INTERNAL AUDIT & RISK -
MANAGEMENT’S PERSPECTIVE
CA LAKSHMI R RAO
INTERNAL AUDIT EVOLUTION
For many years internal auditing was viewed as a necessary evil. Auditors
were the inside people who tested the process to prevent outside audit
surprises. However, in the past two decades auditors began to discuss the
relationship between risk and control and found a role in process
efficiency and effectiveness.
Today the definition of internal auditing places in partnership with
management and governance. Auditors help increase the chances of
achieving strategic and business objectives through assessing control,
risk management, and governance.
Cont.…
The world is witnessing rapid development and changes in the business
environment with artificial intelligence, thus business organizations are
moving to develop effective structures, processes, and reengineering
their operations, to add some accountability in line with their need for
more relevant and reliable information for decision-making.
How to manage risk rather than avoid it, as a result, the role of internal
audit by identifying, measuring, and disclosing these risks in a way that
the users of the financial statements can judge the effectiveness in
manage and control risks that may be exposed in the future to make the
decisions.
Internal Audit - purpose
The definition of ‘internal audit’ is: ‘An independent, objective
assurance and consulting activity designed to add value and improve
an organisation’s operations. It helps an organisation accomplish its
objectives by bringing a systematic, disciplined approach to evaluate
and improve the effectiveness of risk management, control and
governance processes.’
The internal audit function is crucial to a company’s
growth. Objectively evaluating risks, analyzing and
assessing processes and systems for efficiencies, doing
spot-checks for as-yet-unknown issues, and keeping
departments aligned and meeting business objectives are
all important ways that auditors can bring value.
An internal audit is an unbiased review of a company’s internal systems, processes, and
procedures. The goal of an internal audit is to provide independent assurance over a company’s
operations. Internal audits help teams to accomplish their goals by bringing a disciplined approach
and objective perspective to the effectiveness of internal controls, risk management, and adherence
to and alignment with company goals and objectives. Some areas that internal audit might focus on
include operational risks, environmental compliance, procedural efficiency, effectiveness of
systems, fraud management, health and safety compliance, and regulatory compliance.
● Internal Auditing is a valuable resource to an organization’s executive
management, governing bodies (audit committees), and other
stakeholders in helping them achieve their business goals and
objectives, as well as strengthening internal control and governance.
● The global demand for internal auditors today is unprecedented and
is expected to increase annually as public and private companies and
government entities continue to expand their audit needs in response to
corporate reforms.
TYPES OF INTERNAL AUDITS
● Compliance Audit - assess compliance with relevant laws and regulatory policies and procedures
● Environmental Audit-the impact of a company’s actions and operations on the environment, and may
also assess an organization’s compliance levels
● Security and Technology Audit-evaluate an organization’s information technology systems and the
underlying infrastructure to assess the accuracy and/or security of data and information or intellectual
property
● Performance Audit-evaluate if a company is meeting the internal targets and able to hit key
performance indicators and other goals set
● Financial Audit-performed to confirm financial reporting as it pertains to the overall business, budgets,
assets, or special projects
● Operational Audit-assess a company’s control mechanisms and their overall effectiveness, efficiency,
and reliability
● Special Audits- performed at the request of management
Why Organizations Need an
Internal Audit Function?
● Regardless of its size, every organization should have some type of internal control
system/process to:
○ Reduce liability
○ Help control risks
○ Free-up management to focus on core mission
○ Improve the accuracy of financial and operational information
○ Offer a second opinion
○ Enhance service delivery
○ Improve financial results
● Required in some countries
○ Not legally required in the U.S.
○ Exceptions: NYSE-listed corporations and a few specific industry/government requirements
Coordination between Internal Audit
and Risk Management Perspective
The process of risk management and internal audit functions is very important to
the success, sustainability of the organization, and risk management is a vital
element that is based on uncertainty about the events or outcomes that can occur
have the main impact on the achievement of the strategies of the institution.
Despite the distinguished role for the internal auditor in providing advice, support
to the correct administrative decisions, and attempting to address administrative
decisions that appear to be inappropriate, but the process of control and risk
management falls under the responsibility of senior management and the board
Internal Auditors’ Possible Stakeholders
Key Secondary Tertiary
Stakeholders Stakeholders Stakeholders
Audit Other business Employees and
committee/board unit executives retirees
External auditors Investment
CEO
and regulators analysts
CFO or individual
to whom CAE Investors and Potentially, the
reports creditors general public
administratively
(Government
Potentially, other
audit) citizens and
chief officers
taxpayers
● Management can be more efficient about what to explore. For example, while external
financial audits must test an entire financial system, a company may be concerned about whether the cash
management process is being fraudulently managed; therefore, management can elect to have all audit
procedures analyze cash processes.
● Internal audits may save companies money. If a company's processes are very strong, the
external audit process may not be as long as intensive, thereby reducing the external audit fee and time
spent supporting external auditors.
• The company enhances its control environment. Even if the internal audit yields no
findings, employees may be aware that their work gets analyzed and reported on, thereby motivating
adherence to company policy.
• Internal audits may make companies more efficient. External audits often are not intended
to make processes better; they are meant to review whether processes are accurate. This distinction is
important because a company may be "just getting by" with inefficient processes that meet very minimum
requirements.
• Internal audit reports give management a head start to make corrections. Instead
of having to scramble when an external audit finds a deficiency, management can take longer to think
through solutions, implement the solution with care, and review whether the solution worked.
• Certain departments may need enhanced oversight. Whether it is lack of expertise,
staffing shortages, or problem with current personnel, a company may benefit from targeting a specific area
and formally reviewing its workflow and processes.
5 Cs in Internal Audit
Internal audit reports often outline the criteria, condition, cause,
consequence, and corrective action. These five areas report why the
audit was performed, what caused the reason for the audit, how the
audit will be performed, what the auditor aims to achieve, and what
steps will be taken after the audit findings are presented.
THANK YOU