Do You Need an Internal Audit?

You have worked hard to develop your business, and your efforts have paid off! Now you have a thriving business. You employ lots of employees, have a wider geographical reach, and have built relationships with lots of vendors. You have always been involved in every aspect of your business, but now it is too big for you to be directly involved with every part of the operations. Do you find yourself asking these types of questions?

If any of the above or similar thoughts have been weighing on you, having an internal audit might give you peace of mind.  So, what is involved with having an internal audit?

The internal audit process is not a cookie-cutter, one size fits all process. The process can be tailored to the specific needs of the organization. With that said, it would generally include some basic steps that will be discussed below.

The first step is to identify the key risks inherent to the organization that could prevent it from achieving its goals. This phase identifies “what can go wrong?” And if they do go wrong, would it have a high, moderate, or low negative impact? This phase is accomplished with the involvement of the key people in the organization who are knowledgeable about its various processes. The company’s management is usually aware of the various risks, but there could be important risks that are being overlooked.

The second step involves identifying what internal controls were implemented to mitigate the various risks faced by the organization. This exercise is intended to highlight if there are gaps (risks where no mitigating controls have been implemented). A side benefit is the identification of redundancies — risks where there are too many controls implemented, usually resulting in the cost of the controls outweighing the expected benefits. A comparison of the inherent risks and the controls in place results in the residual or net risk.

The internal auditor determines what areas will be included in the audit testing. Audit coverage usually focuses on the higher risk areas and the related key controls in those areas. If the internal audit is conducted in an advisory capacity for management, the nature and scope of the testing are subject to agreement with management. In this phase, various administrative tasks are performed, such as identifying and scheduling the internal audit resources with the requisite knowledge to perform the testing.

The internal audit function can serve as the eyes and ears of management. They can serve in an advisory capacity to management by performing testing to determine if the implemented controls are actually in place and working as intended. The methods used by the internal auditors to obtain evidence to support their conclusions are: inquiry, observations, inspections of records, and reperformance. Inquiry is the weakest form of audit evidence while inspection of records and reperformance are considered the strongest.

In this step, the results of the audit testing are summarized. The internal auditor determines if the exceptions represent a trend or are isolated cases. Exceptions that are pervasive (represent a pattern or trend) are then communicated to management.

Remediation is management’s responsibility. The internal audit usually comes in after corrective actions have been implemented and performed testing to verify that remediation efforts are successful in addressing the issues that were identified. Since remediation efforts can be like a New Year’s resolution that is practiced for one or two months and then forgotten for the rest of the year, an internal audit lets the newly implemented control mature before performing follow-up testing.

Read our article “How to Improve Your Internal Audit Process” to take your process to the next level.

If you would like more information about how an internal audit can help your company or would like a brief demonstration to experience how we operate, don’t hesitate to get in touch with us for a free consultation.