content/blog/2020-09-22-internal-audit.org

  1#+date:        <2020-09-22 Tue 00:00:00>
  2#+title:       Functional Roles and Significance of Internal Audit in Organizations
  3#+description: Analysis of internal audit processes, their contribution to risk management, governance frameworks, and compliance monitoring within corporate structures.
  4#+slug:        internal-audit
  5#+filetags:    :audit:internal-audit:governance:
  6
  7* Definitions
  8
  9One of the many reasons that Internal Audit needs such thorough explaining to
 10non-auditors is that Internal Audit can serve many purposes, depending on the
 11organization's size and needs. However, the Institute of Internal Auditors (IIA)
 12defines Internal Auditing as:
 13
 14#+begin_quote
 15Internal auditing is an independent, objective assurance and consulting activity
 16designed to add value and improve an organization's operations. It helps an
 17organization accomplish its objectives by bringing a systematic, disciplined
 18approach to evaluate and improve the effectiveness of risk management, control,
 19and governance processes.
 20#+end_quote
 21
 22However, this definition uses quite a few terms that aren't clear unless the
 23reader already has a solid understanding of the auditing profession. To further
 24explain, the following is a list of definitions that can help supplement
 25understanding of internal auditing.
 26
 27** Independent
 28
 29Independence is the freedom from conditions that threaten the ability of the
 30internal audit activity to carry out internal audit responsibilities in an
 31unbiased manner. To achieve the degree of independence necessary to effectively
 32carry out the responsibilities of the internal audit activity, the chief audit
 33executive has direct and unrestricted access to senior management and the board.
 34This can be achieved through a dual-reporting relationship. Threats to
 35independence must be managed at the individual auditor, engagement, functional,
 36and organizational levels.
 37
 38** Objective
 39
 40Objectivity is an unbiased mental attitude that allows internal auditors to
 41perform engagements in such a manner that they believe in their work product and
 42that no quality compromises are made. Objectivity requires that internal
 43auditors do not subordinate their judgment on audit matters to others. Threats
 44to objectivity must be managed at the individual auditor, engagement,
 45functional, and organizational levels.
 46
 47** Assurance
 48
 49Assurance services involve the internal auditor's objective assessment of
 50evidence to provide opinions or conclusions regarding an entity, operation,
 51function, process, system, or other subject matters. The internal auditor
 52determines the nature and scope of an assurance engagement. Generally, three
 53parties are participants in assurance services: (1) the person or group directly
 54involved with the entity, operation, function, process, system, or other subject
 55
 56- (the process owner), (2) the person or group making the assessment - (the
 57  internal auditor), and (3) the person or group using the assessment - (the
 58  user).
 59
 60** Consulting
 61
 62Consulting services are advisory in nature and are generally performed at the
 63specific request of an engagement client. The nature and scope of the consulting
 64engagement are subject to agreement with the engagement client. Consulting
 65services generally involve two parties: (1) the person or group offering the
 66advice (the internal auditor), and (2) the person or group seeking and receiving
 67the advice (the engagement client). When performing consulting services, the
 68internal auditor should maintain objectivity and not assume management
 69responsibility.
 70
 71** Governance, Risk Management, & Compliance (GRC)
 72
 73The integrated collection of capabilities that enable an organization to
 74reliably achieve objectives, address uncertainty and act with integrity.
 75
 76* Audit Charter & Standards
 77
 78First, it's important to note that not every organization needs internal
 79auditors. In fact, it's unwise for an organization to hire internal auditors
 80unless they have regulatory requirements for auditing and have the capital to
 81support the department. Internal audit is a cost center that can only affect
 82revenue indirectly.
 83
 84Once an organization determines the need for internal assurance services, they
 85will hire a Chief Audit Executive and create the audit charter. This charter is
 86a document, approved by the company's governing body, that will define internal
 87audit's purpose, authority, responsibility, and position within the
 88organization. Fortunately, the IIA has model charters available to IIA members
 89for those developing or improving their charter.
 90
 91Beyond the charter and organizational documents, internal auditors follow a few
 92different standards in order to perform their job. First is the International
 93Professional Practices Framework (IPPF) by the IIA, which is the model of
 94standards for internal auditing. In addition, ISACA's Information Technology
 95Assurance Framework (ITAF) helps guide auditors in reference to information
 96technology (IT) compliance and assurance. Finally, additional standards such as
 97FASB, GAAP, and industry-specific standards are used when performing internal
 98audit work.
 99
100* Three Lines of Defense
101
102[[https://theiia.org][The IIA]] released the original Three Lines of Defense model in 2013, but have
103released an updated version in 2020.
104
105I won't go into depth about the changes made to the model in this article.
106Instead, let's take a look at the most current model.
107
108The updated model forgets the strict idea of areas performing their own
109functions or line of defense. Instead of talking about management, risk, and
110internal audit as 1-2-3, the new model creates a more fluid and cooperative
111model.
112
113Looking at this model from an auditing perspective shows us that auditors will
114need to align, communicate, and collaborate with management, including business
115area managers and chief officers, as well as reporting to the governing body.
116The governing body will instruct internal audit /functionally/ on their goals
117and track their progress periodically.
118
119However, the internal audit department will report /administratively/ to a chief
120officer in the company for the purposes of collaboration, direction, and
121assistance with the business. Note that in most situations, the governing body
122is the audit committee on the company's board of directors.
123
124The result of this structure is that internal audit is an independent and
125objective function that can provide assurance over the topics they audit.
126
127* Audit Process
128
129A normal audit will generally follow the same process, regardless of the topic.
130However, certain special projects or abnormal business areas may call for
131changes to the audit process. The audit process is not set in stone, it's simply
132a set of best practices so that audits can be performed consistently.
133
134While different organizations may tweak the process, it will generally follow
135this flow:
136
137** 1. Risk Assessment
138
139The risk assessment part of the process has historically been performed
140annually, but many organizations have moved to performing this process much more
141frequently. In fact, some organizations are moving to an agile approach that can
142take new risks into the risk assessment and re-prioritize risk areas on-the-go.
143To perform a risk assessment, leaders in internal audit will research industry
144risks, consult with business leaders around the company, and perform analyses on
145company data.
146
147Once a risk assessment has been documented, the audit department has a
148prioritized list of risks that can be audited. This is usually in the form of
149auditable entities, such as business areas or departments.
150
151** 2. Planning
152
153During the planning phase of an audit, auditors will meet with the business area
154to discuss the various processes, controls, and risks applicable to the
155business. This helps the auditors determine the scope limits for the audit, as
156well as timing and subject-matter experts. Certain documents will be created in
157this phase that will be used to keep the audit on-track an in-scope as it goes
158forward.
159
160** 3. Testing
161
162The testing phase, also known as fieldwork or execution, is where internal
163auditors will take the information they've discovered and test it against
164regulations, industry standards, company rules, best practices, as well as
165validating that any processes are complete and accurate. For example, an audit
166of HR would most likely examine processes such as employee on-boarding, employee
167termination, security of personally identifiable information (PII), or the IT
168systems involved in these processes. Company standards would be examined and
169compared against how the processes are actually being performed day-to-day, as
170well as compared against regulations such as the Equal Employment Opportunity
171(EEO), American with Disabilities Act, and National Labor Relations Act.
172
173** 4. Reporting
174
175Once all the tests have been completed, the audit will enter the reporting
176phase. This is when the audit team will conclude on the evidence they've
177collected, interviews they've held, and any opinions they've formed on the
178controls in place. A summary of the audit findings, conclusions, and specific
179recommendations are officially communicated to the client through a draft
180report. Clients have the opportunity to respond to the report and submit an
181action plan and time frame. These responses become part of the final report
182which is distributed to the appropriate level of administration.
183
184** 5. Follow-Up
185
186After audits have been completed and management has formed action plans and time
187frames for audit issues, internal audit will follow up once that due date has
188arrived. In most cases, the follow-up will simply consist of a meeting to
189discuss how the action plan has been completed and to request documentation to
190prove it.
191
192* Audit Department Structure
193
194While an internal audit department is most often thought of as a team of
195full-time employees, there are actually many different ways in which a
196department can be structured. As the world becomes more digital and fast-paced,
197outsourcing has become a more attractive option for some organizations. Internal
198audit can be fully outsourced or partially outsourced, allowing for flexibility
199in cases where turnover is high.
200
201In addition, departments can implement a rotational model. This allows for
202interested employees around the organization to rotate into the internal audit
203department for a period of time, allowing them to obtain knowledge of risks and
204controls and allowing the internal audit team to obtain more business area
205knowledge. This program is popular in very large organizations, but
206organizations tend to rotate lower-level audit staff instead of managers. This
207helps prevent any significant knowledge loss as auditors rotate out to business
208areas.
209
210* Consulting
211
212Consulting is not an easy task at any organization, especially for a department
213that can have negative perceptions within the organization as the "compliance
214police." However, once an internal audit department has delivered value to
215organization, adding consulting to their suite of services is a smart move. In
216most cases, Internal Audit can insert themselves into a consulting role without
217affecting the process of project management at the company. This means that
218internal audit can add objective assurance and opinions to business areas as
219they develop new processes, instead of coming in periodically to audit an area
220and file issues that could have been fixed at the beginning.
221
222* Data Science & Data Analytics
223
224One major piece of the internal audit function in the modern world is data
225science. While the process is data science, most auditors will refer to anything
226in this realm as data analytics. Hot topics such as robotic process automation
227(RPA), machine learning (ML), and data mining have taken over the auditing world
228in recent years. These technologies have been immensely helpful with increasing
229the effectiveness and efficiency of auditors.
230
231For example, mundane and repetitive tasks can be automated in order for auditors
232to make more room in their schedules for labor-intensive work. Further, auditors
233will need to adapt technologies like machine learning in order to extract more
234value from the data they're using to form conclusions.