Conducting an Internal Audit
The internal audit is an essential—and now much discussed—part of business. The Institute of Internal Auditors, an international association of internal auditors, offers this definition: "An independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes." To this end, internal auditing furnishes staff with analyses, appraisals, and recommendations relating to these activities.
Some organizations are large enough to have a designated internal audit function. However, most internal audits are carried out by staff members from within the organization.
An internal audit offers several advantages.
- It directs management's attention to the key business issues. The audit analyzes weaknesses in the system of control, and becomes the basis for practical recommendations for improvement.
- It gives management confidence when controls are operating satisfactorily.
- It identifies opportunities for improving efficiency and effectiveness.
- It gives early notice of potential problems, so that management can take action to head them off.
An internal audit's primary objective is to examine key controls.
- Financial—how is money handled within the organization? For example, who authorizes payment, and what checks and balances are in place to prevent unauthorized spending and fraud?
- Administrative—are these conducive to meeting strategic objectives?
- Systems-related—what systems are in place departmentally and across the organization, and how do they fit together?
Internal audits look, too, at whether the organization is getting value for the money spent. Do the systems currently in place achieve this, or do they fail to measure it?
The first step is to determine which of the above considerations are your priorities and set the broad audit objectives to reflect them.
An internal audit examines a variety of aspects of the way in which an organization operates. It does not focus solely on financial issues. Write an audit brief or strategy that sets detailed priorities and gives some idea of the proportion of time you expect the auditor to spend on the various aspects of the audit.
The usual procedure is to appoint someone from within the organization as the internal auditor. Depending on the issues to be examined, a formal degree, for example, in accounting may be desirable.
Make sure you have all the background information you need before you brief your auditor. Include the following for your organization:
- strategic or business plans
- articles of incorporation, articles of organization, or partnership agreements
- internal procedure manuals
- lists of key personnel
- an organization chart
Meet with the auditor to confirm that you have provided sufficient information. Even if the person is an employee, do not make assumptions about his or her level of knowledge.
The goal of the meeting is to agree on the objectives of the audit. Find out how the auditor plans to meet these objectives. Agree on a timetable and a plan of action and find out if the auditor needs further information.
The next stage is to beginning looking at detail. The auditor needs to look at the organization's existing procedures for controlling the areas you have selected as priorities.
Next, evaluate how effective the controls are. Could they be improved? Are there any areas in which there are no controls? Questions worth thinking about include the following:
- If someone wanted to commit fraud, where and how would they do it?
- If you had bought this product or service personally, would you be happy with the purchase price and the level of service offered?
Choose a number of activities or transactions at random, and trace through all the steps that took place in order to test the controls. Then ask:
- Are there procedures or rules in place for this transaction?
- Did people follow the procedures?
This will indicate the degree of compliance with the existing rules and procedures.
The random test may reveal areas of concern that need thorough investigation. The auditor should now conduct a detailed examination of these areas. For example, every transaction of a particular type should be examined over a number of months to see whether the random, problematical sample was an exception or a recurring problem.
Whatever the overall audit objectives, it is always an internal auditor's job to test whether the organization is receiving value for the money.
- Has the market been tested by getting quotes and tenders for goods and services?
- Has the system worked efficiently?
Draft a report of all the auditor's findings with a set of recommendations. Discuss it with everyone who participated in the audit to make sure that the auditor has not misinterpreted any information.
The final report should include an action plan to tackle the areas that need strengthening. Use the auditor's knowledge as a guide to best practice, and make sure the recommendations are practicable. The report should include a timetable and an agreed time to meet again to monitor progress.
Act to improve problem areas and monitor the progress and effectiveness of the remedial actions. This may well require changing written instructions, manuals, or procedures, alerting staff members to the changes, and seeing that adequate training is given to the staff in those areas.
An internal audit should be a continuous process. You cannot expect a single audit to pick up all the potential weak links in your systems. Nor can you expect it to be a day-to-day management control mechanism.
If handled insensitively, an internal audit can make staff members feel that they are being scrutinized with the intention of finding fault. Brief the staff on the benefits of the audit and keep them informed of the findings and of the positive action that has been taken as a result of it.
Moeller, Robert R.
Spencer Pickett, K. H.
The Institute of Internal Auditors: www.theiia.org
U.S. Chamber of Commerce: www.uschamber.com