Plus the principal tasks.
Every business has a system of internal controls. Very small businesses likely rely on luck and the honesty of their one or two office staff. Small businesses rely on their independent auditors to check their system once a year and large companies employ one or more internal auditors on their staff.
MORE: The Ten Financial Controls That’ll Make You a Hero | Rule #1: Start with Cash | Organization Minutes Too Often Overlooked | Five Cash Reports You Can’t Live Without | The Priorities Were Backward | The Seven-Minute Financial Statement
Exclusively for PRO Members. Log in here or upgrade to PRO today.
This post explains the internal audit process that applies to every size business. Businesses have voluminous transactions; multiple people involved, companywide; and assets that need protection.
Each step carries risks, opportunities for theft and potential for mistakes. Internal audit can provide a check that the systems are working properly.
Internal control includes:
- Processes for planning, organizing, directing and controlling operations
- Systems for measuring, reporting and monitoring performance
- Actions taken by management and other parties to enhance risk management and increase the likelihood that established objectives and goals will be achieved
Some of the benefits of having a good system of internal controls are:
- Helping protect assets and reduce the possibility of fraud
- Improving efficiency in operations
- Increasing financial reliability and integrity
- Ensuring compliance with laws and statutory regulations
- Establishing monitoring procedures
Internal audit is responsible for monitoring the effectiveness of the internal control processes that have been established by management.
The principal tasks of an internal audit include:
- Risk assessment – Assisting management with identifying and prioritizing areas or processes that require attention and audit focus to actions that may adversely affect the organization; prioritizing projects by level of potential risk; and developing a plan that will limit exposure to loss
- Process walkthroughs and documentation – Gaining an understanding of the processes and procedures as they currently exist, especially with respect to the IT systems processing high volumes of transactions and interviewing department heads and process owners with a focus on “what can go wrong” scenarios
- Control assessment – Identifying gaps, also known as “trouble spots,” where procedures and controls are not properly designed
- Testing – Performing tests of controls to verify whether controls are working as designed
- Reporting – Providing observations and recommendations to improve processes and controls
- Organizational changes – Having an alertness to organizational changes that could potentially impact the management of risk, changes in organizational ethics, management reorganizations, financial demands, resource constraints, technology and E-business changes, consolidations and alliances, and legislative and regulatory imperatives
Some specific benefits that an internal audit function will provide:
- Improving the “control environment” of the organization
- Making the organization process-dependent instead of person-dependent
- Identifying redundancies in operational and control procedures and providing recommendations to improve the efficiency and effectiveness of procedures
- Serving as an Early Warning System, enabling deficiencies to be identified and remediated on a timely basis (i.e., prior to external, regulatory or compliance audits)
- Ultimately increasing accountability within the organization
- With an internal audit function, management would have an advocate, a risk manager, a controls expert, an efficiency specialist, a problem-solving partner and a safety net
The establishment of an internal audit function need not be a major investment. An entity does not have to jump into the deep end of the pool and hire an entire department. The function can be internal, but just as easily outsourced or co-sourced. A way to begin could be with a preliminary risk assessment followed by a prioritizing of the areas of need at which time, a decision can be made as to how to efficiently staff the priority projects and get the benefit of an internal auditor on your team.
