Internal Audit

Thursday, June 12, 2008

Internal Audit Standards

There are two types of Internal Audit (IA) standards i.e. Attribute Standards and Performance Standards.

Attribute standard is the 1 series i.e. 1xxx standards. Attribute describes the characteristics or what are the criteria of an IA function. E.g. Attribute Standard 1100 states that “The internal audit activity should be independent, and internal auditors should be objective in performing their work.”

Performance standard is the 2 series i.e. 2 xxx standards. Performance describes how to perform the audit work. E.g how IA should be managed and etc.

What is Consulting Services?

The range of services, beyond internal audit's assurance services, provided to assist management in meeting objectives.

The nature and scope of work are agreed upon with the client.

Example:

Assessment - the auditor examines and evaluates past, present or future aspects of operations and renders information that helps decision making. E.g. assess security risks, assess proposed controls
Facilitation - The auditor does not judge organizational performance but guide management in identifying improvement opportunities e.g. Control Risk Self Assessment
Remediation - The auditor assumes a direct role to prevent or remediate known or suspected problems on behalf of a client e.g. review proposed policies

What is Assurance Services?

An objective examination of evidence
for the purpose of providing an independent assessment on

risk management,
control or
governance process.

Example:

Compliance
Due Dilligence
Financial reporting
Quality certification
Ethics
Fraud investigation
E-commerce reliability
Quality assurance review
Strategic

Tuesday, June 10, 2008

Audit Charter

Audit charter serves as a basis or authorization for every effective internal audit program. The internal audit activity's charter should be in writing.

What should be included in the Charter

1000 Purpose, Authority, and Responsibility
The purpose, authority, and responsibility of the internal audit activity should be formally defined in a charter, consistent with the Standards, and approved by the board.

The charter should:

(a) establish the internal audit activity's position within the organization;
(b) authorize access to records, personnel,and physical properties relevant to the performance of engagements; and
(c) define the scope of internal audit activities.

Who approve the audit charter
The chief audit executive (CAE) should seek approval of the charter by senior management as well as acceptance by the board. The approval of the charter should be documented in the governing body minutes. The Audit Committee is responsible for aproving the audit charter.

Assurance and Consulting Activity

"Internal auditing is an independent, objective assurance and consulting activity"

The two activities carried out by an Internal Audit function are assurance and consulting. In conducting these two activities, the Internal Audit function is guided by the Standards. The standards are further designated as (A) for assurance and (C) for consulting. See example below:-

Standards

1000 - Purpose, Authority, and Responsibility
The purpose, authority, and responsibility of the internal audit activity should be formally defined in a charter, consistent with the Standards, and approved by the board.

1000.A1 - The nature of assurance services provided to the organization should be defined in the audit charter. If assurances are to be provided to parties outside the organization, the nature of these assurances should also be defined in the charter.

1000.C1 - The nature of consulting services should be defined in the audit charter

Independent

“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations."

How can internal audit achieve independent? The answer is via two O attributes:-

Organizational independence - the internal audit function is reporting to a party which is independent e.g. Audit Committee
Objectivity - the individual auditor is independent in performing the audit, without any bias or influence from others

This is written in the "Attribute Standard" which describes the characteristics of an Internal Audit function. Attribute Standard 1100 specifically address the independence characteristic.

1100 - Independence and Objectivity
The internal audit activity should be independent, and internal auditors should be objective in performing their work.
1110 - Organizational Independence
The chief audit executive should report to a level within the organization that allows the internal audit activity to fulfill its responsibilities.
1110.A1 - The internal audit activity should be free from interference in determining the scope of internal auditing, performing work, and communicating results.
1120 - Individual Objectivity
Internal auditors should have an impartial, unbiased attitude and avoid conflicts of interest.

Tuesday, June 3, 2008

A revamp for internal audit

Internal auditor leaders must adopt a risk-centric mindset if they aspire to be key players In assurance and risk management, according to PricewaterhouseCoopers (PwC).

Two reports from PwC -Internal Audit 2012 and Internal Audit 2012-Asia Pacific Supplement identify trends that will likely shape internal audit over the next five years.

The reports also highlight the similarities and differences between the internal audit functions in the Asia-Pacific region and the US.

Based on the studies, PwC has determined that the controls-focused approach is expected to diminish in relevance over the coming years.

And, a "risk-centric" internal audit model would provide assurance on the effectiveness of risk management in addition to controls assurance.

This additional level of assurance would help internal audit align itself more closely with the organisation's maturing risk-management capabilities, PwC says.

The studies were based on interview and survey data from chief audit executives from 50 large companies in the Asia Pacific and from US Fortune 250 companies.