Welcome to the Internal Audit Process!
Welcome to one of the most practical chapters in your P3 – Risk Management journey! Think of Internal Audit (IA) as a "health check" for a company. Just like you might visit a doctor for a check-up to ensure everything is working correctly before a problem becomes a crisis, a company uses internal audit to ensure its processes, risks, and controls are healthy.
Don't worry if this seems a bit "corporate" or dry at first. By the end of these notes, you’ll see that IA is simply about asking: "Are we doing what we said we would do, and is it actually working?"
1. What is Internal Audit?
According to the official definition, Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations.
Key Concept: The Two Faces of IA
1. Assurance: Giving management and the board confidence that controls are working.
2. Consulting: Providing advice on how to improve processes and manage risks better.
Analogy: Think of a professional sports referee. They don’t play for either team (Independence), they call the fouls as they see them (Objectivity), and they make sure the game follows the rules so that the final score is fair (Assurance).
Key Takeaway:
Internal audit isn't just about "catching people doing things wrong." It's about helping the organization achieve its goals by being a "critical friend."
2. Independence and Objectivity
For an internal audit to be useful, it must be unbiased. If the person checking the work is the same person who did the work, they might hide mistakes. This is why independence is vital.
How do we stay independent?
Internal auditors should report functionally to the Audit Committee (part of the Board of Directors) and only administratively to the CEO. This means the CEO can't fire the auditor just because they found a mistake in the CEO's department!
Common Mistake to Avoid:
Students often think internal auditors are "external" because they are independent. They are usually employees of the company, but their reporting line is what makes them independent from the daily operations.
3. The Internal Audit Charter
The Internal Audit Charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility. It is the "rulebook" for the IA department.
What’s inside?
- The scope of their work (what they can and cannot check).
- Their right to access all records, personnel, and physical properties.
- Their reporting relationship with the Audit Committee.
Did you know? Without a Charter, an internal auditor might be told "You aren't allowed to look at those files." The Charter ensures they have the "keys to the building."
4. Types of Internal Audit
Internal auditors don't just look at accounting books. They wear many hats:
Financial Audit: Checking if the financial records are accurate (though this is primarily the External Auditor's job, IA might do internal checks).
Operational Audit: Checking if a process (like the warehouse shipping process) is efficient and effective.
Compliance Audit: Checking if the company is following laws and regulations (e.g., GDPR or Health & Safety).
Management Audit: Assessing the quality of management's decision-making and organizational structure.
Quick Review: The 3 Es (Value for Money Audit)
When auditing for "Value for Money," auditors look at:
1. Economy: Are we buying inputs at the best price? (Spending less)
2. Efficiency: Are we getting the most output from our inputs? (Spending well)
3. Effectiveness: Are we achieving our actual goals? (Spending wisely)
5. The Internal Audit Process: Step-by-Step
The actual "doing" of an audit usually follows four main stages. Let’s break them down:
Step 1: Planning
You can't audit everything at once. The IA team looks at the company’s Risk Register and decides which areas are the highest risk. They then define the scope (what will be checked) and the objectives (what they hope to find).
Step 2: Fieldwork (The "Doing" Phase)
This is where the auditor gathers evidence. They use techniques like:
- Observation: Watching a process happen.
- Inquiry: Interviewing staff.
- Inspection: Looking at documents and vouchers.
- Re-performance: Doing the calculation themselves to see if they get the same result.
Step 3: Reporting
The auditor writes a report. It usually includes the findings (what was found), the implications (what could go wrong because of this), and recommendations (how to fix it). This goes to management and the Audit Committee.
Step 4: Follow-up
This is the most forgotten but crucial step! The auditor returns later to see if management actually implemented the recommendations. If they didn't, the risk still exists.
Key Takeaway:
An audit isn't finished when the report is written; it’s finished when the risk is managed.
6. Internal vs. External Audit
This is a favorite topic for exam questions. Here is a simple comparison:
Internal Audit:
- Who are they? Employees or outsourced providers.
- Who do they report to? The Board/Audit Committee.
- Objective? To improve operations and manage risk.
- Focus? Past, present, and future risks.
External Audit:
- Who are they? Independent third-party firms (e.g., KPMG, PwC).
- Who do they report to? The Shareholders.
- Objective? To give an opinion on whether the financial statements are "true and fair."
- Focus? Mostly historical financial data.
Mnemonic: Internal is for the Inside (Management). External is for the Everyone else (Shareholders).
7. The Relationship with the Audit Committee
The Audit Committee (a sub-committee of the Board of Directors, made up of Non-Executive Directors) acts as the "guardian" of the internal auditors. They ensure the internal audit team has enough resources, is being listened to by management, and remains independent.
Why does this matter?
If a manager is committing fraud, they will try to stop the internal auditor. The Audit Committee provides a safe "whistleblowing" route for the auditor to report problems at the highest level.
Summary Checklist for Success
Before moving to the next chapter, make sure you can answer these:
- Why is independence important for internal auditors?
- What are the 4 stages of the audit process?
- How does an internal audit differ from an external audit?
- What are the "3 Es" in a Value for Money audit?
Keep going! You're doing great. Internal audit is all about logic and keeping the business on the right track. Once you master the "referee" analogy, the rest falls into place!