Welcome to Your Guide on Internal and External Audit!
Hello there! You are currently diving into Section B of the BA4 curriculum, which focuses on Corporate Governance, Controls and Corporate Social Responsibility. In this chapter, we are going to look at one of the most important "safety nets" in the business world: Auditing.
If you have ever felt confused about the difference between an internal and external auditor, don't worry—you are not alone! Think of an audit like a health checkup for a business. Sometimes you check your own temperature (internal), and sometimes you go to a specialist doctor for a formal report (external). Both are vital to make sure the "body" of the business is healthy and following the rules. Let’s break it down step-by-step.
1. What exactly is an Audit?
Before we look at the two types, let's define what we mean by an audit. At its simplest, an audit is an independent examination of data, statements, or records to provide an opinion on whether they are accurate and follow the rules.
Why do we need them? In large companies, the people who own the business (Shareholders) are often not the same people who run it (Directors). This creates a "gap" in information (agency problem). Audits help bridge that gap by providing Assurance—basically a fancy word for "peace of mind"—that the information being reported is reliable.
2. The External Audit: The "Independent Watchdog"
The External Audit is a formal process usually required by law (this is called a Statutory Audit) for companies over a certain size.
What is their goal and what is "Fair Presentation"?
The primary goal of an external auditor is to provide an independent opinion on whether the company's financial statements show a true and fair view (or achieve fair presentation) of its financial position and performance in accordance with an applicable financial reporting framework.
Fair presentation means that the financial statements faithfully reflect the effects of transactions, events, and conditions in accordance with recognized accounting standards. It requires truthful representation, freedom from material bias or error, and adequate disclosure so users are not misled.
Basic Processes Undertaken in an External Audit:
External auditors follow structured stages during an audit assignment:
1. Planning and Risk Assessment: Understanding the entity, evaluating the control environment, and identifying areas of high risk of material misstatement.
2. Testing of Controls (Compliance Testing): Evaluating whether the company's internal controls operate effectively to prevent or detect errors.
3. Substantive Testing: Gathering direct evidence through tests of detail and analytical procedures to verify transaction amounts, account balances, and disclosures.
4. Review and Reporting: Evaluating all evidence collected and issuing an independent audit report containing their formal audit opinion to the shareholders.
Who do they report to?
This is a common exam trap! Even though management pays their fees, external auditors report directly to the Shareholders. They are there to protect the owners from being misled by the managers.
Key Characteristics of External Audit:
1. Independence: They must be completely separate from the company. They cannot be employees or have close personal relationships with the directors.
2. Focus: They focus primarily on the financial statements and the underlying records that produce those numbers.
3. Public Report: Their final "Audit Opinion" is a public document included in the published annual report.
Analogy: Think of an external auditor like a Food Health Inspector. They don't work for the restaurant; they come in from the outside to make sure the kitchen follows the law so the customers (shareholders) don't get "sick" from bad information.
Quick Review: The External Audit
Objective: To express an independent opinion on the fair presentation / true and fair view of financial statements.
Reporting to: The Shareholders.
Requirement: Required by statute/company law.
Main Focus: Accuracy and integrity of published financial reporting.
3. The Internal Audit: The "Business Consultant"
While the external auditor is like an outside inspector, the Internal Auditor is more like a dedicated coach working inside the team.
What is their goal?
The internal audit function is a key element of the company's internal control system. Their job is much broader than just looking at financial statements. They provide independent, objective assurance and consulting services designed to add value and improve an organisation's operations across risk management, corporate governance, and internal controls.
Basic Procedures of Internal Audit:
Internal audit performs regular systematic procedures, including:
1. Reviewing financial controls: Ensuring policies and procedures safeguard assets, ensure accurate bookkeeping, and prevent fraud.
2. Audit checks: Conducting compliance tests, surprise visits, spot checks, and inventory counts to verify that operational and financial procedures are being followed.
3. Testing audit trails: A visible, step-by-step paper or electronic path by which a transaction can be traced from origin to summary totals in the accounts (and vice versa). Internal auditors follow the audit trail to confirm data integrity and verify authorization at every stage.
4. Nonfinancial monitoring: Reviewing quality standards, IT system security, human resource policies, regulatory compliance, and environmental or health and safety standards.
Who do they report to?
Internal auditors usually report functionally to the Audit Committee (a sub-committee of the Board of Directors) and administratively to senior management (such as the CEO or Finance Director). Reporting to the Audit Committee safeguards their objectivity even though they work within the organisation.
Key Characteristics of Internal Audit:
1. Scope: Broad and flexible—covering both financial controls and nonfinancial monitoring across the entire organisation.
2. Value-adding: Designed to improve operational efficiency, strengthen risk management, and help the organisation achieve its strategic goals.
3. Legal status: Not universally mandatory by law for all companies, but strongly required or recommended under corporate governance best practice.
Analogy: Think of an internal auditor like a Personal Trainer. You hire them to watch how you exercise. They tell you if your form is wrong (identifying risk) and how to get stronger (improving efficiency) before you enter a competition.
Did You Know?
Internal auditors often perform Value for Money (VFM) audits. They look at the "Three Es":
Economy: Are we buying resources of the right quality at the best price?
Efficiency: Are we getting the maximum output for our input of resources?
Effectiveness: Are we actually achieving our intended goals and objectives?
4. Comparing Internal and External Audit
Understanding the differences is key for your BA4 exam. Here is a clear breakdown:
1. Appointment: External auditors are appointed by shareholders (or by directors to fill casual vacancies). Internal auditors are appointed by the Board / Audit Committee.
2. Objective: External is about verifying "fair presentation" (true and fair view) of financial statements. Internal is about reviewing risk, control, and operational effectiveness.
3. Relationship: External auditors are independent third parties. Internal auditors are employees of the organisation (though the function may be outsourced).
4. Reporting: External auditors report formally to Shareholders in the public annual report. Internal auditors report internally to the Audit Committee and Executive Management via internal management reports.
5. Scope: External audit is defined by statute and professional auditing standards. Internal audit scope is set by management and the Audit Committee.
Memory Aid: The "Who and Why" Mnemonic
External = Everyone (reports to shareholders/public) to evaluate External financial presentation.
Internal = Inside (reports to Audit Committee/management) to Improve operations and internal controls.
5. The Audit Committee: The Bridge
You might be wondering: "If internal auditors work for the company, how can they be honest about the bosses?" Great question! This is where the Audit Committee comes in.
The Audit Committee is made up of Independent Non-Executive Directors (NEDs). They act as an independent buffer. Both the internal and external auditors have direct, unrestricted access to the Audit Committee. This ensures that if auditors find a serious problem or executive misconduct, they have an objective forum to report it without fear of management reprisal.
Responsibilities of the Audit Committee regarding Audit:
1. Monitoring the integrity of the financial statements and reviewing significant financial reporting judgements.
2. Reviewing the company’s internal financial controls and risk management systems.
3. Monitoring and reviewing the effectiveness, scope, and resources of the internal audit function.
4. Recommending the appointment, re-appointment, or removal of the external auditor and overseeing their independence and fees.
6. Common Mistakes to Avoid
Mistake 1: Thinking auditors "guarantee" there is no fraud.
This is a huge misconception called the Expectation Gap. Auditors provide "reasonable assurance," not an absolute guarantee. External auditors test samples of transactions; they do not check every transaction, so undetected fraud may still exist.
Mistake 2: Confusing who they report to.
Always remember: External auditors report to Shareholders. Internal auditors report to the Audit Committee and Management. An exam option stating that external auditors report to the Finance Director is incorrect!
Mistake 3: Thinking Internal Audit only looks at bookkeeping.
Internal audit covers both financial and nonfinancial control activities, including IT security, regulatory compliance, risk management, and operational efficiency across the whole business.
7. Final Summary - Key Takeaways
The Core Difference: External audit is about Accountability and fair presentation for external users; Internal audit is about Assurance and Value Addition to enhance governance, control, and operations from within.
Independence and Objectivity: These are foundational to auditing. External auditors maintain statutory professional independence from the firm; internal auditors maintain operational objectivity through direct reporting to the independent Audit Committee.
Controls, Checks, and Trails: Effective internal audit relies on sound financial controls, systematic audit checks, and clear audit trails that allow transactions to be traced from inception to final financial reports.
Keep coming back to the two distinct roles: The Independent Outside Inspector (External) and the Objective Internal Coach (Internal). You've got this!