-
Aligning the Internal Audit Function with Strategic Objectives
Given today’s complex and rapidly changing management climate, companies must implement continuous improvements to achieve efficiency, and assure investors and other concerned parties of solid corporate governance.The recent scandals at Enron, Worldcom, Parmalat, and others have raised the profile of corporate governance across the globe. Trust in the process of financial accounting, corporate governance, and auditing has been undermined by... -
Best Practices in Risk-Based Internal Auditing
In designing risk-based auditing and monitoring activities, it is important that the internal auditor works closely with the organization’s senior leadership and the board, or committee of the board, to gain a clear understanding of auditing and monitoring expectations and how these activities can be leveraged together to help minimize and mitigate risks for the organization. These discussions should also include leadership from the legal,... -
Effective Financial Reporting and Auditing: Importance and Limitations
The major problem with financial reporting is that people with limited financial knowledge can look at a set of accounts and, by attempting to interpret the numbers, feel that they understand what is happening in an organization. While in simpler times this may have been true, the scale and complexity of modern business, together with the limitations of what can be portrayed in financial statements, means that today’s statements may have the... -
Engaging Senior Management in Internal Control
Top managers in any organization have many calls on their time and attention. Vying for their attention will be customers, suppliers, employees, consultants, and many others. Internal controls can easily be squeezed out of their agenda. The problem this can create is that if senior management does not take control seriously, the “tone from the top” will be wrong—and if the people in charge don’t care, then why should anyone else in the... -
Has Financial Reporting Impacted on Internal Auditing Negatively?
It was unfortunate that the Institute of Internal Auditors (IIA) released its first consulting Standards, to add to its already existing assurance Standards, at exactly the time when Enron collapsed. “Implementation Standards” set out how the “Attribute Standards” and “Performance Standards” should be applied in the context of either assurance or consulting work. In 2007 the IIA announced that it had no plans to release further sets of... -
How Can Internal Audit Report Effectively to Its Stakeholders?
Internal audit has a variety of stakeholders who rely on its work. These include: the board of directors; the audit committee; the chief executive officer; senior executives such as the chief financial officer, chief information officer, chief risk officer, etc.; the external auditors; in some cases, regulatory bodies; and stockholders—who, in the case of government organizations, could be the public.All these stakeholders are seeking assurance... -
How Internal Auditing Can Help with a Company’s Fraud Issues
Regulatory oversight is increasing, as are penalties. A passive attitude in an organization toward oversight and the topic of fraud, antifraud programs, and controls would be a strong indicator of a significant deficiency in its system of internal controls.Economic factors can increase the occurrence of fraudulent practices. When the economy is in a downturn the risk of fraud increases due to personal financial pressures, the stagnation of... -
Implementing an Effective Internal Controls System
In some jurisdictions law or regulation may require effective systems of internal control, with serious penalties for irresponsible failure. The Sarbanes–Oxley Act (2002) requires CEOs and CFOs of companies with listings in the United States to certify their assessment of the effectiveness of internal control over reported disclosures (s302) and financial reporting (s404), with penalties of up to $1 million and ten years imprisonment for... -
Incorporating Operational and Performance Auditing into Compliance and Financial Auditing
“The truth is, “audit gets no respect.” Quite frankly, if the audit department in question is using yesterday’s approach in today’s company, has not manoeuvred top management and the board into focusing on the company’s top five or ten risks, has not caused management to quantify these risks, and has not succeeded in developing authorized bounds of risk tolerance, then it doesn’t deserve any respect.” Larry Small, President, Fannie Mae,... -
Internal Audit and Partnering with Senior Management
“The internal audit function has evolved from corporate cop to that of a savvy in-house consulting service.”1Internal auditing in the twenty-first century imposes even greater demands on the professional internal audit staff, whose role has expanded to combine both an assurance and a consulting service to management. Internal audit charters have been broadened considerably to reflect these demands.The chief executive of the Institute of Internal... -
Internal Audit Planning: How Can We Do It Better?
Internal audit is an information service. Internal auditors do not—indeed, must not—make decisions for the managers of organizations. They are a highly skilled and expensive resource that exists to serve the best interest of the organization and yet, on the surface, they do not directly contribute to organizational performance. They examine processes and produce reports; they attempt to capture good practice and identify poor; and they design... -
Internal Auditors and Enterprise Risk Management
Traditionally, internal auditors have been “policemen,” and their efforts have been concentrated on the more detailed, and arguably less appealing, aspects of financial auditing within organizations. Often, therefore, internal auditors have been regarded in the past as the poor relations of their external auditor cousins. This no longer applies, however, as the purpose of many internal audit functions has evolved over time.From a concern with... -
Managing the Relationships between Audit Committees and the CAE
The audit committee is intended, overall, to assist an organization to achieve an effective internal control structure derived directly from the tone at the top. The authority of an audit committee is drawn from the board of directors, the rules and regulations of the organization, and any relevant governance legislation of the country or countries within which the organization operates.This role, of necessity, involves ensuring that the risk... -
New Assurance Challenges Facing Chief Audit Executives
Looking back over the last 15 to 20 years, it does seem that at one time the biggest challenge facing the profession of internal auditing was whether the unique scope and contribution of internal audit was clearly defined, understood, or indeed actually needed. Much of the thought leadership around internal auditing in recent years has focused on this challenge. Two publications by PricewaterhouseCoopers in 2007,1 and a heads of internal audit... -
Optimizing Internal Audit
Internal auditing is defined by The Institute of Internal Auditors (IIA) as follows:“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”1It is widely accepted... -
Starting a Successful Internal Audit Function to Meet Present and Future Demands
In 1998 on the occasion of the fifty-year celebration of the establishment of the Institute of Internal Auditors (IIA)’s five chapters in the United Kingdom, I wrote:1“We need to be seen as innovators in the world of regulation, control and auditing. Creativity, innovation and experimentation are now key to our professional success. They must be the vision of all internal auditing functions. This means improving old and developing new products... -
The Assurance versus Consulting Debate: How Far Should Internal Audit Go?
Internal auditors have described their discipline as an “assurance and consulting activity.” Such a definition immediately begs the question: what is the difference, and what should the balance be?Assurance has been variously defined. The dictionary definition, “a statement or indication that inspires confidence,” differs quite considerably from the statement to be found in Assurance Standards (quoted here from the Australian Assurance Standards... -
The Complex World of International Auditing Regulation
The development of international audit regulation is closely linked to the development of international accounting regulation. Both have been significantly associated with the globalization of capital markets and growth in importance of international investors. Such investors expect the financial reports of the companies they are investing in to be fair and reliable, with auditors playing a critical role—famously categorized by Paul Volcker in... -
The Internal Audit Role—Is There an Expectation Gap in Your Organization?
Establishing the internal audit role in any organization requires formality to ensure that it is understood not only by the board and management but also by its customers across the organization and, where necessary, those external to the organization. The internal audit assurance and consulting role should be explained clearly in a charter to minimize any expectation gaps at board and organization levels. When the role is being established, it... -
What Is the Range of the Internal Auditor’s Work?
Internal auditing is an evolving profession. It has been around for a very long time, probably since the pharaohs in Egypt. But it wasn’t until 1947—when the foremost professional body for internal auditing, the Institute of Internal Auditors (IIA), was formed—that internal auditing was set on its path to emerging as a profession.Subsequently, professional standards and a code of ethics for internal auditing have been established, and in 1974...


