The scope of the internal audit function, outsourcing and internal audit assignments

Audit and Assurance (AA) · ACCA · 5 min read

Internal Audit: The Insider’s Perspective

Welcome to this chapter on Internal Audit (IA)! If the External Auditor is like a police officer checking if a company followed the law, the Internal Auditor is more like a personal trainer. They are there to help the company get stronger, run faster, and stay healthy from the inside out.

In this section, we will explore what internal auditors actually do, why some companies choose to "outsource" this job to external firms, and the specific types of tasks they handle. Don't worry if this seems a bit technical at first—we'll break it down piece by piece!

1. What is the Internal Audit Function?

The Internal Audit function is an appraisal activity established within an entity as a service to the entity. Essentially, it is a department that looks at the company’s internal controls, risk management, and governance to ensure everything is working as it should.

Key Difference: Internal vs. External Audit
This is a favorite topic for examiners! Let’s look at the main differences:

1. Who are they reporting to?
- External Audit: Reports to the shareholders (the owners).
- Internal Audit: Reports to management or the Audit Committee (the bosses).

2. What is their objective?
- External Audit: To provide an opinion on whether the financial statements are "true and fair."
- Internal Audit: To improve the company’s operations and internal controls.

3. Is it mandatory?
- External Audit: Usually required by law for large companies.
- Internal Audit: Not legally required, but recommended by Corporate Governance codes for listed companies.

Quick Review: The Reporting Line

To stay independent, internal auditors should ideally report to the Audit Committee, not the Finance Director. Why? Because you can't effectively critique the person who has the power to fire you!

Key Takeaway: External audit looks at the past (financial statements), while Internal audit looks at the present and future (systems and risks).

2. The Scope of Internal Audit Assignments

What do internal auditors do all day? Their "scope" is much broader than external auditors. Here are the common assignments:

A. Value for Money (VFM) Audit

This is a huge topic in the ACCA AA exam. VFM focuses on whether the company is using its resources wisely. Remember the "Three Es":

1. Economy: Getting the inputs at the lowest cost (Buying ingredients at the best price).
2. Efficiency: Getting the most out of your inputs (Not wasting food while cooking).
3. Effectiveness: Achieving the desired goal (The meal tastes great and satisfies the customer).

B. IT Audit

Internal auditors check if the company's computer systems are secure. Are passwords strong? Is there a backup if the server crashes? In a digital world, this is a top priority.

C. Financial Audit

They might perform "mini-audits" of specific departments (like payroll or sales) to ensure the numbers are being recorded accurately before the external auditors arrive.

D. Operational Audit

This focuses on the processes. For example, in a warehouse, the internal auditor might check if the layout is safe and if staff are following the correct procedures for shipping goods.

Memory Aid: "V-I-F-O"
Value for Money
IT Audit
Financial Audit
Operational Audit

Key Takeaway: Internal audit is flexible; they go wherever management feels there is a risk that needs checking.

3. Factors Affecting the Need for Internal Audit

Not every company has an internal audit department. A small "Mom and Pop" shop doesn't need one, but a global giant like Apple definitely does. Factors that lead a company to start an IA department include:

- Scale and Complexity: The bigger and more complex the business, the harder it is for management to see everything.
- Number of Employees: More people means a higher risk of fraud or error.
- Risk Profile: Companies in high-risk sectors (like banking or chemicals) need constant monitoring.
- Cost-Benefit: Does the cost of hiring auditors outweigh the money they might save by preventing fraud or inefficiency?

Did you know? Many Corporate Governance codes say that if a company *doesn't* have an internal audit function, the board must review the need for one every single year!

4. Outsourcing the Internal Audit Function

Sometimes, a company doesn't want to hire its own full-time internal auditors. Instead, they hire a professional firm (like an accounting firm) to do it for them. This is called Outsourcing.

Analogy: It’s like hiring a professional cleaning service for your house once a month instead of hiring a full-time live-in housekeeper.

Advantages of Outsourcing:

- Expertise: You get access to specialists (e.g., IT experts) that you couldn't afford to hire full-time.
- Flexibility: You only pay for the work done. If you don't need an audit this month, you don't pay.
- Independence: External firms may be more objective because they aren't "part of the office politics."
- No Recruitment Costs: No need to spend time interviewing and training staff.

Disadvantages of Outsourcing:

- Lack of Knowledge: An outside firm might not understand the "culture" or "unwritten rules" of the company as well as an insider.
- Cost: Professional firms often charge high hourly rates.
- Conflicts of Interest: If the firm also does the External Audit, there could be a serious threat to independence (Self-review threat). Note: In many jurisdictions, the same firm is forbidden from doing both for listed companies.

Common Mistake to Avoid:
Students often think outsourcing means the company is no longer responsible for internal audit. Incorrect! Even if outsourced, the management of the company is still responsible for the internal control system.

Key Takeaway: Outsourcing offers expertise and flexibility but comes at a higher price and a potential loss of "company-specific" knowledge.

5. Summary and Final Tips

In the AA exam, you might be asked to discuss whether a company should set up an IA department or whether they should outsource it. Use the points above to build your argument!

Quick Review Box:

- Internal Audit works for management to improve controls.
- VFM uses the 3 Es: Economy, Efficiency, Effectiveness.
- Outsourcing provides expertise but can lead to independence issues or high costs.
- Audit Committee oversight is vital for IA independence.

You've got this! Internal audit is all about making a business better. Keep that "consultant" mindset, and this chapter will feel much more natural.

Quick check

Can you answer these now?

Open each question to check the key ideas from this chapter.

What is the primary definition and role of the Internal Audit (IA) function?

The IA function is an appraisal activity established within an entity to evaluate and improve its internal controls, risk management, and governance.

To whom do internal auditors and external auditors report?

External auditors report to the company's shareholders, while internal auditors report to management or the Audit Committee.

How do the objectives of internal and external audits differ?

The external audit's objective is to provide an opinion on the financial statements, while the internal audit's objective is to improve operations and controls.

Is an internal audit department legally mandatory for all companies?

No, internal audit is not legally required by law, though Corporate Governance codes often recommend it for listed companies.

Why should the internal audit function ideally report to the Audit Committee?

Reporting to the Audit Committee ensures independence and allows auditors to critique management without fear of being fired.

What are the "Three Es" in a Value for Money (VFM) audit?

The Three Es are Economy (lowest cost), Efficiency (max output for input), and Effectiveness (achieving goals).

What are IT, Financial, and Operational internal audit assignments?

IT audits check system security, Financial audits check specific department records, and Operational audits check process efficiency and safety.

What factors influence whether a company should establish an internal audit function?

Factors include the scale and complexity of the business, the number of employees, the risk profile, and the cost-benefit analysis.

What are the main advantages of outsourcing the internal audit function?

Advantages include access to specialized expertise, increased flexibility in costs, and greater objectivity.

What are the main disadvantages of outsourcing the internal audit function?

Disadvantages include a lack of specific company knowledge, higher hourly costs, and potential conflicts of interest.

Does outsourcing internal audit remove management's responsibility for internal controls?

No, management always remains responsible for the design, implementation, and monitoring of the internal control system.

Ready to test yourself?

Turn these notes into exam-style practice. Get unlimited AI questions on this topic with instant marking and explanations.

Practice This Topic

More Audit and Assurance (AA) chapters

* The content provided by thinka is generated by AI and may not always be accurate or up-to-date. Please use it as a supplementary resource and verify with official materials.

Put These Notes into Practice

Reading the notes is a great start. Now practise with unlimited AI-generated questions and get instant feedback. 100,000+ students are already improving their grades.

Start Practising Now View Pricing

Done reading? Test yourself with AI practice questions

Practice This Topic Now