1. Internal Auditing and Outsourcing
Chapter 18
Internal Auditing and Outsourcing

2. Define Internal Auditing
Internal auditing is an independent and objective assurance and consulting activity that is designed to add value to improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, discipline approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

3. Discuss Internal Auditing
Exists only because it adds value to the organization
Must change as organizations change
Proves objective assurance to top management and the board
Reports problems, and also offers advice on needed improvements
Encompasses all the important operations of an organization

4. Assurance & Consulting Activity
Assurance services - objective services that improve the
Quality of information about processes
Effectiveness of controls
Reliability of information
Compliance with company, regulatory, or governmental procedures
Effectiveness and efficiency of operations
Consulting services:
Advisory or partnering activities that add value and improve operations
Both parties must agree on nature and scope of services
Identifies problems and potential solutions
Advisory; does not include decision making

5. Discuss Assurance & Consulting Activity
Systematic and Disciplined Approach
Internal auditing standards are designed to ensure objective, relevant, and sufficient evidence is gathered and evaluated
Internal auditors identify risks, gather evidence, evaluate findings, and suggest improvements
Elements of the systematic and disciplined approach:
Defined audit objectives
Risk analysis
Audit work plan
Defined audit procedures
Use of technology
Independent review of audit work
Review of conclusions with management

6. Assurance & Consulting Activity (Continued)
Corporate Governance, Risk Management, and Control
Good governance requires organizations implement processes and controls designed to ensure
Decisions are made at the appropriate level of the organization
Processes comply with organization policies and government regulations
Processes are efficient and effective
Risks are identified and factored into decisions
Controls are properly designed and implemented
Effective whistle-blowing function is implemented

7. Review Internal Auditing & Corporate Governance
Internal auditors should:
Understand key governance issues, stakeholders, and accountability to those stakeholders
Provide analysis to determine that top management understands risks and have processes in place to address such risks
Ensure the organization has controls to address such risks, and that such controls are operating effectively
Evaluate organization's processes for determining operating efficiency
Determine that operations comply with organization policies as well as contracts, laws, and regulations
Determine that an effective whistle-blowing function is in place

8. What is the internal audit charter?
Statement of the internal audit's role in an organization, the charter accomplishes two important objectives:
Defines the scope of the internal audit activity including access to company records
Defines the reporting relationships that exist between the audit activity and others within the organization such as audit committee members, senior management, and operating management
Important issues that should be noted in the charter:
Statement of the mission of the activity defined in terms of governance, risk, control, and operating efficiency
Identification of audit accountabilities
Defined responsibility to provide periodic reports
Prohibition against performing operational tasks
Identification of standards by which to judge performance of internal audit work

9. Review Internal Auditing & the Audit Committee
Internal auditors assist the audit committee in a number of ways:
Review the quality of internal controls over financial reporting
Provide an independent viewpoint on major accounting issues
Provide feedback on the efficiency of operations and compliance with company and regulatory policies
Facilitate information flow to the audit committee
Perform special projects or investigations as requested

10. Review Internal Auditing & the Audit Committee
Monitor effectiveness of whistle-blowing activities
Evaluate whether the company has met its reporting objectives
Assess the "quality" of financial reporting
Evaluate the effectiveness of risk management processes
Provide independent assessments of risk
Provide information to facilitate monitoring of key risks

11. Discuss Internal Audit Outsourcing
Recent trend for companies to outsource their internal audit function to public accounting or other specialize firms
This trend may slow as the SEC prohibits a CPA from providing both internal and external audit services for the same company
Possible advantages of outsourcing internal audit function. Service provider may:
Have greater expertise or specialized talents
Be able to provide service at lower cost
Have global presence and be able to provide service without language or cultural problems
Provide greater flexibility in staffing and budgeting
Possible disadvantages of outsourcing internal audit function:
Employees may have greater knowledge of the company and its operations
Loss of internal audit as a training ground to develop new managers

12. What is value added internal auditing?
Internal audit activities can be classified as:
Risk analysis
Organizations take risks to accomplish their objectives
Organizations need processes to recognize risk and institute controls to minimize adverse outcomes
Risk analysis examines whether processes are adequate to manage risks
Information reliability
Organizations need accurate, reliable, and timely information
Information must also be protected
Internal auditors perform periodic reviews of security and controls

13. What is value added internal auditing? (Continued)
Control effectiveness
Controls exist to address risks
Internal auditors provide objective assessment as to whether
Controls are adequate to manage risk
Controls are operating effectively
Operational effectiveness and efficiency
Conformance with company policies and procedures
Fraud investigations

14. What are operational audits?
Evaluate organization's activities, systems, and controls
Assess quality and efficiency of performance
Identify opportunities and develop recommendations for improvement
Criteria for evaluation of performance
Past operations
Best practices for similar operations
Stated management objectives

15. Further Discussion of Operational Audits
Every operational audit follows the same ten step process:
Understanding the operational area and management's interest in having the area audited
Develop background information about the audit area
Develop objective criteria regarding operational efficiency
Perform preliminary analysis of the audit area
Perform detailed risk analysis
Develop and analyze data that might indicate problems
Perform inquiry and testing to identify source of problems
Performed detailed tests of operating activities and controls
Summarize findings - prepare report and discuss with management
Develop mechanism to follow-up on recommendations

16. More Operational Audits
Detailed considerations: Establish criteria
Objective criteria should be established prior to the audit
Criteria should include both performance and control measures
Perform preliminary risk analysis for all operational audit areas
To determine whether organization has effective risk management process
To identify important controls
Perform analytical analysis
To identify existence and source of potential operating problems
Test controls and operations
Every operational audit will have compliance testing component
To determine whether operations follow company policies and meet company standards

17. Discuss Compliance Audits
Performed to determine whether operations are being conducted in compliance with contracts, management's policies, or applicable laws and regulations
Add value because they can
Improve operational efficiency
Provide assurance that organization is operating within applicable laws and regulations

18. Internal Auditing and Sarbanes-Oxley
Internal auditors are an integral part of assisting organizations to implement provisions of the Sarbanes-Oxley Act
Internal audit may assist in facilitating a control self-assessment by management assisting operating personnel understand controls and documentation

19. Review Internal Audit Standards
Standards for the Professional Practice of Internal Auditing (IIA):
Attribute Standards
Purpose, Authority, and Responsibility
Independence and Objectivity
Proficiency and Due Professional Care
Quality Assurance and Improvement Program
Performance Standards
Managing the Internal Audit Activity
Nature of Work

20. Review Internal Audit Standards (Continued)
Performance Standards
Engagement Planning
Performing the Engagement
Communicating Results
Monitoring Progress
Management's Acceptance of Risks
Implementation Standards
There may be multiple implementation standards derived from the concepts in the attribute and performance standards

21. What is the IIA Code of Ethics?
Focuses on broad-based Principles and Rules of Conduct regarding:
Integrity
Objectivity
Confidentiality
Competence

22. Comment on Reporting Fraud
The IIA's Code of Ethics makes it clear that an internal auditor should
"Observe the law and make disclosures expected by the law and the profession"
"Not knowingly be a party to any illegal activity, nor engage in acts that are discreditable to the profession of internal auditing or to the organization"

23. Comment on Reporting Fraud
If an internal auditor uncovers evidence of fraud, the auditor should:
Document the findings and include them in an audit report
Report findings to the board of directors, the audit committee, and appropriate members of top management
Consult with an attorney on actions appropriate to the particular case
Consider the need for any additional action to disassociate from the fraud