Chapter 5

Internal audit

Topics to be covered
1)
2)
3)
4)
5)
6)
7)
8)

Internal audit and corporate governance codes

Assessing the need for internal audit
Scope and limitations of internal audit
Nature and purpose of Outsourcing internal audit
internal audit assignments
Comparison of internal and external audit
Nature and purpose of operational internal audit
assignments
Outsourcing internal audit
Internal audit reports

Definition of internal auditing

Internal auditing is an independent, objective
assurance and consulting activity designed to
add value and improve an organization's
operations. It helps an organization
accomplish its objectives by bringing a
systematic, disciplined approach to evaluate
and improve the effectiveness of risk
management, control, and governance
processes.

Independence
1) Internal auditors should be independent of the
activities they audit.
2) Internal audit departments should be granted
sufficient status to achieve independence from the
various company functions.
3) Internal audit reports should be considered
appropriately by directors and recommendations
acted upon.
4) Internal auditors must have a reporting line that is
independent of the function they are auditing
highest level of management/ audit committee

Objectivity
1) Objectivity is an independent mental
attitude. Consider the facts in front of you
and nothing else.
2) Drafting procedures for systems, designing
systems, installing systems and operating
systems are not in the remit of internal audit
work. Performance of such tasks likely to
hinder objectivity.

Internal audit and corporate

governance codes
Codes of corporate governance, such as the IFAC
Code or the UK's Combined Code highlight the need
for businesses to maintain good systems of internal
control to manage the risks the company faces.
It is seen as part of good corporate governance to
have an internal audit function to assess and
monitor internal control policies and procedures

Best practice guidance from corporate

governance codes
BOARD(overall responsibility for analysis of risk)

Audit committee

Meet at least once a year with IA head without the

presence of management

Internal Audit Department

Audit committee to Internal Audit Dept

1) Monitor and review effectiveness of IA
2) Approve appointment/ termination of
appointment head of IA
3) Review and assess the annual IA work plan
Internal audit department to Audit Committee
1) Regular report on the results of IA work
2) Direct assess to board chairman and audit
committee
3) Accountable to audit committee

Factors to be considered when assessing

the need for internal audit
The board should consider:
1) Any trends or current factors relevant to the
company's activities, markets or other aspects of
its external environment that have increased risks.
2) Internal factors such as organizational
restructuring or changes in reporting processes or
underlying information systems
3) Adverse trends evident from the monitoring of
internal control systems.

Particulars
External auditor
Comparison
of internal
Objectives

Internal
audit
andAuditor

external
The main
objective audit
of the
external auditor is to express
an
opinion on the truth and
fairness of the financial
statements.

The main objective of

a companys operation
efficiency and effective
internal controls.

Reporting

External auditors report to the

shareholders or members of the
company. External audit reports
are contained within the financial
statements and hence are publicly
available.

Internal auditors norm

or those charged with
reports not publicly av
intended to be seen by
report. The reports are
board of directors and
governance such as th

Scope of

The external auditors work is

The internal auditor ca

Assignment performed by internal auditor

1) Value for money audit

2) Best value audit
3) Information technology audit
4) Financial audit
5) Operational audits
6) Fraud investigation

Value for money audit

value for money audit focuses on whether the best
combination of services has been obtained for the
lowest level of resources.
In performing a value for money audit there are three
areas which an auditor will commonly focus on being
economy, efficiency and effectiveness, and these are
known as the three Es.
Economy Keeping the cost of resources used to a
minimum.
Efficiency The relationship between the output from
goods and services and the resources used to produce
them.
Effectiveness How well the organization's objectives
have been achieved.

Best value Audit

A best value audit, typically used in local government,

is an investigation into whether there is a public
demonstration that value is being achieved.
Challenge :The current position is challenged to
establish whether better options may exist.
Compare :Performance is compared with similar
service providers to establish how good the current
position is.
Consult :All users and providers of the service are
invited to put forward their views.
Compete :The organization must demonstrate that it is
following the most efficient and effective service

Information technology audit

This involves testing controls within the computer
systems of the business. Areas which might be the
subject of audit include:
1) Systems development process
2) Asset management
3) Database management systems
4) E-business
5) Networks
6) Access controls
IT audits are likely to be carried out by computer
specialists rather than by general internal audit staff

Financial internal audit

This was the traditional role of internal audit. It
involved gathering evidence (mainly within the
company's records) to substantiate the information
in the management accounts and financial
statements.
The external auditors may wish to rely on the work
of financial internal audit in order to reduce the
volume of substantive work that they will have to
carry out.

Operational internal audit

Operational assignments should focus on the

identification of the principal business risks involved
which may prevent the organization achieving its
objectives, and the assessment of the extent t
which controls are in place and are operating
effectively to manage these risks.
They can also be called management or efficiency
audits
1) Identify key risk areas
2) Establish required controls
3) Test existing controls
4) Report conclusion & Recommendation

Approach to operational internal audit

assignments
Two aspects
Ensure policies are
adequate

Read policies
Discuss with staff of
relevant management
Assess adequacy
Advice management on
improvements.

Ensure policies
work effectively

Identify controls
Observe
Test

Examples of operational internal audit

assignments

Procurement
Procurement (or purchasing) is the act of obtaining
goods and services from outside suppliers. Primary
risks are:
fictitious or excessive payments made to suppliers
inaccurate or delayed payments
best value not achieved from current suppliers

Examples of operational internal audit

assignments (Marketing )
Marketing involves pricing, placing and
promoting the company's products. Primary
risks are:
- advertising that breaches regulations
- advertising that loses customers
- advertising that is expensive but achieves no
new sales

Examples of operational internal audit

assignments (Treasury)
Treasury involves the handling of all financial matters,
including raising and investing finance cash flow
management, banking procedures and currency
management. Potential risks can be huge, and if not
properly managed can bring down companies. Primary
risks are:
failure to manage cash flow leading to cash shortfalls at
critical times
failure to manage currency leading to massive exchange
losses
high finance costs due to selection of wrong source of
funds

Examples of operational internal audit

assignments (Human resource )

HR encompasses a wider role than a traditional

personnel department. HR includes responsibility
for recruitment, training, remuneration policy,
disciplinary procedures and leavers. Primary risks
are:
failure to identify and recruit the right skills
staff are not properly trained
staff paid wrong rates, or for time not worked

Outsourcing the internal audit

department

Outsourcing is the use of external suppliers as a source

of finished products , components and services.
It can be expensive to maintain an internal audit
function consisting of employees of the company. It is
possible that monitoring and review required by a
certain company could be done in a small amount of
time and full time employees can not justified.
It is also possible that a number of internal audit staff
are required but the cost of recruitment is prohibited,
in such circumstances it is possible to outsource the
internal audit function that is purchase of service from
outside.

Benefits of outsourcing
1) Staff do not be recruited because the service provider
has good quality staff
2) The service provider has different specialist skills and
can assess what management requires them to do
3) It can provide an immediately internal audit
department
4) Associated cost , such as staff training can be
eliminated
5) The service contract can be for an appropriate time
scale
6) It can be used on short term basis

Drawbacks of outsourcing
1) There will be independence and objectivity issues if
the company uses the same firm to provide external
and internal audit service
2) The cost may be too high some time
3) Company staff may oppose outsourcing if it results in
redundancies
4) There may be high staff turnover of internal audit staff
5) The outsourced staff may have only limited knowledge
of company
6) The company will lose in house skills
7) Difficult to ensure high standards once the contract
has been awarded and the previous employees have
left

ISA 610 (Reliance on the work of

internal auditor)

External Auditor can relay on the work of internal

auditor If Criteria is met.
ISA 610 Using the Work of Internal Auditors details
the factors the external auditors should consider in
order to place reliance on the work of the internal
audit (IA) department as follows:
1) Objectivity
2) Technical competence
3) Due professional care
4) Communication

Reliance on the work of internal auditor

1. Objectivity
They should consider the status of IA within the
company and if they are independent of other
departments, in particular the finance department.
In addition, consideration should be given as to who
IA reports to, whether this is directly to those
charged with governance or to a finance director.
2. Technical competence
The technical competence of IA staff should be
considered. Consideration should be given to
whether they are members of a professional body
and have relevant qualifications and experience.

Reliance on the work of internal auditor

3. Due professional care
The external auditors should consider if the IA
department have exercised due professional care,
the work would need to have been properly
planned including detailed work programmes,
supervised, documented and reviewed.
4. Communication
In order to place reliance there needs to be
effective communication between the internal
auditors and the external auditor. This is most likely
to occur when the IA department is free to
communicate openly and regular meetings are held
throughout the year.

Dec 2007 (8 marks)

Matalas Co sells cars, car parts and petrol from 25 different

locations in one country. Each branch has up to 20 staff
working there, although most of the accounting systems are
designed and implemented from the companys head office.
All accounting systems, apart from petty cash, are
computerized, with the internal audit department frequently
advising and implementing controls within those systems.
Matalas has an internal audit department of six staff, all of
whom have been employed at Matalas for a minimum of five
years and some for as long as 15 years. In the past, the chief
internal auditor appoints staff within the internal audit
department, although the chief executive officer (CEO) is
responsible for appointing the chief internal auditor.
The chief internal auditor reports directly to the finance
director. The finance director also assists the chief internal
auditor in deciding on the scope of work of the internal audit
department.

June 2008 (20 Marks)

Discuss the advantages and disadvantages of outsourcing an internal audit

department. (b) MonteHodge Co has a sales income of $253 million and employs
1,200 people in 15 different locations. MonteHodge Co provides various financial
services from pension and investment advice to individuals, to maintaining cash
books and cash forecasting in small to medium-sized companies. The company is
owned by six shareholders, who belong to the same family; it is not listed on any
stock-exchange and the shareholders have no intention of applying for a listing.
However, an annual audit is required by statute and additional regulation of the
financial services sector is expected in the near future.
Most employees are provided with on-line, real-time computer systems, which
present financial and stock market information to enable the employees to provide
up-to-date advice to their clients. Accounting systems record income, which is
based on fees generated from investment advice. Expenditure is mainly fixed, being
salaries, office rent, lighting and heating, etc. Internal control systems are limited;
the directors tending to trust staff and being more concerned with making profits
than implementing detailed controls. Four of the shareholders are board members,
with one member being the chairman and chief executive officer. The financial
accountant is not qualified, although has many years experience in preparing
financial statements.
Required:

December 2008(8 marks)

Benefit of having internal Audit????

June 2009 , December 2012 (8)

Contrast the role of internal and external
auditors????

June 2011

Goofy Cos year end is 31 December, which is traditionally a

busy time for NAB & Co. Goofy Co currently has an internal
audit department of five employees but they have struggled
to undertake the variety and extent of work required by the
company, hence Goofy Co is considering whether to recruit to
expand the department or to outsource the internal audit
department. If outsourced, Goofy Co would require a team to
undertake monthly visits to test controls at the various shops
across the country, and to perform ad hoc operational
reviews at shops and head office. Goofy Co is considering
using NAB & Co to provide the internal audit services as well
as remain as external auditors.
Required:
(b) Discuss the advantages and disadvantages to both Goofy
Co and NAB & Co of outsourcing their internal audit
department.