Limitations of the Internal Audit

• Internal auditors may be employees of the company they are reporting on and therefore may not wish to raise issues if they lose their jobs.
• In smaller entities, internal audit may part of the finance function. Therefore, they will have to report upon the effectiveness of financial systems they form part of and may be reluctant to say that the department has deficiencies.
• If the internal audit staff has worked in the company for a long time, they may be a familiarity threat as they will be auditing the work of long-standing friends and colleagues.
• Most internal audits are denied the needed resources to operate
• Most internal audit units are not staffed with qualified personnel

Independence could be achieved through:

• Separate reporting channels of the internal audit and financial function
• Independent review of the internal audit function
• Outsource the internal audit function to the third party
• Liaise with management for resources to operate
• Ensure qualified staff are employed to man the function

(5 points @ 2 marks each =10 marks)

Internal Audit and Corporate Governance: Established codes of corporate governance highlight the need for business to maintain good systems of internal control to manage risks the company faces. Internal audit can play a key role in assessing and monitoring control policies and procedures. The internal audit function can assist the board in other ways as well:
In effect, acting as auditors for the board
By being the experts in fields such as auditing and accounting standards in the company and assisting in implementing new standards
By liaising with external auditors, particularly, where external auditors can use internal audit work and reduce the time and therefore cost of the external audit.                                                                                                                        (5 marks)

Internal Audit and Risk Management: Internal auditors have two roles to play in relation to organisational risk management. One is to ensure the company’s risk management system operates effectively. And secondly to ensure that strategies implemented in respect of business risks operate effectively.
As a significant risk management policy is to implement internal controls, internal audit has a key role in assessing systems and testing controls.
Internal audit may assist in the development of systems, however its key role will be in monitoring the overall process and providing assurance that the systems which the departments have designed meet objectives and operate effectively.
It is important that the internal audit department retains its objectivity towards these aspects of its role, which is a reason why internal audit would generally not be involved in the assessment of risks and the design of the systems.

(5 marks)

According to the Institute of Internal Auditors, internal auditing is an independent objective assurance and consulting activity designed to add value and improve an organizations operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. From the definition it can be deduced that the two broad categories of activity or engagements that internal audit would be involved in are:

Assurance Services: These involve an objective examination of evidence for the purposes of providing an independent assessment on risk management, control and governance process for the organization. Example may include financial performance, compliance, systems security and due diligence engagement. It the activities which engage in measuring performance against identified criteria to give assurance on correct performance. It is more of historical work on looking back on what has been done and assure management that the things are moving in the right direction or not.

Consultancy Services: Advisory and related client service activities, nature and scope of which are agreed with the client and which are intended to add value and improve an organization governance, risk management and control processes without the internal auditor assuming management responsibility. Examples include counsel, advice, facilitation and training. It is more future intended than historical.

The scope of internal audit work may vary from organization to organization but may typically encompass the following:

• To determine whether the risk management control and governance processes, as designed and presented by management, are adequate and functioning in a manner to ensure that:
• Risks are appropriately identified and managed
• Interaction with various governance groups occur as needed
• Significant financial, managerial and operating information is accurate, reliable and timely
• Accounting procedures are effective
• Employees’ actions are in compliance with policies, standards, procedures and applicable laws and regulations.
• Resources are acquired economically, used efficiently and adequately protected
• Programmes, plans and objectives are achieved
• Quality and continuous improvements are fostered and are recognised and addressed appropriately
• Opportunities for improving management control and the organisations image may be identified during audits and communicated to the appropriate level of management.

(5 points for 5 marks)

Meaning – Internal audit is an independent review of operations and records. While internal check is an arrangement of duties allocated in such a manner that the work of one clerk is automatically checked by another.
ii. Object – The object of internal audit is to detect frauds and errors. But the object of internal check is to prevent frauds and errors.

iii. Staffing requirement – Internal audit is carried out by staff especially assigned for it. At times, entities engage the services of professional auditors, to carry out the internal audit, in order to save its cost. On the other hand, for internal check no special staff is required to be engaged.
iv. Timing – Internal audit is a post-mortem analysis and starts after the completion of recording of transactions. But internal check is simultaneous i.e., starts operating the moment a transaction is finalized and continues till all its aspects are recorded.
v. Submission of report – Internal auditor submits his report to the management. While under the system of internal check, the statement relating to the transactions for the whole day is to be submitted by the clerk to departmental heads.

 The role of internal audit
The internal audit department has a two-fold role in relation to risk management.

• It monitors the company’s overall risk management policy to ensure it operates effectively
• It monitors the strategies implemented to ensure that they continue to operate effectively
  As a significant risk management policy in companies is to implement internal controls, internal audit has a key role in assessing systems and testing controls.
• Internal audit may assist in the development of systems. However, its key role will be in monitoring the overall process and in providing assurance that the systems which the departments have designed meet objectives and operate effectively.
• It is important that the internal audit department retains its objectivity towards these aspects of its role, which is another reason why internal audit would not be involved in the assessment of risks and the design of the system.

• To review the control system and to identify weaknesses, breakdown and to report to management with recommendations.
• To design checks to reveal the existence of frauds or to prevent frauds.
• To rationalize accounting policies within a group and to design and implement new accounting systems.
• To conduct management efficiency audits and post implementation audits of capital projects.
• To describe key risks facing the business activities within scope of audit and to identify control procedures used to ensure each key risk is properly controlled and monitored.
• To develop and execute risk based sampling and testing approach to determine whether most important controls are operating as intended.
• To report issues/make recommendations/negotiate action plans with Management to address issues.
• To follow up on reported findings periodically
                                                                                                                                                                                 (Any 3 points)

***END

Criteria to be considered when assessing whether to place reliance on internal audit work include the following:
Objectivity of function
The external auditor should consider whom the internal auditors report to and whether they are subject to any conflicting responsibilities, constraints or restrictions. This will affect the capability of the internal auditors to communicate significant matters openly.
Scope of function
The external auditors should consider the extent and nature of assignments performed by the internal auditors and the action taken by management as a result of internal audit reports.
Technical Competence
The external auditors should consider whether the internal auditors have adequate technical training and proficiency.
Due professional care
The external auditors should consider whether the work of internal audit is properly planned, supervised, reviewed and documented.

Prevention, detection and reporting of fraud and error
External Auditors
Prevention and detection
The external auditors are bound by the requirements of ISA 240. This requires that auditors recognize that fraud and error may materially affect the financial statements and design procedures to ensure that the risk is minimized. The auditors have no specific requirement to prevent or detect fraud. However, they must maintain professional scepticism throughout the audit, recognizing that circumstances may exist that cause the financial statements to be materially misstated.
By conducting the audit in accordance with ISAs the auditor obtains reasonable assurance that the financial statements are free from material misstatement caused by fraud or error. However, due to the nature of fraud the risk of not detecting fraud is higher than the risk of not detecting error.
Reporting
ISA 240 also sets out the requirements in relation to reporting fraud. If auditors suspect or detect a fraud, they must report it on a timely basis to the appropriate level of management.
If management are implicated the matter must be communicated to those charged with governance, unless the fraud necessitates immediate reporting to a third party.
The matter should only be referred to in the audit report if the opinion is modified on those grounds. It may also be that the matter is one which needs reporting to a relevant authority in the public interest. If the auditors feel that this is so, they should seek legal advice before taking any action, and request that the entity reports itself. If the directors refuse to make any disclosure in these circumstances, the auditors should make the disclosure themselves.
Internal auditors
Prevention and detection
It is likely that the internal auditors will have a role both in the prevention and detection of fraud. Indirectly, they play a role in their involvement with the internal controls of a business, which are set up to limit risks to the company, one of which is fraud. Directly, they may be engaged by the directors to carry out test when a fraud is suspected, or routinely to discourage such activity.
However, if a serious fraud was suspected, a company might bring in external experts, such as forensic accountants or the police.
Reporting
If internal auditors discovered issues which made them suspect fraud, they would report it immediately to their superiors, who would report to those charged with governance. In the event that an internal auditor suspected top level fraud, he might make disclosure to the relevant authority in the public interest.