The Essential Guide to Internal Auditing E-Book

K. H. Spencer Pickett

• Herausgeber: John Wiley & Sons
• Kategorie: Fachliteratur
• Sprache: Englisch
• Veröffentlichungsjahr: 2011

Seitenzahl: 815

Beschreibung

The Second Edition of The Essential Guide to Internal Auditing is a condensed version of the Handbook of Internal Auditing, Third Edition. It shows internal auditors and students in the field how to understand the audit context and how this context fits into the wider corporate agenda. The new context is set firmly within the corporate governance, risk management, and internal control arena. The new edition includes expanded coverage on risk management and is updated throughout to reflect the new IIA standards and current practice advisories. It also includes many helpful models, practical guidance and checklists.

Leseprobe

Table of Contents

Title Page

Copyright

Dedication

List of Abbreviations

Chapter 1: Introduction

Introduction

1.1 Reasoning behind the Book

1.2 The IIA Standards and Links to the Book

1.3 How to Navigate around the Book

1.4 The Essential Guide as a Development Tool

1.5 The Development of Internal Auditing

Summary and Conclusions

Chapter 2: Corporate Governance Perspectives

Introduction

2.1 The Agency Model

2.2 Corporate Ethics and Accountability

2.3 International Scandals and Their Impact

2.4 Models of Corporate Governance

2.5 The Institute of Internal Auditors

2.6 The External Audit

2.7 The Audit Committee

2.8 Internal Audit

2.9 The Link to Risk Management and Internal Control

2.10 Reporting on Governance, Risk and Internal Controls

2.11 New Developments

Summary and Conclusions

Chapter 3: Managing Risk

Introduction

3.1 What is Risk?

3.2 The Risk Challenge

3.3 Risk Management Process

3.4 Mitigation through Controls

3.5 Risk Registers and Appetites

3.6 The Risk Policy

3.7 Enterprise-Wide Risk Management

3.8 Control Self-Assessment

3.9 Embedding Risk Management

3.10 The Internal Audit Role in Risk Management

3.11 New Developments

Summary and Conclusions

Chapter 4: Internal Controls

Introduction

4.1 Why Controls?

4.2 Control Framework – COSO

4.3 Control Framework – CoCo

4.4 Other Control Models

4.5 Links to Risk Management

4.6 Control Mechanisms

4.7 Importance of Procedures

4.8 Integrating Controls

4.9 The Fallacy of Perfection

4.10 The Complete Control Model

4.11 New Developments

Summary and Conclusions

Chapter 5: The Internal Audit Role

Introduction

5.1 Defining Internal Audit

5.2 The Four Main Elements

5.3 The Audit Charter

5.4 Audit Services

5.5 Independence

5.6 Audit Ethics

5.7 Police Officer versus Consultant

5.8 Managing Expectations through Web Design

5.9 Audit Competencies

5.10 Training and Development

5.11 New Developments

Summary and Conclusions

Chapter 6: Professionalism

Introduction

6.1 Audit Professionalism

6.2 Internal Auditing Standards

6.3 Due Professional Care

6.4 Professional Consulting Services

6.5 The Quality Concept

6.6 Supervision

6.7 Internal Review

6.8 External Reviews

6.9 Marketing the Audit Role

6.10 Creating the Audit Image

6.11 New Developments

Summary and Conclusions

Chapter 7: The Audit Approach

Introduction

7.1 The Risk-Based Systems Approach

7.2 Control Risk Self-Assessment (CRSA)

7.3 The CRSA Process

7.4 Integrating Self-Assessment and Audit

7.5 Fraud Investigations

7.6 Information Systems Auditing

7.7 Compliance

7.8 Value for Money (VFM)

7.9 The Consulting Approach

7.10 The ‘Right’ Structure

7.11 New Developments

Summary and Conclusions

Chapter 8: Setting an Audit Strategy

Introduction

8.1 Risk-Based Strategic Planning

8.2 Resourcing the Strategy

8.3 Managing Performance

8.4 The Auditor Appraisal Scheme

8.5 Methods of Staff Appraisal

8.6 The Audit Manual

8.7 Time Monitoring System

8.8 Audit Planning Process

8.9 The Annual Audit Plan

8.10 The Quarterly Audit Plan

8.11 New Developments

Summary and Conclusions

Chapter 9: Audit Fieldwork

Introduction

9.1 Planning the Audit

9.2 Interviewing Skills

9.3 Ascertaining the System

9.4 Evaluation

9.5 Testing Strategies

9.6 Evidence and Working Papers

9.7 Statistical Sampling

9.8 Audit Testing and Statistical Sampling

9.9 Reporting Results of the Audit

9.10 Structuring the Audit Report

9.11 Audit Committee Reporting

9.12 New Developments

Summary and Conclusions

Chapter 10: Meeting the challenge

Introduction

10.1 The New Dimensions of Internal Auditing

10.2 The Audit Reputation

10.3 Globalization

10.4 Providing Audit Assurances

10.5 Meeting the Challenge

Summary and Conclusions

Appendix A: Auditing the Risk Management Process: A Case Study

Systems related business objectives

Scope of the audit

Audit approach

Control Objective One

Control Objective Two

Control Objective Three

Control Objective Four

Index

This edition first published 2011

© 2011 KH Spencer Pickett

Registered office

John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, United Kingdom

For details of our global editorial offices, for customer services and for information about how to apply for permission to reuse the copyright material in this book please see our website at www.wiley.com.

The right of the author to be identified as the author of this work has been asserted in accordance with the Copyright, Designs and Patents Act 1988.

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, except as permitted by the UK Copyright, Designs and Patents Act 1988, without the prior permission of the publisher.

Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books.

Designations used by companies to distinguish their products are often claimed as trademarks. All brand names and product names used in this book are trade names, service marks, trademarks or registered trademarks of their respective owners. The publisher is not associated with any product or vendor mentioned in this book. This publication is designed to provide accurate and authoritative information in regard to the subject matter covered. It is sold on the understanding that the publisher is not engaged in rendering professional services. If professional advice or other expert assistance is required, the services of a competent professional should be sought.

British Library Cataloguing in Publication Data

A catalogue record for this book is available from the British Library.

ISBN 978-0-470-74693-6 (paperback)

ISBN 978-1-119-97382-9 (ebk)

ISBN 978-1-119-97383-6 (ebk)

ISBN 978-1-119-97705-6 (ebk)

This book is dedicated with love to my wife, Jennifer, and my two children, Dexter and Laurel-Jade

A very special thanks goes out to Stuart, Carol, Suzanne and Charlotte

List of Abbreviations

ACAudit CommitteeACCAChartered Association of Certified AccountantsAICPAAmerican Institute of Certified Public AccountantsCAEChief Audit ExecutiveCBOKCommon Body of KnowledgeCEOChief Executive OfficerCFOChief Finance OfficerCGCorporate GovernanceCICACanadian Institute of Chartered AccountantsCIMAChartered Institute of Management AccountantsCIOChief Information OfficerCOSOCommittee of Sponsoring Organizations of the Treadway CommissionCPACertified Public AccountantCPDContinuing Professional DevelopmentCPEContinuing Professional EducationCROChief Risk OfficerCRSAControl Risk Self-AssessmentCRSAControl and Risk Self-AssessmentCSAControl Self-AssessmentDFDirector of FinanceDPData ProtectionEAExternal AuditERMEnterprise Risk ManagementFCOForeign and Commonwealth OfficeFSAFinancial Services AuthorityGAAPGenerally Accepted Accounting PoliciesGAINGlobal Audit Information NetworkGAOGovernment Accountability OfficeGRCGovernance, Risk and ControlHMHer Majesty'sHRHuman ResourceHRMHuman Resource ManagementIAInternal AuditICInput ControlICAEWInstitute of Chartered Accountants in England and WalesICEInternal Control EvaluationICQInternal Control QuestionnaireIIAInstitute of Internal AuditorsIPPFInternational Professional Practices FrameworkIRCINFOSEC Research CouncilISInformation SystemsISOInternational Standards OrganizationITInformation TechnologyKPIsKey Performance IndicatorsKRCMKey Risk and Control MatrixMISManagement Information SystemMUSMonetary Unit SamplingNAONational Audit OfficeNEDNon-Executive DirectorNYSENew York Stock ExchangeOECDOrganization for Economic Cooperation and DevelopmentPACPublic Accounts CommitteePCPersonal ComputerPESTLPolitical, Economical, Social, Technical and LegalPPFProfessional Practices FrameworkPSRPreliminary Survey ReportPwCPricewaterhouseCoopersQAQuality AssuranceRaCERisk-Assessed Control EvaluationRBSARisk-Based Systems AuditingSDSystems DevelopmentSDStandard DeviationSECSecurities and Exchange CommissionSECStock Exchange CommissionSICStatement on Internal ControlSWOTStrengths, Weaknesses, Opportunities and ThreatsUSUnited States of AmericaUSAUnited States of AmericaVFMValue for Money

Chapter 1

Introduction

Introduction

The 1000 page Internal Auditing Handbook 3rd Edition contains a comprehensive account of the role, responsibilities and work of the internal audit profession and this new book is a streamlined text from the same author that draws heavily from the main Handbook. The second edition of The Essential Guide to Internal Auditing reflects the significant changes in the field of internal auditing over the last few years. Since the last edition there have been many developments that impact the very heart of the audit role. There really are ‘new look’ internal auditors who carry the weight of a heightened expectation from society on their shoulders. Auditors no longer spend their time looking down at detailed working schedules in cramped offices before preparing a comprehensive report on low-level problems that they have found for junior operational managers. They now spend much more time presenting ‘big picture’ assurances to executive boards after having considered the really high-level risks that need to be managed properly. Moreover, the internal auditor also works with and alongside busy managers to help them understand the task of identifying and managing risks to their operations. At the same time the internal auditor has to retain a degree of independence so as to ensure the all-important professional scepticism that is essential to the audit role. The auditor's report to the board via the Audit Committee must have a resilience and dependability that is unquestionable and the audit product must add value to the employing organization. These new themes have put the internal auditor at the forefront of business, commerce and public sector entities as one of the cornerstones of corporate governance – and the new The Essential Guide to Internal Auditing has been updated to take this on board. The second edition of The Essential Guide contains much of the material that formed the basis of the first edition and has been expanded in the following manner:

1. The new edition has been updated to reflect the Institute of Internal Auditors' International Standards for the Professional Practice of Internal Auditing that were released during 2009.

2. Each chapter has a new section on new developments to reflect changes that have occurred since the first edition was published.

3. There is a new worked example of auditing the risk management process contained in the appendices.

Change is now a constant and we have tried not to focus too much on specific events such as the 2007/08 banking failures/Credit Crunch, the resulting recession and isolated incidents such as the Madoff fraud or the BP oil leaks in the Gulf Coast, since it is the principles of internal auditing that remain constant, regardless of the latest scandal to impact the economy. Please take a look at the Institute of Internal Auditors' web site at www.theiia.org to keep up to date with new developments and the latest corporate scandals.

The first edition of The Essential Guide described internal auditing as a growing quasi-profession. The quantum leap that occurred between the old and new millennium is that internal auditing has now achieved the important status of being a full-blown profession, led by a chief audit executive. Note that the term ‘chief audit executive’ (CAE) is used throughout the book and this person is described by the Institute of Internal Auditors (IIA):

The chief audit executive is a senior position within the organization responsible for internal audit activities. Normally, this would be the internal audit director. In the case where internal audit activities are obtained from external service providers, the chief audit executive is the person responsible for overseeing the service contract and the overall quality assurance of these activities, reporting to senior management and the board regarding internal audit activities, and follow-up of engagement results. The term also includes titles such as general auditor, head of internal audit, chief internal auditor, and inspector general.

With the growing influence of internal auditing comes the need to ensure expectations of a professional service are fully understood and fully met. Regulators around the world have now recognized the real impact a fully professional internal audit function can make in promoting good governance. However, with greater recognition comes a greater responsibility to deliver the goods, which is why The Essential Guide has been prepared with the need for auditors to live up to this enhanced role kept fully in mind.

The areas that are included in this chapter are:

1.1 Reasoning behind the Book

1.2 The IIA Standards and Links to the Book

1.3 How to Navigate around the Book

1.4The Essential Guide as a Development Tool

1.5 The Development of Internal Auditing

Summary and Conclusions

1.1 Reasoning behind the Book

The original Essential Guide focused on the practical aspects of performing the audit task. It contained basic material on managing, planning, performing and reporting the audit, recognizing the underlying need to get the job done well. The new edition has a different focus. Now we need first and foremost to understand the audit context and how we fit into the wider corporate governance agenda. It is only after having done this that we can go on to address the response to changing expectations. In fact, we could argue that we need to provide an appropriate response to the call for better and more effective governance of both private and public sector organizations, rather than think of the audit position as being more or less static. It is no longer possible to simply write about an audit plan, preparing the audit programme and how best to perform the audit task. To do justice to the wealth of material on internal auditing, we must acknowledge the impact of internal audit standards and the work of writers, thought leaders, academics and journalists.

The new context for internal auditing is set firmly within the corporate governance and risk management arena. The Institute of Internal Auditors' (IIA) definition of internal auditing was not changed when the standards were revised in January 2009 and remains as follows:

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

As a result, The Essential Guide has early chapters on Corporate Governance Perspectives, Managing Risk and Internal Controls. It is only after having addressed these three interrelated topics that we can really appreciate the internal audit role. There are also chapters covering professional standards, audit approaches, managing internal audit, planning, performance and reporting audit work and specialist areas such as fraud and information system (IS) auditing. The final chapter attempts to peer into the future at some of the changes that may well be on the way. The Essential Guide rests firmly on the platform provided by the IIA's International Standards for the Professional Practice of Internal Auditing as part of the International Professional Practices Framework (IPPF). Internal auditing is a specialist career and it is important that we note the efforts of a professional body that is dedicated to this chosen field. Note that despite the recent changes in the field of internal auditing there is much of the first book that is retained in the new edition. Change means we build on what we, as internal auditors, have developed over the years rather than throw away anything that is more than a few years old. This is why much of the original material from the first edition has not been discarded – as the saying goes, it is important not to throw away the baby with the bath water. Note that all references to IIA definitions, code of ethics, IIA attribute and performance standards, practice advisories and practice guides relate to the International Professional Practices Framework (IPPF) prepared by the Institute of Internal Auditors in 2009.

1.2 The IIA Standards and Links to the Book

The Essential Guide addresses many aspects of internal auditing that are documented in the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing. Some years ago, the Institute of Internal Auditors (IIA) Executive Committee commissioned an international Steering Committee and Task Force to review the Professional Practices Framework (PPF), the IIA's guidance, structure and related processes. The Task Force's efforts were focused on reviewing the scope of the framework and increasing the transparency and flexibility of the guidance development, review and issuance processes. The results culminated in a new International Professional Practices Framework (IPPF) and a reengineered Professional Practices Council, the body that supports the IPPF. The Attribute Standards outline what a good internal audit set-up should look like, while the Performance Standards set a benchmark for the audit task. Together with the Practice Advisories, Position Statements and Practice Guides and other reference material, they constitute a worldwide professional framework for internal auditing. The IIA's main Attribute and Performance Standards are listed below.

Attribute Standards

1000: Purpose, Authority, and Responsibility The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval.

1100: Independence and Objectivity The internal audit activity must be independent and internal auditors must be objective in performing their work.

1200: Proficiency and Due Professional Care Engagements must be performed with proficiency and due professional care.

1300: Quality Assurance and Improvement Program The chief audit executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity.

Performance Standards

2000: Managing the Internal Audit Activity The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organization.

2100: Nature of Work The internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic and disciplined approach.

2200: Engagement Planning Internal auditors must develop and document a plan for each engagement, including the engagement's objectives, scope, timing, and resource allocations.

2300: Performing the Engagement Internal auditors must identify, analyze, evaluate, and document sufficient information to achieve the engagement's objectives.

2400: Communicating Results Internal auditors must communicate the engagement results.

2500: Monitoring Progress The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management.

2600: Resolution of Senior Management's Acceptance of Risks When the chief audit executive believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the decision regarding residual risk is not resolved, the chief audit executive must report the matter to the board for resolution.

1.3 How to Navigate around the Book

A brief synopsis of The Essential Guide will help the reader work through the material. Although most chapters contain 10 main sections, they are each of variable length:

Chapter 1 – Introduction

This, the first chapter, deals with the content of The Essential Guide and lists the International Standards for the Professional Practice of Internal Auditing. It also covers the way The Essential Guide can be used as a development tool for internal audit staff. The way internal auditing has developed over the years is an important aspect of the chapter, whereby the progress of the profession is tracked in summary form from its roots to date. It is important to establish the role of internal audit at the start of the book in order to retain this focus throughout the next few chapters, which cover corporate perspectives. Note that the internal audit process appears in some detail from Chapter 5 onwards. Likewise our first encounter with the IPPF appears in this chapter, which will underpin the entire Essential Guide.

Chapter 2 – Corporate Governance Perspectives

Chapter 2 covers corporate governance in general in that it summarizes the topic from a business standpoint rather than focusing just on the internal audit provisions. A main driver for ‘getting things right’ is the constant series of scandals that have appeared in developed (as well as developing) economies. The governance equation is quickly established and then profiles of some of the well-known scandals are used to demonstrate how fragile accountability frameworks can be. New-look models of corporate governance are detailed using extracts from various codes and guidance to form a challenge to business, government and not-for-profit sectors. Note that the chapter may be used by anyone interested in corporate governance as an introduction to the subject. The section on internal auditing is very brief and simply sets out the formal role and responsibilities, without going into too much detail. One topic that stands out in the chapter relates to audit committees, as many view this forum as the key to ensuring corporate responsibility and transparency. The corporate governance debate is ongoing and each new code refers to the need to start work on updates almost as soon as they are published. As such, it is never really possible to be up to date at publication and the reader is advised to keep an eye on new developments as and when they arise.

Chapter 3 – Managing Risk

Many writers argue that we have entered a new dimension of business, accounting and audit whereby risk-based strategies are essential to the continuing success of all organizations. Reference is made to various risk standards and policies and we comment on the need to formulate a risk management process as part of the response to threats and opportunities. The corporate aspiration to embed risk management into the way organizations work is discussed. The growing importance of control self-assessment has ensured this appears in The Essential Guide, although this topic is also featured in the chapter on audit approaches (Chapter 7). The chapter closes with an attempt to work through the audit role in risk management and turns to the published professional guidance to help clarify respective positions. There is a link from this chapter to risk-based planning in the later chapter on setting an audit strategy (Chapter 8). Throughout The Essential Guide we try to maintain a link between corporate governance, risk management and internal control as integrated concepts that impact the internal audit role.

Chapter 4 – Internal Controls

Some argue that internal control is the most important concept for internal auditors to get to grips with. Others simply suggest that we need to understand where controls fit into the risk management equation. Whatever the case, it is important to address this topic before we can get into the detailed material on internal auditing. An auditor armed with a good control model is more convincing that one who sees controls only as isolated mechanisms. Chapter 4 takes the reader through the entire spectrum of control concepts from control models, procedures and the link to risk management. One key section concerns the fallacy of perfection, where gaps in control and the reality of imperfection are discussed. For most business ventures it is uncertainty that creates business opportunities and new thinking. With the advent of risk management this does not mean controls take a back seat; it just means controls need to add value to the business equation to be of any real use.

Chapter 5 – The Internal Audit Role

This chapter moves into the front line of internal audit material. Having gone through the reasoning behind the audit role (governance, risk management and the need for sound controls), we can turn to the actual role. The basic building blocks of the audit charter, independence, ethics and so on are important aspects of The Essential Guide. Much of the material builds on the original first edition of The Essential Guide and is updated to reflect new dimensions of auditing. One key component is the section on audit competencies, which forms the balancing factor in the equation – ‘the challenges’ and ‘meeting the challenges’.

Chapter 6 – Professionalism

The auditors' work will be determined by the needs of the organization and the experiences of senior auditors, and most audit shops arrive at a workable compromise. One feature of the upwards direction of the internal audit function is the growing importance of professional standards, while the main footing for The Essential Guide revolves around the IIA's IPPF. Moreover, quality is a theme that has run across business for many years. If there are quality systems in place for internal auditing, we are better able to manage the risk of poor performance. It would be ironic for internal audit reports to recommend better controls over operations that are reviewed when the audit team has no robust system in place that ensures it can live up to its own professional standards. Processes that seek to improve the internal audit product are covered in this chapter, including the important internal and external reviews that are suggested by auditing standards.

Chapter 7 – The Audit Approach

The range and variety of audit services that fall under the guise of internal auditing have already been mentioned. A lot depends on the adopted approach and, rather than simply fall into one approach, it is much better to assess the possible positions armed with a knowledge of what is out there. Once we know what services we will be providing, we can think about a suitable structure for the audit shop. There is a note on control risk self-assessment (CRSA) and consideration of how it is possible to integrate the CRSA technique with the audit process. Other specialist aspects of audit work involving fraud investigations and information systems auditing are also mentioned. The IPPF acknowledges the linked trend towards more consulting work by internal audit outfits and therefore the consulting approach has its own section in this chapter.

Chapter 8 – Setting an Audit Strategy

One view is that formulating an internal audit strategy is one of the most important tasks for the chief audit executive. In itself, this task depends on an intimate understanding of the corporate governance context, the audit role and competencies and challenge to add value to the business. The CAE needs to define a strategy, set standards, motivate staff and then measure what is done to have a half chance at delivering a successful audit service.

Chapter 9 – Audit Fieldwork

Audit fieldwork covers the entire audit process from planning the assignment to reporting the results, while interviewing is seen as the primary means of obtaining information for the audit. Various models are used throughout the chapter to explain the way risk-based auditing can be applied and there is coverage of planning, ascertaining, evaluating and reporting the audit assignment. The bridge between good working papers and audit findings and preparing the draft report is established using a key audit schedule as the pivotal document. Chapter 9 is quite involved and goes through the entire audit process in some detail.

Chapter 10 – Meeting the Challenge

This final short chapter attempts to track key developments that impact on internal auditing and includes comments from various authoritative sources on future directions.

Appendix – Auditing the Risk Management Process: A Case Study

The Appendix provides a case study on auditing the risk management process, which is provided in presentation format.

1.4 The Essential Guide as a Development Tool

All internal auditors need to be professionally competent and all internal audit shops need likewise to demonstrate that they add value to the task of enhancing risk management, control and governance processes. While a great deal of high-level work may be undertaken by the chief audit executive in terms of strategy, budgets and audit plans, the bottom line comes down to the performance of each and every individual auditor. It is this person who must carry the burden of heightened expectations where internal audit seeks a seat at the governance table. The Essential Guide is a resource that can be used to help support the internal auditor's constant drive to greater professionalism. It contains a basic minimum of knowledge that should be assimilated by competent internal auditors. The Essential Guide can also be used as an induction tool for new auditors who could work through each chapter and have a look at the case study in the Appendix.

1.5 The Development of Internal Auditing

Internal audit is now a fully developed profession. An individual employed in internal audit 10 years ago would find an unrecognizable situation in terms of the audit role, services provided and approach. For a full appreciation of internal auditing, it is necessary to trace these developments and extend trends into the future. It is a good idea to start with the late Lawrence Sawyer, the Godfather of internal audit, to open the debate on the audit role. Sawyer has said that audit has a long and noble history: ‘Ancient Rome “hearing of accounts” one official compares records with another – oral verification gave rise to the term “audit” from the Latin “auditus” – a hearing’.1

The Evolution of the Audit Function

It is important to understand the roots of internal auditing and the way it has developed over the years. One American text has detailed the history of internal audit:

Prior to 1941, internal auditing was essentially a clerical function…. Because much of the record keeping at that time was performed manually, auditors were needed to check the accounting records after it was completed in order to locate errors… railroad companies are usually credited with being the first modern employers of internal auditors… and their duty was to visit the railroads' ticket agents and determine that all monies were properly accounted for. The old concept of internal auditing can be compared to a form of insurance; the major objective was to discover fraud….2

It is clear that the internal audit function has moved through a number of stages in its development which can be tracked as follows:

Extension of external audit Internal audit developed as an extension of the external audit role in testing the reliability of accounting records that contribute to published financial statements. Internal audit was based on a detailed programme of testing accounting data. Where this model predominates, there can be little real development in the professionalism of the internal audit function. It would be possible to disband internal audit by simply increasing the level of testing in the external auditor's work plan. Unfortunately there are still organizations whose main justification for resourcing an internal audit service is to reduce the external audit fee. The IIA UK&Ireland have suggested this link between external and internal audit:

The nineteenth century saw the proliferation of owners who delegated the day-to-day management of their businesses to others. These owners needed an independent assessment of the performance of their organizations. They were at greater risk of error, omissions or fraud in the business activities and in the reporting of the performance of these businesses than owner-managers. This first gave rise to the profession of external auditing. External auditors examine the accounting data and give owners an opinion on the accuracy and reliability of this data. More slowly the need for internal auditing of business activities was recognized. Initially this activity focused on the accounting records. Gradually it has evolved as an assurance and consulting activity focused on risk management, control and governance processes. Both external audit and internal audit exist because owners cannot directly satisfy themselves on the performance and reporting of their business and their managers cannot give an independent view of these.3

Internal check The testing role progressed to cover nonfinancial areas, and this equated the internal audit function to a form of internal check. Vast numbers of transactions were double-checked to provide assurances that they were correct and properly authorized by laid-down procedures. The infamous ‘audit stamp’ reigned supreme, indicating that a document was checked by the auditor and deemed correct and above board. Internal control was seen as internal check and management was presented with audit reports listing the sometimes huge number of errors found by internal audit. The audit function typically consisted of a small team of auditors working under an assistant chief accountant. This actually encouraged management to neglect control systems on the grounds that errors would be picked up by the in-house auditors on the next visit. It locked the audit role tightly into the system of control, making it difficult to secure real independence. Moreover, most internal auditors assumed a ‘Got-Ya’ mentality, where their greatest achievements resided in the task of finding errors, abuse and/or neglect by managers and their staff. One writer has said:

The old concept of internal auditing can be compared to a form of insurance; the major objective was to discover fraud more quickly than it could be discovered by the public accountant during an annual audit.4

Probity work Probity work arrived next as an adaptation of checking accounting records, where the auditors would arrive unannounced at various locations and local offices, and perform a detailed series of tests according to a preconceived audit programme. Management was again presented with a list of errors and queries that were uncovered by the auditors. The auditors either worked in small teams based in accountancy or had dual posts where they had special audit duties in addition to their general accounting role. Audit consisted mainly of checking, with the probity visits tending to centre on cash income, stocks, purchases, petty cash, stamps, revenue contracts and other minor accounting functions. The main purpose behind these visits was linked to the view that the chief accountant needed to check on all remote sites to ensure that accounting procedures were complied with and that local books and records were correct. The audit was seen as an inspection routine on behalf of management. This militates against good controls, as the auditor is expected to be the main avenue for securing information on whether local office records were correct. Insecure head office management may then feel that their responsibility stops at issuing a batch of detailed procedures to local offices and nothing more. The auditors would then follow up these procedures without questioning why they were not working. The fundamental components of the control systems above local office level fell outside the scope of audit work, which was centred on low-level, detailed checking.

Nonfinancial systems The shift in low-level checking arose when audit acquired a degree of separation from the accounting function with internal audit sections being purposely established. This allowed a level of audit management to develop, which in turn raised the status of the audit function away from a complement of junior staff completing standardized audit programmes. The ability to define an audit's terms of reference stimulated the move towards greater professionalism, giving rise to the model of audit as a separate entity. Likewise, the ability to stand outside basic financial procedures allowed freedom to tackle more significant business problems. It was now possible to widen the scope of audit work and bring to bear a whole variety of disciplines and not just accounting experience.

Chief auditors Another thrust towards a high-profile, professional audit department was provided through employing chief internal auditors (or chief audit executives, CAEs) with high organizational status. They could meet with all levels of senior management and represent the audit function. This tended to coincide with the removal of audit from the finance function. The audit department as a separate high-profile entity encourages career auditors, able to develop within the function. This is as well as employing people who are able to use this audit experience as part of their managerial career development. The current position in many large organizations establishes a firm framework from which the audit function may continue to develop the professional status that is the mark of an accepted discipline. When assessing risk for the audit plan one asks what is crucial to the organization before embarking on a series of planned audits that in the past may have had little relevance to top management. Professionalism is embodied in the ability to deal with important issues that have a major impact on success.

Audit committees Audit committees bring about the concept of the audit function reporting to the highest levels and this had a positive impact on perceived status. Securing the attention of the board, chief executive, managing director, nonexecutive directors and senior management also provides an avenue for high-level audit work able to tackle the most sensitive corporate issues. This is far removed from the early role of checking the stock and petty cash. Internal audit was now poised to enter all key parts of an organization. An important development in the US occurred when the Treadway Commission argued that listed companies should have an audit committee composed of nonexecutive directors. Since then, most stock exchange rules around the world require listed companies to have an audit committee and most also require an internal audit presence.

Professionalism The Institute of Internal Auditors has some history going back over 50 years. Brink's Modern Internal Auditing has outlined the development of the IIA:

In 1942, IIA was launched. Its first membership was started in New York City, with Chicago soon to follow. The IIA was formed by people who were given the title internal auditor by their organizations and wanted to both share experiences and gain knowledge with others in this new professional field. A profession was born that has undergone many changes over subsequent years.5

The importance of sound organizational systems came to the fore in the US where the Foreign Corrupt Practices Act, passed in 1997, stated that an organization's management was culpable for any illegal payments made by the organization even where they claimed they had no knowledge of the payments. The only way to ensure legality and propriety of all payments was to install reliable systems and controls. The systems-based approach offers great potential with the flexibility in applying this approach to a multitude of activities and developing a clear audit methodology at corporate, managerial and operational levels. Many internal audit shops have now moved into risk-based auditing, where the audit service is driven by the way the organization perceives and manages risk. Rather than start with set controls and whether they are being applied throughout the organization properly, the audit process starts with understanding the risks that need to be addressed by these systems of internal control. Much of the control solution hinges on the control environment in place and whether a suitable control framework has been developed and adopted by the organization. Internal audit can provide formal assurances regarding these controls. Moreover, many internal audit shops have also adopted a consulting role, where advice and support are provided to management.

There is no linear progression in audit services, with many forces working to take the profession back to more traditional models of the audit role where compliance and fraud work (including financial propriety) are the key services in demand. Many of the trends behind the development of internal audit point to the ultimate position where the audit function becomes a high-profile autonomous department reporting at the highest level. This may depend on moving out audit functions currently based in accountancy. The true audit professional is called upon to review complicated and varied systems even if the more complicated and sensitive ones may sometimes be financially based. A multidisciplined approach provides the flexibility required to deal with operational areas. Again, this move is strengthened by the growing involvement in enterprise-wide risk management. The latest position is that there is normally no longer a clear logic to the chief audit executive to continue to hold a reporting line to the DF. The debate now revolves around whether the CAE should report directly into the main board and not just to the audit committee.

The Expectation Gap

Audit services will have to be properly marketed, which is essentially based on defining and meeting client needs. This feature poses no problem as long as clients know what to expect from their internal auditors. It does, however, become a concern when this is not the case, and there is a clear gap in what is expected and what is provided. Management may want internal auditors to:

Check on junior staff on a regular basis.Investigate fraud and irregularity and present cases to the police and/or internal disciplinaries.Draft procedures where these are lacking.Draft information papers on items of new legislation or practice.Investigate allegations concerning internal disputes and advise on best resolution.Advise on data privacy and security, and check that the rules are complied with.Identify key risks for senior management.

One cannot give up professional integrity but, at the same time, the above expectations cannot simply be ignored. If new resources are brought in to cover these services, they may end up competing for the internal audit role. It is important not to sacrifice assurance work by diverting audit resources to carrying out pure consulting services. We must also keep an eye on the wider societal expectations. If internal audit is seen as professionally independent, then there will come a time when audit reports will be of increasing interest to stakeholders who sit outside the corporate entity.

The emergence of a Governance, Risk and Compliance process in many larger organizations derives from an attempt to integrate these three concepts into a meaningful whole. New legislation and regulations should be considered and the effects anticipated. The audit strategy and business plan should take on board these additional factors in a way that promotes the continuing success of the audit function. This means that the CAE must resource the continual search for new legislation that affects the organization's control systems or impacts on the future of internal audit. As suggested by the current definition of internal auditing, these three concepts now form the framework for the design and provision of the internal audit service. One major issue is the growth of risk committees that are being established by main boards along with the appointment of high-level chief risk officers, and the impact this has on the internal audit role. This is why the next three chapters deal with these topics.

Summary and Conclusions

This first chapter of The Essential Guide takes the reader through the structure of the book and highlights the pivotal role of the IIA standards. We have also provided a brief snapshot of the development of the internal audit role as an introduction to the subject. Many of the points mentioned above are dealt with in some detail in the main part of the book, although it is as well to keep in mind the basics of internal audit while reading more widely. The concept of internal audit is really quite simple – it is the task of putting the ideals into practice that proves more trying. Internal auditors have a noble history as guardians of good governance and as the need for better accountabilty becomes more profound, the auditor will need to step further and further into the corporate spotlight. We have mentioned Sawyer's views in this chapter, which is why we close with another quote on the wide range of benefits from a good internal audit team:

IA can assist top management in:

monitoring activities top management cannot itself monitoridentifying and minimizing risksvalidating reports to senior managementprotecting senior management in technical analysis beyond its kenproviding information for the decision-making processreviewing for the future as well as for the pasthelping line managers manage by pointing to violation of procedures and management principles.6

Whatever the new risk-centric jargon used to describe the audit role, much of the above benefits described by Sawyer remain constant. For those embarking on a career in internal auditing, these are exciting new times, where the contribution of the competent auditor will be immense in helping locate integrity and transparency right at the forefront of the way large organizations are governed.

Endnotes

1. Sawyer, Lawrence B. and Dittenhofer, Mortimer A., Assisted by Scheiner, James H. (1996) Sawyer's Internal Auditing, 4th edition, Florida: The Institute of Internal Auditors, p. 8.

2. Flesher, Dale (1996) Internal Auditing: A One-Semester Course, Florida: The Institute of Internal Auditors, pp. 5–6.

3. Internal Auditing (2002) Distance Learning Module, Institute of Internal Auditors UK&Ireland.

4. Flesher, Dale (1996) Internal Auditing: A One-Semester Course, Florida: The Institute of Internal Auditors, p. 7.

5. Moeller, Robert and Witt, Herbert (1999) Brink's Modern Internal Auditing, 5th edition, New York: John Wiley & Sons, Inc.

6. Sawyer, Lawrence B. and Dittenhofer, Mortimer A., Assisted by Scheiner, James H. (1996) Sawyer's Internal Auditing, 4th edition, Florida: The Institute of Internal Auditors, p. 13.

Chapter 2

Corporate Governance Perspectives

Introduction

Corporate governance is a term that, over the years, has now found its way into popular literature. It has been described by Sir Adrian Cadbury as the way organizations are directed and controlled. This simple statement contains many profound elements including the performance/conformance argument of whether good governance is about complying with codes of practice or whether it also underpins better business performance. There is also some debate as to whether companies should follow a fixed set of rules or be guided by less rigid principles. An organization's main task is to achieve the level of performance that it was established for. However, at the same time, it must adhere to all relevant standards, rules, laws, regulations, policies and expectations that form a framework within which this performance will be assessed. This, in turn, may cause many difficulties in the real world. Our first reference to corporate governance comes from Ireland:

Improved standards of corporate governance, like ‘motherhood’, cannot be argued against. It is critical to a small economy like Ireland, which is seeking to develop business in the more sophisticated sectors, that we are seen to operate to high standards.