Chapter 9
Internal Audit
Binhkhieu@[Link]
0966623936
Chapter study guidance
To Practical significance Study approach Exam approach Self-
pic test
1 What is internal audit? This is a brief chapter but A question on this topic is 1,2,3
Many larger companies have internal audit includes some important likely to be included in your
departments, as they are generally considered information. Read through assessment as one of the
to be an important part of good management this section paying particular questions on internal
of a company. Most large audit firms also offer attention to the distinction controls.
internal audit services as well as external audit between the internal and
services. the external auditor and the
role of internal audit.
2 What does the internal audit function do? Read through this section, This area is also directly 4
If you work in a large or mid-tier firm you are including the worked examinable in your
likely to come across internal audit at some example, and attempt the assessment.
point in your training, either liaising with them interactive question at the
or reviewing their work as part of an external end.
audit. Some of you may carry out some or all
of your training as an internal auditor. Stop
and think Might there be any problems
associated with offering both external and
internal audit services? Assurance
binhkhieu@[Link]
1
1. What is an
internal audit?
Assurance
binhkhieu@[Link]
What is internal audit?
• Internal audit function: An appraisal activity established or provided as a service to the entity. Its
functions include, amongst other things, examining, evaluating and monitoring the adequacy and
effectiveness of internal control.
• Internal audit is generally a feature of large companies (internal or outsource) to assist management in
achieving corporate objectives.
• The UK Corporate Governance Code (mandatory for UK listed companies) highlight the need for
businesses to maintain good systems of internal control to manage the risks the company faces.
Internal audit can play a key role in assessing and monitoring internal control policies and procedures.
• Role of IA in assisting the board:
Acting as auditors for board reports not audited by the external auditors.
By being the experts in fields such as auditing and accounting standards and assisting in implementation of new
standards.
By liaising with external auditors, particularly where external auditors can use internal audit work and reduce
the time and therefore cost of the external audit. There are limits on the extent to which internal audit work can
be used, however, the use of internal auditors to provide direct assistance to the external auditor is prohibited in
an audit conducted under ISAs (UK).
Assurance
binhkhieu@[Link]
2
The importance of having an internal audit function in UK CG code
• The company's board should establish an audit committee of independent non-executive directors, with a
minimum membership of three, or in the case of smaller companies, two, stipulating that directors of companies
that do not have an internal audit department should reconsider the need for one annually (UK Corporate
Governance Code, Provision 24).
• The main roles and responsibilities of the audit committee should include monitoring and reviewing the
effectiveness of the company's internal audit function, or where there is not one, considering annually whether
there is a need for one and making a recommendation to the board (UK corporate Governance Code, Provision 25).
Add a footer Assurance
binhkhieu@[Link]
5
Distinction between internal and external audit
Internal audit External audit
Add value and improve an organization’s Express an opinion on the financial
Reason
operations. statements.
Reporting to Board of directors, or the audit committee Shareholders of a company
Relating to Operations of the organization. Financial statements.
Relationship with the Often employees of the organization, or Independent of the company and its
company outsourced. management, appointed by the shareholders.
Add a footer Assurance
binhkhieu@[Link]
6
3
Self test 3
• It is possible to buy in an internal audit service from an external organisation.
A. True
B. False
Add a footer Assurance
binhkhieu@[Link]
7
2. What does the
internal audit
function do?
Add a footer Assurance
binhkhieu@[Link]
8
4
The internal audit function
Area Activity
Assessing the governance process in its accomplishment of objectives on:
ethics and values
performance management and accountability
Governance
communicating risk and control information to appropriate areas of the organisation
effectiveness of communication among those charged with governance, external and
internal auditors, and management
Identifying and evaluating significant exposures to risk and contributing to the improvement of
Risk Management risk management and internal control (including effectiveness of the financial reporting process)
Performing procedures to assist the entity in the detection of fraud
Reviewing controls, evaluating their operation and recommending improvements
Examination of financial and operating information
Review of operating activities including reviewing the economy, efficiency and effectiveness of
Internal Control operating activities, including non-financial activities
Reviewing compliance with:
laws, regulations and other external requirements
management policies and directives and other internal requirements
Add a footer Assurance
binhkhieu@[Link]
9
2.1 Risk
Risk Explanation
All companies face risks arising from their activities, which cannot be eliminated but must be
Nature of risk
managed
Role of company Risks must be managed by the company
Internal control Designing and operating systems of internal control is a key part of a company's risk management
Responsibility Usually performed by employees in their various departments
External support Sometimes the company will hire external expertise (especially for specialised computer systems)
Internal audit may carry out activities to assist with the process of risk management
Add a footer Assurance
binhkhieu@[Link]
10
5
2.2 Internal controls
Role of internal audit:
Monitoring the overall process and providing assurance that the internal control system meets control objectives and is operating
effectively
Internal audit should retain objectivity and therefore is unlikely to be directly involved in
Independence
risk assessment and design/implementation of controls
Monitoring controls Internal audit will test (monitor) controls as part of their role
Focus on all internal controls (not just financial reporting), so scope is broader than
Scope
external audit
Review the economy, efficiency and effectiveness of operating activities
Operational reviews
(management/efficiency audits)
Objective Monitoring management’s performance and ensuring company policy is adhered to
Add a footer Assurance
binhkhieu@[Link]
11
2.2 Internal controls
Review of operating Ensure policies are adequate
activities Ensure policies work effectively
Reviewing policies Reading them
(adequacy) Discussing them with members of the department
Assessment Assess whether policies are adequate and possibly advise the board of improvement
Testing controls Examine the operating effectiveness of controls by testing them
Add a footer Assurance
binhkhieu@[Link]
12
6
2.3 Other functions
• Special investigations in respect of a suspected fraud,
• Traditional financial audits, similar to the exercise carried out by the external auditors.
Add a footer Assurance
binhkhieu@[Link]
13
Context example: Internal audit
• Ritzy Hotels plc (RH) is a listed company which owns a number of hotels in the UK. Each hotel is a subsidiary company
of RH, for example, Ritzy Southampton Limited is the hotel in Southampton. RH charges each hotel a management
charge, which is determined on a fixed calculation dependent on the number of rooms at the hotel. One of the things
this management charge covers is the internal audit function, which is managed centrally by RH.
• The internal audit function at RH is required to carry out cyclical operational audits at all the hotels. The London hotel,
which comprises 20% of group income, is audited annually. Other hotels are audited on a rotational basis, with each
hotel being audited at least once every three years.
• An ‘audit’ comprises a number of elements, all of which have to have been carried out (although not all at the same
time) for the full cyclical audit to have been completed. These elements are:
• Surprise cash counts in key cash transactions areas (reception, bar, restaurant)
• Asset inspections, particularly linens and leisure facilities
• Inventory count for certain assets, particularly the larder and bar
• Tests of controls in key systems: sales, purchases, payroll (RH has a systems manual that all hotels are required to
follow)
• Health and safety control systems testing
• Review of actual results against budget for the year
• In addition, the internal audit function is sometimes required to carry out a special investigation. In 2019, there was a
special investigation into VAT errors at one hotel. Currently, the directors of RH, concerned at the results of analytical
review on bar income at one of the hotels, are considering implementing a discrepancy investigation at that hotel.
Add a footer Assurance
binhkhieu@[Link]
14
7
Interactive question 1: Internal audit activities
• Lightening plc has an organizational structure which includes accounting, human resources, internal audit and
audit committee. Requirement
Which department should not be involved in determining pay rises?
A. Accounting
B. Human resources
C. Internal audit
D. Audit committee
Add a footer Assurance
binhkhieu@[Link]
15
Self test 4
• As objectivity is a key issue for internal auditors, they are likely to routinely be involved in operational activities.
A. True
B. False
Add a footer Assurance
binhkhieu@[Link]
16
8
THANK YOU!
BINHKHIEU@[Link]
0966623936
Assurance
binhkhieu@[Link]