What is Internal Audit?

The International Auditing Standard, ISA 610 (2007) defines internal audit as ‘an appraisal activity established within an entity as a service to the entity. Its functions include, amongst other things, monitoring internal control’. Yet others define internal audit as ‘an independent, objective assurance and consulting activity designed to add value and improve an organization's operations’.  A less formal definition is internal audit is an audit to ensure smooth internal function of the company or organization. When 'internal audit' is mentioned, many people think only of financial audits. However, the purview of internal audit includes other type of audits as well. For example, system audit is as important as financial audit in strengthening the company internally. 

An internal audit plays a very crucial role in improving the company's functioning internally. The internal auditor provides insights and analyses concerning the activities reviewed. The internal auditor can suggest the Management ways to curtail costs, boost productivity and increase revenue. While an external audit focuses on determining whether financial statements conform to generally accepted accounting principles, an internal audit focuses on uncovering internal control weaknesses and evidence of misdemeanour, malpractice or outright fraud by some unscrupulous employees. Internal audits are also beneficial for effective risk management implementation.

While each internal audit has unique requirements, the audit process typically involves planning, fieldwork, audit report and follow-up. In the first phase, i.e. the planning phase, the auditor (mostly a competent audit consultant) meets with the management team to understand what exactly they want to audit. Once the role of the internal auditor is defined and fixed, the team starts doing field-work. This typically involves understanding the process flow of all that needs to be audited, and the actual data entry involved. The main point the team looks at is whether any checks are already in place. For example, let’s say the manager sends an e-mail to an employee, asking him to complete some task. A check in place would be if the manager asks a ‘Read receipt’ from the employee. This would ensure that the concerned employee has indeed received and acknowledged that he / she has read the mail. This is a very small example of what the internal audit team checks. The internal audit team than assimilates all the data and generates Management Information System (MIS) reports pertaining to the audit. These reports identify any weaknesses the auditing team may have noticed, and the recommended actions to rectify or improve the process under audit. In the final phase, the audit team again visits the organization after a suitable time period and reviews if the recommendations that were finalized with consultation with the top management have been really implemented.

The main objective of the internal audit process is to provide an assurance on the organization’s risk management, internal control environment and governance framework through review and appraisal of: a. Operational control framework including fundamental and basic systems in all areas of the business, the adequacy of risk identification, assessment and mitigation in the organization. This shall include fraud risks b. Extent, adequacy, relevance of, and compliance with existing policy, plans and procedure documents within the SBU c. The extent of compliance with relevant statutory requirements d. Status of implementation of internal / external audit recommendations

Benefits of Internal Audit

i. Accuracy: Let us take a simple example, which will highlight the need for an internal audit. Suppose a bank has offered to pay an interest rate of 5% per annum for the savings account. Unfortunately, the custom banking software has made an error of 0.0005% in calculating the interest. Most customers do not bother to verify that the interest they are earning is properly calculated. And in the case of small investors, such an error does not really matter. However, it may make a significant impact for big investors. And if the error is not rectified before going online, there are bound to be compliance issues later on. It is the job of the internal auditor to detect this error and rectify it before the software system is launched for use. This is a very small example why internal audits are needed. For financial accounting, the auditors and CAs rely on the information they have received; it is the job of the internal auditors to verify that the information they are getting is technically correct.

ii. Good corporate governance: Like an individual, the goal of every organization must be to achieve the highest level of competency in whatever it was established to perform, while adhering to all relevant standards and ethics. Internal audit is the first check to ensure that the company is on track to achieve its objectives. 

iii. Internal audits monitor activities that the top management cannot handle. The top management is more concerned about taking the company ahead in terms of revenues and profits. The reports generated by internal audits assist management in the decision making process that will help them take the company ahead.

iv. It is mandated by law: Section 138 of the Indian Companies Act deals with internal audit of companies. It states that certain classes of companies shall be required to appoint an internal auditor. The Act further stipulates that this person shall either be a Chartered Accountant, Cost Accountant or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the company. As of June 2020, all listed companies and companies with a paid up capital of Rs. 50 crores or more, or companies with a turnover of 200 crores need to get internal audit. Please note these criteria may change from time to time; but the bottom-line is that some companies need to get internal audit done by law. And of course, what is true of India is true for other countries like U.S.A, U.K, etc. The clauses may vary, but most nations now require internal audit to be mandatory.

Internal Audit Reporting
The crux of internal auditing – or for that matter any auditing – is to present the findings in a formal way. It summarizes the work by recording observations and recommendations. After all, the most important aspect of the entire internal auditing process is to pinpoint problem areas in an organization and suggesting solutions to rectify them in a language the management can understand. Good internal audit reporting is more than just report preparation and appearances. A good audit report should reflect the basic philosophy of an enterprise’s decision to implement internal audit, including its underlying review objectives, supporting strategies and major policies, procedures covering the audit work, and the professional performance of the audit staff. Excellent field work followed up by shabby report writing is of no use to anyone, and this is where professional internal audit service providers should prove their mettle.  An ineffective audit can mean severe consequences; resulting in process failure, customer dissatisfaction and regulatory noncompliance. Optimize your auditing skills with the internationally recognized ISO 9001:2015 and boost your internal audit capabilities. Gain confidence in planning and performing an effective audit, as well as reporting and taking corrective action where necessary.

Internal Audit Services
Should you hire professional audit consultants or delegate the job to an internal team? 

Internal audit is a tough job. The management is keen on getting meaningful insights from the reports, and the employees are reluctant to make any changes or accept the existence of lacunae in the existing system. Independent consultants make the best internal auditors as they are experienced, and more concerned about streamlining operations in a way that would benefit the organization and comply with laws. In other words, professional internal auditors are meticulous and unbiased. And in many cases, the law stipulates that the internal audit be handled by external agencies. Since implementing the recommendations of an auditor can have far reaching effects for an organization, it is necessary to hire competent and reliable internal auditors who are highly experienced in their job.