Internal audit is an independent and objective activity providing assurance and advice to add value and improve an organisation’s operations, by evaluating the effectiveness of governance, risk management and internal control through a systematic approach.
1 Two roles, not one
| Assurance engagements | Advisory engagements | |
|---|---|---|
| Purpose | Giving an independent opinion on an existing state of affairs | Helping management improve something before it is implemented |
| Who sets the scope | Internal audit | By agreement with the requesting party |
| Parties | Three: the auditor, the audited area, the user of the report | Two: the auditor and the requesting party |
| Example | Auditing the procurement cycle | Commenting on the design of a new procedure before it is approved |
A line that is not crossed
An auditor may advise on the design of a control; they may not implement or approve it. If they did, they would later be auditing their own work, and their objectivity would be gone.
2 Independence and objectivity
- Independence is organisational: the chief audit executive reports functionally to the audit committee, and administratively to the CEO only to the extent that it does not impair independence.
- Objectivity is personal: the auditor’s impartiality, and not letting influence, interest or kinship change their judgement.
- Disclosing conflicts of interest: an auditor should not audit an activity they were responsible for within a reasonable period.
- Free access: to all records, people and assets needed for the engagement, without seeking permission from the area being audited.
3 The internal audit charter
A document approved by the board or the audit committee, and the function’s point of reference in any dispute. It covers:
Purpose
Why the function exists
Authority
The right of access and inspection
Scope
What the audit covers
Reporting line
Who the reports go to
Standards
Commitment to the professional standards
Without an approved charter, audit becomes a guest in every department, allowed in only as far as it pleases
4 How it differs from neighbouring functions
| Internal audit | External audit | Compliance | |
|---|---|---|---|
| Reports to | The audit committee, inside the organisation | Independent, outside the organisation | Management, with an independent reporting line |
| Scope | Governance, risk and controls as a whole | Primarily the financial statements | Regulatory requirements and policies |
| Beneficiary | The board and management | Shareholders and external parties | Management and the regulators |
| Frequency | A continuous annual plan | Usually annual | Continuous |
The event: a supplier was paid without an approved purchase order.
Compliance asks: did we breach the procurement policy and a regulatory requirement?
Internal audit asks: how often has this happened? Why did the system allow it? Which control is missing? — and then recommends a root-cause fix.
External audit asks: did this materially affect the accuracy of the financial statements?
Lesson summary
- Internal audit is an independent, objective activity, both assurance and advisory, that adds value.
- It advises on the design of controls but does not implement them, so that it can still audit them.
- Independence is organisational, through the link to the audit committee; objectivity is personal, through impartiality.
- The approved charter is the reference for authority, scope and reporting line.
- It differs from external audit in reporting line, scope and beneficiary, and from compliance in depth and role.
5 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. The internal auditor was asked to write and approve the new procurement procedure. What should they do?
Advice is permitted; implementing and approving would cost them their objectivity when the procedure is later audited.
2. Whom does the chief audit executive report to functionally?
The functional link to the audit committee is what protects the independence of the function and its reports.
3. What defines internal audit’s authority and scope?
The charter is an approved reference document; without it, audit’s authority is renegotiated on every engagement.