CHAPTER THREE

Internal Auditing
Internal auditing is an independent, objective assurance and consulting
activity designed to add value and improve an organizations operations.
It helps an organization to accomplish its objectives by bringing a
systematic, disciplined approach to evaluate and improve the
effectiveness of risk management, control and governance processes.
However, management is responsible for identifying and managing risk
and establishing internal control system.

Function of Internal Auditing

The objective of the internal auditor is to assist members of an
organization for the effective discharge of their responsibilities by
furnishing them with analyses, appraisals, recommendations and
counsel. In performing these functions, internal auditors can be thought
of as a part of the organization's internal control. They represent a high-
level control that functions by measuring and evaluating the
effectiveness of other controls.

Internal auditors are not merely concerned with the organizations

financial controls. Their work encompasses all of the organizations
internal control.

In general, the role (function) of internal audit is

- Examine and evaluate organizations risk management process
- Examine and evaluate organizations control system
- Make recommendation on risk management and control system to
enable the company to achieve objectives

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
 - Examine and evaluate the financial and operational information of
the organization
- Review the economy, effectiveness and efficiency of operations.
- Review compliance with external laws and regulations
- Review compliance with internal policies and procedures
- Advice management on the development of key organizational
system and its implementation

Limitations of the Internal Audit Function

Although there is no question regarding the relevance of internal
auditing, there are different limitations of the function.

1. Independence
Internal audit should be an independent and objective function.
However, this independence can be compromised, particularly where
reporting lines are through to operational areas upon which they are
required to review and report, for example, the traditional reporting line
for internal audit was through to finance and in some instances this is
still the case. If an auditor with such a reporting line is required to
provide critical comment on the finance function itself, there may be
pressure to avoid confrontation and either soften or omit such comment.

Where internal auditors have transferred to the internal audit

department from an operational area, they should not be involved in the
auditor of that department for a minimum of a year.

2) Poor relationship with external auditors

Internal auditors and external audit should work closely together with
reliance by external audit on the work of internal audit.

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
3) Relatively new profession
Internal audit is still a relatively new profession, which has been
changing significantly over the years. It is still seen as inferior compared
to the mainstream accountancy profession.

4) Understanding of internal audit

There is generally poor understanding of the function of internal audit. It
is still seen as a negative 'policeman' type activity, checking for
compliance.

Reliance On Internal Audit

The External Auditor and Reliance on Internal Audit
When external auditors are going to plan their work, they need to be
aware of the work of internal audit department and the extent to which
they can rely on it. However, before they are going to rely on the work of
internal audit function, they need to consider the following factors:
A) Mutual cooperation between the external and internal auditors.
If the external auditors have a plan to rely on the work of the internal
audit, they must have a mutual cooperation with the internal audit
function. This is because:
- Most of the objectives of these two functions are similar and
therefore, they have to follow similar audit procedures while they
are auditing the organization.
- Since internal auditors are assigned their work by management,
the external auditors may need to amend their work schedule to
that of the internal audit function.
- External auditors may agree with management that the internal
audit may perform some procedures which are relevant to the
external audit work.

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
B. Assessment of the internal audit
The external auditors must obtain a sufficient understanding of the
internal audit function in order to plan an effective audit approach and
to determine their degree of relevance. They should consider the following
factors:

1) Organizational status of internal audit

Before the external audit will rely on the work of internal audit, they
should have to understand the organizational structure of the internal
audit functions and they have to satisfy themselves regarding:
- The ability of the internal audit to plan and carry out their work as
they wish (degree of independence)
- Their line of reporting (whether they report directly to the highest
level of management i.e., board of directors/audit committee or
not)
- The independence of the auditors from operating responsibility
- The ability (freedom) of the auditors to communicate to the
external auditors
- The availability of an audit charter (manual) that clearly sets out
the role, responsibility and access of the internal auditors.

2) The scope of the internal audit

Since the scope of the internal audit is much broad than the external
audit, the whole work performed by the function may not be relevant to
the external audit. It may include the following:
Corporate-business planning and corporate governance
Financial e.g. payroll and accounts payable
Support - such as IT and HR management

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
Other operational functions such as marketing, and research and
development work.

3) Due professional cares

The external auditors should have to judge as to whether or not the work
of internal audit generally appears to be properly planned, controlled,
recorded and reviewed as evidenced by adequate audit manuals, work
programs (schedules) and working papers. The internal audit department
should measure their value and product reports on their performance.

4) The technical competence of internal auditors

The internal audit department should be appropriately staffed interms of
numbers; grades, qualifications and experience to achieve
responsibilities and objectives department should have the right people
with the right core competence.

5) The relationship of the internal auditors

The internal auditor should demonstrate constrictive working
relationships and mutual understanding with management, external
auditors, the audit committee and other parties. They should avoid any
relationship that impairs their independence and objectivity.

C. Evaluating and testing the work of the internal audit

The external auditors, after assessing the internal audit department,
need to evaluate and test the work of the internal audit. They can do this
by following different procedures.
- Obtain the internal auditors report and cross check if with their
working papers ensuring that relevant work which supports the
report is documented.

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
 - Ensure that the work of the internal audit team is reviewed by
senior staffs
- Check that their working papers and properly filed
- Check that the auditors report to a unit which did not impair their
independence
- Check their work program against their achievement
- Receive few personal files of the audit team and check their
technical skill and experience
- Check that their findings are subsequently resolved (get decision
by management)
- Obtain the internal audit procedures and re-perform some of their
work.
In general the external auditors should assess the work of the internal
audit function and evaluate their work before they rely on the work and
they need to update their assessment year by year. They also need to
fully document the extent of their relevance and the reason thereon.
External auditors should be careful for material and risky areas of the
account before they rely on the work of internal auditors.

Internal and Governmental financial auditing and

operational auditing

1) Internal Financial Auditing

Financial auditing was traditionally associated with internal audit. It
embraces the conventional task of examining records and evidence to
support financial and management reporting in order to detect errors
and prevent fraud. It would enable analyzing information, identifying
trends and potential significant variations from the norm.

2) Operational Internal auditing

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
Operational auditing covers examination and review of a business
operation, including the control procedures and areas for improvement
in efficiency and performance including improving operational economy,
efficiency and effectiveness which are called "value for money - 3Es",
where as a financial audit focuses on measurement of financial position,
results of operations and cash flow, an operational audit focuses on the
efficiency, effectiveness and economy of operations. Operational audit is
distinct from financial audit as it can cover any aspect of an
organization's operation i.e., wider scope than financial audit.

Value for money auditing is concerned with obtaining the best possible
combination of services for the least resources. It includes the 3Es:
1) Economy- least cost whcih accomplishes goals and objectives at a
commensurate with the risk.
2) Efficiency - best use of resources that accomplishes goals and
objectives in an accurate and timely fashion with minimal use of
resources. It is input output relationship.
3) Effectiveness- best results, which assure that the organizational
objectives, will be achieved.

Objectives of Operational Audit

Operational audits are often performed by internal auditors for their
organizations. The major users of operational audit reports are managers
at various levels, including the board of directors. Internal auditors
should have to assure the following for top management.

- Assessment of unit's performance against management's objective

or other appropriate criteria.
- Management's plan an comprehensive, consistent ad understood
at the operating level

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
 - How well management plans and policies are being carried out in
all areas of operations and the opportunities for improvement in
the 3Es.
- Any weakness in operating controls, particularly as to possible
sources of waste.

Approaches (stages) of operational audits

In many respects the auditors work in performing an operational audit is
similar to that of the financial statement audit, except some significant
differences. The major steps of operational audits are:
Defining purpose- The purpose of an operational audit usually includes
the intention to appraise the performance of a particular
organization function or group of activities. The auditors must
determine specifically which policies and procedures are to be
appraised and how they relate to the specific objective of the
organization.
Familiarization- before starting an operational audit, the auditors must
obtain a comprehensive knowledge of the objectives, organizational
structure, and operating characteristics of the unit being audited.
The familiarization process might began with a study of
organizational charts, statement of the functions and responsibilities
assigned, management policies and directives and operating policies
and procedures.
Preliminary survey- this is the summary auditor's preliminary
conclusions about the critical aspects of the operations and
potential problem areas. This survey is used as a guide for the
development of audit program.
Program Development- operational audit program should be prepared
and tailored to the particular engagement. It contains all the tests

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
 and analyses the auditors believe to evaluate the organization's
operation. Appropriate personnel should be assigned.
Field work- it involves the execution of the operational audit program.
Just as in financial statement audits the auditors will
1) Select representative samples of the transactions from the records
and check whether the proper procedures have been followed.
2) Inquire or observe employees to see the flow of the operation.
3) Carry out different analysis such as comparing actual performance
with budget, other similar unit, etc to recommend on the 3Es.
4) Summarize their findings, discuss with supervisors
5) Document all their work, and findings in their working papers.

Reporting the findings- on final completion of the fieldwork, the

auditors should summarize findings and report to their reporting
unit. The report will include suggested improvements in the
operational policies and procedures of the unit and the list of
compliance weaknesses should be included. After they have
completed the draft report, they will arrange an exit meeting with the
responsible management.

Follow-up- The final stage in the operational auditor's work is the follow-
up action to ensure that any deficiencies disclosed in the audit report
are improved. Though a staff group is assigned to correct those
deficiencies, the auditor is responsible to follow-up so as to check the
action taken by the group is satisfactory. This follow-up may be in
the form of reexamination after a reasonable laps of time.

Some of the operational areas in which the auditors will engage are:
- Procurement
- Marketing

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
 - Treasury
- Human Resources (HR)

For these operational areas, the auditors should have to identify the
possible risks, assess the controls in place and check their
appropriateness and perform tests of control. Then after, they will report
any weakness and recommendations for improvement.

Governmental financial and operational auditing

Governmental organizations are subject to a validity of laws and
regulations that affect their financial statements, many more than typical
businesses enterprises. An important aspect of generally accepted
accounting principles for governmental organizations is the recognition of
various legal and contractual requirements. These requirements are
reflected in their basis of accounting, fund structure and other
accounting principles. Therefore, in performing an audit of governmental
organization's financial statements, the auditors are more likely to
encounters laws and regulations that have a direct and material effect on
the financial statements.

Governmental organizations receive funds from various sources such as

taxes, special assessments and bond issues. Laws and regulations often
dictate the way the funds may be spent. While certain funds may be used
for general purposes, others are restricted to specific purposes such as
schools, libraries, highways, etc.

The auditors should therefore perform the following procedures to

identify the laws and regulations:
1. Discuss laws and regulations with management and grant
administrators

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442
 2. Review relevant grant and loan agreements
3. Review minutes of the legislative body of the government
organization
Obtain written management representation regarding the completeness
of laws and regulations and their compliance.

The auditors may use generally auditing standards, government auditing

standards or single audit acts. (The number of reports and the number of
compliance tests (procedures) required increases respectively for these
standards.)

The governmental operational (performance) audit is usually evaluated

by testing the compliance with laws are regulations i.e., government
auditing standards or single audit act).

Professional standards of internal auditing

Please have a look on the attached copy

Compiled by: Aragie Beyene, ACCA

CUC ACCT 442