Internal audit

The internal auditing profession evolved steadily with the progress of management science after World War II. It is conceptually similar in many ways to financial auditing by public accounting firms, quality assurance and banking compliance activities. While some of the audit technique underlying internal auditing is derived from management consulting and public accounting professions, the theory of internal auditing was conceived primarily by Lawrence Sawyer (1911–2002), often referred to as "the father of modern internal auditing";[6] and the current philosophy, theory and practice of modern internal auditing as defined by the International Professional Practices Framework (IPPF) of the Institute of Internal Auditors owes much to Sawyer's vision.

With the implementation in the United States of the Sarbanes–Oxley Act of 2002, the profession's exposure and value was enhanced, as many internal auditors possessed the skills required to help companies meet the requirements of the law . However, the focus by internal audit departments of publicly traded companies on SOX related financial policy and procedures derailed progress made by the profession in the late 20th century toward Larry Sawyer's vision for internal audit. Beginning in about 2010, the IIA once again began advocating for the broader role internal auditing should play in the corporate arena, in keeping with the IPPF's philosophy.[7]

While internal auditors are hired directly by their company, they can achieve independence through their reporting relationships. Independence and objectivity are a cornerstone of the IIA professional standards; and are discussed at length in the standards and the supporting practice guides and practice advisories. Professional internal auditors are mandated by the IIA standards to be independent of the business activities they audit. This independence and objectivity are achieved through the organizational placement and reporting lines of the internal audit department. Internal auditors of publicly traded companies in the United States are required to report functionally to the board of directors directly, or a sub-committee of the board of directors (typically the audit committee), and not to management except for administrative purposes.

The required organizational independence from management enables unrestricted evaluation of management activities and personnel and allows internal auditors to perform their role effectively. Although internal auditors are part of company management and paid by the company, the primary customer of internal audit activity is the entity charged with oversight of management's activities. This is typically the audit committee, a committee of the board of directors. Organizational independence is effectively achieved when the chief audit executive reports functionally to the board. Examples of functional reporting to the board involve the board:[8] Approving the internal audit charter; Approving the risk based internal audit plan; Approving the internal audit budget and resource plan; Receiving communications from the chief audit executive on the internal audit activity's performance relative to its plan and other matters; Approving decisions regarding the appointment and removal of the chief audit executive; Approving the remuneration of the chief audit executive; and Making appropriate inquiries of management and the chief audit executive to determine whether there are inappropriate scope or resource limitations.

Internal auditing activity is primarily directed at evaluating internal control. Under the COSO Internal Control Framework, internal control is broadly defined as a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of the following core objectives for which all businesses strive:

• Effectiveness and efficiency of operations.
• Reliability of financial and management reporting.
• Compliance with laws and regulations.
• Safeguarding of Assets

Management is responsible for internal control, which comprises five critical components: the control environment; risk assessment; risk focused control activities; information and communication; and monitoring activities. Managers establish policies, processes, and practices in these five components of management control to help the organization achieve the four specific objectives listed above. Internal auditors perform audits to evaluate whether the five components of management control are present and operating effectively, and if not, provide recommendations for improvement.

In the United States, the internal audit function independently assesses management's system of internal control and reports its results to top management and the company's audit committee of the board of directors.

Internal auditing professional standards require the function to evaluate the effectiveness of the organization's Risk management activities. Risk management is the process by which an organization identifies, analyses, responds, gathers information about, and monitors strategic risks that could actually or potentially impact the organization's ability to achieve its mission and objectives.

Under the COSO enterprise risk management (ERM) Framework, an organization's strategy, operations, reporting, and compliance objectives all have associated strategic business risks – the negative outcomes resulting from internal and external events that inhibit the organization's ability to achieve its objectives. Management assesses risk as part of the ordinary course of business activities such as strategic planning, marketing planning, capital planning, budgeting, hedging, incentive payout structure, credit/lending practices, mergers and acquisitions, strategic partnerships, legislative changes, conducting business abroad, etc. Sarbanes–Oxley regulations require extensive risk assessment of financial reporting processes. Corporate legal counsel often prepares comprehensive assessments of the current and potential litigation a company faces. Internal auditors may evaluate each of these activities, or focus on the overarching process used to manage risks entity-wide. For example, internal auditors can advise management regarding the reporting of forward-looking operating measures to the board, to help identify emerging risks; or internal auditors can evaluate and report on whether the board and other stakeholders can have reasonable assurance the organization's management team has implemented an effective enterprise risk management program.

In larger organizations, major strategic initiatives are implemented to achieve objectives and drive changes. As a member of senior management, the chief audit executive (CAE) may participate in status updates on these major initiatives. This places the CAE in the position to report on many of the major risks the organization faces to the audit committee, or ensure management's reporting is effective for that purpose.

The internal audit function may help the organization address its risk of fraud via a fraud risk assessment, using principles of fraud deterrence. Internal auditors may help companies establish and maintain Enterprise Risk Management processes.[9] This process is highly valued by many businesses for establishing and implementing effective management systems and ensuring quality is maintained & professional standards are met[10] Internal auditors also play an important role in helping companies execute a SOX 404 top-down risk assessment. In these latter two areas, internal auditors typically are part of the risk assessment team in an advisory role.

Internal auditing activity as it relates to corporate governance has in the past been generally informal, accomplished primarily through participation in meetings and discussions with members of the board of directors. According to COSO's ERM framework, governance is the policies, processes and structures used by the organization's leadership to direct activities, achieve objectives, and protect the interests of diverse stakeholder groups in a manner consistent with ethical standards. The internal auditor is often considered one of the "four pillars" of corporate governance, the other pillars being the board of directors, management, and the external auditor.[11]

A primary focus area of internal auditing as it relates to corporate governance is helping the audit committee of the board of directors (or equivalent) perform its responsibilities effectively. This may include reporting critical management control issues, suggesting questions or topics for the audit committee's meeting agendas, and coordinating with the external auditor and management to ensure the committee receives effective information. In recent years, the IIA has advocated more formal evaluation of corporate governance, particularly in the areas of board oversight of enterprise risk, corporate ethics, and fraud. See also § Three lines of defence below.

Based on the risk assessment of the organization, internal auditors, management and oversight boards determine where to focus internal auditing efforts. This focus or prioritization is part of the annual/ multi-year annual audit plan. The audit plan is typically proposed by the CAE (sometimes with several options or alternatives) for the review and approval of the audit committee or the board of directors. Internal auditing activity is generally conducted as one or more discrete assignments.

It should be adapted to the specific purpose of audit, and the selection of audit method must be adapted to its specific purpose. Otherwise, it will deviate from the purpose of the audit.[12]

A typical internal audit assignment[13] involves the following steps:

1. Establishing and communicating the scope and objectives of the audit to appropriate members of management.
2. Developing an understanding of the business area under review – this includes objectives, measurements & key transaction types and involves interviews and a review of documents – flowcharts and narratives may be created, if necessary.
3. Describing the key risks facing the business activities within the scope of the audit.
4. Identifying management practices in the five components of control used to ensure that each key risk is properly controlled and monitored. An internal audit checklist[14] can be a helpful tool to identify common risks and desired controls in the specific process or specific industry being audited.
5. Developing and executing a risk-based sampling and testing approach to determine whether the most important management controls are operating as intended.
6. Reporting issues and challenges identified and negotiating action plans with the management to address these problems.
7. Following-up on reported findings at appropriate intervals. Internal audit departments maintain a follow-up database for this purpose.

Audit assignment length varies based on the complexity of the activity being audited and internal audit resources available. Many of the above steps are iterative and may not all occur in the sequence indicated.

In addition to assessing business processes, specialists called information technology (IT) auditors review information technology controls.

Internal auditors typically issue reports at the end of each audit that summarize their findings, recommendations, and any responses or action plans from management. An audit report may have an executive summary – a body that includes the specific issues or findings identified and related recommendations or action plans, and appendix information such as detailed graphs and charts or process information. Each audit finding within the body of the report may contain five elements, sometimes called the "5 C's":

1. Condition: What is the particular problem identified?
2. Criteria: What is the standard that was not met? The standard may be a company policy or other benchmark.
3. Cause: Why did the problem occur?
4. Consequence: What is the risk/negative outcome (or opportunity foregone) because of the finding?
5. Corrective action: What should management do about the finding? What have they agreed to do and by when?

The recommendations in an internal audit report are designed to help the organization achieve effective and efficient governance, risk and control processes associated with operations objectives, financial and management reporting objectives; and legal/regulatory compliance objectives.

Audit findings and recommendations may also relate to particular assertions about transactions, such as whether the transactions audited were valid or authorized, completely processed, accurately valued, processed in the correct time period, and properly disclosed in financial or operational reporting, among other elements.

Following are the steps about how continuous improvement can be achieved through audit findings.

• Develop CAPAs to address quality issues.
• Train users or employees to develop effective audit processes or procedures.
• Maintain steady and healthy relation with suppliers, vendors, users, auditors and audit bodies.

Under the IIA standards, a critical component of the audit process is the preparation of a balanced report that provides executives and the board with the opportunity to evaluate and weigh the issues being reported in the proper context and perspective. In providing perspective, analysis and workable recommendations for business improvements in critical areas, auditors help the organization meet its objectives.

Internal audit functions may also develop functional strategies described in multi-year strategic plans. Professional guidance on building an Internal Audit strategic plan was issued by the Institute of Internal Auditors in July 2012 via a Practice Guide called Developing the Internal Audit Strategic Plan.[16] A key aspect of developing IA strategy is understanding the expectations of stakeholders, such as the audit committee and top management. This helps guide the IA function in its mission of helping the organization address the risks it faces. Specific topics considered in IA strategic planning include:

• Scope and emphasis: An IA function may be involved in addressing risks related to financial reporting, operations, legal and regulatory compliance, and the company strategy. There may also be special topics of interest to stakeholders that change considerably year-to-year.
• Portfolio of services: IA functions may provide traditional audit assurance across the risk spectrum as well as consulting project support in a variety of areas such as project management, data analysis, and monitoring of major company initiatives. Larger audit functions may establish specialty areas to handle their service portfolio.
• Competency development: The stakeholder expectations around scope and service portfolio determine what competencies the function needs, which drives decisions regarding hiring of specific skills and training programs. The internal audit function is often used as a "management training ground" to provide employees with a deeper knowledge of the company's operations before they are rotated into a management position.[17]
• Technology: IA functions use a variety of technology tools/software to support audit process workflow, statistical analysis, and obtaining data from systems.

Building the IA strategy may involve a variety of strategic management concepts and frameworks, such as strategic planning, strategic thinking, and SWOT analysis.[16]

• Certified Information Systems Auditor
• Chartered Institute of Internal Auditors
• Committee of Sponsoring Organizations of the Treadway Commission (COSO)
• Fraud deterrence
• Institute of Internal Auditors
• International Auditing and Assurance Standards Board
• International Register of Certificated Auditors
• IS audit
• Operational auditing
• Risk-based internal audit