Recent developments in corporate governance focus on the importance of an organisation’s ability to identify and manage risk. It is the responsibility of management to identify and respond to risk, but as part of the organisation’s internal control, internal audit can help provide assurance that risks have been managed properly. Internal auditors may also be involved in providing consultancy services. However, a balance needs to be struck between a wish to increase the level of responsibility given to internal auditors, in order to benefit from their skills, and the danger that involvement which amounts to management involvement would compromise the independence of the internal auditors.
Required:
i) Discuss the nature of consultancy projects in internal auditing and the dangers in internal auditing becoming too involved in consultancy projects. (6 marks)
View Solution
Consultancy projects are one-off projects designed to address adhoc issues. It is playing an increasing role in the work of internal audit. Taking on this projects enables internal auditors to extend their skills and the organization to draw on the knowledge of internal auditors. However there are dangers in becoming too involved in consultancy projects.
The resultant dangers include:
- Internal audit staff may be diverted to consultancy projects, and the regular audit reviews may be inadequately resourced.
- By taking on consultancy projects and suggesting solutions, internal audit could be getting too much involved in operational concerns. There is a serious lack of independence if internal audit has to review solutions that internal audit staff have provided.
- Management is relying on internal audit to solve problems instead of having operational staff and managers solve or preferably prevent them. Certain steps can be taken in order to avoid these problems.
ii) Recommend FOUR actions to be taken to minimize the danger posed by internal audit becoming too involved in consultancy projects. (4 marks)
View Solution
- The terms of reference of the internal audit department should draw a clear distinction between regular audit services and consultancy work.
- Enough resources for regular audit services should be guaranteed. Consultancy work should be separately resourced and additional resources obtained if necessary.
- If managers are concerned about improving controls, reviewing these improvements can legitimately be included in the work of internal audit.
- Regular audit reviews and consultancy projects can be undertaken by different staff.
- If consultancy work identifies serious control deficiencies, these must be incorporated into internal audit reviews.