Welcome to the Internal Audit Process!
Welcome to one of the most practical chapters in your P3 – Risk Management journey! Think of Internal Audit (IA) as a "health check" for a company. Just like you might visit a doctor for a check-up to ensure everything is working correctly before a problem becomes a crisis, a company uses internal audit to ensure its processes, risks, and controls are healthy.
Don't worry if this seems a bit "corporate" or dry at first. By the end of these notes, you'll see that IA is simply about asking: "Are we doing what we said we would do, and is it actually working?"
1. What is Internal Audit?
According to the official definition, Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations.
Key Concept: The Two Faces of IA
1. Assurance: Giving management and the board confidence that controls are working.
2. Consulting: Providing advice on how to improve processes and manage risks better.
Analogy: Think of a professional sports referee. They don't play for either team (Independence), they call the fouls as they see them (Objectivity), and they make sure the game follows the rules so that the final score is fair (Assurance).
Key Takeaway:
Internal audit isn't just about "catching people doing things wrong." It's about helping the organisation achieve its goals by acting as a constructive, "critical friend."
2. Elements of Effective Internal Audit
For an internal audit function to be effective, it must satisfy three core elements: independence, staffing, and resourcing.
Independence and Objectivity:
For an audit to be useful, auditors must be unbiased. If the person checking the work designed or operated that same process, objectivity is compromised. Internal auditors maintain independence by reporting functionally to the Audit Committee (a sub-committee of independent non-executive directors) and only administratively (day-to-day matters) to senior management such as the CEO.
Staffing and Resourcing:
The internal audit department must be adequately resourced with competent, qualified staff who possess the technical expertise, commercial acumen, and specialised skills (such as IT audit or data analytics) required to evaluate the organisation's operations. Under-resourced departments fail to audit high-risk areas effectively.
3. The Internal Audit Charter
The Internal Audit Charter is a formal document that defines the internal audit activity's purpose, authority, and responsibility. It is the "rulebook" approved by the Audit Committee.
What's inside?
- The scope of internal audit work (what operations, systems, and entities are covered).
- Authorised right of access to all records, personnel, and physical properties.
- Reporting lines to the Audit Committee and senior management.
4. Forms of Internal Audit
Internal auditors perform various forms of audits depending on organisational objectives and risks:
Compliance Audit: Checking adherence to internal policies, corporate governance codes, and external laws and regulations (e.g., environmental laws, health and safety, data protection).
Fraud Investigation: Identifying suspected irregularities, assessing how fraud occurred, evaluating control failures, and recommending preventive measures.
Value-for-Money (VFM) Audit / Management Audit: Assessing the economy, efficiency, and effectiveness of operations and management decision-making:
- Economy: Minimising resource costs while maintaining appropriate quality (spending less).
- Efficiency: Maximising output from given inputs (spending well).
- Effectiveness: Ensuring intended operational and strategic goals are met (spending wisely).
Social and Environmental Audit: Evaluating sustainability performance, carbon footprint reporting, waste management, and social impact commitments.
5. Audit Risk and Analytical Review
Understanding Audit Risk
Internal auditors must manage audit risk—the risk that the auditor reaches an incorrect conclusion or fails to detect a significant control deficiency or irregularity.
Audit risk is a function of three components:
\( \text{Audit Risk} = \text{Inherent Risk} \times \text{Control Risk} \times \text{Detection Risk} \)
1. Inherent Risk (IR): The susceptibility of an activity, transaction class, or objective to a material error, fraud, or loss, assuming there are no related internal controls. For example, complex cross-border derivative contracts or high volumes of cash transactions have naturally high inherent risk.
2. Control Risk (CR): The risk that the organisation's internal control system fails to prevent, or detect and correct, a significant error or failure on a timely basis. If controls are poorly designed or ignored, control risk is high.
3. Detection Risk (DR): The risk that the auditor's own procedures, testing, and sampling fail to detect an existing deficiency or misstatement. While inherent risk and control risk exist within the business entity, detection risk is directly managed and controlled by the auditor through audit planning, sample sizes, and substantive procedures.
Exam Insight: When auditors assess inherent risk and control risk as high, they must lower detection risk by performing more extensive, detailed testing to keep overall audit risk at an acceptably low level.
Analytical Review
Analytical review involves evaluating financial and operational information by studying plausible relationships between both financial and non-financial data. Techniques include ratio analysis, trend analysis, variance analysis against budgets, and comparisons across operational units.
Interpreting Results: Analytical review identifies unexpected fluctuations, abnormal variances, or the absence of expected relationships. For example, if sales revenue rises by 25% but delivery freight costs drop by 15%, this discrepancy highlights an anomaly requiring targeted audit investigation.
Advising on Reliability: The reliability of analytical review depends on:
- Source independence and objectivity: Data generated by independent third parties or systems with strong internal controls is more reliable.
- Comparability: Whether industry benchmarks or historical bases are truly comparable.
- Level of aggregation: Disaggregated data (e.g., monthly branch-by-branch figures) is substantially more reliable for identifying anomalies than high-level company totals.
- Predictability of the relationship: Operating environments that are stable yield far more reliable analytical patterns than volatile, changing markets.
6. The Internal Audit Process: Step-by-Step
The execution of an internal audit engagement follows four structured stages:
Step 1: Planning and Risk Assessment
Auditors identify the audit scope and objectives based on the corporate risk register and assessments of inherent and control risk. They determine the resources needed and schedule the audit assignment.
Step 2: Fieldwork and Testing
Auditors gather audit evidence through:
- Analytical review: Evaluating trends and variances.
- Inquiry and interviews: Speaking with operational personnel.
- Observation: Watching control procedures in action (e.g., inventory counts).
- Inspection: Reviewing records, authorizations, and reconciliations.
- Re-performance: Independently reperforming calculations or control activities.
Step 3: The Internal Audit Report and Findings
The team analyses their findings and prepares the audit report. An effective audit report clearly states:
- Condition: What was actually found.
- Criteria: What the standard, policy, or expectation was.
- Cause: Why the control failure or deviation occurred.
- Consequence (Impact): The risk or potential financial, reputational, or operational exposure.
- Recommendations: Realistic corrective actions to address root causes.
Findings are shared with operational management to agree action plans, and the final report is submitted to senior management and the Audit Committee.
Step 4: Follow-up
Auditors follow up on agreed management actions to ensure that recommendations have been implemented and that control weaknesses have been effectively remediated.
7. Internal vs. External Audit
Understanding the distinction between internal and external audit is central to P3:
Internal Audit:
- Appointed by and reports to: The Board of Directors / Audit Committee.
- Primary objective: Evaluate and improve risk management, internal controls, and governance processes.
- Scope: All operational, financial, compliance, and strategic activities across the entire organisation.
- Orientation: Forward-looking and continuous, focusing on managing present and future risks.
External Audit:
- Appointed by and reports to: The Shareholders.
- Primary objective: Provide an independent opinion on whether the annual financial statements present a true and fair view in accordance with applicable financial reporting frameworks.
- Scope: Limited to financial records and controls relevant to the financial statements.
- Orientation: Periodic and largely historical.
8. The Relationship with the Audit Committee
The Audit Committee acts as the oversight body for internal audit. Its responsibilities regarding internal audit include:
- Approving the Internal Audit Charter and the annual risk-based internal audit plan.
- Ensuring the internal audit team has sufficient resourcing, access, and independence from operational management.
- Reviewing internal audit reports, monitoring management's responses to findings, and ensuring recommendations are implemented.
- Meeting regularly with the Head of Internal Audit without executive management present.
Summary Checklist for Success
Before moving on, ensure you can:
- Explain the three elements of effective internal audit: independence, staffing, and resourcing.
- Distinguish the key forms of internal audit: compliance, fraud, value-for-money, and social/environmental.
- Define inherent risk, control risk, and detection risk, and explain how they interact to determine audit risk.
- Describe the purpose and reliability factors of analytical review.
- Outline the four main steps of the internal audit process and what belongs in an internal audit report.
- Compare the roles, objectives, and reporting lines of internal audit versus external audit.