Welcome to Audit and Compliance!
Hello there! Welcome to one of the most important chapters in your Strategic Business Leader (SBL) journey. Don't let the word "Audit" scare you off. Many students think audit is just about checking numbers and math, but in SBL, it is much broader. It is about trust, safety, and making sure the business does what it says it will do.
In this chapter, we will explore how a company keeps itself on track through internal checks and balances. We will look at who watches the "watchmen" and how a business stays on the right side of the law. Think of this as the "security system" of a giant organization. Let's dive in!
1. What is Internal Audit (IA)?
Imagine you are training for a marathon. You might hire a coach to check your progress, look at your diet, and make sure you aren't overtraining. That coach is like an Internal Auditor. They don't run the race for you, but they make sure you are doing everything correctly to succeed.
Internal Audit is an independent department within a company that provides "assurance" to management and the board. They check if the company's internal controls (rules) are working and if risks are being managed properly.
The Main Roles of Internal Audit
Internal auditors do more than just check boxes. Their work usually covers:
1. Monitoring Internal Controls: Are the rules being followed? For example, does the person who buys supplies also have the power to pay for them? (This is a risk! We need "Segregation of Duties").
2. Risk Management: They look at what could go wrong in the business and check if there is a plan to stop it.
3. Value for Money (VFM) Audits: They check if the company is spending money wisely. This is often remembered by the 3 Es:
- Economy: Getting inputs at the lowest cost.
- Efficiency: Getting the most out of those inputs.
- Effectiveness: Actually achieving the desired goal.
4. Compliance: Checking if the company is following laws, like health and safety or data protection rules.
Quick Review: Internal audit is like a "health check" performed by the company on itself to make sure everything is running smoothly and safely.
2. Independence: Why It’s Vital
Don't worry if this seems tricky at first... but for an auditor to be useful, they must be independent. If an auditor is best friends with the Finance Manager, they might look the other way when they see a mistake. That’s why independence is key.
How do we keep Internal Audit independent?
- Reporting Lines: The Head of Internal Audit should report to the Audit Committee (which is made up of independent directors), not to the CEO or CFO.
- No Operational Responsibility: Internal auditors shouldn't be the ones actually doing the work they are auditing. You can't mark your own homework!
- Rotation: Auditors shouldn't audit the same department for ten years in a row. They might get too "comfortable."
Did you know? In many corporate scandals, the internal auditors actually found the problems early, but they were ignored by senior management. This is why having a direct line to the board is so important!
3. The Audit Committee: The "Watchdogs"
The Audit Committee is a sub-committee of the Board of Directors. It should be made up entirely of Independent Non-Executive Directors (NEDs). At least one person on the committee should have "recent and relevant financial experience."
What does the Audit Committee do?
Think of the Audit Committee as the bridge between the auditors and the board. Their main jobs are:
- Overseeing Internal Audit: They hire the head of IA, approve their budget, and make sure they have the resources they need.
- Overseeing External Audit: They recommend which external firm to hire and ensure the external auditors are being treated fairly (and are staying independent).
- Financial Reporting: They review the company's financial statements before they are published to make sure they are honest and clear.
- Risk and Control: They review the overall "internal control system" of the company.
Key Takeaway: The Audit Committee provides oversight. They don't do the auditing themselves; they make sure the auditing process is working and that the results are taken seriously.
4. Internal vs. External Audit: Spot the Difference
A common mistake students make is confusing these two. Let's clear that up right now!
External Audit:
- Who for? The shareholders (owners).
- Why? It is a legal requirement for large companies.
- Focus: Are the financial statements "True and Fair"?
- Reporting: A public report included in the Annual Report.
Internal Audit:
- Who for? Management and the Board.
- Why? To help improve the business (often voluntary, but recommended by Corporate Governance codes).
- Focus: Risks, controls, efficiency, and operations.
- Reporting: Private reports sent to the Audit Committee/Management.
Analogy: An Internal Auditor is like a personal trainer who tells you how to get healthier every day. An External Auditor is like a doctor who does an official annual check-up to tell the world you are fit to work.
5. Compliance and Regulatory Issues
Compliance simply means "following the rules." These rules can be laws (like the Companies Act), regulations (like listing rules for the stock exchange), or internal policies (like an ethics code).
Why is Compliance hard?
As a business grows and goes global, compliance gets complicated because:
- Different Jurisdictions: A rule in the UK might be different from a rule in Singapore.
- Constant Change: Laws change all the time (think about data privacy laws like GDPR).
- Cost: Staying compliant costs money, but the cost of non-compliance (fines, jail time, and reputation damage) is much higher!
Common Mistakes to Avoid in the Exam:
1. Assuming IA is only for Finance: IA can audit anything! They can audit the HR department's hiring process or the IT department's cybersecurity.
2. Thinking the Audit Committee runs the company: They are "Non-Executive." They advise and monitor; they don't make the day-to-day business decisions.
3. Forgetting the "Soft" stuff: Audit isn't just about spreadsheets; it’s about culture. If the "Tone at the Top" is bad, no amount of auditing will save the company.
6. Summary and Final Tips
To wrap up this chapter, remember these three main pillars:
1. Control: Internal Audit checks if the company's safety nets are working.
2. Oversight: The Audit Committee ensures the auditors (both internal and external) can do their jobs without being bullied by management.
3. Compliance: The company must follow all legal and ethical rules to stay in business and keep its reputation clean.
Memory Aid for Audit Committee Tasks: Just remember "RICA"
- Review internal controls.
- Interface between board and auditors.
- Compliance with laws.
- Accuracy of financial statements.
You've got this! When you see an SBL case study about a company failing or a fraud happening, always ask yourself: "Where was the internal audit?" and "What was the Audit Committee doing?" Those questions will often lead you to the right answer!