1

Table of Contents
• Introduction of internal audit

• History of internal auditing

• Role in internal control

• Role in risk management

• Role in corporate governance

• Nature of internal audit activity

• Internal audit reports

• Developing the plan of engagement

• Best practices in internal auditing

• Reporting of critical findings

3

INTRODUCTION OF INTERNAL AUDIT

Internal auditing is an independent, objective assurance

and consulting activity designed to add value and improve an
organization's operations. It helps an organization accomplish its
objectives by bringing a systematic, disciplined approach to
evaluate and improve the effectiveness of risk management,
control, and governance processes. Professionals called internal
auditors are employed by organizations to perform the internal
auditing activity.

The scope of internal auditing within an organization is

broad and may involve topics such as the reliability of financial
reporting, deterring and investigating fraud, safeguarding assets,
and compliance with laws and regulations.Internal auditing
frequently involves measuring compliance with the entity's
policies and procedures. However, Internal auditors are not
responsible for the execution of company activities; they advise
management and the Board of Directors (or similar oversight
body) regarding how to better execute their responsibilities. As a
result of their broad scope of involvement, internal auditors may
have a variety of higher educational and professional
backgrounds.

Publicly-traded corporations typically have an internal

auditing department, led by chief audit executive ("CAE") who
generally reports to the audit committee of the board of directors,
with administrative reporting to the chief executive officer.

The profession is unregulated, though there are a number

of international standard setting bodies, an example of which is
the institute of internal auditor ("IIA"). The IIA has established
Standards for the Professional Practice of Internal Auditing and
has over 150,000 members representing 165 countries, including
approximately 65,000 Certified Internal Auditors.
4

History of internal auditing

The Internal Auditing profession evolved steadily with the
progress of management science after World War II. It is
conceptually similar in many ways to financial auditing by public
accounting firms, quality assurance and banking compliance
activities. Much of the theory underlying internal auditing is
derived from management consulting and public accounting
professions.

Role in internal control

Internal auditing activity is primarily directed at improving internal

control.Internal control is broadly defined as a process, effected
by an entity's board of directors, management, and other
personnel, designed to provide reasonable assurance regarding
the achievement of objectives in the following internal control
categories:

• Effectiveness and efficiency of operations.

• Reliability of financial reporting.
• Compliance with laws and regulations.

Management is responsible for internal control. Managers

establish policies and processes to help the organization achieve
specific objectives in each of these categories. Internal auditors
perform audits to evaluate whether the policies and processes are
designed and operating effectively and provide recommendations
for improvement.
5

Role in risk management

Internal auditing professional standards require the function

to monitor and evaluate the effectiveness of the organization's
Risk management processes. Risk management relates to how an
organization sets objectives, then identifies, analyzes, and
responds to those risks that could potentially impact its ability to
realize its objectives.

Risks fall under strategic, operational, financial reporting, and

legal/regulatory categories. Management performs risk
assessment activities as part of the ordinary course of business in
each of these categories. Examples include: strategic planning,
marketing planning, capital planning, budgeting, hedging,
incentive payout structure, and credit/lending practices. Internal
auditors may evaluate each of these activities, or focus on the
processes used by management to report and monitor the risks
identified. For example, internal auditors can advise management
regarding the reporting of forward-looking operating measures to
the Board, to help identify emerging risks.

In larger organizations, major strategic initiatives are

implemented to achieve objectives and drive changes. As a
member of senior management, the Chief Audit Executive (CAE)
may participate in status updates on these major initiatives. This
places the CAE in the position to report on many of the major risks
the organization faces to the Audit Committee, or ensure
management's reporting is effective for that purpose.

Internal auditors may help companies establish and maintain

Enterprise Risk Management processes

Role in corporate governance

6

Internal auditing activity as it relates to corporate

governance is generally informal, accomplished primarily through
participation in meetings and discussions with members of the
Board of Directors. Corporate governance is a combination of
processes and organizational structures implemented by the
Board of Directors to inform, direct, manage, and monitor the
organization's resources, strategies and policies towards the
achievement of the organizations objectives. The internal auditor
is often considered one of the "four pillars" of corporate
governance, the other pillars being the Board of Directors,
management, and the external auditor.

A primary focus area of internal auditing as it relates to

corporate governance is helping the Audit Committee of the Board
of Directors (or equivalent) perform its responsibilities effectively.
This may include reporting critical internal control problems,
informing the Committee privately on the capabilities of key
managers, suggesting questions or topics for the Audit
Committee's meeting agendas, and coordinating carefully with the
external auditor and management to ensure the Committee
receives effective information.

Nature of the internal audit activity

Based on a risk assessment of the organization, internal

auditors, management and oversight Boards determine where to
focus internal auditing efforts. A typical internal audit project
involves the following steps:

1. Establish and communicate the scope and objectives for the

audit to appropriate management.
2. Develop an understanding of the business area under review.
This includes objectives, measurements, and key transaction
types. This involves review of documents and interviews.
Flowcharts and narratives may be created if necessary.
7

3. Describe the key risks facing the business activities within

the scope of the audit.
4. Identify control procedures used to ensure each key risk and
transaction type is properly controlled and monitored.
5. Develop and execute a risk-based sampling and testing
approach to determine whether the most important controls
are operating as intended.
6. Report problems identified and negotiate action plans with
management to address the problems.
7. Follow-up on reported findings at appropriate intervals.
Internal audit departments maintain a follow-up database for
this purpose.

Internal audit reports

Internal auditors typically issue reports at the end of each audit

that summarize their findings, recommendations, and any
responses or action plans from management. An audit report may
have an executive summary; a body that includes the specific
issues or findings identified and related recommendations or
action plans; and appendix information such as detailed graphs
and charts or process information. Each audit finding within the
body of the report may contain five elements, sometimes called
the "5 C's":

1. Condition: What is the particular problem identified?

2. Criteria: What is the standard that was not met? The
standard may be a company policy or other benchmark.
3. Cause: Why did the problem occur?
4. Consequence: What is the risk/negative outcome (or
opportunity foregone) because of the finding?
5. Corrective action: What should management do about the
finding? What have they agreed to do and by when?

The recommendations in an internal audit report are designed

to help the organization achieve its goals, which may relate to
8

operations, financial reporting or legal/regulatory compliance.

They may relate to effectiveness (i.e., whether goals were met or
compliance with standards was achieved) or efficiency (i.e.,
whether the outputs were generated with minimum inputs).

Audit findings and recommendations also relate to particular

assertions about transactions, such as whether the transactions
audited were valid or authorized, completely processed,
accurately valued, processed in the correct time period, and
properly disclosed in financial or operational reporting, among
other elements.

Developing the plan of engagements

nternal auditing standards require the development of a plan
of audit engagements (projects) based on a risk assessment,
updated at least annually. The input of senior management and
the Board is typically included in this process. Many departments
update their plan of engagements throughout the year as risks or
organizational priorities change.

This effort helps ensure the audit activity is aligned with the
organization’s objectives, by answering two key questions: First,
what goals are the organization trying to accomplish in the
upcoming period? Second, how can the Internal Audit Department
assist the organization in achieving these goals?

Internal auditors often conduct a series of interviews of

senior management to identify potential engagements. Changes
in people, processes, or systems often generate audit project
ideas. Various documents are reviewed, such as strategic plans,
financial reports, consulting studies, etc. Further, the results of
prior audits and resolution of open issues are considered. For
example, automated programs such as NEMEA Compliance Center
can collect responses, produce and write standardized compliance
reports for an organization seeking or issuing compliance rules.
Even if a business area is important, prior audit work and the
nature and status of open issues may render further audit effort
unnecessary. If the organization has a formal enterprise risk
management (ERM) program, the risks identified therein help limit
9

the amount of separate risk assessment performed by Internal

Audit.

The preliminary plan of engagements is documented and

prioritized. Audit resources and expertise are then considered and
a final plan is presented to senior management and the Audit
Committee. The presentations vary based on the needs of the
stakeholders and may include the following:

• Summary of key goals, risks and corresponding major audits,

to illustrate alignment;
• Analyses of audit effort along a variety of dimensions.
• Brief description of critical projects identified;
• Projects requested but not planned for execution due to
prioritization and resources;
• Required co-sourcing effort, typically where outside expertise
is required or during peak periods;
• Coordination with other risk functions, such as legal,
compliance or insurance, to ensure coverage of key
organizational risks;
• Update on audit staffing levels, experience and certification;
and
• Appendix materials, such as planning approach, assumptions
(e.g., days per auditor and staffing level) and brief
descriptions of all planned audits and related prioritization.
•

Best Practices in Internal Auditing

Measuring the internal audit function

The measurement of the internal audit function can involve a
balanced scorecard approach. Internal audit functions are
primarily evaluated based on the quality of counsel and
information provided to the Audit Committee and top
management. However, this is primarily qualitative and therefore
difficult to measure. “Customer surveys” sent to key managers
10

after each audit project or report can be used to measure

performance, with an annual survey to the Audit Committee.
Scoring on dimensions such as professionalism, quality of counsel,
timeliness of work product, utility of meetings, and quality of
status updates are typical with such surveys. Understanding the
expectations of senior management and the audit committee
represent important steps in developing a performance
measurement process, as well as how such measures help align
the audit function with organizational priorities.

Quantitative measures can also be used to measure the function’s

level of execution and qualifications of its personnel. Key
measures include:

Plan completion: This is a measure of the degree to which the

annual plan of engagements is completed, measured at a point in
time. This may be measured using the number of projects
completed, weighted by the planned size of each project, with
estimates for projects in-progress. Measured throughout the year,
it is compared against the percentage of the year elapsed.

Report issuance: This is a measure of the time elapsed from

completion of testing to issuance of the final audit report,
including management’s action plans. This can be measured in
average days or percentage of reports issued within a certain
standard, such as 30 days. Establishing expectations for the
timing of management’s response to report recommendations is
critical. In addition, the scope and degree of change involved in
the report’s action plans are key variables. For example, a report
for a single retail store requiring only the store manager’s action
might take 3–5 days to issue. However, a report consolidating
findings from 20 retail stores, with action plans with national
implications determined by top management, may take 30–60
days in complex organizations.

Issue closure: Reported audit findings are often called “issues” or

“deficiencies.” Professional standards require audit functions to
track reported findings to resolution, which effectively requires the
maintenance of an issues follow-up database. The number of days
that reported issues remain open, or open after their agreed-upon
11

closure date, are key measures. In addition, reporting database

statistics such as the number of issues open (unresolved), closed
(resolved), and issues opened/closed during a given period are
useful statistics.

Staff qualifications: This can be measured through the percentage

of staff with professional certifications, graduate degrees, and
overall years of experience.

Staff utilization rate: This is measured as the percentage of time

spent on projects, as opposed to administrative time such as
training or vacation. Many internal audit departments track time
by audit project. This is typically captured in a database or
spreadsheet.

Staffing level: The number of positions filled relative to the

authorized staffing level. Due to the challenge of finding qualified
staff, departments may have rotational programs to bring in
management to complete tours in the function or be "guest"
auditors. Audit departments also "co-source," meaning they obtain
contract auditors from service providers.

Reporting of critical findings

The Chief Audit Executive (CAE) typically reports the most critical
issues to the Audit Committee quarterly, along with
management's progress towards resolving them. Critical issues
typically have a reasonable likelihood of causing substantial
financial or reputational damage to the company. For particularly
complex issues, the responsible manager may participate in the
discussion. Such reporting is critical to ensure the function is
respected, that the proper "tone at the top" exists in the
organization, and to expedite resolution of such issues. It is a
12

matter of considerable judgment to select appropriate issues for

the Audit Committee's attention and to describe them in the
proper context.