Internal audit and governance and the differences between external audit and internal audit

Welcome to Your Guide on Internal Audit and Governance!

Hello there! Today, we are diving into a part of the Audit and Assurance (AA) syllabus that is actually quite intuitive once you get the hang of it. We are looking at Internal Audit—how it fits into a company's "government" (governance) and how it differs from the External Audit you’ve been studying so far.

Think of it this way: if a company were a high school, the External Auditor would be the government inspector who comes once a year to make sure the school is following the law. The Internal Auditor would be the school's own quality control officer who walks the halls every day to make sure teachers are teaching well and the lunchroom is clean. Both are important, but they have very different jobs!

1. What is Internal Audit?

Internal audit is an appraisal activity established within an entity as a service to the company. It’s basically the company’s own "policing" unit. While external auditors care about whether the financial statements are "true and fair," internal auditors care about whether the company is running efficiently and following its own rules.

What do Internal Auditors actually do?

Don't worry if this seems like a lot; just remember that internal auditors are the "Swiss Army Knives" of a company. Their scope includes:

• Monitoring internal controls: They check if the locks on the doors (metaphorically and literally) are working.
• Examining financial and operating information: They look at how departments are spending money.
• Value for Money (VFM) audits: They check for the "3 Es"—Economy, Efficiency, and Effectiveness.
• Compliance audits: Are we following the local laws and internal company policies?
• Risk management: Helping the company identify what might go wrong in the future.

Quick Review: Internal audit is NOT a legal requirement for most companies, but it is considered "best practice" for large companies to have one.

2. Internal vs. External Audit: The Great Comparison

This is a favorite topic for exam questions! Students often get these mixed up, so let's use a clear breakdown.

Key Differences

1. Reason for existing (Objective):
- External: To give an opinion on whether the financial statements are true and fair.
- Internal: To improve the company’s operations and controls.

2. Who are they reporting to?
- External: The Shareholders (the owners).
- Internal: The Board of Directors or the Audit Committee.

3. Is it required by law?
- External: Yes, for most companies over a certain size.
- Internal: No, it is voluntary (though highly recommended by Corporate Governance codes).

4. Who employs them?
- External: They must be independent third parties (usually an accounting firm).
- Internal: Usually employees of the company (though they can be outsourced).

Memory Aid: Think of the "3 Rs" to remember the differences:
Reason (Objective), Reporting (To whom?), and Requirement (Legal or not?).

3. Internal Audit and Corporate Governance

Corporate Governance is just a fancy way of saying "how a company is directed and controlled." To make sure the managers aren't "marking their own homework," we use an Audit Committee.

The Audit Committee's Role

The Audit Committee is a sub-committee of the Board of Directors made up of Independent Non-Executive Directors (NEDs). They act as a bridge between the auditors and the board.

Why is this important for Internal Audit?
If the Internal Auditor reports directly to the Finance Director, they might be scared to report a mistake the Finance Director made. But, if they report to the Audit Committee, they can be honest and independent!

Common Mistake to Avoid: Don't assume the Internal Auditor is 100% independent. Because they are paid by the company, they can never be as independent as an External Auditor. We call their goal "Objectivity" rather than "Independence."

4. Outsourcing the Internal Audit Function

Sometimes a company doesn't want to hire its own full-time internal auditors. Instead, they hire a firm (like KPMG, PwC, or a smaller firm) to do it for them. This is called Outsourcing.

The Pros and Cons of Outsourcing

The Good Stuff (Advantages):
- Expertise: You get specialists who know exactly what to look for.
- Cost: You only pay for the work done, rather than a full-time salary and benefits.
- Speed: The outside firm can start the job immediately.

The Risky Stuff (Disadvantages):

- Lack of Knowledge: An outside firm might not understand the "culture" or specific quirks of the company.
- Confidentiality: You are letting outsiders see your private internal data.
- Conflict of Interest: IMPORTANT! Under ethical rules, the External auditor should generally not perform the Internal audit for the same client if it creates a self-review threat.

Did you know? Even if a company outsources its internal audit, the Board of Directors is still the one responsible for the company's internal controls. You can outsource the work, but you cannot outsource the responsibility!

5. Summary and Key Takeaways

Internal audit is a powerful tool for a company to keep itself on track. Here is what you must remember for your exam:

• Internal Audit works for the Board; External Audit works for the Shareholders.
• Internal Audit focuses on controls, risks, and efficiency (VFM).
• The Audit Committee helps protect the objectivity of internal auditors.
• Outsourcing is an option, but it brings risks regarding company knowledge and ethics.

Quick Review Box:
- Who performs Internal Audit? Employees or outsourced providers.
- Main goal? Reviewing controls and risks.
- To whom do they report? The Audit Committee/Board.
- Is it mandatory? No.

Don't worry if the distinction between "independent" and "objective" feels a bit blurry at first. Just remember: External auditors are "outside," and Internal auditors are "inside" (even if they are outsourced). You've got this!