Internal audit - Purpose, scope and reporting of internal au...

Learning Outcomes

After studying this article, you will be able to explain the purpose of internal audit, describe the typical scope of internal audit activities, and outline the reporting responsibilities of the internal audit function. You will understand how internal audit differs from external audit and why effective communication is important.

ACCA Foundations in Audit (FAU) Syllabus

For ACCA Foundations in Audit (FAU), you are required to understand what internal audit is, its main objectives, and how it operates in organisations. Focus your revision on these syllabus points relevant to this article:

• The purpose of internal audit and how it contributes to strong corporate governance
• The typical scope of internal audit, including financial, operational, and compliance activities
• The reporting function of internal audit and the importance of communicating findings to management and those charged with governance
• The distinction between internal and external auditors
• The concept of independence within internal audit
• How external auditors may consider and place reliance on the work of internal auditors

Test Your Knowledge

Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, remember to look more closely at that area during your revision.

1. Which of the following is usually a main objective of internal audit?
   1. Auditing solely for statutory compliance
   2. Improving internal controls and advising management
   3. Providing an external opinion for shareholders
   4. Preparing financial statements
2. Internal auditors typically report to:
   1. Shareholders
   2. Audit committee or board of directors
   3. External auditors
   4. Suppliers

3. True or false? Internal auditors are always employees of the company.

4. Briefly state two activities that might fall within the scope of internal audit.

Introduction

All organisations need assurance that their systems work effectively and risks are controlled. Internal audit provides this assurance by reviewing processes, evaluating controls, and reporting weaknesses directly to those responsible for governance. Unlike external auditors, internal auditors work within the organisation and have a broader brief, focusing on operational, compliance, and specialist matters as well as financial controls.

Key Term: internal audit
An objective review and assurance activity, established within an entity, designed to evaluate and improve the effectiveness of risk management, internal controls, and governance processes.

Purpose of Internal Audit

The principal aim of internal audit is to provide independent and objective assurance to management and the board (or audit committee) that internal controls, risk management, and governance processes are effective. Internal audit helps management to identify weaknesses, suggests improvements, and can monitor the implementation of corrective actions.

Examples of internal audit objectives include:

• Reviewing the effectiveness of internal controls over financial reporting
• Assessing the adequacy of processes designed to manage key business risks
• Ensuring the organisation complies with laws, regulations, and internal policies
• Evaluating the efficiency and effectiveness of operations

Key Term: assurance
An expression of confidence, by an independent function, that certain objectives or controls are being met or operating effectively.

Scope of Internal Audit

The work of internal audit is set by management or those charged with governance, often with reference to a formal audit plan. Scope may cover:

• Financial controls and reporting processes
• Operational efficiency and resource usage
• Compliance with external regulations and internal procedures
• Safeguarding of assets
• Fraud detection and investigation
• IT systems and data security
• Special projects (e.g., post-implementation review of new systems)

The scope can be wide or narrow, tailored to risks and management requirements.

Worked Example 1.1

A manufacturing company is experiencing frequent inventory discrepancies. What might internal audit include in its review, and why?

Answer:
Internal audit could review the procedures for recording inventory movements, inspect physical controls over warehouses, check for proper segregation of duties, and examine reconciliation processes. The objective would be to identify control weaknesses causing discrepancies, recommend improvements, and help prevent losses from error or fraud.

Reporting Function of Internal Audit

Internal auditors report the results of their work to senior management and, ideally, to an independent audit committee or board. Reports typically:

• Detail the area reviewed, scope of work, and methodology
• Summarise findings, including control weaknesses or instances of non-compliance
• Recommend corrective actions and prioritise them by risk
• Set out agreed management responses and an implementation timeline

The reporting line should be direct to the highest possible level to ensure independence and the ability to act on important findings. Internal audit may also follow up on previous recommendations to ensure they have been implemented.

Key Term: audit committee
A subcommittee of the board of directors responsible for oversight of the external and internal audit functions, and for reviewing the effectiveness of internal controls.

Independence of Internal Audit

Although internal auditors are usually employees, they must remain independent in appearance and fact. This is achieved through:

• Reporting directly to the board or its audit committee, not to operational management
• Having free access to all records and personnel
• Being free from conflicts of interest (e.g., not auditing areas they were recently responsible for)

Key Term: independence
The ability to carry out work objectively, without bias or undue influence, so that conclusions can be relied upon by management or governing bodies.

Relationship with External Audit

External auditors may consider the existence and work of internal audit when planning and conducting their own procedures. Where effective, the internal audit function can help external auditors by providing evidence over controls or by reducing the extent of their own testing in low-risk areas.

However, external auditors must assess the objectivity and competence of internal audit before placing reliance on any work and retain responsibility for forming their own opinion on the financial statements.

Worked Example 1.2

The external auditors of Beta Ltd are assessing whether to place reliance on the client’s internal audit work covering payroll controls. What should the external auditors consider?

Answer:
They should review the organisational status of internal audit (who they report to), the qualifications and experience of internal auditors, and the quality and documentation of internal audit planning and work. If satisfied, external auditors may perform test checks or use the internal audit evidence for their own purposes, focusing additional procedures only where necessary.

Exam Warning

Do not assume internal audit can replace external audit. Internal audit’s objectives, reporting lines, and scope are set by management, whereas external audit provides an independent opinion for shareholders and must always form its own conclusions.

Summary

Internal audit delivers ongoing assurance over risk and control to management and the board. Its scope is tailored to the organisation’s needs and risks. Its reports provide critical information for managing controls and improving effectiveness, but external audit remains responsible for providing an independent opinion for shareholders.

Key Point Checklist

This article has covered the following key knowledge points:

• Define internal audit and explain its core purpose
• Identify typical areas included in the scope of internal audit’s work
• Outline the reporting process and main content of internal audit reports
• Distinguish between internal and external audit responsibilities, reporting, and independence
• Understand the importance of independence for effective internal audit

Key Terms and Concepts

• internal audit
• assurance
• audit committee
• independence