Please enable JavaScript.

Coggle requires JavaScript to display documents.

describe the role, type of work carried out and value added by internal…

- - - - definition
        
        What is IIA's definition of internal auditing?
        
        • Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations.
        • It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes
        
        'Systematic, disciplined approach' = unbiased and objective evidence-gathering process with standards to determine the sufficiency and competence of audit evidence
        
        'Control' = exists to help management by mitigating risk exposure
        
        'Consulting' = it is value-adding rather than compliance
        
        'Governance' - process by which entities and stakeholders gain assurance
        
        This traditional definition of internal auditing is consistent with the view that the role of the internal auditor is concerned primarily with: SONER
        • review of the reliability and integrity of financial and operating information
        • review of systems established to ensure compliance with policies, procedures, plans, laws and regulations impacting on operations and reports
        • review of the means of safeguarding assets
        • appraisal of economy and efficiency of any aspect or functional area of an organisation
        • review of operations and programs.
        
        Internal auditing as an assurance service
        
        consistent with the definition of assurance services as outlined in Module 1
        
        The notion of internal auditing as a consulting service emphasises the shift of internal auditing from compliance to value-adding, working with management to identify solutions, not just problems.
        
        evaluate and improve the effectiveness of risk management, control and governance processes’
        
        emphasises the need for the auditor to understand risks as well as management’s methods for managing or mitigating such risks.
        
        Governance is the process by which entities and stakeholders gain assurance that broad organisational policies are implemented and adhered to, and that accountability relationships are established.
        
        Controls exist to help management by mitigating risk exposure and, therefore, are part of the risk-management process.
        
        The evaluation of risk exposure includes the following: REACS
        • achievement of the organization’s strategic objectives;
        • reliability and integrity of financial and operational information;
        • effectiveness and efficiency of operations and programs;
        • safeguarding of assets; and
        • compliance with laws, regulations, policies, procedures, and contracts (IIA 2017b, p. 13, para. 2121.A1).
        
        1 more item...
        
        new definition of internal auditing highlights a strategic risk analysis approach to the internal audit function, rather than the compliance approach that characterised traditional internal auditing.
        
        This definition emphasises some important points that deserve further elaboration:
        • Internal auditors should be independent of those managers whose work they are evaluating.
        • Internal auditors add value by adopting an objective approach to each of the areas subject to audit examination. This objectivity is achieved by an appropriate mindset by the auditors.
        
        What is the definition of internal audit function?
        
        • An appraisal activity established or provided as a service to the entity
        
        The IAASB ‘Glossary of terms’ defines the internal audit function as a ‘function of an entity that performs assurance and consulting activities designed to improve the effectiveness of the entity’s governance, risk management and control processes’ (IAASB 2016b, p. 26). Its functions include monitoring the adequacy and effectiveness of internal control.
      - Institute of Internal Auditors
        
        • Present, promote and develop the professional practice of internal auditing
        
        The IIA is an international professional association dedicated to enhancing the status of internal auditing.
        
        IIA argues that, in order to do this, the internal audit group must be adequately resourced and professionally staffed, and follow the internationally recognised framework for internal auditing.
        
        framework
        
        includes the International Standards for the Professional Practice of Internal Auditing, Code of Ethics and Practice Advisory Statements.
        
        Institute of Internal Auditors Standards
        
        The IIA (2017b) Standards have the following purposes: FEMP
        
        Guide adherence with the mandatory elements of the International Professional Practices Framework.
        
        Provide a framework for performing and promoting a broad range of value-added internal auditing services.
        
        Establish the basis for the evaluation of internal audit performance.
        
        Foster improved organizational processes and operations (IIA 2017b, p. 1).
        
        The Standards apply to both assurance services and consulting services by internal auditors.
        
        2 more items...
        
        attribute standards
        
        1 more item...
        
        IIA members are required to adhere to both auditing standards and the Code of Ethics
      - Recent changes in the regulatory environment related to sustainability reports, and in particular to GHG emissions, have led to new roles for internal auditors
    - - Risk management
        
        Risk-management processes include evaluating risk exposures related to governance, operations and information systems. It also involves evaluating the potential for the occurrence of fraud and how the organisation manages fraud risk.
        
        Internal risk-management audits are aimed at helping the organisation identify and evaluate significant exposure to risks, and contribute to the improvement of risk management.
        
        This includes monitoring and evaluating the organisation’s risk-management system.
        
        A particular internal audit assignment might relate to part of that system. For example:
        • The board of directors may be concerned about exposure to foreign exchange fluctuations.
        • A bank may be concerned about the unusually high profits in a particular area of trading.
        • Management may ask for large inventory thefts at a particular location to be investigated.
        
        The internal audit activity must evaluate the effectiveness of risk-management processes and contribute to their improvement.
        
        This involves assessing whether: ROCR
        • Organizational objectives support and align with the organization’s mission;
        • Significant risks are identified and assessed;
        • Appropriate risk responses are selected that align risks with the organization’s risk appetite; and
        • Relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities (IIA 2017b, p. 13, para. 2120).
      - Control
        
        Internal control audits are aimed at helping the organisation maintain effective controls by evaluating effectiveness and efficiency, and by promoting the continuous improvement of those controls.
        
        Internal auditors might also review operations and programs to determine the extent to which operating goals have been established, and whether results are consistent with the established goals
        
        For example, actual versus budget performance could be compared across programs and locations
        
        Internal auditors can evaluate controls on a rotational basis, or based on the results of risk assessments.
        
        The evaluation of the:
        … adequacy and effectiveness of controls in responding to risks within the organization’s governance, operations, and information systems regarding the: OREAC
        • Achievement of the organization’s strategic objectives;
        • Reliability and integrity of financial and operational information;
        • Effectiveness and efficiency of operations and programs;
        • Safeguarding of assets; and
        • Compliance with laws, regulations, policies, procedures, and contracts (IIA 2017b, para. 2130.A1).
        
        management
        
        assurance
        
        function provides assurance to management of the effectiveness of internal controls, risk-management processes and operational processes.
        
        consulting
        
        Internal audit also provides consulting services to management, including improving controls and risk-management practices, and developing and evaluating performance measurements systems.
        
        audit committee
        
        In addition, audit committees rely on assurance from internal auditors regarding compliance, controls, risk management and corporate governance issues.
        
        Other
        
        internal audit function makes extensive use of the COSO framework described earlier in this module.
      - Governance
        
        Governance internal audit activities assess the governance process and suggest improvements where necessary including: CREPED
        • making strategic and operational decisions;
        • overseeing risk management and control;
        • promoting appropriate ethics and values within the organization;
        • ensuring effective organizational performance management and accountability;
        • communicating risk and control information to appropriate areas of the organization; and
        • coordinating the activities of and communicating information among the board, external and internal auditors, other assurance providers, and management (IIA 2017b, p. 13, para. 2110).
- - - - Carrying out the engagement
        
        Evidence
        
        must collect audit evidence that is sufficient, reliable, relevant and useful
        
        Reliable information is the best attainable information through the use of appropriate engagement techniques.
        
        Relevant information supports engagement observations and recommendations and is consistent with the objectives for the engagement. Useful information helps the organization meet its goals (IIA 2017b, p. 17, para. 2310).
        
        Sufficient information is factual, adequate, and convincing so that a prudent, informed person would reach the same conclusions as the auditor.
        
        Documentation
        
        need to document all relevant information to support the conclusion and engagement results.
        
        field survey (start)
        
        to familiarise themselves with organisational charts and systems, and to evaluate the control systems and the control risk for systems that come within the audit. This field survey usually involves accessing relevant policy and procedure manuals, management reports, and undertaking a ‘walk-through’ of the relevant operations (e.g. storage of inventory).
        
        This also involves discussion with relevant management to obtain information about known problems and recent and forthcoming changes.
        
        At this point, it may be necessary to reconsider the objectives, scope and planned audit procedures
      - Internal audit reporting
        
        communication
        
        An important skill for the internal auditor is to communicate their findings to busy executives and board members. ‘Communications must include the engagement’s objectives and scope and results’ (IIA 2017b, p. 18, para. 2410).
        
        elements in report
        
        Some essential elements of internal audit reports include: EIARC
        • an executive summary—the purpose of the summary document is to alert the recipient to the key findings. It should encourage the reader to want to read the full report, and should generally include:
        –– a summary of key findings
        –– the audit objectives and coverage –– an overall conclusion
        • an introduction, incorporating:
        –– the reason for conducting the audit –– the objectives of the audit
        –– the audit approach –– the audit coverage –– the criteria used
        • a section on each of the areas audited—these sections could be split up by issues addressed, parts of organisation audited, etc. These sections would include a description of the work done, results and specific recommendations
        • a list of recommendations with the auditee’s responses
        • a conclusion.
      - Internal audit engagement planning
        
        IIA (2017b) auditing standards require internal auditors to develop and document a plan for each engagement.
        
        This plan includes objectives, scope, timing and resource allocations
        
        audit objectives
        
        The internal audit management team identify high-risk areas for internal audit consideration. Senior management and the board of directors also have input into that process
        
        individual audit
        
        audit objectives of each of these must be defined and documented in more detail.
        
        scope
        
        In determining the scope, it will be necessary to consider the resources and timing of engagement work, key factors affecting business conditions and operations in the areas being reviewed (including changes in the environment), and requests from management.
        
        Prior to commencing the engagement, the internal auditor prepares an engagement program that considers: WOSPR
        • the objectives of each engagement
        • the scope of the engagement, which must be sufficient to satisfy the objectives of the engagement
        • the engagement resource allocation, which would determine if sufficient resources are available
        • a work program, which states the nature and extent of testing required
        • procedures for collecting, analysing, interpreting and documenting information during the engagement.
        
        The internal auditor also determines the period covered, estimated completion dates and final engagement communication format.
      - summary of steps (difference performance standards relate to each step)
        
        Planning
        
        Planning
        considerations†
        Engagement
        objectives
        Engagement scope
        Engagement
        resource allocation
        Engagement work
        program
        
        Evidence
        gathering
        
        Identifying
        information†
        Analysis and
        evaluation†
        Documenting
        information†
        Engagement
        supervision†
        
        Reporting
        and other
        communication
        responsibilities
        
        Criteria for and quality
        of communications
        Errors and omissions
        Engagement
        disclosure of non-
        conformance
        Disseminating results
        Overall opinions
        Communicating the
        acceptance of risks
    - - increasing trend
        
        Some key reasons for this include changes in regulatory demand, a greater push towards real-time financial reporting and the move towards automating manual audits
      - automated feedback mechanisms used respectively by Internal Audit or Management to monitor IT systems, transactions and controls on a frequent or continuous basis, throughout a given period’.
      - advantages
        
        Some advantages of using continuous assurance in the internal audit environment include: CBC
        • greater audit coverage at lower cost
        • identifying control breakdowns in real time with quicker corrective action
        • a continuous rather than cyclical audit process.