Name Roll No.
Ratna Singh 15
Anagha Vadnere 17
Index
Sr No. Topic
1 INTRODUCTION
2 Internal Audit and Management
3 Mission and Scope of Work
4 Accountability
5 The role of internal audit in Risk Management
6 Control
6.1 The primary objectives of internal controls
6.2 Who is responsible for control?
6.3 A system of internal control
6.4 Limitations and shortcomings of internal control
7 Authority
8 CONCLUSION
1. INTRODUCTION
The Institute of Internal Auditors as defines internal Audit:
"An independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes".
Internal auditing is an independent appraisal activity established within the organization to examine and evaluate its activities. The objectives of internal auditing are to assist members of the organization in the effective discharge of their responsibilities by furnishing them with analysis, appraisals, recommendations and pertinent comments concerning the activities reviewed. However, the internal audit review and appraisal of an area shall not in any way relieve management of its assigned responsibilities.
2.Internal Audit and Management
Essentially, internal control is management's responsibility. They are responsible to design, develop, implement and monitor internal control systems.
It is here that the influence of the internal auditor can be most significant. In may respects internal audit is known to be internal control specialist. It is thus the auditors' responsibility to stay abreast of new laws and to flag any evidence of legal non-compliance. Internal audit is then responsible for recommending remedial controls to management.
When talking about responsibilities for controls, the very contentious issues of “fraud” and “detention of fraud” comes to mind. Fraud together with corruption gives any company a bad reputation. Sure it is management's responsibility of prevent fraud from happening. However, an incidence of fraud is indicative of a weakness in internal controls. Here the internal auditor is provided with the opportunity to contribute substantially to reducing the incidence of fraud by virtue of the control systems recommended for introduction in the employer's business operations.
Unfortunately, the very group responsible for internal controls, namely senior management, is frequently best placed to commit fraud through management override of control procedures. Therefore it may be safely assumed that auditors have a role to play in this regard. From the side of internal audit, a good system of internal control and internal checks supported by a strong, involved investigative attitude is essential. Strong independent auditors must review the emphasis they place on their audit providing value added business-oriented services at the expense of the time required to be spend on the more traditional areas of internal controls and systems.
Internal audit must also ensure that management challenge the ethos of their corporate culture to ensure it conveys the message that dishonesty, lack of integrity and dubious activities will not be tolerated.
3.Mission and Scope of Work
The Office of Internal Audits (Internal Audit) provides independent, objective assurance and consulting services designed to add value and improve organisation’s operations. Internal Audit helps the company accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control mechanisms, and operational and governance processes.
Internal Audit is responsible for providing executive management with information about the adequacy and effectiveness of company’s system of internal administrative and accounting controls and the quality of operating performance when compared with established standards.
The scope of work of Internal Audit is to determine whether company’s network of risk management, control mechanisms, and governance processes, as designed and represented by management, is adequate and functioning in a manner to ensure the following:
· Risks are appropriately identified and managed;
· Significant financial, managerial, and operating information is accurate, reliable, and timely;
· Employees’ actions are in compliance with policies, standards, procedures, and applicable laws and regulations;
· Resources are acquired economically, used efficiently, and adequately protected and accounted for;
· Programs, plans, goals and objectives are achieved;
· Quality and continuous improvement are encouraged and fostered in the institution’s control process.
Internal Audit will communicate opportunities for improvement, when identified, to the appropriate level of management.
4. Accountability
The Manager of Internal Audit shall be accountable to the Company’s Management and the owned Audit Committee to:
· Provide assessments on the adequacy and effectiveness of the organization’s processes for controlling its activities and managing its risks in the areas set forth under the Mission and Scope of Work;
· Report significant issues related to the processes for monitoring and controlling the activities of the organization and its affiliates, including potential improvements to those processes when identified, and provide information needed to resolve all issues as identified;
· Consider the scope of work of the external auditors and regulators, as appropriate, for the purpose of providing optimal audit coverage to the institution;
· Ensure that an appropriate internal quality control system is in place and undergo an external peer review of their auditing and attestation engagement practices at least once every three years by reviewers independent of the audit organization.
· Provide consulting and advisory services as appropriate;
· Guide the company on control self-assessment by assisting managers with risk self-assessment and conducting self-audits;
· File internal audit reports and related responses or action plans with the Company’s System Audit Office, the Office of the Governor, the State Auditor’s Office, the Sunset Advisory Commission, and the Legislative Budget Board;
5.The role of internal audit in Risk Management
The internal auditing activity evaluates and contributes to the improvement of risk management, control, and governance, regarding:
i) Compliance with laws, regulations and contracts
ii) Effectiveness and efficiency of operations
iii) Reliability and integrity of financial and operational information
iv) Safe-guarding of assets.
Risk is defined as “the presence of uncertainty, where there may be uncertainty as to the occurrence of an event producing a loss, and uncertainty as regards the outcome of an event; where the degree of risk is interpreted with reference to the degree of variability and not with reference to the frequency with which the event will occur or the probability that it will display a particular outcome”.
In short risk implies uncertainty. Avoiding negative surprises requires the deployment of certain strategies. According to them, independent research has indicated that the majority of companies do not carry out a risk assessment to identify and evaluate the potential impact of an unplanned event on their business.
Internal audit can make a difference by considering the risk that fraud, incompetence and errors may exist that may not be detected. By taking he following factors into account possible fraud and errors might be detected;
· Weaknesses in the design of the accounting and internal control system;
· Non-compliance with internal controls;
· Questions with respect to management's integrity and competence;
· Unusual external or internal pressure on entities;
· Unusual transactions;
· Difficulty to obtain sufficient appropriate audit evidence.
Internal audit can make a difference by recommending and educating management in the difference risk management strategies that can be used to reduce risks:
· Risk Avoidance
· Risk Transfer
· Risk Acceptance
· Risk Control
· Insuring Risk
There are a number of other strategies which internal audit can follow in order to minimize the risks and exploit the opportunities. The development of appropriate skills has to be your primary focus, individually, corporately and as a profession. As the saying goes “if you think education is expensive try ignorance.” You can make a huge difference by developing your own business models in order to deliver relevant and timeous assurance.
6.Control
Control is defined in the IIA's Standards for the Professional Practice of Internal Auditing as:
“Any action taken by management to enhance the likelihood that established objectives and goals will be achieved. Management plans, organizes and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved.”
6.1 Primary objectives of Internal Control
The primary objectives of internal controls are to ensure:
· The reliability and integrity of information
· Compliance with policies, plans, procedures, laws, regulations and contracts
· The safeguarding of assets
· The economical and efficient use of resources
· The accomplishment of established objectives and goals for operations or programs
This can be summarized as the safeguarding of resources (assets) from inappropriate use or loss and ensuring that liabilities are identified and managed.
6.2 Who is responsible for control?
The roles and responsibilities of various members of an organization for the proper functioning of a company's internal control structure are as follows:
· The board of directors provides governance, guidance, and oversight, and should discuss the internal control structure with management based on input from the internal and independent auditors and provide oversight as necessary
· Senior management sets the tone at the top and assumes ownership of the system
· The internal auditors evaluate the effectiveness of the control systems and contribute to their ongoing effectiveness
· Other personnel, such as managers, are explicitly or implicitly responsible for the effectiveness of internal controls and should report to senior management about operational problems, non-compliance with the code of conduct, and policy violations or illegal acts.
A system of internal control
The system of internal control is defined as a process, affected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
· Effectiveness and efficiency operations
· Reliability of financial reporting
· Compliance with applicable laws and regulations
Traditionally internal audit has made recommendations for improvement after evaluating the basic principles and requirements for a system of internal control. These basic principles and requirements can be summarized as follows:
· There should always be segregation of duties
· It must be carried out consistently, efficiently and without any interruption or relaxation
· Responsibilities must be established for the fulfillment of duties
· No single person must be in a position to both initiate and complete a transaction
· Personnel must be carefully selected and trained for their particular tasks
· Fidelity insurance cover for key staff members
· A strict practice of rotation of duties and compulsory leave of staff members
· Job specifications must be clear and documented so that each individual knows exactly what is expected of him/her
· Utilization of control accounts and totals obtained from different sources
· The system must be adaptable to changing circumstances and represent the business at all levels
· The system must not be unnecessarily complicated and should be understood by all involved
· Should be cost effective
· The system must be designed in such a way that it affords protection to all involved
From the above it is clear that if Internal Audit want to make a difference we should:
· Stay relevant
· Be proactive in making recommendations
· Understand our clients business and then look into the future to determine how value can be added
· Be respected by management/investors
6.3 Limitations and shortcomings of internal control
Despite all our modern technological and scientific planning, control is still exercised mainly by human supervision.
Internal control owes its origin mainly to human weakness, i.e., human proneness to errors and deceit, and even in its most elementary form of application through the functional divisional of labour, any system of internal control will collapse in the face of collusion.
It is still true today that all systems of internal control are subject to limitations and weakness, i.e., no matter how good the planning of the system, no matter how strict and consistent its application, it can never give perfect protection and safety.
Reasons for limitation of internal control systems can be mainly attributed to the following:
· Human factors e.g. proneness to errors, and deceit, collusion between members of staff etc.
· The historical basis of accounting control. Accountancy is based on historical facts – facts are revealed after the completion of activities
· The higher the rank in the ladder of authority the less automatic control there is of the predecessor's work and of the office himself. It is a fact that in every undertaking a point is reached where control no longer comes from a higher authority. The activities of such executive officers are therefore virtually free from any form of control and/or supervision. Consequently, in practice, conspiracy among high-placed officers is more common and easier, mainly because they have more opportunities for concealment, and is so placed as to derive greater personal advantage from fraud.
· The fact that factual communications on hitches, irregularities and shortfalls do not flow along the line of authority from the bottom to the top as easily and consistently as they should
Within all of these limitations lie Internal Audit's opportunities. As long as there are human intervention in controls Internal Audit can make a difference by monitoring, advising and recommending based on our experiences.
6.4 Measures to overcome limitations and shortcomings
· The continuous study, evaluation and adaptation of the system of internal control
· Selection of staff. The careful selection and control of staff will improve the internal control and limit the making of errors
· Utilization of internal reports; timeous reports on results, deviations and irregularities will ensure that the necessary steps can be taken to rectify matters
· The establishment of an internal audit department: internal auditing is the most effective strengthening factor in the system of internal control as a whole and is a very convenient channel for conveying particulars, observations and preliminary results from the source to the management.
7. Authority
Internal Audit staff is authorized to:
· Have full, free, and unrestricted access to all functions, activities, records, property, information systems, and personnel needed to accomplish its Mission and Scope of Work;
· Allocate resources, set frequencies, select subjects, determine scopes of work, and apply the techniques required to accomplish audit objectives;
· Obtain the necessary cooperation and assistance of personnel in units where Internal Audit performs audits, as well as other specialized services from within or outside the institution.
Internal Audit staff is not authorized or expected to:
· Perform any operational duties;
· Initiate or approve accounting transactions external to Internal Audit;
· Direct the activities of any Company employee not employed by Internal Audit, except to the extent such employees have been appropriately assigned to auditing teams or to otherwise assist the auditors.
· Engage in any activities that Internal Audit would normally be expected to review or appraise.
8. CONCLUSION
Reporting on auditing involves at the highest levels of the organization and many cross-divisional, cross-functional and departmental boundaries.
The Internal Auditor will in addition to traditional skills require to develop expertise and experience in the following fields:
· Information systems and technology
· Risk and reputation management and monitoring
· Corporate citizenship, social and environmental responsibility
· Business ethics
· Supply chain monitoring
· Systems monitoring and evaluation
· Corporate reporting and disclosure
· Corporate governance
· Monitoring of performance and compliance
· Review of policies - security, human resource, intellectual property, knowledge management, communications, delegation, standards, etc.
In essence therefore, Internal Audit should be seen as “the eye of the Board” confirming to that Board that:
· The systems and procedures of internal control are adequate, well designed and work in practice to safeguard and secure the assets and resources of the organization
· The board is informed about, and has considered, all relevant risks
· The board receives all the information relevant to its role and that the information is accurate, reliable and complete.