The crucial role of internal auditors (I)
Internal auditing is an essential part of business operation which every company that cherishes long-term growth does not shirk. A study, State of the Internal Audit Profession Study, conducted by an accounting and advisory firm, PricewaterhouseCoopers (PwC), in March 2015, reflects the opinions of more than 1,300 Chief Audit Executives (CAE), senior management and board members globally. The results suggested that external drivers of change were influencing how internal audit should evolve to maintain its relevance.
Advertisement
Internal auditing has emerged in both the public and private sectors as a distinctive profession. In Ghana, the practice has been with organisations for a long time, but it gained roots with the passage of the Internal Audit Agency Act, 2003 (Act 658). The legislation provided a timely accentuation for all public sector organisations to embrace internal auditing as part of their day-to-day operations.
For the private sector, changes in the economic and business environment compelled professional bodies such as accountancy organisations, to make internal auditing an integral part of business operations. They thus helped companies they consulted to institute the practice or those that already had it to improve it, with robust systems and control mechanisms.
The 2008 financial crisis, which was partly the doing of poor auditing and third party assurance systems, also called for the strengthening of the auditor's role in the internal affairs of the organisation.
Incidentally, in Ghana's case, Act 658 also coincided with the entry of several international accounting firms in the country, which were contracted by blue chip and medium scale companies to audit their books. These helped to emphasise the need for making internal auditing germane to the activities of organisations in the country, both private and public.
Not only that, the practice is moving towards a new height which emphasises the need to “harness the power of data throughout the audit life cycle to provide better insights into the business.”
To remain relevant, however, the PwC report advises internal auditors to begin to revise the traditional approach to assessing enterprise risks based on only current and historic events to a position where they are proactive and anticipate risks.
What it means
Internal Auditing is usually expressed as the eyes and ears of owners and management. This is because like the owner, the internal auditor is to look at every part of the organisation’s business from the standpoint of increasing efficiency and value creation. It is, therefore, generally accepted that internal auditing should be seen as an independent objective assurance and consulting activity designed to add value and improve organisation's operations and help it to achieve its objectives. It does that by bringing systematic disciplined approaches to evaluate and improve the effectiveness of risk management, control and governance.
Independence
One of the cardinal tenets of effective internal auditing is independence. Independence is the freedom from conditions that threaten the ability of the internal audit activity to carry out its responsibilities in an unbiased manner.
Although the internal auditor is an employee of the organisation, the position requires independence from the rest of his colleagues. It is for this reason that the Chief Audit Executive must report to a level within the organisation that allows the internal audit activity to fulfil its responsibilities.
According to two auditors, Messrs Erasmus Badu Akuffo and Bartholomew Darko, whose views the Daily Graphic sought, the Chief Audit Executive (CAE) or Director of Audit, as some organisations refer to the position, is part and parcel of the executive management of the organisation, a top echelon member of the organisation, so that the function will be taken seriously and accorded the cooperation required.
According to the Chartered Institute of Internal Auditors, UK (CIIA), this is important to provide the position holders the clout with which to go about their duties.
According to practitioners, since the CAE is part of the organisation and management, achieving independence from the midst of your colleagues becomes challenging, and, therefore, calls for professionalism and putting the interest of the organisation first.
To this end, the internal auditor must adopt an unbiased mental attitude that allows them to perform engagements in such a manner that no significant quality compromises are made. This professionalism must reflect in the reporting; it should be very objective.
A chartered accountant with many years’ experience with Ernst & Young told the Daily Graphic, “You are part of management but if you want to do it and do it well, you need to be objective and that independence must be there.”
Assurance
The internal auditor is responsible for providing assurances to management on processes and procedures, not only on the financial health of the organisation as the profession used to be concerned about. This assurance cuts across the policies and procedures that the organisation has in place to ensure that they work to plan, not only in the accounts department but across the entire organisation.
To wit, the internal audit function is to ensure that human resource policies, procurement, operational policies, policies governing legal, research, marketing and so on, will not become white elephants. They should be followed in practice, they are monitored and ways of improving them are recommended by the internal audit team. Sometimes, the recommendations are for changing them. This is the advisory function that auditors play.
Mr Akuffo agrees with the results in the PwC report regarding adding value to the organisation, and said “there are times you have to be proactive. You look at the numbers and predict what can be a future occurrence based on current and past trends. This is the area that Internal Audit is going into.”
Governance and reporting
In modern-day practice, the internal auditor has two lines of reporting. First, for the resources needed to the work, the auditor reports to the managing director or chief executive officer. On the second strand, the report itself is not to the functional head of the organisation but a higher body being the audit subcommittee of the board of directors.
The committee upon receipt of the Internal Audit Report, examines it for the issues raised, including the recommendations, and ensures that they are implemented.
However, the chartered accountants explained, since the internal auditor is part of management, it would be prudent to first engage with management for responses and clarifications before the board, through its subcommittee, peruses the report.
It is common to find management rejecting some recommendations of the internal audit team and this will require a third eye to pronounce on the middle ground. On such occasions, the board subcommittee comes in handy. It is important that the organisation involves the internal audit outfit in all its operations and supply it with information that will enable the unit to perform its functions properly.
According to the resource persons, it is common to see some organisations push the role of internal audit to the back burner, because of their penchant to stop some transactions, procedures and conducts of the organisations.
However, every organisation is better off having the critical eyes and the objective instincts of the internal auditor, as they not only help in checking and mitigating risks, but adding value to the organisation.
The next article will look at internal auditing and risk management and how it adds value to the organisation.