost.

Note: Economy does not simply mean obtaining the lowest cost
though. The requirement to attain appropriate quantity and
quality remains important.
BPP LEARNING MEDIA

Internal audit assignments 3

Efficiency
The relationship between goods or services produced (outputs)
and the resources used to produce them.
(Eg, an efficient operation produces the maximum output possible
for any given set of resource inputs.)
BPP LEARNING MEDIA

Internal audit assignments 4

Effectiveness
Concerned with how well an activity is achieving its policy
objectives or other intended effects.
BPP LEARNING MEDIA

Internal audit assignments 5

Problems with VFM audits
• Measuring outputs and measuring efficiency – In not-for-
profit (NFP) organisations, output often doesn't have a
market value which makes it difficult to measure efficiency;
eg is a fire brigade which puts out one big fire more or less
efficient that one which puts out three small fires?
• Defining objectives – How are objectives defined in
NFP organisations?
• Sacrifice of quality – Economy and efficiency could be
achieved by sacrificing quality.
BPP LEARNING MEDIA

Internal audit assignments 6

Problems with VFM audits (continued)
• Over-emphasis on cost control – Focus on short term cost
control rather than achieving longer term benefits and value.
• Measuring effectiveness – eg as hospitals are more successful
at treating illnesses life expectancy increases. But this means
population may also increase, leading to over-crowding in
hospitals and other services.
BPP LEARNING MEDIA

Real World Example: National Audit Office

In the UK, the National Audit Office scrutinises public
spending on behalf of the government. Part of its remit is
to act as the external auditor of the financial statements of
central government departments.
Its other objective is to carry out value for money audits to
help public service managers improve performance and
delivery of services.
One of its latest VFM reports is 'Emergency admissions to
hospital: managing the demand' which finds that many
emergency admissions are avoidable and sometimes
patients stay in hospital longer than necessary.
www.nao.org.uk
BPP LEARNING MEDIA

Internal audit assignments 7

Information technology (IT) audits
• Tests of controls of the computer systems

Will most likely need have an IT specialist in the

internal audit team to undertake an audit of IT system
controls.
BPP LEARNING MEDIA

Internal audit assignments 8

Financial audits
• The importance of controls in preventing financial reporting
errors mean it is necessary to review certain areas
regularly to ensure relevant controls remain in place.
• Internal audit functions often adopt a cyclical approach to
ensure key areas are reviewed regularly.
BPP LEARNING MEDIA

Internal audit assignments 9

Financial audits
BPP LEARNING MEDIA

Internal audit assignments 10

Regulatory compliance audits
• Companies will always have to comply with certain
regulations and laws, some more than others, depending
on the type of business being carried out.
• Internal auditors might be used to review compliance with these
laws and regulations.
• Examples include tax law, health and safety legislation,
employment law.
BPP LEARNING MEDIA

Internal audit assignments 11

Fraud investigations
• Internal auditors may be asked to carry out special
investigation where instances of fraud are suspected.
• They may also be asked to review and test controls to
prevent or detect fraud.
• The fraudulent financial reporting at WorldCom was
famously uncovered by the company's internal
auditors.
BPP LEARNING MEDIA

Internal audit assignments 12

Customer experience audits
• Internal auditors may be asked to assess the level of
customer service.
• How?
• Phoning the company or pretending to be customers!
BPP LEARNING MEDIA

Internal audit assignments 13

Operational (or management or efficiency) audits
• Audits of the operational processes of the
organisation (eg procurement)
• Objective is the monitoring of management's performance,
ensuring company policy is adhered to.
• Verify whether policies are adequate. If not, advise on improvement.
• Confirm policies work effectively, by observing them in operation
or by testing them.
BPP LEARNING MEDIA

Question: 2014 Specimen Paper (Sec A,

Q3)
Fellaini Co operate a large department store and have a large
internal audit department in place. The management of
Fellaini Co are keen to increase the range of assignments that
internal audit undertake.
Which of the following assignments could the internal
audit department of Fellaini Co be asked to perform by
management?
A Internal audit department members could undertake
'mystery shopper reviews, where they enter the store as a
customer, purchase goods and rate the overall shopping
experience.
B Internal audit could be asked to assist the external auditors
by requesting bank confirmation letters.
C Internal audit could be asked to implement a new
 payroll package for the payroll department.
D Internal audit could be asked to assist the finance
department with the preparation of the year end financial
statements.

BPP LEARNING MEDIA

Answer: 2014 Specimen Paper (Sec A, Q3)

A Internal audit department members could undertake
'mystery shopper reviews, where they enter the store as a
customer, purchase goods and rate the overall shopping
experience.

Remember that internal auditors provide a monitoring role within

an organisation. The other choices in the question are incorrect
because in A, only the external auditors would prepare the bank
confirmation letters, in B and C, the internal auditors would not
be providing a monitoring role if they assisted in implementing a
new payroll package or assisted in the preparation of the year
end financial statements.
BPP LEARNING MEDIA

Question: December 2010 Question 1d

Required:
Describe additional assignments that the internal audit
department of Greystone Co could be asked to perform by
those charged with governance. (6 marks)

[Please refer to the December 2010 paper for the full scenario.]
BPP LEARNING MEDIA

Approach: December 2010 Question 1d

• This question is worth 6 marks so you have almost 12
minutes to answer it.
• Note the requirement is 'Describe…' so a list will not be
enough to score full marks.
• Use the scenario! Do not produce an answer of every
conceivable internal audit assignment possible. Your
answer needs to be tailored to the organisation described
in the question.
• Assume 1 mark per well described assignment.
BPP LEARNING MEDIA

Answer: December 2010 Question 1d

• Review of controls over cash as cash is going to be a
high risk area for a retailer.
• Operational audits such as procurement audit as the
company purchases large amounts of items from around
the world.
• Payroll audit as the company is likely to have a large
number of employees.
• Fraud investigations as there is a higher risk of
misappropriation of inventory and cash in a clothing retailer
such as Greystone.
• IT audit over the computer systems used by Greystone,
which are likely to be complex as there are many
branches around the world.
• Compliance with laws and regulations as the company
operates worldwide and each country will have different
 laws and regulations in place.

BPP LEARNING MEDIA

Internal audit reports 1

• Internal auditors are employees of the organisation they audit
and so reports will be addressed to management and those
charged with governance.
• Reports can take any format as there are no formal
reporting requirements.
• Reports are for internal use only, although they may be
shared with external auditors.
• Reports will first be in a draft format and discussed at an exit
meeting, after which they will be finalised.
BPP LEARNING MEDIA

Internal audit reports 2

Although the content and format of internal reports will
vary, as a minimum they should describe purpose, scope
and results of the engagement.
• Purpose – objective of the audit engagement should be
clearly stated. Findings should be linked back to the
objective.
• Scope – identify which activities are audited, and highlight any
which are excluded from the audit.
• Results – This should include: observations; conclusions;
opinions (eg of management); recommendations; action
plans.
BPP LEARNING MEDIA

Outsourcing the internal audit function 1

What is outsourcing?
Outsourcing is the process of purchasing key functions from an
outside source eg many of the large accountancy firms offer
internal audit services, so a company could buy in internal audit
services as required rather than maintaining its own internal
audit department.
BPP LEARNING MEDIA

Outsourcing the internal audit function 2

Advantages of outsourcing
• Service provider has high calibre staff
• Different specialist skills
• Immediate internal audit department
• Associated costs (training, recruitment etc)
eliminated • Service contract can be for
appropriate time scale • Team of staff can be
provided if required
• Can be used on a short-term basis
BPP LEARNING MEDIA

Outsourcing the internal audit function 3

Disadvantages of outsourcing
• Independence and objectivity issues (self-review, self-
interest, familiarity threats if using the same firm to
provide internal and external audit services
• Cost may be too high
• Company staff may oppose outsourcing if it results in
redundancies of existing staff
• High staff turnover
• Outsourced staff may have limited knowledge of
client • In-house skills lost
BPP LEARNING MEDIA

Outsourcing the internal audit function 4

Managing an outsourced department – controls to implement
• Set performance measures (eg in terms of areas of the
business reviewed)
• Ensure appropriate audit methodology is
maintained • Review working papers on a
sample basis
• Agree work plans in advance
• If firm also provides external audit, ensure it has appropriate
safeguards in place to ensure independence and objectivity
are not impaired
BPP LEARNING MEDIA

Tackling the exam 1

• Internal audit has come up in every exam sitting under the
current F8 examining team except one.
• It could be tested in either section A or section B as we have
seen in the Specimen Paper.
• In a scenario question, it could be tested alongside
professional ethics or as part of a question on audit
evidence.
BPP LEARNING MEDIA

Tackling the exam 2

• It is important that you understand the remit of internal
audit and how this differs from that of external audit.
• If a scenario-based question comes up, make sure your
answer is relevant to the circumstances in the question –
use the information provided to your advantage.
BPP LEARNING MEDIA

Question: June 2014 (Sec B Question 4)

Saxophone Enterprises Co (Saxophone) has been trading for
15 years selling insurance and has recently become a listed
company. In accordance with corporate governance
principles, Saxophone maintains a small internal audit
department. The directors feel that the team needs to
increase in size and specialist skills are required, but they are
unsure whether to recruit more internal auditors, or to
outsource the whole function to their external auditors, Cello &
Co.
Required
Explain the advantages and disadvantages for each of
Saxophone Enterprises Co AND Cello & Co of outsourcing
the internal audit department. (10 marks)
Note: The total marks will be split as follows:
Saxophone Enterprises Co (8 marks)
 Cello & Co (2 marks)

BPP LEARNING MEDIA

Approach: June 2014 (Sec B Question 4)

• This question contains two separate requirements on
internal audit, totalling ten marks.
• It is important to note that 8 marks have been allocated for
discussing Saxophone, and only 2 marks have been
allocated for discussing Cello. This gives you a hint for
how long you should spend on each part of the question.
• It is typical of the recent exam approach: testing a topic
would usually be examined in a knowledge-based way,
but as part of an applied scenario
• Since a scenario has been given, make sure your answers
make reference to the scenario whenever possible.
BPP LEARNING MEDIA

Answer: June 2014 (Sec B Question 4)

Saxophone
Advantages
Staffing: Saxophone Enterprises Co (Saxophone) wishes to
expand its internal audit department in terms of size and
specialist skills. If they outsource, then there will be no need
to spend money in recruiting further staff as Cello & Co
(Cello) will provide the staff members.
Immediate solution: As the current internal audit department
is small, outsourcing can provide the number of staff needed
straight away.
Skills and experience: Cello is likely to have a large pool
of staff available to provide the internal audit service to
Saxophone.
In addition, the audit firm is likely to have staff with
specialist skills already available.
BPP LEARNING MEDIA

Answer: June 2014 (Sec B Question 4)

Saxophone
Advantages (cont.)
Cost savings: Outsourcing can be an efficient means to
control the costs of internal audit as any associated costs
such as training will be eliminated as Cello will train its own
employees. In addition, the costs for the internal audit service
will be agreed in advance. This will ensure that Saxophone
can budget accordingly.
Flexibility: If the internal audit department is outsourced,
Saxophone will have total flexibility in its internal audit
service. Staff can be requested from Cello to suit the
company’s workloads and requirements. This will ensure
that, when required, extra staff is readily available for as
long or short a period as needed.
BPP LEARNING MEDIA

Answer: June 2014 (Sec B Question 4)

Saxophone
Disadvantages
Existing internal audit department: Saxophone has an
existing internal audit department; if they cannot be
redeployed elsewhere in the company, then they may need
to be made redundant and this could be costly for
Saxophone. Staff may oppose the outsourcing if it results in
redundancies.
Increased costs: As well as the cost of potential
redundancies, the internal audit fee charged by Cello may
over a period of time increase, proving to be very
expensive.
BPP LEARNING MEDIA

Answer: June 2014 (Sec B Question 4)

Saxophone
Disadvantages (cont.)
Knowledge of company: Cello will allocate available staff
members to work on the internal audit assignment; this may
mean that each visit the staff members are different and
hence they may not fully understand the systems of
Saxophone. This will decrease the quality of the services
provided and increase the time spent by Saxophone’s
employees in explaining the system to the auditors.
Loss of in-house skills: If the current internal audit team is not
deployed elsewhere in the company, valuable internal audit
knowledge and experience may be lost. If Saxophone then
decided at a future date to bring the service back in-house,
this might prove to be too difficult.
BPP LEARNING MEDIA

Answer: June 2014 (Sec B Question 4)

Saxophone
Disadvantages (cont.)
Confidentiality: Knowledge of company systems and
confidential data will be available to Cello. Although the
engagement letter would provide confidentiality clauses, this
may not stop breaches of confidentiality.
Control: Saxophone currently has more control over the
activities of its internal audit department; however, once
outsourced, it will need to discuss areas of work and
timings well in advance with Cello.
BPP LEARNING MEDIA

Answer: June 2014 (Sec B Question 4)

Cello
Advantages
Additional fees for Cello: The audit firm will benefit from the
internal audit service being outsourced as this will generate
additional fee income. However, the firm will need to monitor
the fees to ensure that they do not represent too high a
percentage of their total fee income. As a public interest
company, fee income should not represent more than 15% of
gross practice income for two consecutive years.
Disadvantages
Independence: If Cello provides both external audit and
internal audit services, there may be a self-review threat
especially where the internal audit work is relied upon by the
external auditor team. The firm would need to take steps to
ensure that separate teams are put in place as well as
 additional safeguards.

BPP LEARNING MEDIA

Question: June 2013 Question 4b, c, d

Bush-Baby Hotels Co operates a chain of 18 hotels located
across the country. Each hotel has bedrooms, a restaurant
and leisure club facilities. Most visitors to the restaurant and
leisure club are hotel guests; however, these facilities are
open to the public as well. Hotel guests generally charge any
costs to their room but other visitors must make payment
directly to the hotel staff.
During the year, senior management noticed an increased
level of cash discrepancies and inventory discrepancies,
and they suspect that some employees have been stealing
cash and goods from the
hotels. They are keen to prevent this from reoccurring and
are considering establishing an internal audit department to
undertake a fraud investigation.
BPP LEARNING MEDIA

Question: June 2013 Question 4b, c, d

(cont'd)
Required:
(b) Explain how the new internal audit department of Bush-
Baby Hotels Co could assist the directors in preventing and
detecting fraud and error. (3 marks)
(c) Describe the limitations of Bush-Baby Hotels Co
establishing and maintaining an internal audit department. (2
marks)

The directors would like the internal audit department to

have as broad a role as possible, as this will make the
decision to recruit an internal audit department more cost
effective.
Required:
 (d) Describe additional functions, other than fraud
investigations, the directors of Bush-Baby Hotels Co could
ask the internal audit department to undertake. (5 marks)

BPP LEARNING MEDIA

Approach: June 2013 Question 4b, c, d

• This question contains three separate requirements on
internal audit, totalling ten marks.
• Each requirement relates to the company in the question
(Bush Baby Hotels Co) so your answers need to be
relevant to this organisation.
• Use the information provided to you to help you. For
example, you are told that there are cash and inventory
discrepancies, so in part (b), on the prevention and
detection of fraud and error, make sure your answer uses
this information.
BPP LEARNING MEDIA

Approach: June 2013 Question 4b, c, d

(cont'd)
• Parts (b) and (c) are worth only three and two marks
respectively so your answers need to be succinct and
consist of the correct number of well-explained points to
score full marks.
• Part (d) is worth five marks so assume there is one mark per
function described. Note also the requirement is 'Describe
…' so a list will not suffice here.
BPP LEARNING MEDIA

Answer: June 2013 Question 4b, c, d

(b) The internal audit department could assist in preventing
and detecting fraud and error by acting as a deterrent in
the first instance. They could first undertake a risk
assessment to identify the risk areas over cash and
inventory. They could then review the existing controls in
place over inventory and cash handling and recommend
improvements to those controls if deficiencies are
identified. They also need to test that the controls are
working by compliance testing. All findings from their work
would be reported in writing to senior management for
review and further action if necessary.
BPP LEARNING MEDIA

Answer: June 2013 Question 4b, c, d

(cont'd)
(c) Bush-Baby Hotels have not had an internal audit
department before so employees may not like the idea
of being observed in their work and being reported on.
Setting up the department will cost a considerable amount
and as there are 18 hotels in the company, the directors
need to ensure they recruit an adequate number of
internal audit staff to be able to achieve coverage across
the company.
Unless the department will be set up from existing
employees, it is unlikely that the staff recruited will have
the knowledge and experience required to audit this type
of industry. Furthermore, internal auditors are not required
to be professionally qualified so staff may not be
sufficiently knowledgeable in the industry or the work of
 internal audit initially.

BPP LEARNING MEDIA

Answer: June 2013 Question 4b, c, d

(cont'd)
Internal auditors can never be completely independent, unlike
external auditors, as they are employees of the company.
Independence is therefore impaired, especially if senior
management are dominant. Internal auditors may be
unwilling to report serious findings to senior management for
fear of losing their jobs.
Internal auditors should report to both senior management
and those charged with governance (dual reporting) but if
this is not the case, management could unduly influence the
internal audit plan, scope and reporting responsibilities.
BPP LEARNING MEDIA

Answer: June 2013 Question 4b, c, d

(cont'd)
(d) The internal audit team could undertake value for money
reviews, looking at the economy, effectiveness and
efficiency of activities and processes within the company.
The internal auditors could perform IT audits, ie
performing tests of controls on the computer systems of
the company.
The internal auditors could carry out financial audits,
using substantive procedures and tests of controls in
different areas such as cash, inventory and
purchasing for example.
The department could also do operational audits,
looking at the operational processes in place.
The internal auditors could also examine compliance
with laws and regulations. As the company operates in
 the hotel industry, this may be a key area to focus on.
Finally, the internal auditors could carry out customer service

reviews, analysing the results of customer service surveys.

BPP LEARNING MEDIA

Chapter 6
Risk assessment
• Introduction to risk
• Materiality
• Understanding the entity and its environment
• Assessing the risks of material misstatement
• Responding to the risk
assessment
• Fraud, law and regulations
• Documentation of risk
assessment
00
M
O
NT
H

00
00
BPP LEARNING MEDIA

Syllabus learning outcomes 1

• Identify the overall objectives of the auditor and the need to
conduct an audit in accordance with ISAs.
• Identify the need to plan and perform audits with an
attitude of professional scepticism, and to exercise
professional judgement.
• Explain the components of audit risk.
• Explain the audit risks in the financial statements and
explain the auditor's response to each risk.
BPP LEARNING MEDIA

Syllabus learning outcomes 2

• Define and explain the concepts of materiality and
performance materiality.
• Explain and calculate materiality levels from financial information.
• Explain how auditors obtain an initial understanding of the
entity and its environment.
• Describe and explain the nature, and purpose, of
analytical procedures in planning.
• Compute and interpret key ratios used in analytical procedures.
BPP LEARNING MEDIA

Syllabus learning outcomes 3

• Discuss the effect of fraud and misstatements on the audit
strategy and extent of audit work.
• Discuss the responsibilities of internal and external auditors
for the prevention and detection of fraud and error.
• Explain the auditor's responsibility to consider laws and regulations.
BPP LEARNING MEDIA

Overview
BPP LEARNING MEDIA

Chronology of an audit
BPP LEARNING MEDIA

Introduction to risk 1
Let's remind ourselves what the overall objective of the external
auditor is:
'To obtain reasonable assurance about whether the financial
statements as a whole are free from material misstatement,
 whether due to fraud or error, thereby enabling the auditor to
express an opinion on whether the financial statements are
prepared, in all material respects, in accordance
with an applicable financial reporting framework; and to report
on the financial statements, and communicate as required by
the ISAs, in accordance with the auditor's findings.'

ISA 200 Overall objectives of the auditor and the conduct of an

audit in accordance with International Standards on Auditing

BPP LEARNING MEDIA

Introduction to risk 2
Professional scepticism and judgement
• In order to achieve the overall objectives of an external
audit, the auditor needs to plan and perform the audit
with professional scepticism and to apply professional
 judgement.
• Professional scepticism – an attitude that includes a
questioning mind, being alert to conditions which might
indicate possible misstatement due to error or fraud, and a
critical assessment of audit evidence.
• Do pieces of evidence contradict other evidence received?
• Is information received which brings into question the
reliability of audit evidence already obtained?

BPP LEARNING MEDIA

Introduction to risk 3
Professional scepticism and judgement (continued)
• Professional judgement – the application of relevant training,
knowledge and experience in making informed decisions
 about the courses of action that are appropriate in the
circumstance of the audit engagement.
The following require professional judgement:
• Determining materiality and audit risk
• Determining nature, timing and extent of audit procedures
• Evaluating whether sufficient appropriate audit evidence has
been obtained
• Drawing conclusions based on the audit evidence obtained
• Evaluating whether management have applied an applicable
financial reporting framework

BPP LEARNING MEDIA

Introduction to risk 4
• In order to obtain assurance that financial statements are free
from material misstatements, the auditor needs to consider
how and where misstatements are most likely to arise.
 • The auditor carries out a risk assessment in order to
ensure the areas which are most susceptible to material
misstatement are adequately investigated during the
audit.
• We need to understand what risk is in the context of the
financial statements…
• It is therefore very important that you understand the
difference between business risk and audit risk.

BPP LEARNING MEDIA

Introduction to risk 5

Business risk is the risk inherent to the entity in its

operations (at all levels of the business).
 Audit risk is the risk that the auditor expresses an
inappropriate audit opinion when the financial statements are
materially misstated.
ISAs required auditors to follow a risk-based approach.
Audit risk has three components and is illustrated diagramatically
on the next slide.

BPP LEARNING MEDIA

Introduction to risk 6 THE

AUDIT RISK
MODEL
 AR = IR x CR x DR
Audit Risk Control risk
Inherent Risk Detection Risk

Sampling Risk Non-sampling Risk

BPP LEARNING MEDIA

Introduction to risk 7
• Inherent risk is the susceptibility of an assertion to a
misstatement that could be material individually or when
aggregated with other misstatements, assuming there were
 no related controls.
• Inherent risk is affected by the nature of the entity; for
example, the industry it is in; the regulations it falls under;
and the nature of the strategies it adopts.
• Examples of factors which could affect
inherent risk: — Integrity of management
— Inventory valuation in a jewellery business
— High cash business such as retail
— Technological obsolescence

BPP LEARNING MEDIA

Introduction to risk 8
• Control risk is the risk that a material misstatement that could
occur in an assertion and that could be material, individually or
 when aggregated with other misstatements, will not be
prevented or detected and corrected on timely basis by the
entity's internal control.
• Examples:
Monthly bank reconciliations not reviewed by a
manager Purchase invoices not matched to
goods received notes References not followed
up for new employees
Computer passwords not required to be changed
regularly • We will look at controls in more detail in
Chapters 9 and 10.

BPP LEARNING MEDIA