Fear and frustration almost always go with the words “internal audit.” Even under ideal conditions, it intimidates most people. They would find having someone review their company’s activities a bit unsettling.
Understanding the role of an internal audit, what to expect during an internal audit, and potential pitfalls to avoid will help put you and your employees at ease. Thus it is crucial to have a flawless audit system that ripples value to the entire processes in an agency.
The Internal Audit Process
Although each audit is unique, the process for most companies is similar and typically consists of four stages:
Planning is also known as a survey or preliminary review
This is when the auditing team structures and plans the clients’ internal audits to ensure that it is comprehensive and as efficient as possible.
Fieldwork
This is when the auditing team conducts all aspects of the audit, from working with third-party vendors to using in-house technology for relevant information.
Audit report
During this stage, the auditing team will analyze the data based on the company’s concerns or compliance obligations that need to be tackled by the client’s teams with data and recommendations that they can utilize to lead their companies forward.
Thus, when working with internal personnel during the audit process, it is necessary to ensure access to all relevant data. Giving your employees access to ISO 9001 lead auditor certification program will enable them to understand what all is required for the audit and how to follow it as per the rules.
Follow-up review
This is when the auditing team will check if the company correctly implemented the strategies recommended in the audit report and if they efficiently achieved the company’s goals. Below are details of how internal audit consulting procedures take place:
Data Analysis and Reporting
Client participation is essential at all stages of the audit process.
In addition, audits, like any particular project, will require some time away from your department’s personnel. One of the main goals is to reduce this time and avoid disrupting ongoing activities.
Let’s look at the activities carried out in each stage of the auditing process below.
Planning
To begin, the company’s management and auditing team would identify the proper scope of the audit. They would locate all appropriate data sources. The team would also take charge of who to choose as internal personnel.
Part of the planning stage is to choose members who should and shouldn’t be part of the audit process.
The auditor does the following steps:
- Informs the client of the audit
- Reviews the scope and objectives of the examination in an official meeting with the organization’s management
- Gathers information on essential processes and evaluates existing controls such as current narratives and flow charts if available.
- Maps out the remaining audit steps during the planning portion of the audit.
Announcement Letter or Planning Memo
Afterward, the auditing company will inform the client of the details of the audit. They do this through an announcement or letter from the internal audit team’s director.
This letter conveys the extent and purpose of the audit, the auditors appointed to the project, and other pertinent information.
Opening Conference
During the opening conference, the internal audit team discusses the audit process and the plan for completion.
In this meeting, the client will also describe the department or system to be reviewed, the organization, and available resources such as personnel, facilities, equipment, funds, and other pertinent information.
Then, the internal auditor meets with the senior officer directly accountable for the unit under review and any other staff the internal auditor wishes to include.
It’s worth noting that the client must identify issues or areas of particular concern that need to be addressed. Thus,
Preliminary Survey/Questionnaire
In this stage, the auditor gathers relevant information about the department or system to obtain a general overview of operations.
Then the auditing team meets with key personnel to review reports, files, and other sources of information.
Internal Control Design
The auditor will review the company’s internal control structure, and this step is usually one of the most time-consuming in the process.
The auditor uses various tools and techniques to collect and analyze information about the operation. Then, they will review the internal controls to help the auditor decide the areas of high risk and design tests to be executed in the fieldwork section.
An excellent internal audit team will adopt flow-charting and Risk/Control Matrices. These are tools to assess the design effectiveness of the Internal Control structure.
Then, the internal audit will give copies to the client for their use, such as future reference and training needs.
Prepared by Client (PBC) Listing
The Internal Audit team prepares a document needed to complete the audit, such as:
- reports
- vouchers
- meeting minutes
- policies, and procedures
These are just a few that would be on this listing.
Audit Program
The audit program completes the preliminary review phase. This document outlines the fieldwork necessary to achieve audit objectives.
Fieldwork
The focus of the fieldwork is on transaction testing and informal communication.
The auditor identifies whether the controls identified during the preliminary review operate effectively and in the manner reported by the client during this phase.
The fieldwork stage closes with a list of significant findings from which the auditor will prepare the audit report’s final draft.
Transaction Testing
After finishing the preliminary review, the auditor executes the procedures in the audit program.
These procedures usually check the major internal controls and the accuracy and propriety of the transactions.
Various techniques, such as sampling, are used during the fieldwork phase.
Audit Working Papers
These are vital tool of the audit because it does the following:
- Support the audit observations.
- Connect the client’s accounting records and other financials to the auditor’s opinion.
- Comprehensive and serve many functions.
Advice and Informal Communications
As the fieldwork develops, the auditor examines any significant findings with the client.
This allows the client to provide insights and work with the auditor to decide the best method of resolving the finding.
Usually, these communications are in-person or online. However, memos or e-mails are written in more complex situations to ensure complete understanding by the client and the auditor.
Audit Summary
Upon finishing the fieldwork, the auditor summarizes the findings, conclusions, and recommendations for the audit report discussion draft.
Internal Audit Report
The main product of an internal audit is the final report. This is where the auditors document observations and recommendations for improvements.
This document includes management’s response and implementation plan, the completion time frame, and the responsible individual.
Audit Report Discussion Draft
After the auditor prepares a “draft” report, the team will thoroughly review the audit working papers and the discussion draft before they present it to the client for additional comments.
This is done to properly facilitate communication and ensure that the recommendations presented in the final document are practical before issuing the final report and before the exit conference.
Client Response
In the response, the client should explain how to report findings should be resolved and include an implementation timetable.
In some cases, managers may choose to respond with a decision not to implement an audit recommendation and to accept the risks associated with an audit finding.
The client should copy the response to all recipients of the final report if they decide not to have their response included or attached to the final document.
Exit Conference
When everyone has approved the discussion draft, both parties will now discuss the findings and recommendations,
The client comments on the documents at this meeting and agrees on the final audit findings and report content.
Formal Draft
The auditor prepares a formal draft, considering any revisions resulting from the exit conference and other discussions.
Once both parties review the formal draft, the final report is issued.
Final Report
The auditing team distributes the final report. This document is primarily for internal use.
However, if a company wants to release the report outside the company, it needs approval from the auditing team.
Auditee/Client Comments
Finally, as part of the auditing team’s self-evaluation program, the company also needs to comment on the team’s performance.
This feedback is beneficial to make changes in their procedures based on clients’ suggestions.
Aging Process
After each audit report, the auditing team keeps track of all audit observations and the timing of implementation.
They follow up on each audit point to determine the status and prepare aging reports for the company’s management.
But, the company’s management is accountable for promptly completing the recommended implementations.
Follow-Up Review / Report
The auditing team uses this to test the efficacy of the strategies implemented based on the final report.
The company and the auditing team will discuss all unresolved findings in the follow-up report.
Final Thoughts
Conducting an internal audit is an essential part of company operations. It helps protect against financial fraud and loss while providing valuable information to help business owners improve.
Thus, working with auditors is essential to any company, from smaller start-ups to major corporations. They help ensure businesses run smoothly and effectively, which ultimately helps a company succeed in its goals.
The auditing process is tedious, but it is necessary. There is no doubt that the process works best when the auditing team and the company’s management have a solid working relationship based on clear and continuing communication.
Thus, it is essential to remember that employees must participate fully during each stage of the audit process.
