Connect Support Advance

Factsheet: Internal Audit

Benefits
What originally drove internal auditing? What are the benefits of internal auditing?
Merchants recognised the benefits of auditing in the centuries The mission of internal audit is to enhance and protect
BC when they verified receipts for grain brought to market. Then organisational value by providing risk-based and objective
corporate business recognised the benefits in the 19th and 20th assurance, advice, and insight. This is achieved through internal
centuries when business expansion resulted in growing demand auditors:
for systems of control in organisations conducting operations in
Being a partner to management
many locations and employing thousands of people.
Historically nternal audit was seen as a punitive or police-like
Why have internal auditing?
function, but these days modern internal audit operates in a
Internal audit is a key pillar of governance in any organisation. collaborative way to build a partnership with management
It is an important element in the governance and assurance without losing its independence from line management. After
environment, and a valuable tool to manage risk effectively. all, Internal audit works for the organisation and should have a
keen interest in helping to make the organisation stronger and
Many jurisdictions, especially government, mandate that
more successful.
organisations must have an independent and effective internal
audit function. This can apply to the public sector, and also Ensuring decision-makers get unfiltered messages
corporate and not-for-profit organisations.
Internal audit is established to be independent and objective
The increased importance of internal audit has been reflected through (a) separation from line management (b) reporting
in the most recent revision of the ASX ‘Corporate Governance functionally for its operations to the audit committee (c)
Principles and Recommendations’ (4th edition 2019) issued by reporting administratively to the chief executive officer. This
the ASX Corporate Governance Council which adopted the means internal audit’s messages and commentary are not
position that, if listed organisations do not have an internal subject to filtering through various layers of management and
audit function, they need to disclose that fact and the processes they can report in a ‘frank and fearless’ manner.
it employs for evaluating and continually improving the
Helping maintain organisational focus on achieving objectives
effectiveness of its governance, risk management and internal
control processes (‘ if not, why not’ approach). The Australian An effective internal audit function will ensure its work is risk-
Prudential Regulation Authority (APRA) has a mandated based and aligned to its organisation’s strategic objectives.
requirement for internal audit for financial institutions, and many Every internal audit report should link back to how it informs
governments in Australia require internal audit functions to be whether organisation objectives are on track to be achieved or
established. whether they are at risk.

What does internal audit do? Providing assurance that decisions are properly authorised

› Provides independent, unbiased assessment of A fundamental component of every internal audit engagement
organisation operations. is to follow the approval process to assure key organisation
decisions are properly authorised in line with the approved
› Provides management with information on the effectiveness
delegation structure.
of risk management, control and governance processes.
Validating the reliability and integrity of information
› Acts as a catalyst for improvement in risk management,
control and governance. Management needs to know that organisation information is
reliable and has integrity otherwise the basis for management
› Is an adviser that tells management what it needs to know,
decisions will be flawed. Internal audit engagements will
when it needs to know it.
typically examine reliability and integrity of information.

For more information, please call +61 2 9267 9155 or visit www.iia.org.au
© 2020 - The Institute of Internal Auditors - Australia
 Connect Support Advance
Delivering an opinion as to whether assets are adequately save money by helping to keep projects on track. Reviewing
safeguarded projects after they are completed is too late.
An asset is something of economic value or future benefit. Delivering in-house consultancy services to management
Organisation assets can include such things as money, land,
Internal audit has an opportunity to provide advisory services
buildings, facilities, warehouse stock, information, patents,
that may occur after the internal audit plan is approved each
intellectual property and people. Internal audit engagements
year. Collaborative internal audit functions seek to partner with
will often focus on whether assets are protected.
management while maintaining their independence. A portion
Providing assurance the organisation is complying with laws, of the internal audit plan should be kept aside for the audit
regulations, policies and contracts committee and management to request ad hoc internal audit
services in response to emerging risks and issues that may arise
Most internal audit engagements will focus on whether
after the internal audit plan was approved.
there is compliance with laws and regulations with which
its organisation must comply, and then provide a synopsis What is internal audit’s value proposition?
on where there may be gaps. Likewise, compliance with
Internal audit’s value proposition is based on the three core
organisation policies and contractual requirements will also be
elements of value delivered to an organisation (a) assurance
examined and non-conformances highlighted.
(b) insight (c) objectivity. Internal audit adds value by improving
Determining whether business activities are conducted an organisation’s operations and helping it to accomplish its
efficiently, effectively, economically and ethically objectives.
Internal audit activities should consider: The value is realised when (a) internal audit’s suggested
improvement actions are implemented (b) the outcomes support
Efficiency – example – Where the cost of providing healthcare
the needs and expectations of the chief executive officer (c) the
has been reduced over time.
cost of internal audit services are reasonable. This is achieved
Effectiveness – example – Where disease rates have fallen as a through internal auditors:
result of healthcare.
Following-up previous audits to assess if remedial action has
Economy – example – Where healthcare supplies or services of been effectively implemented
a specific quality are purchased at the best possible price.
Every time an audit, review or evaluation is commissioned in an
Ethical Conduct – Where the interests of others are actively organisation there are improvement actions to be implemented
considered to assure honesty, integrity and fairness when by management. An internal audit role is to monitor and track
making decisions. these to make sure they are properly implemented in a timely
way. Without this internal audit role, the cost and effort involved
Promoting activities that minimise the risk of fraud
in audits, reviews and evaluations is potentially wasted if things
It is not a specific internal audit role to detect and investigate do not change for the better.
fraud. But it is internal audit’s role to make sure controls
Helping the chief executive officer keep their job
designed to control fraud risk are in place and operating
effectively. A 2020 report by the Association of Certified Fraud It has been said that internal audit is the ‘eyes and ears’ of
Examiners on fraud in the Asia–Pacific Region assessed average management because it gets around the organisation and looks
loss from cases of fraud at almost USD 2 million. at lots of risk areas. When the organisation’s risk management,
control and governance are operating properly, the chief
Identifying business improvements and better ways of doing
executive officer is protected. Many chief executive officers have
things
found to their cost that they took their eye off something that
Internal audit works right across their organisation and is ultimately cost them their job. Examples are high-risk programs
therefore in a privileged position to highlight (a) what should be and projects that collapse in a spectacular or costly way or
the state of play (b) what is actually the state of play (c) suggest are never delivered. Or a gift and entertainment policy that is
what can be done to improve the way business activities are treated with disdain by employees. Internal audit applying a
done. Internal audit can contribute immensely by a focus on lens to these activities can provide tighter controls and greater
efficiency, effectiveness, economy and ethical conduct of comfort for the chief executive officer that things are working as
business activities. they should.
Monitoring high-risk programs and projects to ensure they Paying its way
remain on track
Some chief audit executives adopt an approach that their
To their cost, many organisations rely on self-assessed project internal audit function will have a key performance measure
reporting from the projects themselves that is not validated (KPI) to pay for itself by savings generated from its audit
before being reported to decision-makers. This can be a recipe observations. Many purists can be critical of this approach,
for disaster with projects putting a rosy view on progress, or but internal audit is a non-core function with a cost, so it is
alternatively making it seem things are ‘going off the rails’ something worth considering. This approach is usually popular
to extract further budget. Independent validation of project with chief executive officers.
reporting by internal audit can pinpoint issues and ultimately

For more information, please call +61 2 9267 9155 or visit www.iia.org.au
© 2020 - The Institute of Internal Auditors - Australia