Internal Audit and Control

Question 1

What is internal audit?

Answer 1

Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Internal audit is a function, provided either by employees of the entity or sourced from an external organisation, to assist management in achieving the organisation’s objectives.

Question 2

What value does internal audit add to the organisation?

Answer 2

Internal audit’s objective assessment of internal controls and risk management processes provides management and other stakeholders with independent assurance that the organisation’s risks have been appropriately mitigated.

Internal audit helps the organisation succeed by telling management whether the systems and processes that make sure the organisation is on track are themselves working well (assurance).

Internal audit also helps managers improve those systems and processes where necessary (consulting).

Question 3

Risk-based internal auditing

Answer 3

While the responsibility for identifying and managing risks belongs to management, one of the key roles of internal audit is to provide assurance that those risks have been properly managed. Professional internal audit activity can best achieve its mission as a cornerstone of governance by positioning its work in the context of the organisation’s own riskmanagement framework. This involves looking at the way managers identify,
assess, respond to and report risks, as well as how well managers monitor how responses to risks are working.

Question 4

What are the difference between internal and external audit?

Question 5

What is internal control?

Answer 5

Internal control is the process designed to mitigate risks to the business and ensure that the business operates efficiently and effectively.

Question 6

What are the reasons for internal controls?

What are the reasons for internal controls?

Answer 6

The reasons for internal controls include:

• minimising the organisation’s business risks
• ensuring the continuing effective functioning of the organisation
• ensuring that the organisation complies with relevant law and regulations

Question 7

What are the components of internal control?

Answer 7

Internal control comprises five components:

1. Control environment. The attitude of management towards internal controls which sets the tone of an organisaiton, influencing the control consciousness of its employees.
2. Organisation’s risk assessment process.
3. Information systems that capture information about transaction and events for financial reporting purposes.
4. Control activities. The policies and procedures which may prevent or detect and correct errors.
5. On-going review of the overall control system to ensure that it is still operating optimally.

Question 8

What are the different types of control activities?

Answer 8

There are five types of control activities: authorisation; performance reviews; information processing; physical controls; and segregation of duties.

Question 9

What does the internal audit function do?

Answer 9

The internal audit function has two key roles to play in relation to organisation risk management:

• ensuring the organisation’s risk management system operates effectively
• ensuring that strategies implemented in respect of business risks operate effectively

Internal auditors undertake operational audits.

Internal auditors may also undertake special investigations on behalf of the directors.

However, to preserve objectivity, internal auditors must not get involved in operational decision-making matters.

Question 10

What duties does internal audit carry out?

Answer 10

• probity work (known as ‘regularity audit’)
• systems-based audit
• value-for-money reviews
• cost management and overhead management
• contract auditing
• risk management
• fraud investigations (known as ‘forensic accounting’)
• computer audit
• environmental audit
• social audit
• operational audit.

Question 11

Cybernetic Control Theory (1)

Answer 11

Cybernetic control theory (CCT) suggests implementing a system of analysing risks and then trying to control both predictable and unpredictable risk. This does mean establishing system-control objectives. In other words, establishing the purpose or reason for which key controls should be in place.

Controls can be input-related (to do with income and expenditure) or output-related (based on the units of activity achieved). Ultimately, the model must achieve the desired outcome.Information must be supplied to the appropriate levels of management. It should be in the form of feedback, which is performance information about the past. It should also be in the form of ‘feed-forward’, which is budgeted or projected information about the future.

Question 12

Cybernetic Control Theory (2)

Answer 12