Internal audit is carried out by professionals who understand an organisation’s systems, processes and workflows. It measures the adequacy and effectiveness of the internal control systems built to counter the risks that could stand in the way of the company’s objectives. It is defined as an independent, objective assurance and advisory activity. Its purpose is less to find fault than to close gaps and add value.
Today internal audit covers regulatory compliance, performance, financial, information technology and systems audits. The guiding principle is a risk-based approach: audit resources are directed to the areas that carry the highest risk to the company’s objectives.
Internal audit helps the people who work in a company’s departments, and its management, carry out their activities more efficiently. Through risk, control and testing work, it contributes to the assessment of effectiveness and supports the company in reaching its objectives. When giving assurance it stays within the data examined; where the company needs it, it acts as an objective party and offers advice.
The internal audit process
The process begins with defining the audit areas and ends with follow-up. Each step provides the input for the next.
- Defining audit areas. For companies with several locations, we establish which units will be audited and to what extent, and decide whether the audit will take a broad scope or focus on areas seen as high-risk.
- Defining risk criteria. Risks inside and outside the company are not static, so risks to objectives are reassessed systematically every year, with their likelihood and potential impact analysed.
- Rating and prioritising risks. Risks are ranked by size, significance and timing, and the priority for action is set.
- Selecting a response. For each risk, one approach is chosen: accept, transfer, reduce, control, or avoid the activity.
- Allocating the data to be audited. The information and documents needed in areas requiring control are collected in full.
- Planning and approval. Responsible officers and managers draw up the audit plan together, and it takes effect once management approves it.
- Execution. The audit is tracked through its workflow, with spot checks where needed.
- Reporting. Findings, assessments and recommendations are reported to management.
- Follow-up. We track whether the agreed actions have been implemented and the risks addressed.
Types of audit
- Compliance audit
- Performance audit
- Financial audit
- Information technology audit
- Systems audit
Internal control
Internal control is the set of mechanisms that ensure a company’s activities comply with regulation, improve the effectiveness of its operations and keep workflows running smoothly. It is not a check applied at certain points and times; it is a continuous process that covers every unit and function.
An effective control environment calls for professional values and honest management, authority and responsibility placed with competent people, adherence to standards, prevention of transactions that breach regulation, and transparency. Companies that build, operate and keep improving such an environment tend to strengthen their position in their sector over time.
How internal audit and internal control relate
The two concepts are distinct but complementary. Internal control is the design and operation of the control mechanisms that reduce the impact of risk. Internal audit tests the accuracy and reliability of those controls, evaluates them and reports to management. Management learns most of what it knows about internal controls from internal audit reports.
Responsibilities of the internal auditor
- Evaluate management and internal control systems
- Examine whether resources are used effectively and efficiently
- Verify the accuracy of information and records
- Audit legal compliance
- Audit the systems behind financial management and control
- Check that spending and decisions are consistent with the company’s objectives, policies and plans
- Report irregularities to management
- Recommend improvements and follow up on their implementation
Frequently asked questions
What do internal auditors do?
Internal auditors evaluate a company’s internal control from an objective and impartial standpoint. They report their findings to senior managers, giving the company a fuller picture of itself. Effective internal audit is carried out by experienced specialists who know the sector.
What is the value of internal audit to a company?
Internal auditors assess financial risks and conditions by looking at broad matters such as the company’s reputation, its impact on the environment and the competence of its people. By monitoring and improving business processes through advice, they help companies sustain stable growth.
How does internal audit differ from external audit?
External audit sits within financial reporting: it gives an opinion on the financial statements to establish their reliability. Internal audit covers all of a company’s risk categories; it evaluates and improves the internal control system and develops solutions to the risks it finds.
Why does internal audit matter?
The internal auditor assesses significant risks, reports them to management and highlights the processes that need improvement. Its role is to protect and enhance organisational value by providing risk-based, objective assurance, advice and insight.
What should be done to build a strong control environment before an external audit?
Carry out the necessary risk assessments, keep the external auditor informed about the control process, monitor changes in the control environment and revisit risk and control results, and secure assurance with management on the company’s objectives.
