Internal auditors are responsible for conducting audits of the organisation’s internal controls. External auditors are responsible for expressing an opinion on the fairness of the organisation’s financial statements[1]. The audit committee is responsible for overseeing the audit process and ensuring the independence and objectivity of the internal and external auditors. The board of directors is responsible for setting the overall direction and policies of the organisation and for ensuring that the internal controls are aligned with the organisation’s goals and objectives.
Internal Auditors
Internal audit is a function within an organisation that helps ensure the integrity, reliability, and effectiveness of the organisation’s operations. The internal audit function is independent of the activities it audits and is objective in its assessments.
The main function of internal audit is to provide assurance that the organisation’s risk management, governance, and internal control systems are functioning effectively. This can involve conducting audits of financial systems, operations, and other areas of the organisation to identify any weaknesses or potential risks. Internal audit may also provide consulting services to help the organisation improve its internal control systems and processes.
Internal audit is important because it helps an organisation identify and mitigate risks, improve efficiency, and ensure compliance with laws, regulations, and other requirements. It also helps build trust with stakeholders by providing assurance that the organisation is operating effectively and efficiently.
Do you need an internal auditor?
There are several factors that can affect the need for internal audit within an organisation. These include:
- The size and complexity of the organisation: Larger and more complex organisations may require more extensive internal audit functions to ensure that all areas of the organisation are adequately covered.
- The level of risk facing the organisation: Organisations that face higher levels of risk, such as financial institutions or organisations in regulated industries, may need more robust internal audit functions to ensure that risks are adequately managed.
- Changes in the organisation’s operations or environment: Changes in the organisation’s operations or external environment may increase the need for internal audit to ensure that the organisation’s internal control systems are adequate to address the new risks and challenges.
Auditor independence
Auditor independence refers to the internal auditor’s objectivity and impartiality in conducting audits. It is important for the internal auditor to be independent in order to provide objective assurance that the organisation’s internal control systems are functioning effectively. To maintain independence, the internal auditor should not be involved in the activities being audited and should not have a financial interest in the outcome of the audit. The internal auditor should also be free from any undue influence or pressure when conducting audits.
Auditors must be independent
There are several potential ethical threats that can undermine the independence of an auditor’s opinions. These include:
- Financial interests: If the auditor has a financial interest in the organisation being audited, it may compromise their independence and objectivity.
- Undue influence: If the auditor is subjected to undue influence or pressure from management or other stakeholders, it may affect their independence and objectivity.
- Personal relationships: If the auditor has a close personal relationship with someone at the organisation being audited, it may compromise their independence and objectivity.
- Self-review threat: If the auditor is involved in the activities being audited, it may compromise their independence and objectivity.
What is an audit committee?
The audit committee is a group of independent directors within an organisation who are responsible for overseeing the organisation’s financial reporting and internal controls. The audit committee’s main responsibilities include:
- Reviewing and approving the organisation’s financial statements before they are released to the public.
- Selecting and overseeing the work of the independent auditors.
- Reviewing the results of the independent audit and any other internal audit work.
- Monitoring the organisation’s internal controls and financial reporting processes.
- Reviewing and approving related party transactions.
Board of directors role with internal controls
The objectives of the board of directors in regard to internal controls are to ensure that the organisation has effective internal controls in place to achieve its objectives and to protect against risks such as fraud and errors. The board of directors is responsible for setting the overall direction and policies of the organisation and for ensuring that the internal control systems are aligned with the organisation’s goals and objectives.
Audit committee supports the board of directors
The audit committee plays a key role in supporting the board of directors in its oversight of internal controls. The audit committee is responsible for reviewing and monitoring the effectiveness of the organisation’s internal controls and for providing the board of directors with assurance that the internal controls are functioning as intended. This includes reviewing the results of the independent audit and any other internal audit work, as well as monitoring the organisation’s internal controls and financial reporting processes. The audit committee also has a role in selecting and overseeing the work of the independent auditors, which helps ensure the independence and objectivity of the audit process.
Role of audit committee
In overseeing the internal audit function, the audit committee has several key roles. These include:
- Appointing the head of internal audit: The audit committee is responsible for appointing the head of internal audit and for reviewing their performance.
- Reviewing the internal audit plan: The audit committee should review and approve the internal audit plan to ensure that it covers all areas of the organisation that are material to the financial statements and that it is consistent with the organisation’s risk profile.
- Reviewing the internal audit report: The audit committee should review the internal audit report and any recommendations made by the internal auditors. The audit committee should also ensure that the internal audit report is communicated to the board of directors and that appropriate action is taken on the recommendations.
- Monitoring the internal audit function: The audit committee should monitor the internal audit function to ensure that it is adequately staffed, funded, and has sufficient resources to carry out its duties. The audit committee should also review the internal audit function’s policies and procedures to ensure they are consistent with best practices.
External auditors
The audit committee and external auditors are linked through the audit process. The external auditors are responsible for expressing an opinion on the fairness of the organisation’s financial statements, while the audit committee is responsible for overseeing the audit process and ensuring the independence and objectivity of the external auditors.
In the UK, the Corporate Governance Code provides guidance on the roles and responsibilities of the audit committee in relation to the external audit process. The code states that the audit committee should:
- Appoint, re-appoint, and if necessary, remove the external auditor.
- Review and approve the audit plan and scope, as well as the audit fee.
- Review the external auditor’s independence and objectivity, and ensure that the external auditor has adequate resources and access to relevant information.
- Review the external auditor’s report on the financial statements and any other matters the audit committee considers appropriate.
- Meet with the external auditor, with and without management present, to discuss the audit.
Audit committee on internal controls
It is important for the audit committee to report on internal controls to shareholders and the board of directors in order to provide assurance that the organisation’s internal control systems are functioning effectively. This can include:
- Reporting on the results of the independent audit and any other internal audit work.
- Providing updates on the status of any recommendations made by the internal or external auditors.
- Reporting on the effectiveness of the organisation’s internal controls and any actions taken to address any weaknesses or deficiencies identified.
- Reporting on the independence and objectivity of the internal and external auditors.
The audit committee should ensure that its reports on internal controls are clear, concise, and easily understood by shareholders and the board of directors. It is also important for the audit committee to communicate any significant findings or issues in a timely manner.