FOUNDATIONS OF INTERNAL AUDITING

FOUNDATIONS OF INTERNAL AUDITING

 

Traditionally, internal auditors had been concerned with both accounting and

financial processes, and some expertise in these areas had generally been considered

to be essential. Coverage of accounting and financial controls and processes

also provided an opportunity for expanding the range of internal audit services

into the broader operational areas. Since accounting and financial records directly

or indirectly reflect all operational activities, financially oriented internal audit

reviews often open doors to the other activities. This combination of operational

and financial internal audit practices as well as information systems auditing will

be considered throughout this book. In terms of strategy, an internal audit abandonment

of accounting and financial areas can create a vacuum that would invite

the emergence of other audit-type functions. 

“Internal Audit Quality

Assurance and ASQ Quality Audits” for example, will discuss how many traditional

internal auditors in the past ignored the International Organization for

Standardization (ISO) “quality” movement in its early days, leading to an almost

separate profession of quality auditors.

An internal audit function today needs to have an adequate coverage of key

accounting and financial areas, and the responsibilities of whomever does that

will inevitably spill over into an overview of broader operational areas. The failure

to cover key financial areas was one of the arguments external audit firms

made to senior management when they offered to provide internal audit outsourcing

services. For some years leading up to the enactment of SOA, it almost

appeared that the public accounting firms were taking over internal auditing

through their outsourcing arrangements. Now, an organization’s external auditors

are prohibited from also performing internal audits for the same organization.

In the wake of SOA and the internal control assessment requirements of the

Act’s Section 404 requirements about internal audits’ roles

and responsibilities are changing again as we move through the first decade of

the twenty-first century. Internal auditors today are a much more important element

in an organization’s overall internal control framework than they were not

that many years in the past. To be effective here, an internal auditor must gain a

strong understanding of internal controls, and any internal audit involvement

with SOA Section 404 reviews require some understanding of generally accepted

accounting principles (GAAP) and their related financial controls. Therefore,

internal auditors today need to understand financial and operational as well as

information systems controls. An objective of this book is to cover all three of

these areas, but to cover them in a manner whereby they are not considered separate

internal audit practices, but represent skills and knowledge that should be

used by all internal auditors.

RELATIONSHIPS OF OPERATIONAL, FINANCIAL, AND INFORMATION SYSTEMS AUDITING

 RELATIONSHIPS OF OPERATIONAL, FINANCIAL,

AND INFORMATION SYSTEMS AUDITING

During the 1960s, there was a strong tendency for many to use the term of operational

auditing in place of the traditional internal auditing. The rationale was that internal

auditing was a term tied too closely with basic financial auditing, including the external

auditor’s review of both financial control activities and financial statements.

Internal auditors called themselves operational auditors because of their desire to

focus more of their efforts on the other operational activities in the organization that

could potentially point to areas for increased profit and overall management service.

In its most extreme form, the so-called operational auditing function would disassociate

itself entirely from the so-called financial areas. They would claim, for example,

to have no expertise on the financial controls surrounding an accounts receivable

operation. Rather, they might look at process controls and ignore the issue of

whether the cash received was properly recorded and tied to financial accounts,

including the general ledger. Management often became confused and dismayed

when their internal auditors all but ignored these important accounting or financialrelated

issues. This separation of responsibility created issues of both substance and

self-interest for the operational audit–oriented internal auditors.

Operational and Financial Activity in Internal Audit

Internal auditing today involves a broad spectrum of types of operational

and financial activity and levels of coverage. In organizations today, internal

auditing has moved beyond being a staff activity roughly tied to the controller’s

organization, although internal audit’s role is constantly being redefined. SOA

has been a major driver of change for internal auditors. While they once only

had a nominal reporting relationship to the audit committee of the board, SOA

has strengthened and formalized that reporting relationship. However, in some

other organizations, internal audit continues to function at just a routine compliance

level. In other situations, internal audit still suffers from being integrated

too closely with regular accounting activities and limits virtually all of its audit

work to strictly financial areas. These are all exceptions that do not reflect the

potential capabilities of the modern internal audit organization. They may also

reflect the lack of progressive attitudes in the overall organization.

Today, modern internal auditors have expanded their activities to all operational

areas of the organization and have established themselves as valued and

respected parts of the senior management effort. With renewed emphasis from

SOA, the modern internal auditor today is formally and actively serving the

board of director’s audit committee. While internal audit organizations once had

an almost nonexistent, dotted line reporting relationship to their audit committee—

with little direct communication—the chief audit executive (CAE) today

has direct and active level of communication with that same audit committee.

This overall situation reflects major progress in the scope of internal audit’s coverage

and level of service to all areas of the organization. The internal auditing

profession itself, through its own self development and dedication, has contributed

to this progress and has set the stage for a continuing upward trend.

Internal Audit History and Background

INTERNAL AUDITING HISTORY AND BACKGROUND
It is normal for any activity—including a control activity such as internal auditing—
to come into being as a result of emerging needs. The business organization
of 1942, when modern internal auditing was just getting started, was very different
from our twenty-first century organization of today. For example, aside from
some electromechanical devices and activities in research laboratories, computer
systems did not exist. Organizations had no need for computer programmers
until these machines started to become useful for various record keeping and
other computational functions. Similarly, organizations had very rudimentary
telephone connections where switchboard operators routed all incoming calls to
a limited number of desktop telephones. Today, we are all connected through a
vast, automated worldwide web of telecommunications and the Internet. The
increasing complexity of modern business and other organizations has created
the need for a similar specialist in various business controls: the internal auditor.
We can better understand the nature of internal auditing today if we know something
about the changing conditions in the past and the different needs these
1.2 INTERNAL AUDITING HISTORY AND BACKGROUND
5
changes created. What is the simplest or most primitive form of internal auditing
and how did it come into existence? How has internal auditing responded to
changing needs?
At its most primitive level, a self-assessment or internal auditing function can
exist when any single person sits back and surveys something that he or she has
done. At that point, the individual asks him- or herself how well a particular task
has been accomplished and, perhaps, how it might be done better if it were to be
done again. If a second person is involved in this activity, the assessment function
would be expanded to include an evaluation of the second person’s participation in
the endeavor. In a small business, the owner or manager will be doing this review
to some extent for all enterprise employees. In all of these situations, the assessment
or internal audit function is being carried out directly as a part of a basic management
role. However, as the operations of an organization become more
voluminous and complex, it is no longer practicable for the owner or top manager
to have enough contact with every aspect of operations to satisfactorily review
their effectiveness. These operations review responsibilities need to be delegated.
Although this hypothetical senior manager could build a supervisory system
to try to provide a personal overview of operations, that same manager will
find it increasingly difficult to know whether all of the interests of the organization
are being properly served as it grows larger and more complex. Are established
procedures being complied with? Are assets being properly safeguarded?
Are the various employees functioning efficiently? Are the current approaches
still effective in the light of changing conditions?
The ultimate response to these questions is that the manager must obtain
further help by assigning one or more individuals to be directly responsible for
reviewing activities and reporting on the previously mentioned types of questions.
It is here that the internal auditing activity comes into being in a formal
and explicit sense. The first internal auditing assignments usually originated to
satisfy very basic and sharply defined operational needs. The earliest special
concern of management was whether the assets of the organization were being
properly protected, whether company procedures and policies were being complied
with, and whether financial records were being accurately maintained.
There was also considerable emphasis on maintenance of the status quo. To a
great extent, this internal auditing effort was initially viewed as a closely related
extension of the work of external auditors.
The result of all of these factors was that these early internal auditors were
viewed as playing a relatively narrow role in their organizations, with limited
responsibility in the total managerial spectrum. An early internal auditor often
was viewed as a financially oriented checker of records and more of a police
officer than a coworker. In some organizations, internal auditors had major
responsibilities for reconciling canceled payroll checks with bank statements or
checking their mathematics in regular business documents. In retail organizations,
internal auditors often were responsible for reconciling daily cash sales to
recorded sales receipts.
Understanding the history of internal auditing is important because this old
image still persists, to some extent, for today’s modern internal auditors. This is so
even though the character of the internal auditing function is now very different.
FOUNDATIONS OF INTERNAL AUDITING
6
Over time, the operations of various organizations increased in volume and complexity,
creating managerial problems and new pressures on senior management. In
response to these pressures, management recognized the possibilities for better utilization
of their internal auditors. Here were individuals already set up in an audit
function, and there seemed to be every good reason for getting greater value from
these individuals with relatively little increase in cost.
At the same time, internal auditors perceived these opportunities and initiated
new types of services themselves. Thus, internal auditors gradually took on
broader and more management-oriented responsibilities in their work efforts.
Because internal auditing was initially largely accounting-oriented, this upward
trend was felt first in the accounting and financial-control areas. Rather than just
report the same accounting-related exceptions—such as some documentation lacking
a supervisor’s initials—internal auditors began to question the overall control
processes they were reviewing. Subsequently, internal audit valuation work began
to be extended to include many nonfinancial areas in the organization.
In 1942, the Institute of Internal Auditors (IIA) was launched. Its first membership
chapter was started in New York City, with Chicago soon to follow. The
IIA was formed by people who had been given the title internal auditor by their
organizations and who wanted to both share experiences and gain knowledge
with others in this new professional field. A profession was born that has undergone
many changes over subsequent years and has resulted in the type of modern
internal auditor discussed in this book.

What is Internal Auditing??

WHAT IS INTERNAL AUDITING?
An effective way to begin this book about modern internal auditing is to refer to
the professional standards of the Institute of Internal Auditors (IIA). This internal
auditor professional organization defines the practice of internal auditing as
follows: Internal auditing is an independent appraisal function established within an
organization to examine and evaluate its activities as a service to the organization.
This statement becomes more meaningful when one focuses on its key
terms. Auditing suggests a variety of ideas. It can be viewed very narrowly, such
as the checking of arithmetical accuracy or physical existence of accounting or
other business records, or more broadly, as a thoughtful review and appraisal at
the highest organizational level. In this book, we use the term auditing to include
this total range of levels of service, from detailed checking of accounting balances
to higher-level operational appraisals.
The term internal defines work carried on within the organization by its own
employees. Internal auditing work is distinguished from such audit-related
work carried on by outside public accountants or other parties (such as government
regulators) who are not directly a part of an organization.
The remainder of the IIA’s definition of internal auditing covers a number of
important terms that apply to the profession:
• Independent means auditing that is free of restrictions that could significantly
limit the scope and effectiveness of the review or the later reporting
of resultant findings and conclusions.
• Appraisal confirms the need for an evaluation that is the thrust of internal
auditors as they develop their conclusions.
• Established confirms that internal audit is a formal, definitive function in
the modern organization.
• Examine and evaluate describe the active roles of internal auditors, first for
fact-finding inquiries and then for judgmental evaluations.
FOUNDATIONS OF INTERNAL AUDITING
4
• Its activities confirm the broad jurisdictional scope of internal audit work
that applies to all of the activities of the modern organization.
• Service reveals that help and assistance to management and other members
of the organization are the end products of all internal auditing work.
• To the organization confirms that internal audit’s total service scope pertains
to the entire organization, including all personnel, the board of directors
and its audit committee, stockholders, and other interested stakeholders.
Internal auditing can also be recognized as an organizational control that
functions by measuring and evaluating the effectiveness of other controls. When
an organization establishes its planning and then proceeds to implement its
plans in terms of operations, it must do something to monitor the operations to
ensure the achievement of its established objectives. These further efforts can be
thought of as controls. While the internal audit function is itself one of the types
of controls used, there is a wide range of other controls. The special role of internal
audit is to help measure and evaluate those other controls. Thus, internal
auditors must understand both their own role as a control function and the
nature and scope of other types of controls in the organization.
Internal auditors who do their job effectively become experts in what makes
for the best possible design and implementation of all types of controls. This
expertise includes understanding the interrelationships of various controls and
their best possible integration in the total system of internal control. It is thus
through the control door that internal auditors come to examine and evaluate all
organizational activities to provide maximum service to the organization. Internal
auditors cannot be expected to equal—let alone exceed—the technical and
operational expertise pertaining to the many activities of the organization. However,
internal auditors can help the responsible individuals achieve more effective
results by appraising existing controls and providing a basis for helping to
improve those controls.

Assurance Auditing

assurance auditing provides an assessment of the reliability and/or relevance of data and operations in specific areas of business functions. The scope of assurance engagements includes fraud investigation, risk and control self-assessment, third-party and contract audit, quality audit, due diligence audit, security audit, privacy audit, performance audit, operational audit, financial audit, information technology audit, and compliance audit. With these engagements, internal auditors provide reasonable assurance whether organizational goals are being accomplished.

Management Process

The primary objectives of the overall management process are to achieve: relevant, reliable, and credible financial and operating information; effective and efficient use of the organization’s resources; safeguarding of the organization’s assets; compliance with laws, regulations, ethical and business norms, and contracts; identification of risk exposures and use of effective strategies to control them; established objectives and goals for operations or programs.