What Is an Internal Audit and Can It Benefit Your Organization?

Your organization may have, or you may have considered, an audit of the entity’s financial statements (an external audit). These are often required by regulators, lenders, or other stakeholders who need comfort over the entity’s financial position and operating results. Financial auditors provide reasonable assurance on the organization’s financial statements and may provide insight into internal control shortcomings they encounter as part of their procedures. So, what is the difference between these and an internal audit (which typically isn’t required), and why would you consider spending time and money on an internal audit? Simply put, risk management.

Internal and external audits differ in two primary ways – purpose and structure. Your external audit is typically done once a year for the purpose mentioned above of financial statement assurance by independent accountants. Conversely, an internal audit generally is not a singular event. It is an iterative process performed by objective (but not necessarily independent) consultants who assist management in identifying, assessing, and monitoring the mitigation of risks to the organization’s objectives.

COSO’s Internal Control – Integrated Framework is the most broadly used internal control framework in the United States. Its model categorizes an organization’s objectives as operating, reporting, or compliance while recognizing that some goals may encompass multiple categories. To illustrate the difference between external and internal audits using the COSO Framework as a reference, the external audit focuses specifically on one aspect of reporting (financial). Conversely, the internal audit function may address all of the organization’s objectives – whether they relate to operations, internal or external reporting, or compliance initiatives – through various projects and duties of the team.

One distinct advantage of an internal audit is that it attempts to uncover deficiencies and inefficiencies in a company’s operations — including internal controls, corporate governance, compliance, and accounting processes — before they are brought to light in an external audit. Internal auditors provide insight and information about the business to management and the board of directors so they are aware of issues and can make appropriate corrective actions in a timely manner.

Because it is involved with all aspects of the organization, the scope of internal audit projects can be as broad or limited as needed. Procedures can focus heavily on some areas while ignoring others. This flexibility is one reason why business owners avoid internal audit — they don’t know where to begin.

What Does an Internal Audit Look Like?

Internal Audits are an iterative, continuous process because the process of risk management never stops. The internal audit team, while not performing management functions themselves, should work with and guide management through the risk management cycle – defining and clarifying objectives, identifying, and assessing risks to the achievement of those objectives, developing company responses to the risks, and monitoring and assessing the effectiveness of internal controls towards the mitigation of risks. Additionally, internal audits may also perform ad hoc projects such as internal fraud investigations, advice on software implementation, or assistance with due diligence related to a pending purchase or sale.

Defining and Clarifying Objectives

What does the organization do, and what are its goals for operations, internal and external reporting, and compliance with laws and regulations? Internal audits can serve as an advisor by prompting or facilitating discussions with management and corporate governance to help them articulate the entity’s overall objectives and what those look like from the entity-wide level all the way down to a transactional or singular employee level. Some questions that go into the process might include:

• Are the objectives aligned with the organization’s strategic priorities?
• Do the objectives align with laws, regulations, and standards applicable to the company?
• Have objectives been articulated in a way that is specific, measurable or observable, and relevant?
• Are objectives reflected across the entity and its subunits?

Identify and Evaluate Risks

While defining risk is important, it’s just as important to determine management’s threshold for risk. Businesses cannot realistically mitigate all risks, so management must be clear about what risks they are willing to accept. Internal auditors can help management identify and analyze the risks to the achievement of its objectives. Some examples of risks include:

Strategic Risks: Misallocation of resources Market fluctuations Inaccurate projections Operational Risks: IT security breaches Inefficient workforce Damage to (or theft of) assets

Reporting Risks: Accounting errors Errors in operational reports Compliance Risks: Non-compliance with rules or regulations Illegal acts

The internal audit team might conduct an enterprise-wide risk assessment (ERA) on behalf of, or in conjunction with, management to address the following as it relates to the types of risks the organization faces:

• Where and how do the risks exist?
• What are the organization’s tolerances for the risks?
• What is the potential significance of these risks?
• Given its resources and risk tolerances, how will the organization respond to the risks – accept, avoid, reduce, or transfer?

Monitoring and Reporting

Based on the risk assessment results, an internal audit may then rate the risks at various levels across the organization and develop an audit plan of projects to address management’s highest concerns. The advantage to this process is its flexibility; management can get a clear picture of its potential issues and can focus on the highest priorities as needed with time and resource constraints. Each project will have specific objectives that should align with the organization’s objectives, related risks, and/or management needs.

Auditors determine the extent and range of testing, or audit scope, required for each project and perform a variety of types of tests in conducting the audit. The types of tests vary based on the goals of the project and the area of the organization being audited. A few of the most common types of tests your auditors will perform are:

• Inquiry — interviewing an employee about their process or role
• Observation — observing a process or procedure
• Inspection — reviewing documentation, like procedure manuals, flowcharts, policies, etc.
• Reperformance — reperforming the procedure to see if they get the same results

Once the procedures are completed, the internal auditors will prepare reports outlining the types and scope of testing they performed and their findings. These typically also include recommendations to management for making improvements.

Ad Hoc Projects and Other Roles

In addition to assisting with the standard, ongoing risk management process, internal audits often serve the organization in other capacities. Situations may arise that require objectivity or specific skill sets that internal auditors possess, such as internal fraud investigations, advising on new software implementation, or evaluating vendor performance against contract obligations. Management may ask for an internal audit to examine specific processes and make recommendations for efficiency and improvement. Because the internal audit function usually has a strong understanding of the organization’s processes, risks, and internal controls, they are often asked to assist external auditors in certain procedures as well.

Why is Internal Audit Important?

An effective internal audit function can:

• Identify risks that would not be known otherwise
• Improve operating efficiencies
• Provide objective insight into the business and its industry
• Predict future outcomes for the business
• Improve the control environment
• Detect and deter against fraud

A positive internal audit report will increase board member confidence that the business is operating efficiently. If any deficiencies are discovered, management can confront those challenges head-on.

Should You Outsource Your Internal Audit Function?

Internal audit teams are often maintained in-house as employees of the organization, but they don’t have to be. Internal audit can be co-sourced or outsourced to a CPA firm if you need additional support. Outsourcing your internal audit may be a good choice if:

• Your business has seen rapid growth
• You suspect fraud
• You do not have the experience or resources available internally
• You require certain skills not available internally, such as IT or data specialists
• You are preparing for a future sale
• You find it difficult to manage everyday financial reporting tasks
• Your compliance needs have grown

If you have questions about whether your company needs an internal audit function or how to improve your internal audit process, your CRI advisors can help. We can discuss the available options, including hiring internally, outsourcing, or co-sourcing your internal audit function.