ROLE OF INTERNAL AUDIT IN DIFFERENT AREAS :
Role of Internal Audit in Internal Control
The Internal auditor should examine and contribute to the ongoing effectiveness of the internal control system through evaluation and recommendations. However, the internal auditor is not vested with management’s primary responsibility for designing, implementing, maintaining and documenting internal control. Internal audit functions add value to an organization’s internal control system by bringing a systematic, disciplined approach to the evaluation of risk and by making recommendations to strengthen the effectiveness of risk management efforts. The internal auditor should focus towards improving the internal control structure and promoting better corporate governance. The role of the internal auditor encompasses:
– Evaluation of the efficiency and effectiveness of controls
– Recommending new controls where needed or discontinuing unnecessary controls
– Using control frameworks
– Developing Control self-assessment
Role of Internal Audit in risk management
Internal auditing professional standards require the function to monitor and evaluate the effectiveness of the organization’s Risk management processes. Risk management relates to how an organization sets objectives, then identifies, analyzes, and responds to those risks that could potentially impact its ability to realize its objectives. Under the COSO Enterprise Risk Management (ERM) Framework, risks fall under strategic, operational, financial reporting, and legal/regulatory categories. Management performs risk assessment activities as part of the ordinary course of business in each of these categories. Examples include: strategic planning, marketing planning, capital planning, budgeting, hedging, incentive payout structure, and credit / lending practices. Sarbanes-Oxley regulations also require extensive risk assessment of financial reporting processes. Corporate legal counsel often prepares comprehensive assessments of the current and potential litigation a company faces. Internal auditors may evaluate each of these activities, or focus on the processes used by management to report and monitor the risks identified. For example, internal auditors can advise management regarding the reporting of forward-looking operating measures to the Board, to help identify emerging risks.
In larger organizations, major strategic initiatives are implemented to achieve objectives and drive changes. As a member of senior management, the Chief Audit Executive (CAE) may participate in status updates on these major initiatives. This places the CAE in the position to report on many of the major risks the organization faces to the Audit Committee, or ensure management’s reporting is effective for that purpose.
Role of Internal Audit in corporate governance
Internal auditing activity as it relates to corporate governance is generally informal, accomplished primarily through participation in meetings and discussions with members of the Board of Directors. Corporate governance is a combination of processes and organizational structures implemented by the Board of Directors to inform, direct, manage, and monitor the organization’s resources, strategies and policies towards the achievement of the organizations objectives. The internal auditor is often considered one of the “four pillars” of corporate governance, the other pillars being the Board of Directors, management, and the external auditor.
A primary focus area of internal auditing as it relates to corporate governance is helping the Audit Committee of the Board of Directors (or equivalent) perform its responsibilities effectively. This may include reporting critical internal control problems, informing the Committee privately on the capabilities of key managers, suggesting questions or topics for the Audit Committee’s meeting agendas, and coordinating carefully with the external auditor and management to ensure the Committee receives effective information.