The basics of Internal Audit

There is no better time to take the baby steps into the basics of Internal audit, than the month of May, as it is the International Internal Audit Awareness month. As the first step for spreading awareness about internal audit, lets understand what internal audit is, what are the key terminologies and the high-level basic steps for performing an internal audit.

Every organization, regardless of its size, industry or nature of business, should have some type of internal control system or process in place to review organizational risks and the controls in place to mitigate those risks.

What is internal auditing?

Internal auditing is an independent, objective, assurance and consulting activity that adds value to and improves an organization’s business and operations. In other words, internal auditing involves an independent review of identifying the risks that could keep an organization from achieving its goals, making sure the organization’s leaders know about these risks, and proactively recommending improvements to help reduce the risks.

Key terminologies

• Risk - The possibility of an event occurring that will have an impact on the achievement of objectives. Risk is measured in terms of impact and likelihood

• Control - Any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved

• Governance - Processes and structures implemented to communicate, manage and monitor organizational activities

• Risk Management - A process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives

• Audit Plan - A description and schedule of audits to be performed over a certain period of time (typically three years); includes areas to be audited, type and scope of work, and high-level objectives

• Control Environment - The attitude and actions of the board and management regarding the importance of control within the organization. The control environment provides the discipline and structure for the achievement of the primary objectives of the system of internal control

• Risk Appetite - The level of risk that an organization is willing to accept

• Compliance - Adherence to policies, plans, procedures, laws, regulations, contracts, or other requirements

How is internal audit different from external audit?

Internal Audit Life Cycle

Importance of Internal Audit

1. Provides an overview on the effectiveness of the internal controls system of the organization

2. Provides suggestions on improving and enhancing process efficiency

3. Reviews compliance to applicable laws and regulations

4. Acts as one of the most important tools to prevent and detect fraud

5. Provides an objective insight

6. It goes beyond the review of financial aspects

Implementing a process for internal controls review can uncover potential organizational risks that may otherwise go undetected and provide management with a critical tool for gauging and assessing enterprise-wide risk and identify solutions to avoid or mitigate the risks.