Function of Internal Audit

Internal Audit:

Function of Internal Audit:

Internal audit sections or department are found in many large companies,in government organizations and other large entities.Their main role is to act as an independent appraisal function within the entity.

The function of internal audit can be explained as follows.

'Internal auditing is an independent,objective assurance and consulting activity designed to add value and improve an organization's operations.It helps an organization accomplish it's objectives by bringing a systematic,disciplined approach to evaluate and improve the effectiveness of risk management,control and governance processes'.(The Institute of Internal Auditors)
'The objective of internal auditing is to assist [management] in the effective discharge of their of their responsibilities.To this end,internal auditing furnishes them with analysis,appraisals,recommendations...and information concerning the activities reviewed'.(The institute of Internal Auditors)
'Internal audit is an independent appraisal activity established within an[entity] as a service to it.It is a control which functions by examining and evaluating the adequacy and effectiveness of other controls'(CIMA offical Terminology)

Internal audit may be described as a check or control over other controls.It is therefore a part of the internal control system, with a responsibility for monitoring the internal control system.

Internal audit activites:

There is no legal requirement for an entity to have an internal audit department.There should be checks on the effectiveness of internal control.However,these checks could be made by operational managers or by managers in the accounts department,or possibly by an external firm of accountants/auditors.If a company does not have an internal audit functions,it may engage an external firm of accountants-and possibly the company's audit firm-to carry out occasional internal audit investigations.When an entity does have an internal audit department,the tasks of the department may include the following.

Reviewing parts of the internal control systems:Traditionally,internal auditors have carried out checks on financial controls.The work done by the internal auditors might reduce the need for the external auditors to carry out similar checks,when the internal auditors and external auditors co-operate closely.Weaknesses in financial controls should be reported to senior management and notified to the external auditors.Because internal auditors carry out checks on financial controls.It is usual for internal auditors to be professional accountants or trainee accountants.
Special Investigations:Internal auditors might be asked to carry out special investigations into particular departments or aspects of operations.These investigations may be at the request of the manager of the department.Internal audits of particular systems or procedures may be called systems audits.
VFM audits: VFM stands for 'Value for money' and VFM audits check whether an entity is obtaining value for money from particular activities or operations Value for money mean economy,efficiency and effectiveness.

Economy:Economy means not spending more money than is necessary.A VFM audit searches for wasteful spending and recommends actions that should be taken to reduce spending without any loss of efficiency or effectiveness.

Efficiency:Efficiency (or productivity) means getting the most output from the resources that are used.It means,for example using employees and equipment so that the output per employee or the output per item of equipment is improved.

Effectiveness:Effectiveness means success in achieving goals and objectives.An internal audit should check whether the operations subject to audit are successfully achieving their intended purpose.

Risk assessment:Internal auditors may be involved in the identification and assessment of risks, for the purpose of risk management.
Compliance audit:Internal auditors might carry out checks to confirm that there is proper compliance by the entity with particular rules and regulations,such as Health and safety regulations or regulations on pollution.
Stress Tests:Internal auditors might be involved in carrying out tests on what might happen to the entity its business operation and financial position,in the event of a catastrophe or if extremely bad business conditions occur(a worst case scenario).

In carrying out these tasks the internal auditor might be performing one or more of the following functions:

Supervision to check whether procedure and processes are being performed properly.
Attestation to confirm that control are functioning effectively.
Evaluation to assess risks and the benefits of risk controls.

Internal auditor should help senior management to ensure that all major risks facing the organization,both internal and external are identified and managed.To do this they need to have a good understanding of how the business functions.

Internal auditors:independence,Objectivity and status:

Independence:

The internal auditors need to be independent so that they are able to provide an objective analysis and objective recommendation,free from bias and conflicts of interest.It is difficult for internal auditor to be independent because they are full-time employees of the company.They rely on the company for their income and possibly also for their future career.They must report to management,because they have to take their instructions from a person in the management structure.They are dependent on the goodwill of their manager they report to.Their managers after all decides what their remunerations should be.

Internal auditors might therefore have no problem with criticising managers in other departments but they could have a major problem with criticising their own manager.

Objectivity:

Internal auditors like the external auditors need to be independent because they are required to carry out checks on internal controls and evaluate how effective these controls are.It is important that their advice and recommendations should be free from the influence of other managers and should be objective.

Status:

The internal audit dependent should report to a senior person in management-the more senior,the better.This is because the internal auditors are expected to criticise'line manager' and this is very difficult if the line manager is their superior in status and influence in the company.Internal auditors should therefore report to the highest level of executive manager possible.

In addition to give even more protection to the internal auditor from pressure by senior management,the head of internal audit should also report directly to either:

the audit committee
the board of directors

The basel committee for the supervision of banking in a report on internal control systems(1998) commented that the internal audit function,because it provides an independent assessment of the compliance with the already established policies and procedures(and the adequacy of them) it is an important part of assessing the internal control system.The internal auditors provide unbiased information about the company by reporting directly to the board senior management and the audit committee.

Internal audit and the role of the audit committee:

The independence and objectivity of the internal audit department can be protected if the head of internal audit is required to report to the audit committee as well as to a line manager(the finance director).

This was a recommendation of the smith report in the UK (2003) on audit committees.The report recommended that:

The audit committee should approve the appointment of the head of internal audit or the termination of his employment.By removing the authority for appointing and dismissing the head of internal audit from line management (the finance director) the independence of the internal auditors should be strengthened.The head of internal audit would not rely on line management for his job he might therefore feel more secure in his job when he has to criticize weaknesses in internal controls for which the finance director is responsible.
The audit committee should also monitor the work of the internal audit department which should prepare regular reports for the audit committee(for example a report for each scheduled meeting of the audit committee,which might be three or four times each year).

The smith report recommend that the audit committee in its review of the work of the internal audit function,should:

Ensure that the head of internal audit has direct access to the chairman of the board of directors and the audit committee and is accountable to the audit committee.
Review and assess the work plan for the internal audit department to check that the work plan is appropriate.
Receive reports on the work performed by the internal audit department on a periodic basis.
Review the response of management to recommendations that have been made to them by the internal audit department.Have management acted on the recommendations to deal with weaknesses in internal controls or have management ignored the recommendations and done nothing?
Meet at least once each year with the head of internal audit without the presence of management (for example without the CEO or finance director being present).This should make it easier for the audit committee to obtain independent and objective opinions from the internal audit department.
Monitor and assess the effectiveness of the internal audit department within the overall system of internal control and risk management.The audit committee should assess whether the internal audit department is effective.

The Audit committee,internal audit and the combined code:

The UK combined code includes some specific provisions about internal audit and the governance role of the audit committee.It states that:

The audit committee should monitor and review the effectiveness of internal audit activities in the company.
If there is no internal audit function (department) the audit committee should consider each year whether the company ought to have an internal audit function.It should then make a recommendation to the board of directors.
If there is no internal audit function the reason for not having one should be explained in the relevant section of the company's annual report to shareholders.