Welcome to the World of Internal Audit!
Hello there! Welcome to one of the most practical chapters in your P3 Risk Management studies. If you have ever wondered how a company makes sure its rules are actually being followed, you are in the right place. In this chapter, we are exploring the different Forms of Internal Audit.
Internal audit is like a "health check" for a business. Just as a doctor checks different parts of your body (heart, lungs, reflexes), an internal auditor checks different parts of a business to make sure everything is working as it should. Don't worry if this seems like a lot of technical jargon at first—we will break it down piece by piece!
1. What exactly is Internal Audit?
Before we look at the different forms, let’s define it simply. Internal Audit is an independent department within a company that checks if the company’s Internal Controls are working. Their goal is to provide assurance to the Board of Directors that risks are being managed properly.
Analogy: Think of a professional sports team. The players (Management) are trying to win the game (make profit), but the referee (Internal Audit) makes sure everyone follows the rules so the game doesn't fall into chaos.
Quick Review: The Three Lines of Defense
Internal audit is often called the Third Line of Defense:
1. First Line: Management (who own and manage operational risks).
2. Second Line: Risk Management and Compliance functions (who monitor and facilitate risk controls).
3. Third Line: Internal Audit (who provide independent assurance to the board and audit committee).
2. The Different Forms of Internal Audit
Internal auditors don't just look at accounting books. They wear many hats depending on the risks an organisation faces. Here are the key forms of internal audit you need to know for your CIMA P3 exam:
A. Compliance Audit
This is all about following the rules. These rules could be external legal and regulatory obligations (such as data protection laws, tax codes, or health and safety regulations) or internal policies (such as delegated authority limits and travel expense policies).
Common Mistake to Avoid: Many students think compliance is only about statutory laws. In P3, remember that compliance audits also examine adherence to internal policies, procedures, and ethical codes.
B. Fraud Investigation
When fraud is suspected or detected, internal auditors are frequently called upon to investigate. A fraud investigation focuses on identifying how the fraud occurred, assessing the total financial loss and reputational damage, gathering and preserving evidence, identifying control breakdowns, and recommending remedial controls to prevent recurrence.
Key Distinction: While management has primary responsibility for preventing and detecting fraud through robust internal controls, internal audit investigates alleged breaches, evaluates the vulnerability of current systems to fraud, and advises the audit committee on necessary corrective actions.
C. Value-for-Money (VFM) / Management Audit
Also known as a performance audit or operational audit, this form asks: "Is management doing a good job with the organisation's resources?" It evaluates whether objectives are being met economically, efficiently, and effectively.
Memory Aid: The 3 Es of Value for Money
When you see "Value for Money" or "Management Audit," remember these three core criteria:
1. Economy: Minimising the cost of resources acquired or used, having regard to appropriate quality (spending less).
2. Efficiency: Maximising the relationship between output of goods or services and the resources used to produce them (spending well / doing things right).
3. Effectiveness: The extent to which declared objectives and targets have been achieved (spending wisely / doing the right things).
D. Social and Environmental Audit
Modern organisations face significant non-financial, sustainability, and reputational risks. A social and environmental audit evaluates the company's impact on society, local communities, employees, and the natural environment. Examples include assessing compliance with carbon reduction targets, monitoring water and waste management protocols, auditing workplace diversity and inclusion metrics, and verifying whether supply chain partners follow ethical labor practices.
E. Information Technology (IT) and Systems Audit
In digital business environments, an IT audit examines the security, integrity, and availability of computer systems, networks, and databases. Auditors assess access controls, data backup procedures, disaster recovery plans, and cybersecurity defences to ensure business continuity and protect sensitive corporate data.
F. Financial and Operational Audits
Internal auditors review the reliability and integrity of financial and operating information, as well as day-to-day business processes. They test whether key controls—such as bank reconciliations, segregation of duties, inventory counts, and procurement authorisations—are operating effectively to protect company assets.
Key Takeaway: Internal audit is versatile. It encompasses compliance, fraud investigations, value-for-money reviews, social and environmental responsibility, and technology controls.
3. Who Performs the Audit? (Sourcing the Function)
A company has three main ways to set up its internal audit function. Choosing the right one is a key governance decision for the Audit Committee.
1. In-House Department
The company hires its own full-time employees to act as internal auditors.
Pros: They understand the company's culture, operations, and systems deeply, and they provide permanent, immediate availability.
Cons: It can be expensive to train and maintain specialist expertise, and auditors risk losing their objectivity if they become too familiar with the operational staff they audit.
2. Outsourcing
The company contracts an external professional firm (such as an accounting or risk consulting firm) to deliver the entire internal audit service.
Pros: Access to specialist skills, cutting-edge audit software, flexible capacity, and an independent, objective perspective.
Cons: Higher long-term hourly costs, less familiar with the specific operational nuances of the business, and potential loss of in-house organizational learning.
3. Co-sourcing
This is a hybrid model. The organisation maintains an in-house core team for routine audits and management liaison, but brings in external specialists for complex, technical assignments (such as deep cybersecurity penetration testing or complex forensic fraud investigations).
Real-world example: A medium-sized bank maintains its own internal auditors for daily branch and branch-lending compliance checks, but co-sources with a specialist IT forensic firm to audit algorithmic trading systems and cloud security.
Quick Review: Sourcing Decisions
- In-house: Best for organisational knowledge and continuous presence.
- Outsourced: Best for specialist capabilities and clear independent perspective.
- Co-sourcing: Offers the flexibility of specialist external input alongside in-house continuity.
4. Factors Affecting the Internal Audit Plan
Internal auditors cannot audit everything every year. They must adopt a Risk-Based Internal Audit Approach to prioritise resources where risk exposures are highest.
The audit plan is typically determined by:
- Risk Assessment: Prioritising business units, projects, or processes with high inherent and residual risk on the corporate risk register.
- Materiality: Focusing on areas involving significant financial values, critical transaction volumes, or strategic importance.
- Change and Complexity: Areas undergoing recent change—such as new enterprise software implementations, corporate restructuring, or newly acquired subsidiaries—warrant prompt review.
- Management Concerns and Past Findings: Addressing areas with prior compliance failures or specific requests from the audit committee.
5. Summary and Encouragement
You’ve made it through the forms of internal audit! Here is what you need to remember for your CIMA P3 exam:
- Compliance Audit: Verifies conformity with external laws, regulations, and internal company policies.
- Fraud Investigation: Identifies mechanisms of fraud, evaluates losses, preserves evidence, and recommends control improvements.
- Value-for-Money (VFM) / Management Audit: Evaluates operational performance against the 3 Es (Economy, Efficiency, and Effectiveness).
- Social and Environmental Audit: Measures the organisation's environmental sustainability, community impacts, and ethical standards.
- Sourcing Models: Internal audit can be staffed in-house, fully outsourced, or co-sourced based on cost, independence, and specialist skill requirements.
Exam tip: When CIMA presents a scenario question, ask yourself: "What is this specific engagement aiming to evaluate?" Is it rule adherence (Compliance), suspected malpractice (Fraud Investigation), resource optimisation (VFM / Management), or sustainability impact (Social and Environmental)? Identifying the primary objective points you directly to the correct form of audit.
Keep going—internal audit and risk mitigation form a crucial pillar of your P3 exam success!