MODULE 13
INTERNAL AUDIT
ADB Private Sector Development Initiative
Corporate Governance Training
Solomon Islands
Originally by
Dr Judy Taylor
Acknowledgement
These materials were produced by Dr Judy Taylor from La Trobe University, through the Asian Development
Bank’s Pacific Private Sector Development Initiative (PSDI). PSDI is a regional technical assistance facility cofinanced by the Asian Development Bank, Australian Aid and the New Zealand Aid Programme.
Module 13 Outline
•
•
Audit – internal and external
Role of Internal Audit
•
•
•
•
•
•
•
Internal audit committee
Position of internal audit within the company’s financial
structure
Combatting corruption
External Audit
Internal Audit Charter
Responsibilities of internal audit committee
Internal Audit Reporting
Audit
•
•
Is the expression of an opinion
An opinion that the accounts
•
•
•
•
Give a true and fair view of the matters to which they relate
Comply with any applicable regulations made under the act.
External Audit required under S126 and 127
If
•
•
•
It’s a public company
The company’s rules require it
A shareholder or shareholders holding shares that together carry
the right to receive more than 20% of distributions made by the
company give written notice to the company before the end of
the accounting period requiring the financial statements to be
audited.
Audit
External auditors, required by law for public companies focus on the accuracy and
compliance of the annual report and financial statements. They must be separate from
the company’s governance, internal control or ownership structure.
Appointed by Board under advice from Internal Audit Committee.
Internal auditors work with management to systematically review systems and
operations.
•
internal audit is fundamental to good governance
•
"Internal auditing is an independent, objective assurance and consulting activity
designed to add value and improve an organization’s operations. It helps an
organization accomplish its objectives by bringing a systematic, disciplined
approach to evaluate and improve the effectiveness of risk management, control
and governance processes.”
The existence of a strong Internal audit team is as a reflection of the
company's attitude to control and good governance.
International Professional Practices Framework (IPPF), The Institute of Internal Auditors Research Foundation, Florida
USA, January 2011
Audit
The roles of internal audit and the external auditors differ
substantially and provide very different assurance to the audit
committee and management, namely:
•
Internal auditors review and test internal financial
controls at a significantly lower level of materiality than do
external auditors. They often review a much broader range of
risks than those for external financial reporting.
•
External audits are designed to report on historical
data, whereas internal audits are generally focused on the
efficiency and effectiveness of current and future operations.1
1. 20 Questions Directors Should Ask about Internal Audit, Second Edition, John Fraser, CA, CIA, CISA Hugh Lindsay, FCA, CIP, Canadian Institute of
Chartered Accountants. 2007
Role of Internal Audit
•
Internal Audit is an audit conducted by employees
of the company to determine and review;
•
•
•
The Integrity of financial accounts
Compliance by the company with ‘all’ relevant
legislation
If risk and management policies and practices are
appropriate and being followed.
Role of Internal Audit
Position of internal audit within the company’s
financial structure
• Internal audit is completely separate from the other
financial divisions of a company
• Audit staff should not have any responsibilities for
the preparation of the financial statements,
recording of payments or reporting on budgets, or
any delegated financial responsibilities
• See flow chart slide 11.
Qualities of Internal Auditors
Integrity
Integrity establishes trust. Without trust their judgement will not
be accepted.
Objectivity
Objectivity in gathering, evaluating, and communicating
information about the activity, system or process being
examined.
Confidentiality
internal auditors must not disclose information they receive
without appropriate authority unless there is a legal or
professional obligation to do so.
Competency
Have knowledge, skills, and experience to undertake the task.
Internal Audits
•
Types of internal audits
•
•
•
•
•
•
•
Compliance audits
Operational reviews
Risk and control self-assessments
System based audits
Performance audits
IT audits
Specific one off assignments
Financial Governance
ABoard of
Directors
Financial
and
budgeting
Human
Resources
Budgeting
and
Planning
Financial
Reporting
Receipts
Payments
subcommittee
Audit
compliance
and risk
management
Internal
Auditor
Audit
Team
External
Auditor
AUDIT
Board of Directors
Financial
expert
CEO
Internal Audit
committee
Legal
Internal
Auditor
Financial
Compliance
expert
Internal Audit Team
External
Auditor
Role of Internal Audit
•
•
•
•
Internal Audit is overseen by a sub-committee of the
Board
Board determines the scope of the committees
responsibilities and provides a charter to the Audit
Committee listing these responsibilities
Board retains overall responsibility to the accounts
and financial reporting even though it has been
delegated to a committee
Existence of Audit Committee does not reduce the
Boards overriding responsibility in these matters.
Role of Internal Audit
•
•
•
•
Audit committee provides important information to
the board
It is the final step in financial governance
Provides board protection and assistance. But, to be
effective the Audit Committee must be independent
Internal Audit, by ensuring the integrity of
procedures and accounts is a major tool in
combatting internal corruption.
Audit Charter
An Audit Charter will usually address;2
•
Purpose of committee
•
Authority of committee
•
Composition of committee
•
Chair of committee
•
Meetings
•
Responsibilities
•
Fraud
•
Reporting responsibilities
•
Evaluating performance
•
Review of Charter
2. Audit Committees, A Guide to Good Practice, Second Edition. Australian Institute of Company Directors, 2012This next section draws
extensively on this book.
Audit Charter
•
Purpose of committee
•
Assist board to discharge its duties and responsibilities
in relation to
•
•
•
•
Financial statements and financial reporting
Risk management
Internal control
Internal policies
Audit Charter
•
Authority of committee
•
•
•
•
•
•
•
Recommend external auditor and remuneration to full board
Determine terms for external auditor
Oversee external auditor
Meet with external auditors, independent counsel, or other
advisors as necessary
Engage independent legal counsel, accountants, or external
advisors to perform and complete their duties
Unrestricted access to employees and company information
Require management to report to them.
Audit Charter
•
Composition of committee
•
•
Because of required independence of audit the members
should be non-executive board members, usually at least 3
members. They should possess the appropriate skills to
perform their role, be financially literate and at least one
should be an accountant.
Chair of committee
•
•
•
Should be independent not the Chair of Board
Their role is to promote effective communication across the
organization, senior management, CEO, CFO other
committees
Call and run meetings, ensure proper committee papers and
reports, agendas and minutes are maintained
Audit Charter
•
Meetings
•
Usually 4 meetings per year,
•
attendance expected at ALL meetings
•
•
•
Even via Skype or electronic means
Closed meeting
Others attend by invitation
Audit Charter
•
Responsibilities (from purpose)
•
•
•
•
•
Financial reporting
Working with external auditor
Internal audit activity
Risk management and internal control
Compliance with laws, internal policies, ethics, fraud
detection
Audit Charter - Fraud
Enquire to management, internal audit, external auditor,
•
•
•
Regarding suspicion, allegation, or knowledge of fraud,
noting frequency and extent of any incidences.
Their assessment of possible material misstatement of
financial statements due to fraud.
Obtain assurances from management that all cases of
fraud, suspected fraud have been disclosed
•
Letter provides assurances regarding
•
•
•
Financial report Financial information provided
Management acknowledges responsibility for maintenance and
implementation of Internal control procedures
Audit Charter
•
Reporting responsibilities
•
•
•
•
To Board, regularly
Bring to boards attention any significant financial
matters
Prepare reports for board on the outcome of audit
Evaluating performance
•
•
Collectively and individually on a regular basis
Identify and assess committee’s achievements
Audit Charter
•
Review of audit committee
•
•
•
Charter must be reviewed by board each year
Suggested changes should be discussed at board level
Charter must be reapproved by board each year
Responsibilities of internal audit committee
•
Financial reporting
•
Reviewing
•
•
•
•
•
•
•
•
financial information before it is presented to the board
Announcements to the markets
Investor presentations
Media releases
Consider if annual financial reporting complies with legal
and accounting requirements and presents a true and fair
position of the company
Consider if notes that are attached to financial statement's
are prepared on on-going concern basis appropriately
Consider if other information in annual report is consistent
with financial report
Whether any other information should be disclosed.
Responsibilities of internal audit committee
- Responsibilities
•
Financial reporting (cont.)
•
•
Decide on public disclosure of information, continuous disclosure,
earning revision statements
How?
•
•
Sampling transactions
Require management to report on
•
•
•
•
accounting policies used, changes to them and how decision were
made
How and why significant one-off complex or unusual transactions
have been treated
Significant estimates and judgments exercised by management
Process to ensure all necessary information is brought to
Management’s attention.
Responsibilities of internal audit committee
- Responsibilities
•
•
•
•
Processes to identify related party transactions
Processes to ensure compliance with laws, regulations and
external bodies.
Ideally the internal audit committee would request and
receive a letter from management, CEO and CFO
providing assurances, in relation to these matters
May request External auditor to report on
•
•
•
Procedures for accounting policies procedures and internal
controls
Materiality test used in audit
Managements technical competence and compliance with
accounting requirements
Responsibilities of internal audit committee
- Responsibilities
•
Financial reporting (cont.)
•
External reporting
•
•
•
Review all documents sent to external bodies
Review the reporting of entity’s main corporate governance
practices
Review Investor presentations, analyst briefings and media
releases
Responsibilities of internal audit committee
- Responsibilities
•
Working with external auditor
•
•
•
•
•
•
•
•
Make recommendations to board on appointment and term
of external auditor
Liaise with external auditor
Agree on terms of external auditor
Review decision to replace external auditor
Review independence of external auditor
Meet privately with external auditor
Invite external auditor to attend meetings of internal audit
committee
Evaluate performance of external auditor
Responsibilities of internal audit committee
- Responsibilities
•
Internal audit activity
•
•
•
•
•
•
•
•
Make recommendation on appointment remuneration and
term of Chief Audit Executive, CAE,
Review internal audit activity plan
Maintain independence of Internal Audits charter and
ensure sufficiency of resources to execute.
Monitor and review audit plan
Review and approve scope of audit plan and work program
Meet with internal auditor privately at least once per year
Receive, review and note audit findings and implications
Overseeing, evaluation and monitoring quality of internal
audit, external audit, risk and compliance.
Responsibilities of internal audit committee
- Responsibilities
•
•
Risk management and internal control
The board is responsible for the risk taken by the entity
but may delegate to the audit committee
•
•
Review if the entity has an effective risk management system
Understanding and managing material risks faced by
business, specifically in regard to
•
•
•
•
•
•
Significant business risks
Breakdown of key process
Disaster planning
Environmental planning
Fraud and theft
Business continuity
Responsibilities of internal audit committee
- Responsibilities
•
Risk management and internal control
•
•
•
•
•
Monitoring risk identification processes re above
Receiving summary reports from management on suspected
and actual fraud, material breaches of laws and ensure
appropriate reporting to authorities
Assessing adequacy of insurable interests
Monitor and evaluate appropriateness of internal control
systems via discussions with management and external
auditors
Meet periodically with key management and liaise with
other board members
Responsibilities of internal audit committee
- Responsibilities
•
Compliance with laws, internal policies, ethics
•
Unethical behaviour or non compliance with laws and ethics
can cause severe financial and reputational damage to an
entity. As such some oversight of ethical behaviour is often
given to the internal audit committee. The committee should
•
•
•
•
•
•
Stay informed of laws, regulations, industry codes or good
corporate governance policies in industry
Ensuring a code of conduct is in place
Process for approving and reviewing such policies
Identifying early adverse trends
Reviewing management disclosure in financial statements on
ethical issues
Receive advise from external auditor on above.
Responsibilities of internal audit committee
- Responsibilities
Fraud
• Managing strong systems to deter, detect and prevent fraud
are key expressions of control and good governance by the
entity, these include
•
•
•
•
•
•
Ascertaining whether fraud risks are included in risk policy
Review managements efforts to maintain strong internal control
Review managements communications with employees regarding
ethical behaviour
Inquiring of Management, internal auditor, external audit their
assessments of risk policies, material risk misrepresentations due to
fraud, and frequency of such events
Monitoring actions to remedy such events
Obtain representations from management regarding their
knowledge, suspected knowledge of fraud or alleged fraud.