cmc/cleberg.net

  1#+date:        [2020-09-22 Tue 00:00:00]
  2#+title:       Internal Audit: Who Are They?
  3#+description: Learn who your Internal Audit partners actually are.
  4#+slug:        internal-audit
  5#+filetags:    :audit:
  6
  7* Definitions
  8
  9One of the many reasons that Internal Audit needs such thorough explaining to
 10non-auditors is that Internal Audit can serve many purposes, depending on the
 11organization's size and needs. However, the Institute of Internal Auditors (IIA)
 12defines Internal Auditing as:
 13
 14#+begin_quote
 15Internal auditing is an independent, objective assurance and consulting activity
 16designed to add value and improve an organization's operations. It helps an
 17organization accomplish its objectives by bringing a systematic, disciplined
 18approach to evaluate and improve the effectiveness of risk management, control,
 19and governance processes.
 20#+end_quote
 21
 22However, this definition uses quite a few terms that aren't clear unless the
 23reader already has a solid understanding of the auditing profession. To further
 24explain, the following is a list of definitions that can help supplement
 25understanding of internal auditing.
 26
 27** Independent
 28
 29Independence is the freedom from conditions that threaten the ability of the
 30internal audit activity to carry out internal audit responsibilities in an
 31unbiased manner. To achieve the degree of independence necessary to effectively
 32carry out the responsibilities of the internal audit activity, the chief audit
 33executive has direct and unrestricted access to senior management and the board.
 34This can be achieved through a dual-reporting relationship. Threats to
 35independence must be managed at the individual auditor, engagement, functional,
 36and organizational levels.
 37
 38** Objective
 39
 40Objectivity is an unbiased mental attitude that allows internal auditors to
 41perform engagements in such a manner that they believe in their work product and
 42that no quality compromises are made. Objectivity requires that internal
 43auditors do not subordinate their judgment on audit matters to others. Threats
 44to objectivity must be managed at the individual auditor, engagement,
 45functional, and organizational levels.
 46
 47** Assurance
 48
 49Assurance services involve the internal auditor's objective assessment of
 50evidence to provide opinions or conclusions regarding an entity, operation,
 51function, process, system, or other subject matters. The internal auditor
 52determines the nature and scope of an assurance engagement. Generally, three
 53parties are participants in assurance services: (1) the person or group directly
 54involved with the entity, operation, function, process, system, or other
 55subject - (the process owner), (2) the person or group making the assessment -
 56(the internal auditor), and (3) the person or group using the assessment - (the
 57user).
 58
 59** Consulting
 60
 61Consulting services are advisory in nature and are generally performed at the
 62specific request of an engagement client. The nature and scope of the consulting
 63engagement are subject to agreement with the engagement client. Consulting
 64services generally involve two parties: (1) the person or group offering the
 65advice (the internal auditor), and (2) the person or group seeking and receiving
 66the advice (the engagement client). When performing consulting services, the
 67internal auditor should maintain objectivity and not assume management
 68responsibility.
 69
 70** Governance, Risk Management, & Compliance (GRC)
 71
 72The integrated collection of capabilities that enable an organization to
 73reliably achieve objectives, address uncertainty and act with integrity.
 74
 75* Audit Charter & Standards
 76
 77First, it's important to note that not every organization needs internal
 78auditors. In fact, it's unwise for an organization to hire internal auditors
 79unless they have regulatory requirements for auditing and have the capital to
 80support the department. Internal audit is a cost center that can only affect
 81revenue indirectly.
 82
 83Once an organization determines the need for internal assurance services, they
 84will hire a Chief Audit Executive and create the audit charter. This charter is
 85a document, approved by the company's governing body, that will define internal
 86audit's purpose, authority, responsibility, and position within the
 87organization. Fortunately, the IIA has model charters available to IIA members
 88for those developing or improving their charter.
 89
 90Beyond the charter and organizational documents, internal auditors follow a few
 91different standards in order to perform their job. First is the International
 92Professional Practices Framework (IPPF) by the IIA, which is the model of
 93standards for internal auditing. In addition, ISACA's Information Technology
 94Assurance Framework (ITAF) helps guide auditors in reference to information
 95technology (IT) compliance and assurance. Finally, additional standards such as
 96FASB, GAAP, and industry-specific standards are used when performing internal
 97audit work.
 98
 99* Three Lines of Defense
100
101[[https://theiia.org][The IIA]] released the original Three Lines of Defense model in 2013, but have
102released an updated version in 2020.
103
104I won't go into depth about the changes made to the model in this article.
105Instead, let's take a look at the most current model.
106
107The updated model forgets the strict idea of areas performing their own
108functions or line of defense. Instead of talking about management, risk, and
109internal audit as 1-2-3, the new model creates a more fluid and cooperative
110model.
111
112Looking at this model from an auditing perspective shows us that auditors will
113need to align, communicate, and collaborate with management, including business
114area managers and chief officers, as well as reporting to the governing body.
115The governing body will instruct internal audit /functionally/ on their goals
116and track their progress periodically.
117
118However, the internal audit department will report /administratively/ to a chief
119officer in the company for the purposes of collaboration, direction, and
120assistance with the business. Note that in most situations, the governing body
121is the audit committee on the company's board of directors.
122
123The result of this structure is that internal audit is an independent and
124objective function that can provide assurance over the topics they audit.
125
126* Audit Process
127
128A normal audit will generally follow the same process, regardless of the topic.
129However, certain special projects or abnormal business areas may call for
130changes to the audit process. The audit process is not set in stone, it's simply
131a set of best practices so that audits can be performed consistently.
132
133While different organizations may tweak the process, it will generally follow
134this flow:
135
136** 1. Risk Assessment
137
138The risk assessment part of the process has historically been performed
139annually, but many organizations have moved to performing this process much more
140frequently. In fact, some organizations are moving to an agile approach that can
141take new risks into the risk assessment and re-prioritize risk areas on-the-go.
142To perform a risk assessment, leaders in internal audit will research industry
143risks, consult with business leaders around the company, and perform analyses on
144company data.
145
146Once a risk assessment has been documented, the audit department has a
147prioritized list of risks that can be audited. This is usually in the form of
148auditable entities, such as business areas or departments.
149
150** 2. Planning
151
152During the planning phase of an audit, auditors will meet with the business area
153to discuss the various processes, controls, and risks applicable to the
154business. This helps the auditors determine the scope limits for the audit, as
155well as timing and subject-matter experts. Certain documents will be created in
156this phase that will be used to keep the audit on-track an in-scope as it goes
157forward.
158
159** 3. Testing
160
161The testing phase, also known as fieldwork or execution, is where internal
162auditors will take the information they've discovered and test it against
163regulations, industry standards, company rules, best practices, as well as
164validating that any processes are complete and accurate. For example, an audit
165of HR would most likely examine processes such as employee on-boarding, employee
166termination, security of personally identifiable information (PII), or the IT
167systems involved in these processes. Company standards would be examined and
168compared against how the processes are actually being performed day-to-day, as
169well as compared against regulations such as the Equal Employment Opportunity
170(EEO), American with Disabilities Act, and National Labor Relations Act.
171
172** 4. Reporting
173
174Once all the tests have been completed, the audit will enter the reporting
175phase. This is when the audit team will conclude on the evidence they've
176collected, interviews they've held, and any opinions they've formed on the
177controls in place. A summary of the audit findings, conclusions, and specific
178recommendations are officially communicated to the client through a draft
179report. Clients have the opportunity to respond to the report and submit an
180action plan and time frame. These responses become part of the final report
181which is distributed to the appropriate level of administration.
182
183** 5. Follow-Up
184
185After audits have been completed and management has formed action plans and time
186frames for audit issues, internal audit will follow up once that due date has
187arrived. In most cases, the follow-up will simply consist of a meeting to
188discuss how the action plan has been completed and to request documentation to
189prove it.
190
191* Audit Department Structure
192
193While an internal audit department is most often thought of as a team of
194full-time employees, there are actually many different ways in which a
195department can be structured. As the world becomes more digital and fast-paced,
196outsourcing has become a more attractive option for some organizations. Internal
197audit can be fully outsourced or partially outsourced, allowing for flexibility
198in cases where turnover is high.
199
200In addition, departments can implement a rotational model. This allows for
201interested employees around the organization to rotate into the internal audit
202department for a period of time, allowing them to obtain knowledge of risks and
203controls and allowing the internal audit team to obtain more business area
204knowledge. This program is popular in very large organizations, but
205organizations tend to rotate lower-level audit staff instead of managers. This
206helps prevent any significant knowledge loss as auditors rotate out to business
207areas.
208
209* Consulting
210
211Consulting is not an easy task at any organization, especially for a department
212that can have negative perceptions within the organization as the "compliance
213police." However, once an internal audit department has delivered value to
214organization, adding consulting to their suite of services is a smart move. In
215most cases, Internal Audit can insert themselves into a consulting role without
216affecting the process of project management at the company. This means that
217internal audit can add objective assurance and opinions to business areas as
218they develop new processes, instead of coming in periodically to audit an area
219and file issues that could have been fixed at the beginning.
220
221* Data Science & Data Analytics
222
223One major piece of the internal audit function in the modern world is data
224science. While the process is data science, most auditors will refer to anything
225in this realm as data analytics. Hot topics such as robotic process automation
226(RPA), machine learning (ML), and data mining have taken over the auditing world
227in recent years. These technologies have been immensely helpful with increasing
228the effectiveness and efficiency of auditors.
229
230For example, mundane and repetitive tasks can be automated in order for auditors
231to make more room in their schedules for labor-intensive work. Further, auditors
232will need to adapt technologies like machine learning in order to extract more
233value from the data they're using to form conclusions.