INTERNAL AUDIT AND REVIEW.

This topic has featured in almost every sitting of paper F8 and therefore it is very important
that you understand what internal auditing is and how it differs from external auditing as
there is a good chance it could be examined again.
Internal auditing: An appraisal activity established within an entity as a service to the entity. Its functions
include, amongst other things, examining, evaluating and monitoring the adequacy and effectiveness of internal
control. Internal auditors provide assurance about a sound internal control system which enhances the reliability of
the external financial information of the employer. (IAASB)

In accordance with the UK Turnbull report, the need for an internal audit function is influenced by:
• Scale, diversity and complexity of company’s operations.
• Number of Employees.
• Cost-benefit considerations.
• Changes in key risks.
• Changes in organizational structures, systems and processes.
• Increase number of unexplained or unacceptable events.
• Problems with internal control systems.

Distinction between internal and external audit

Although many of the techniques internal and external auditors use are similar, the basis and reasoning of their
work are different.
• Scope: The external audit is focused on the financial statements, whereas the
internal audit is focused on the operations of the entire business.
• Purpose: Internal audit is an activity designed to add value and improve an organization’s
operations while external audit is an exercise to enable auditors to express an opinion on the financial
statements.
• Reporting line: Internal audit reports to the board of directors, or other people charged with
governance, such as the audit committee and such reports are for internal consumption only by the directors
and management of the company, while the external auditors report to the shareholders or members of a
company on the truth and fairness of the accounts, this report usually is publicly available.
• Relationship: Internal auditors are very often employees of the organization, although sometimes
the internal audit function is outsourced. External auditors are independent of the company and its
management. They are appointed by the shareholders.
• Regulation: Internal auditing is not regulated in the same ways as statutory external auditing. There
are no legal requirements associated with becoming an internal auditor. Internal auditor's work is set by
company policy. In contrast to external auditors, internal auditors are not required to be members of a
professional body such as the ACCA.
• Reports: external auditor’s reports are also highly regulated both professionally and statutorily. For
example, ISA 700 and 701 contains detailed guidance on the format of both unmodified and modified
reports respectively. This is not so for internal audit reports as there is no standard form of presentation.

Scope and objectives of the internal audit function:

• Review of accounting and internal control (financial and otherwise) systems for adequacy of
design and operating effectiveness.
• Review of the economy, efficiency and effectiveness of operations.
• Review of compliance with external laws and regulations and internal policies.
 • Examination of financial and operating information to assess its adequacy, relevance and
reliability
• Identification of key business risks and assessment of risk management strategies for
operating effectiveness.
• Review and assessment of systems, policy and other strategic implementations.
• Carrying out special investigations into particular areas.
• Review of and advising on corporate governance procedures.

Limitations of the internal audit function:

 Threats to independence and objectivity majorly as a result of :
i. Involvement in systems design and implementation may create a self review threat.
ii. Familiarity threat often due to present or past involvement in operational activities.
iii. Reporting relationships.
 Variation of standards: approaches to internal audit vary significantly a\\cross industries. While
some are moving to a more consultancy type approach, others continue to perform the traditional checking
approach.
 Cost-benefit considerations, skill shortages, scope conflict are other limitations.
 Limitations to knowledge and technical expertise as not required to be professionally qualified.

SPECIAL INTERNAL AUDIT ASSIGNMENTS

Internal audit can be involved in many different assignments as directed by management. These include:
1. Value for money (VFM) audits : this is concerned with obtaining the best
possible combination of services for the least resources. It is therefore the pursuit of
the 3Es i.e.
 Economy: attaining the appropriate quantity and quality of physical, human and financial
resources (inputs) at lowest cost.
 Efficiency: this is the relationship between goods or services produced (outputs) and the
resources used to produce them. An efficient operation produces the maximum output for any given set of resource
inputs, or it has minimum inputs for any given quantity and quality of product or service provided.
 Effectiveness: this is concerned with how well an activity is achieving its targeted objectives.
The internal auditors will evaluate these three factors for any business system or operation in the company.
Value for money can often only be judged by comparison. In searching for value for money, present
methods of operation and uses of resources must be compared with suitable alternatives.
Pr Problems with VFM auditing: ms with VFM auditing
• Defining objectives and measuring effectiveness is usually a subjective process especially for not-
for- profit organization (NFPs) which mostly sets non-financial objectives.
• Conflict: There is usually a trade off between achieving economy, efficiency and effectiveness
• Over-emphasis in cost control: There can be an emphasis with VFM audits on costs and cost
control rather than on achieving more benefits and value, thus concentrating on short term benefit at the
expense of future growth.

2. Best value: 'Best value' is a requirement for organizations to demonstrate-

 The achievement of the ‘4Cs’, and
 Effective service delivery.
It is a performance framework introduced into local authorities by the UK government. It is of more
prominence in the public sector and for NFPs. In order to achieve best value, an organization must strive for
continuous improvement by implementing the '4 Cs' i.e.
 Challenge: this involves identifying the different options for providing services and questioning the
status quo.
 Compare: Services provided must be compared to that of other local authorities and the private sector in
order to determine areas where improvement is needed.
 Consult: In setting performance targets, service users should be consulted.
 Compete: competition should be used as a means of securing efficient and effective services.
Internal audit's role is to:
 ensure that the authority has arrangements in place to achieve best value.
 take part in carrying out position audits;
 serve as an assurance provider in terms of whether best value objectives are being achieved or not.
 ensure that the authority keeps abreast of best value developments.

3. IT auditing: is a specialist type of work that involves reviewing and reporting on all aspects of information
systems including hardware, application and systems development. This includes identifying key IT risks, assessing
the adequacy and effectiveness of general and application controls.

OPERATIONAL INTERNAL AUDIT ASSIGNMENTS :

It is basically about ensuring policies are adequate and effective. This could include:
Procurement is the process of purchasing for the business. A procurement audit will therefore concentrate on the
systems of the purchasing department and ensure it operates according to company guidelines.
Human resources: People are the most important assets in an organization, without them money and machines
cannot achieve any thing. HR department is not only charged with recruiting able hands, they also assist them in
meeting the organization needs by enhancing individual staff skills.

Marketing is the very important process for increasing the demand for company's products. The internal auditor
ensures that marketing systems policies are adhered to.
Treasury entails managing funds and ensuring that they are available when needed .Treasury invest excess funds
and borrow funds thus exposing the organization to risk. Internal auditor is thus ensures that risks are managed in
line with company procedure.

The external auditor must perform his work in the following circumstances:
Where balances are material to the financial statements
In areas of increased risk- complex accounting treatment or where judgment is required
Where objectives of the internal audit work differ from those of the external audit.

FOCUS POINT: the study guide specifically requires an understanding of the nature and purpose of the above
operational areas. It would be helpful that candidates understand the key risks and possible controls in each
area. Also, see the note on REPORTING for a detailed review of internal audit reports

Outsourcing the internal audit function

Advantages/Reasons :
• Internal audit staff can be used from a broader source of experts e.g. professional firms
that may specialize in the particular type of organization.
• Reduces the risk of high turnover or loss of staff from the internal audit dept.
• Outsourcing can provide an immediate internal audit department.
 • Contracting out could increase independence, since staff from an external firm will need to
comply with robust ethical guidelines and are more likely to be rotated to avoid close working relationship
building up.
• Skills required for only a short time each year can be provided by the service
provider without incurring excessive costs of maintaining an in-house expertise.
• It could provide access to new market place techniques without the need for
significant investment or in-house development. The specialist firm is more likely to be in line with current
developments.
• Generally, less management time is dedicated to internal audit and more time to other core
activities.
• There is greater focus on cost and efficiency in the internal audit function. i.e cost
savings in terms of employee salaries, training costs and recruitment expenses

Disadvantages
• Threats to independence and objectivity if the external audit service is provided by the same firm.
• Standards of performance and service may fall once the contract has been secured and
previous team disbanded.
• Confidentiality of organization information may become an issue.
• The cost of outsourcing the internal audit function might be high enough to justify an in-
house dept.
• Frequent staff changes resulting in poor quality service being provided due to lack of understanding
of clients systems and operations.

Managing an outsourced department

• Setting performance measures in terms of cost and areas of the business reviewed and
investigating any variances
• Ensuring appropriate audit methodology is maintained.
• Reviewing working papers on a sample basis to ensure they meet internal auditing
standards/guidelines
• Agreeing internal audit work plans in advance of work being performed.
• If external auditor is used, ensure that the firm has suitable controls to keep the two functions
separate so that independence and objectivity is not impaired.