Dada Adefolami

By Dada Adefolami

Purposes of internal audit

Internal audit may be defined as an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization.

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Internal audit supports management in the effective discharge of their responsibilities. To this end, internal audit furnishes management with analyses, appraisals, recommendations, counsel and information concerning the activities reviewed.

Main purpose of internal audit is to establish internal control system as well as procedures which ensures that all departments works as per policies and procedures established by management of business as well as to help external auditors in conducting external audit.

Internal Auditors are the resource that could be deployed to monitor how effective a company’s corporate social responsibility (CSR) policies are. This could mean monitoring how well the policies have been implemented or it could mean IA monitoring how well CSR policies and wider corporate objectives are aligned with each other. Schemes like the European Union’s Eco-Management and Audit Scheme (EMAS) provide an example of an instance where specific monitoring of targets (by IA) is an externally imposed requirement on a company. ISO 14000, another environmental standard, also explicitly requires internal audits and reports to management.

OBJECTIVES OF INTERNAL AUDIT
The formal objectives of internal audit may include some or all of the following:
1. Review of accounting and internal control systems
2. Examination of financial and operating information
3. Review of the ‘three E’s (economy, efficiency and effectiveness)
4. Review of compliance with laws and regulations
5. Review of arrangements for the safeguarding of assets
6. Review of implementation of corporate goals and objectives
7. Identification of significant risks to the organization, and monitoring risk management policy and risk management strategies
8. Special investigations as required.

One of the key differences between internal and external audit is that the scope of internal audit work in an unregulated industry is determined by the company specifically by the audit committee while the scope of the external auditors’ work is determined by the fact that they are undertaking a statutory audit, a legal requirement. IA will mean something different in each organization. In one company, the ‘internal audit’ department might only carry out quality control checks, while in another it is a sophisticated team of specialists with different expertise that reflect the risks faced by that organization, including the regulatory requirements placed upon it. The following are the types of work carried out by internal auditors in their Day to Day actives:
1. Value for money audits
2. Information technology audits
3. Best value audits
4. Financial audits
5. Operational audits

Whether the IA department is carrying out a review of the process of designing systems, or a review of the operation of controls within those systems, will depend on the current concerns of the organization in a highly regulated business where compliance failures are a significant risk, monitoring compliance might be a key task assigned to IA. If safeguarding assets is a key concern IA would be involved in a review of the safeguarding of assets. You may have noted that the last two suggestions both relate to the Turnbull statements about a sound system of internal controls. Any of those could be related to the work of internal audit – for example, IA might need to review the implementation of corporate objectives.

WHY IS INTERNAL AUDIT NECESSARY?
The importance of internal audit was highlighted by the Turnbull Report. It states that listed public companies that do not have an internal audit function should review the need to have such a function at least annually. Turnbull goes on to state that listed public companies that do have an internal audit function should review the scope, authority and resources of this function at least annually.

Internal audit is a function which provides assurance that risks faced by an organization is appropriately managed and the internal control system that is devised to mitigate those risks are operating effectively.

Turnbull suggests that the need for the internal audit function will depend on several factors. These include:
1. The scale, diversity and complexity of the organization’s activities
2. The number of employees – the need for an internal audit function increases as the number of employees increases, or if employee interrelationships become more complex
3. Where the benefits of such a function will outweigh the costs of implementation and operation
4. When changes occur over time in the organization’s structures, reporting processes or underlying information systems
5. The nature of risks, changes to risks and emerging risks
6. Problems and issues arising with internal control systems, both actual and perceived
7. The occurrence of an increasing number of unexplained or unacceptable events.

The overall purpose of an audit function is to provide for verification of records, processes or functions in a sufficiently independent manner from the institution or subject being audited in order to add its value and improve its operation

INTERNAL AUDIT AND INTERNAL CONTROL

Internal audit is an internal but independent assurance function. While internal auditors are usually employees of the organization, they should operate independently of management so that their analyses, judgements and reports are free from bias or undue influence. The head of internal audit should report to the board of directors, or to the audit committee. Some organizations reinforce independence by outsourcing the internal audit function to professional external firms.

Internal audit testing is the internal assessment of internal controls and as such is a management control to ensure compliance and conformity of internal controls to pre-determined standards.

Information Audit (IA) extends the concept of auditing holistically from a traditional scope of accounting and finance to the organizational information management system. Information is representative of a resource which requires effective management and this led to the development of interest in the use of an IA
Note that when you conduct an internal audit of your small business, you must set specific, measurable goals for that audit. You should be able to use the results of your internal audit to make improvements in your business practices that will affect your bottom line directly

Internal control, as defined in accounting and auditing, is a process for assuring achievement of an. organization’s objectives in operational effectiveness and efficiency, reliable financial reporting, and. compliance with laws, regulations and policies. A broad concept, internal control involves everything.
Key risks:

Internal audit reviews and reports on internal controls in relation to key risks affecting the organization. The objective here should be to test the extent to which the controls will control the risk if it crystallizes. The conclusions of these reports should enable management to reconsider the controls and modify or redesign them if appropriate.

Financial and operating information:
Internal audit may examine this information in order to ensure it is accurate, fit for purpose and timely. Tests may be applied to determine whether information is correctly measured and therefore suitable as a basis for informing management and external stakeholders.

Compliance:
Organizations have to implement performance standards in relation to compliance. This may be to satisfy the demands of external regulators, or to operate to pre-determined internal standards. Internal audit should review operations for compliance with such standards. In this respect, the work of internal auditors in broadening, as organizations increasingly pursue compliance not only with industry standards for products and service provision, but also with criteria relevant to environmental standards.

Finally
During their duties, internal auditors may carry out various types of audit. These include the following:
Operational audits may be concerned with the efficiency of the organization’s activities. Consider performance relative to pre-determined criteria.

Systems audits are used to test and evaluate controls, test whether the controls can be relied upon to ensure that resources are allocated and managed effectively, also test whether the information provided by the organization’s systems is accurate. Compliance tests verify whether internal controls are being applied in a proper manner. Substantive tests verify the accuracy of figures, and can be used to identify errors and omissions.

A transactions or probity audit is concerned with detecting fraud and other types of criminal or unlawful behaviour. However, it can also be extended to matters relating to fairness of dealings, impartiality, accountability and transparency, sometimes considered to be within the scope of social audit. Generally, social audit may be concerned with any matters relating to governance. Internal audit strategic improvement plan
Internal Audit Strategic Plan. The mission of the OBM Office of Internal Audit (OIA) is to provide independent, objective assurance and consulting activities designed to improve management practices, identify operational improvement, and reduce agency risk exposure.

Internal audit is the control of controls. is a key part of the corporate governance framework of an organization, and it can be viewed through the lens of risk management as a high-level control in response to risk or by considering the detailed work required of IA. Finally, as a key component of the control system, it is important to maintain the integrity of internal audit, from this perspective, issues of professional ethics and characteristics such as independence come into play.

• Dada Suraju Adefolami, FIMC, CMC. Professor of Finance, School of Business Administration, UNEM University Costa Rica, is a Finance / Management Consultant and Certified Forensic Accountant. You can reach him via: [email protected]; 08052043855