Example 1 Saxophone Enterprises Co (Saxophone) has been trading for 15 years selling insurance and has recently become a listed company. In accordance with corporate governance principles Saxophone maintains a small internal audit department. The directors feel that the team needs to increase in size and specialist skills are required, but they are unsure whether to recruit more internal auditors, or to outsource the whole function to their external auditors, Cello & Co. Saxophone is required to comply with corporate governance principles in order to maintain its listed status; hence the finance director has undertaken a review of whether or not the company complies. Bill Bassoon is the chairman of Saxophone, until last year he was the chief executive. Bill is unsure if Saxophone needs more non-executive directors as there are currently three non-executive directors out of the eight board members. He is considering appointing one of his close friends, who is a retired chief executive of a manufacturing company, as a non-executive director. The finance director, Jessie Oboe, decides on the amount of remuneration each director is paid. Currently all remuneration is in the form of an annual bonus based on profits. Jessie is considering setting up an audit committee, but has not undertaken this task yet as she is very busy. A new sales director was appointed nine months ago. He has yet to undertake his board training as this is normally provided by the chief executive and this role is currently vacant. There are a large number of shareholders and therefore the directors believe that it is impractical and too costly to hold an annual general meeting of shareholders. Instead, the board has suggested sending out the financial statements and any voting resolutions by email; shareholders can then vote on the resolutions via email. (a) Explain the advantages and disadvantages for each of Saxophone Enterprises Co AND Cello & Co of outsourcing the internal audit department. Answer: Advantages/disadvantages of outsourcing internal audit department Saxophone Advantages 1. Staffing: Saxophone Enterprises Co (Saxophone) wishes to expand its internal audit department in terms of size and specialist skills. If they outsource, then there will be no need to spend money in recruiting further staff as Cello & Co (Cello) will provide the staff members. 2. Immediate solution: As the current internal audit department is small, then outsourcing can provide the number of staff needed straight away. 3. Skills and experience: Cello is likely to have a large pool of staff available to provide the internal audit service to Saxophone. In addition, the audit firm is likely to have staff with specialist skills already available. 4. Cost savings: Outsourcing can be an efficient means to control the costs of internal audit as any associated costs such as training will be eliminated as Cello will train its own employees. In addition, the costs for the internal audit service will be agreed in advance. This will ensure that Saxophone can budget accordingly. 5. Flexibility: If the internal audit department is outsourced, Saxophone will have total flexibility in its internal audit service. Staff can be requested from Cello to suit the company’s workloads and requirements. This will ensure that, when required, extra staff is readily available for as long or short a period as needed. 6. Set up time: The department can be set up in a few weeks rather than taking months to advertise and recruit appropriate staff. Disadvantages 1. Existing internal audit department: Saxophone has an existing internal audit department; if they cannot be redeployed elsewhere in the company, then they may need to be made redundant and this could be costly for Saxophone. Staff may oppose the outsourcing if it results in redundancies. 2. Increased costs: As well as the cost of potential redundancies, the internal audit fee charged by Cello may over a period of time increase, proving to be very expensive. 3. Knowledge of company: Cello will allocate available staff members to work on the internal audit assignment; this may mean that each visit the staff members are different and hence they may not fully understand the systems of Saxophone. This will decrease the quality of the services provided and increase the time spent by Saxophone’s employees in explaining the system to the auditors. 4. Loss of in-house skills: If the current internal audit team is not deployed elsewhere in the company, valuable internal audit knowledge and experience may be lost. If Saxophone then decided at a future date to bring the service back in-house, this might prove to be too difficult. 5. Confidentiality: Knowledge of company systems and confidential data will be available to Cello. Although the engagement letter would provide confidentiality clauses, this may not stop breaches of confidentiality. 6. Control: Saxophone currently has more control over the activities of its internal audit department; however, once outsourced it will need to discuss areas of work and timings well in advance with Cello. Cello Advantages 1. Additional fees for Cello: The audit firm will benefit from the internal audit service being outsourced as this will generate additional fee income. However, the firm will need to monitor the fees to ensure that they do not represent too high a percentage of their total fee income. As a public interest company, fee income should not represent more than 15% of gross practice income for two consecutive years. Disadvantages 1. Independence: If Cello provides both external audit and internal audit services, there may be a selfreview threat especially where the internal audit work is relied upon by the external auditor team. The firm would need to take steps to ensure that separate teams are put in place as well as additional safeguards. Example 2 (June 2011) Goofy Co’s year end is 31 December, which is traditionally a busy time for NAB & Co. Goofy Co currently has an internal audit department of five employees but they have struggled to undertake the variety and extent of work required by the company, hence Goofy Co is considering whether to recruit to expand the department or to outsource the internal audit department. If outsourced, Goofy Co would require a team to undertake monthly visits to test controls at the various shops across the country, and to perform ad hoc operational reviews at shops and head office. Goofy Co is considering using NAB & Co to provide the internal audit services as well as remain as external auditors. Discuss the advantages and disadvantages to both Goofy Co and NAB & Co of outsourcing their internal audit department. Answer: Advantages of outsourcing Goofy Co’s internal audit department 1. Staffing Goofy Co needs to expand its internal audit department from five employees as it is too small; however, if they outsource then there will be no need to recruit as NAB & Co will provide the staff members and this will be an instant solution. 2. Skills and experience NAB & Co is a large firm and so will have a large pool of staff available to provide the internal audit service. In addition, Goofy Co has requested that ad hoc reviews are performed and, depending on the nature of these, it may find that the firm has specialist skills that Goofy Co may not be able to afford if the internal audit department continues to be run internally. 3. Costs Any associated costs such as training will be eliminated as NAB & Co will train its own employees. In addition, the costs for the internal audit service will be agreed in advance. This will ensure that Goofy Co can budget accordingly. As NAB & Co will be performing both the external and internal audit there is a possibility that the fees may be reduced. 4. Flexibility With the department being outsourced Goofy Co will have total flexibility in its internal audit service. Staff can be requested from NAB & Co to suit Goofy Co’s workloads and requirements. This will ensure that, when required, extra staff can be used to visit a large number of shops and in quieter times there may be no internal audit presence. 5. Additional fees NAB & Co will benefit from the internal audit service being outsourced as this will generate additional fee income. However, the firm will need to monitor the fees to ensure that they do not represent too high a percentage of their total fee income. Disadvantages of outsourcing Goofy Co’s internal audit department 1. Knowledge of systems NAB & Co will allocate available staff members to work on the internal audit assignment, this may mean that each month the staff members are different and hence they may not understand the systems of Goofy Co. This will decrease the quality of the services provided and increase the time spent by Goofy Co employees explaining the system to the auditors. 3. Independence If NAB & Co continues as external auditor as well as providing the internal audit service, there may be a selfreview threat, where the internal audit work is relied upon by the external auditors. NAB & Co would need to take steps to ensure that separate teams were put in place as well as additional safeguards. 3. Existing internal audit department Goofy Co has an existing internal audit department of five employees. If they cannot be redeployed elsewhere in the company then they may need to be made redundant and this could be costly for the company. Staff may oppose the outsourcing if it results in redundancies. 4. Cost As well as the cost of potential redundancies, the internal audit fee charged by NAB & Co may, over a period of time, prove to be very expensive. 5. Loss of in-house skills If the current internal audit team is not deployed elsewhere in the company valuable internal audit knowledge and experience may be lost; if Goofy Co then decided at a future date to bring the service back in-house this might prove to be too difficult. 6. Timing NAB & Co may find that Goofy Co requires internal audit staff at the busy periods for the audit firm, and hence it might prove difficult to actually provide the required level of resource. 7. Confidentiality Knowledge of company systems and confidential data will be available to NAB & Co. Although the engagement letter would provide confidentiality clauses, this may not stop breaches of confidentiality. 8. Control Goofy Co will currently have more control over the activities of its internal audit department; however, once outsourced it will need to discuss areas of work and timings well in advance with NAB & Co. Example 3 (Paper Specimen 2014) (b) Distinguish between internal and external audit. Internal Audit External Audit 1. The main objective of the external 1. The main objective of internal audit is to auditor is to express an opinion on the truth and fairness of the financial Objective improve a company’s operations, by reviewing the efficiency and effectiveness of the company’s internal controls. statements. 2. Internal auditors normally report to 2. External auditors report to management the shareholders or members of the company. or those charged with governance. Internal audit reports are not Reporting External audit reports are contained within publicly available and are only intended to be seen by the addressee of the report. The the financial statements and hence are reports are normally provided to the board publicly available. of directors and those charged with governance such as the audit committee. 3. The internal auditor can have a wide scope of work and it is determined by the 3. The external auditor’s work is limited to requirements of management or those Scope of work verifying the truth and fairness of the charged with governance. Commonly internal audit focus on the company’s financial statements of the company. internal control environment, but any other area of a company’s operations can be reviewed. 4. Internal auditors are appointed by 4. External auditors are appointed by the company’s shareholders. independent of the company. They are Relationship management. As internal auditors are with company normally employees of the company they lack independence. However, the internal audit department can be outsourced and this can increase their independence. Example 4 (June 2009) Contrast the role of internal and external auditors. Role of internal and external auditors – differences Objectives The main objective of internal audit is to improve a company’s operations, primarily in terms of validating the efficiency and effectiveness of the internal control systems of a company. The main objective of the external auditor is to express an opinion on the truth and fairness of the financial statements, and other jurisdiction specific requirements such as confirming that the financial statements comply with the reporting requirements included in legislation. Reporting Internal audit reports are normally addressed to the board of directors, or other people charged with governance such as the audit committee. Those reports are not publicly available, being confidential between the internal auditor and the recipient. External audit reports are provided to the shareholders of a company. The report is attached to the annual financial statements of the company and is therefore publicly available to the shareholders and any reader of the financial statements. Scope of work The work of the internal auditor normally relates to the operations of the organisation, including the transaction processing systems and the systems to produce the annual financial statements. The internal auditor may also provide other reports to management, such as value for money audits which external auditors rarely become involved with. The work of the external auditor relates only to the financial statements of the organisation. However, the internal control systems of the organisation will be tested as these provide evidence on the completeness and accuracy of the financial statements. Relationship with company In most organisations, the internal auditor is an employee of the organisation, which may have an impact on the auditor’s independence. However, in some organisations the internal audit function is outsourced. The external auditor is appointed by the shareholders of an organisation, providing some degree of independence from the company and management. Example 5 (Matalas Co) Explain the issues which limit the independence of the internal audit department in Matalas Co. Recommend a way of overcoming each issue. Answer: Factors limiting independence of internal audit 1. Reporting system The chief internal auditor reports to the finance director. This limits the effectiveness of the internal audit reports as the finance director will also be responsible for some of the financial systems that the internal auditor is reporting on. Similarly, the chief internal auditor may soften or limit criticism in reports to avoid confrontation with the finance director. To ensure independence, the internal auditor should report to an audit committee. 2. Scope of work The scope of work of internal audit is decided by the finance director in discussion with the chief internal auditor. This means that the finance director may try and influence the chief internal auditor regarding the areas that the internal audit department is auditing, possibly directing attention away from any contentious areas that the director does not want auditing. To ensure independence, the scope of work of the internal audit department should be decided by the chief internal auditor, perhaps with the assistance of an audit committee. 3. Audit work The chief internal auditor appears to be auditing the controls which were proposed by that department. This limits independence as the auditor is effectively auditing his own work, and may not therefore identify any mistakes. To ensure independence, the chief internal auditor should not establish control systems in Matalas. However, where controls have already been established, another member of the internal audit should carry out the audit of petty cash to provide some limited independence. 4. Length of service of internal audit staff All internal audit staff at Matalas have been employed for at least five years. This may limit their effectiveness as they will be very familiar with the systems being reviewed and therefore may not be sufficiently objective to identify errors in those systems. To ensure independence, the existing staff should be rotated into different areas of internal audit work and the chief internal auditor independently review the work carried out. 5. Appointment of chief internal auditor The chief internal auditor is appointed by the chief executive officer (CEO) of Matalas. Given that the CEO is responsible for the running of the company, it is possible that there will be bias in the appointment of the chief internal auditor; the CEO may appoint someone who he knows will not criticise his work or the company. To ensure independence, the chief internal auditor should be appointed by an audit committee or at least the appointment agreed by the whole board. Example 6 Question Bush-Baby Hotels Co operates a chain of 18 hotels located across the country. Each hotel has bedrooms, a restaurant and leisure club facilities. Most visitors to the restaurant and leisure club are hotel guests; however, these facilities are open to the public as well. Hotel guests generally charge any costs to their room but other visitors must make payment directly to the hotel staff. During the year, senior management noticed an increased level of cash discrepancies and inventory discrepancies, and they suspect that some employees have been stealing cash and goods from the hotels. They are keen to prevent this from reoccurring and are considering establishing an internal audit department to undertake a fraud investigation. Describe the limitations of Bush-Baby Hotels Co establishing and maintaining an internal audit department. Limitations of establishing and maintaining an internal audit department The internal auditors of Bush-Baby will be employees of the company and so this can impair their independence, as they may not report issues to those charged with governance for fear of losing their job. Although some internal auditors are professionally qualified, there is no requirement to be qualified, as there is for external auditors. Hence, there may be gaps in the experience and technical knowledge of the internal audit department. The cost of establishing an internal audit department can be significant; hence prior to recruiting a team, the management of Bush-Baby should consider carefully the roles the team can perform and whether this will generate sufficient value for money. As Bush-Baby has not previously had any form of internal audit, there may be some resistance from employees of the company. They may be uncomfortable with the idea of their work being reviewed, especially if the first role of the department is to undertake fraud investigations. Example 7 (South Lea Co) Compare the responsibilities of the external and internal auditors to detect fraud. 1. Fraud and External/Internal audit Guidance on the auditor’s responsibility with respect to fraud can be found in ISA 240 The Auditor’s Responsibility to Consider Fraud in an Audit of Financial Statements. 2. Main reason for audit work The external auditor is primarily responsible for the audit opinion on the financial statements. The main focus of audit work is therefore to ensure that the financial statements show a true and fair view. The detection of fraud is therefore not the main focus of the external auditor’s work. The main focus of the work of the internal auditor is checking that the internal control systems in a company are working correctly. Part of that work may be to conduct detailed review of systems to ensure that fraud is not taking place. 3. Materiality In reaching the audit opinion and performing audit work, the external auditor takes into account the concept of materiality. In other words, the external auditor is not responsible for checking all transactions. Audit procedures are planned to have a reasonable likelihood of identifying material fraud, However, internal auditors may carry out a detailed review of transactions, effectively using a much lower materiality limit. It is more likely that internal auditors will detect fraud from their audit testing. 4. Identification of fraud In situations where the external auditor does detect fraud, then the auditor will need to consider the implications for the entire audit. In other words, the external auditor has a responsibility to extend testing into other areas because the risk of providing an incorrect audit opinion will have increased. Where internal auditors detect fraud, they may extend testing into other areas. However, audit work is more likely to focus on determining the extent of fraud and ensuring similar fraud has not occurred in other locations.
