1. The Need for Internal Audit
Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. While not legally required, having an internal audit department is considered best practice, especially for larger, more complex organizations.
Figure 1. The key aspects of internal audit.
The need for an internal audit (IA) function is determined by several factors:
- Scale and diversity of activities.
- Complexity of operations.
- Number of employees and risk of fraud.
- Cost/benefit considerations.
- The desire of senior management for assurance and advice on risk and control.
- The current control environment and history of fraud.
2. Difference between Internal and External Auditors
Internal and external auditors have distinct objectives, reporting lines, and responsibilities. Understanding these differences is crucial.
| External Audit | Internal Audit | |
|---|---|---|
| Objective | Express an opinion on the truth and fairness of financial statements. | Improve the company's operations by reviewing internal controls and processes. |
| Reporting | Reports to shareholders. | Reports to management or those charged with governance. |
| Scope of Work | Verifying the truth and fairness of financial statements. | Wide in scope, covering controls, risk, IT, and operational efficiency. |
| Appointment | By the shareholders of the company. | By the audit committee or board of directors. |
| Relationship | Must be independent of the company. | May be employees or an outsourced function. |
3. The Role of the Internal Audit Function
The role of internal audit is broad and can vary greatly. Key activities include:
- Assessing corporate governance and risk management processes.
- Testing the effectiveness of internal controls.
- Assessing the reliability of financial and operating information.
- Performing **value for money (VFM)** assignments (Economy, Efficiency, and Effectiveness).
- Assessing compliance with laws and regulations.
Limitations of Internal Audit
Internal audit's independence can be compromised. They may be employees of the company, which could lead to a **self-review threat** or a lack of objectivity. A **familiarity threat** can arise if staff audit the work of long-standing colleagues. Acceptable levels of independence can be achieved by having separate reporting channels or outsourcing the function.
4. Outsourcing the Internal Audit Function
Companies may outsource their internal audit function to an external firm to gain benefits such as expertise and greater independence. However, this approach also has disadvantages.
Advantages:
- Access to qualified, competent staff with a broader range of expertise.
- Enhanced independence and objectivity.
- Avoidance of permanent employment costs.
- Access to new technologies without associated costs.
Disadvantages:
- Lack of intimate knowledge of the organization.
- The focus may be on cost rather than the effectiveness of the function.
- Engagements are limited by contractual terms.
- Fees charged by professional firms can be high.
Test Your Understanding Questions and Solutions
Murray Co's internal audit function
The internal audit function at Murray Co consists of a head of internal audit, two senior internal audit managers, four internal audit managers, seven internal auditors and an internal audit assistant. The head of internal audit has been in post for twelve years, and the other members of the team have varying lengths of service from two to fifteen years.
The head of internal audit is responsible for recruiting staff into the internal audit team. The head of internal audit was appointed by the audit committee.
The head of internal audit reports to the audit committee and agrees the scope of work for the internal audit function with the audit committee.
The internal audit staff have no operational responsibility. Where the staff have previously transferred from another department within Murray Co, the head of internal audit ensures that another member of the team carries out the audit of that system.
Murray Co's internal audit function follows the International Standards for the Professional Practice of Internal Auditing issued by the Global Institute of Internal Auditors.
Barker Co's internal audit function
The internal audit function at Barker Co consists of a chief internal auditor, one senior internal audit manager, one audit manager, one auditor and an audit assistant. The chief internal auditor has been in post for ten years, and the other members of the team have varying lengths of service from five to nine years.
The finance director is responsible for recruiting all staff into the internal audit function. The chief internal auditor reports to the finance director and agrees the scope of work for the internal audit function with him.
The internal audit team spend 50% of their time carrying out internal audit assignments and 50% of their time working in the finance department. Due to the limited number of staff in the team, this has resulted in the internal auditors reviewing their own work.
Barker Co's internal audit team follow a variety of standards, in accordance with their own professional training.
Required:
Compare and contrast the effectiveness of Murray Co and Barker Co's internal audit functions.
Solution:
Reporting System
The chief internal auditor at Barker Co reports to the finance director, which limits the effectiveness of the reports due to a lack of independence. In contrast, Murray Co's chief internal auditor reports to the audit committee, which is a key strength that ensures objectivity.
Recruitment of Staff
At Barker Co, the finance director recruits all internal audit staff, which may lead to a lack of independence. At Murray Co, the head of internal audit is appointed by the audit committee and is responsible for recruiting the team, which is a more independent approach.
Scope of Work
The scope of work at Barker Co is decided by the finance director, which may result in a bias towards auditing certain areas and neglecting others. At Murray Co, the audit committee agrees on the scope of work, ensuring a more comprehensive and objective review.
Audit Work
Barker Co's internal audit team reviews its own work and has operational responsibilities, creating a self-review threat. Murray Co's internal audit staff has no operational responsibility, and work is arranged to avoid team members reviewing their own past work, which is a strong control against self-review threats.
Variation of Standards
Barker Co's staff follow a variety of standards, leading to inconsistency. Murray Co follows a single set of professional standards, which ensures uniformity and professionalism.
You are the senior manager in the internal audit department of Octball Co, a limited liability company. You report to the chief internal auditor and have a staff of six junior auditors to supervise, although the budget allows for up to ten junior staff.
In a recent meeting with the chief internal auditor, the difficulty of staff recruitment and retention was discussed. Over the past year, five junior internal audit staff have left the company, but only two have been recruited. Recruitment problems identified include the location of Octball Co's head office in a small town over 150 kilometres from the nearest major city and extensive foreign travel, often to cold climates. Together with the chief internal auditor you believe that outsourcing the internal audit department may be a way of alleviating the staffing problems. You would monitor the new outsourced department in a part-time role taking on additional responsibilities in other departments, and the chief internal auditor would accept the post of finance director (FD) on the board, replacing the retiring FD.
Two firms have been identified as being able to provide the internal audit service:
- The NFA Partnership (NFA), a large local firm specialising in the provision of accountancy and internal audit services. NFA does not audit financial statements or report to members.
- T&M, Octball Co's external auditors, who have offices in 75 countries and employ in excess of 65,000 staff.
Required:
(a) Discuss the advantages and disadvantages of appointing NFA as internal auditors for Octball Co. (8 marks)
(b) Discuss the matters T&M need to consider before they could accept appointment as internal auditors for Octball Co. (7 marks)
(c) Assume that an outsourcing company has been chosen to provide internal audit services. Describe the control activities that Octball Co should apply to ensure that the internal audit service is being maintained to a high standard. (5 marks)
(Total: 20 marks)
Solution:
Part (a): Advantages and disadvantages of appointing NFA
Advantages: NFA can provide a broad range of expertise and may be more cost-effective. As an independent firm, they can offer a high level of objectivity. They are also responsible for their own staff recruitment, training, and retention, which would solve Octball Co's staffing problems.
Disadvantages: NFA will lack the intimate knowledge of Octball Co's operations that an in-house team would have. The effectiveness of their work could be compromised if the fee is too low. As a local firm, they may still face challenges with the foreign travel requirement.
Part (b): Matters to consider for T&M
T&M must ensure their independence is maintained. Providing both internal and external audit services could create a self-review threat. They would need separate teams for each function. T&M must also have staff with the necessary skills for internal audit and be prepared to manage potential fee pressure from Octball Co. Their existing knowledge of Octball Co could be a benefit, but it must be managed carefully to ensure independence is not compromised.
Part (c): Control activities for outsourced service
Octball Co should implement controls to ensure a high standard of service from the outsourced firm. These include: setting clear performance measures, agreeing to the work plan in advance, and ensuring that the work is appropriately documented and reviewed according to a pre-defined methodology. Octball Co's management should also conduct their own review of the internal audit reports to ensure the quality of the work.
You are an audit senior working at Monkey, Mia & Co. You have been seconded to your firm's internal audit department to broaden your experience. You have been assigned to an internal audit assignment to test the effectiveness of the computer systems at a large company. Your firm won the contract to provide internal audit services to the company after the company took the decision to outsource its internal audit function and make the existing internal audit staff redundant.
(1) With which of the following should the internal auditor not be involved?
- A. Identifying deficiencies in internal controls
- B. Providing recommendations to management on how to overcome the deficiencies identified
- C. Implementing the new controls recommended
- D. Evaluating the effectiveness of the new controls implemented
(2) Which TWO of the following statements are TRUE?
- (i) Internal auditors always report directly to shareholders.
- (ii) The format of the independent external auditor's report is determined by management.
- (iii) The internal auditor's work may be determined by management.
- (iv) All external audits must be planned and performed in accordance with International Auditing Standards and other regulatory requirements.
(3) Which of the following is NOT part of the role of internal audit?
- A. Risk identification and monitoring
- B. Expression of opinion to the shareholders on whether the annual financial statements give a true and fair view
- C. Fraud investigations
- D. Assessing compliance with laws and regulations
(4) Which of the following is NOT a valid reason to outsource the internal audit function?
- A. The external audit will be more efficient as the external audit staff will have a good understanding of the company if they are also involved with the internal audit work
- B. Outsourcing may be more cost effective as compared with employing staff and providing training and other employment benefits
- C. A professional firm is likely to be more experienced and able to provide better recommendations for improvements
- D. Greater independence of an external service provider
(5) Identify whether the following statements are true or false.
- Internal audit reports must be produced in a standardised format as set out by the financial reporting framework
- Internal audit reports are issued to shareholders
- There is no legal requirement for companies to have an internal audit department
- The presence of an internal audit function may act as a deterrent for fraud
Solution:
(1) C. Internal auditors should not implement new controls as this would create a self-review threat when the controls are tested at a later date.
(2) D. Internal audit work may be determined by management or the audit committee if there is one. External audits must be conducted in accordance with ISAs.
(3) B. An audit opinion presented to the shareholders must be expressed by an independent external auditor.
(4) A. Ethical guidance requires separate teams to provide internal and external services. Therefore, the internal audit staff will not have knowledge gained from the external audit.
(5)
- Internal audit reports must be produced in a standardised format as set out by the financial reporting framework: False
- Internal audit reports are issued to shareholders: False
- There is no legal requirement for companies to have an internal audit department: True
- The presence of an internal audit function may act as a deterrent for fraud: True