ACCA P1 Governance, Risk and Ethics - 2011 - Study text - Emile Woolf Publishing
Подождите немного. Документ загружается.
Paper P1: Governance, risk and ethics
184 © Emile Woolf Publishing Limited
© Emile Woolf Publishing Limited
185
Paper P1
Governance,riskandethics
CHAPTER
9
Internal control, audit
and compliance
Contents
1 The function and importance of internal audit
2 The audit committee and the external auditors
3 Evaluating the effectiveness of internal control
Paper P1: Governance, risk and ethics
186 © Emile Woolf Publishing Limited
The function and importance of internal audit
The function of internal audit
Internal audit activities
Internal auditors: independence, objectivity and status
Internal audit and the role of the audit committee
The audit committee, internal audit and the Combined Code
1 The function and importance of internal audit
1.1 The function of internal audit
Internal audit sections or departments are found in many large companies, in
government organisations and other large entities. Their main role is to act as an
independent appraisal function within the entity.
The function of internal audit can be explained as follows.
'Internal auditing is an independent, objective assurance and consulting activity
designed to add value and improve an organisation's operations. It helps an
organisation accomplish its objectives by bringing a systematic, disciplined
approach to evaluate and improve the effectiveness of risk management, control
and governance processes' (The Institute of Internal Auditors).
‘The objective of internal auditing is to assist [management] in the effective
discharge of their responsibilities. To this end, internal auditing furnishes them
with analysis, appraisals, recommendations … and information concerning the
activities reviewed’ (The Institute of Internal Auditors).
Internal audit is ‘an independent appraisal activity established within an [entity]
as a service to it. It is a control which functions by examining and evaluating the
adequacy and effectiveness of other controls’ (CIMA Official Terminology).
Internal audit may be described as a check or control over other controls. It is
therefore a part of the internal control system, with a responsibility for monitoring
the internal control system.
1.2 Internal audit activities
There is no legal requirement for an entity to have an internal audit department.
There should be checks on the effectiveness of internal control. However, these
checks could be made by operational managers or by managers in the accounts
department, or possibly by an external firm of accountants/auditors.
If a company does not have an internal audit function, it may engage an external
firm of accountants – and possibly the company’s audit firm – to carry out
occasional internal audit investigations.
Chapter 9: Internal control, audit and compliance
© Emile Woolf Publishing Limited 187
When an entity does have an internal audit department, the tasks of the department
may include the following.
Reviewing parts of the internal control system. Traditionally, internal auditors
have carried out checks on financial controls. The work done by the internal
auditors might reduce the need for the external auditors to carry out similar
checks, when the internal auditors and external auditors co-operate closely.
Weaknesses in financial controls should be reported to senior management and
notified to the external auditors. Because internal auditors carry out checks on
financial controls, it is usual for internal auditors to be professional accountants
or trainee accountants.
Special investigations. Internal auditors might be asked to carry out special
investigations into particular departments or aspects of operations. These
investigations may be at the request of the manager of the department. Internal
audits of particular systems or procedures may be called systems audits.
VFM audits. VFM stands for ‘value for money’ and VFM audits check whether
an entity is obtaining value for money from particular activities or operations.
Value for money means ‘economy, efficiency and effectiveness’.
- Economy. Economy means not spending more money than is necessary. A
VFM audit searches for wasteful spending and recommends actions that
should be taken to reduce spending without any loss of efficiency or
effectiveness.
- Efficiency. Efficiency (or productivity) means getting the most output from
the resources that are used. It means, for example, using employees and
equipment so that the output per employee or the output per item of
equipment is improved.
- Effectiveness. Effectiveness means success in achieving goals and objectives.
An internal audit should check whether the operations subject to audit are
successfully achieving their intended purpose.
Risk assessments. Internal auditors may be involved in the identification and
assessment of risks, for the purpose of risk management.
Compliance audits. Internal auditors might carry out checks to confirm that
there is proper compliance by the entity with particular rules and regulations,
such as health and safety regulations, or regulations on pollution.
Stress tests. Internal auditors might be involved in carrying out tests on what
might happen to the entity, its business operations and financial position, in the
event of a catastrophe or if extremely bad business conditions occur (a ‘worst
case scenario).
In carrying out these tasks, the internal auditors might be performing one or more
of the following functions:
Supervision, to check whether procedures and processes are being performed
properly
Attestation, to confirm that controls are functioning effectively
Evaluation, to assess risks and the benefits of risk controls.
Paper P1: Governance, risk and ethics
188 © Emile Woolf Publishing Limited
Internal auditors should help senior management to ensure that all the major risks
facing the organisation, both internal and external, are identified and managed. To
do this they need to have a good understanding of how the business functions.
1.3 Internal auditors: independence, objectivity and status
Independence
The internal auditors need to be independent, so that they are able to provide an
objective analysis and objective recommendations, free from bias and conflicts of
interest.
It is difficult for internal auditors to be independent, because they are full-time
employees of the company. They rely on the company for their income, and
possibly also for their future career. They must report to management, because they
have to take their instructions from a person in the management structure. They are
dependent on the goodwill of their manager they report to. Their manager, after all,
decides what their remuneration should be.
Internal auditors might therefore have no problem with criticising managers in
other departments, but they could have a major problem with criticising their own
manager.
Objectivity
Internal auditors, like the external auditors, need to be independent because they
are required to carry out checks on internal controls and evaluate how effective
these controls are. It is important that their advice and recommendations should be
free from the influence of other managers, and should be objective.
Status
The internal audit department should report to a senior person in management – the
more senior, the better. This is because the internal auditors are expected to criticise
‘line managers’ and this is very difficult if the line manager is their superior in
status and influence in the company. Internal auditors should therefore report to the
highest level of executive manager possible.
In addition, to give even more protection to the internal auditors from pressure by
senior management, the head of internal audit should also report directly to either:
the board of directors, or
the audit committee.
The Basel Committee for the supervision of banking, in a report on internal control
systems (1998), commented that the internal audit function, because it provides an
independent assessment of the compliance with the already established policies and
procedures (and the adequacy of them), it is an important part of assessing the
internal control system. The internal auditors provide unbiased information about
Chapter 9: Internal control, audit and compliance
© Emile Woolf Publishing Limited 189
the company by reporting directly to the board, senior management and the audit
committee.
Example
The problems facing internal auditors whose status is too low, or who report to a
manager who does not listen to their recommendations, are illustrated by an
example from local government, which has been described by a former head of
internal audit for Flintshire County Council. This example, from 2000, raises some
interesting questions about the status and effectiveness of internal audit in local
government.
The internal auditor had concerns about some transactions by the Council,
including an illegal payment to a former manager, suspicious land and property
deals, and very large salary and overtime payments to an administrative worker. He
was unable to persuade management to take any action, and therefore expressed his
concerns through the channel available for ‘whistle blowers’.
As a result of the disclosures he made, he was dismissed, and an Employment
Tribunal decided that this was constructive dismissal by his employer.
The former auditor’s comment was that management will give their support to the
work of the internal auditors, but only if it does not affect them and is unable to
criticise them. Some of his comments, which are presumably affected by his own
experiences, make useful reading. He suggested that senior management are happy
to give their support to an independent internal audit function, but only in the
following circumstances.
When ‘quite junior, or rank and file, personnel are on the receiving end of the
internal audit findings, usually resulting in disciplinary action and often
dismissal (in this way it helps feed the macho management style - internal audit
provides the bullets and the macho manager fires the gun).’
‘When internal audit is … used as, a tool to rid organisations of perceived
problematic individuals. In this regard there is a quaint phrase that I have heard
used to define what internal audit does: "They comb the battlefield and bayonet
the wounded".’
When they can ‘use critical reports to "get one over" on boardroom rivals’.
When the internal auditor ‘is a low profile "tick and check" operator, who does
not ask too many challenging questions.’
However, when senior management feel threatened by the work of internal
auditors, they might well be very critical of the internal auditors, ignore their
recommendations and (possibly) victimise troublesome auditors.
This example has been adapted from a page on the Freedom to Care website
(www.freedomtocare.org) and is reproduced by kind permission.
Paper P1: Governance, risk and ethics
190 © Emile Woolf Publishing Limited
1.4 Internal audit and the role of the audit committee
The independence and objectivity of the internal audit department can be protected
if the head of internal audit is required to report to the audit committee as well as to
a line manager (the finance director).
This was a recommendation of the Smith Report in the UK (2003) on audit
committees. The Report recommended that:
The audit committee should approve the appointment of the head of internal
audit or the termination of his employment. By removing the authority for
appointing and dismissing the head of internal audit from line management (the
finance director), the independence of the internal auditors should be
strengthened. The head of internal audit would not rely on line management for
his job; he might therefore feel more secure in his job when he has to criticize
weaknesses in internal controls for which the finance director is responsible.
The audit committee should also monitor the work of the internal audit
department, which should prepare regular reports for the audit committee (for
example a report for each scheduled meeting of the audit committee, which
might be three or four times each year).
The Smith Report recommended that the audit committee, in its review of the work
of the internal audit function, should:
Ensure that the head of internal audit has direct access to the chairman of the
board of directors and the audit committee, and is accountable to the audit
committee.
Review and assess the work plan for the internal audit department, to check that
the work plan is appropriate.
Receive reports on the work performed by the internal audit department ‘on a
periodic basis’.
Review the response of management to recommendations that have been made
to them by the internal audit department. Have management acted on the
recommendations, to deal with weaknesses in internal controls, or have
management ignored the recommendations and done nothing?
Meet at least once each year with the head of internal audit, without the
presence of management (for example, without the CEO or finance director
being present). This should make it easier for the audit committee to obtain
independent and objective opinions from the internal audit department.
Monitor and assess the effectiveness of the internal audit department, within the
overall system of internal control and risk management. The audit committee
should assess whether the internal audit department is effective.
Example
A well-reported story of internal audit is the discovery of fraud in US
telecommunications company WorldCom in 2001/2002 by Cynthia Cooper, the
company’s vice president of internal audit. The example shows how, in extreme
circumstances, the independence of the internal auditor can be strengthened by the
audit committee.
Chapter 9: Internal control, audit and compliance
© Emile Woolf Publishing Limited 191
Ms Cooper was responsible for operational audits (auditing operational controls),
but she secretly began to carry out investigations into irregularities in financial
accounting when an unusual transaction was brought to her attention. The
company’s CFO (chief financial officer) had taken responsibility for a reserve
account of $400 million in the balance sheet, without explaining what he was doing
or giving a satisfactory reason for the unusual accounting treatment of the reserve.
Ms Cooper reported her concerns to external auditors, Arthur Andersen, who
ignored her. She therefore went to the audit committee, who investigated the
problem and ordered the CFO to reverse the action that he had taken. The CFO
warned Ms Cooper to stay out of his affairs in the future and to stop her
investigations.
She did not follow his instructions, and continued to investigate the financial
transactions of the company in secret. She found a $2 billion entry in the accounting
records for capital expenditure, when there was no supporting evidence that any
non-current assets had been purchased. Further investigations subsequently found
that the company was regularly reporting operating expenses as capital
expenditure, in order to boost current profits. Most of the fraud was linked to
accounting for takeovers.
The company had written down assets acquired in a takeover, but had included
in the write-down estimates of future operating costs. In this way, the company
was able to record the future costs as costs arising on acquisition, instead of
having to record them as costs in future years.
When WorldCom acquired another company MCI, it reduced the value of MCI’s
assets and increased the goodwill on acquisition by a corresponding amount.
This allowed the company to amortise the goodwill at a much slower rate than it
would have had to charge depreciation on the tangible assets.
The company also under-provided for bad debts.
The discovery by Ms Cooper led to the discovery of much wider accounting fraud.
She reported her concerns to the audit committee, and the company’s CFO was
dismissed. (Its chairman was later jailed.) In July 2002 WorldCom filed for
bankruptcy, having admitted the need to make a downward adjustment of $9
billion to profits between 1999 and the first quarter of 2002.
1.5 The audit committee, internal audit and the Combined Code
The UK Combined Code includes some specific provisions about internal audit and
the governance role of the audit committee. It states that:
The audit committee should monitor and review the effectiveness of internal
audit activities in the company.
If there is no internal audit function (department), the audit committee should
consider each year whether the company ought to have an internal audit
function. It should then make a recommendation to the board of directors.
If there is no internal audit function, the reason for not having one should be
explained in the relevant section of the company’s annual report to shareholders.
Paper P1: Governance, risk and ethics
192 © Emile Woolf Publishing Limited
The audit committee and the external auditors
The audit committee and financial reporting
Disagreements between the audit committee and management
The audit committee and the external auditors
Monitoring the independence of the external auditors
The audit committee and the external audit process
2 The audit committee and the external auditors
2.1 The audit committee and financial reporting
As a committee of the board of directors, the audit committee’s main responsibilities
are to:
ensure the integrity of financial reporting by the company, and
ensure the integrity of external auditing. It should do this by making sure that
the external auditors are independent and objective, and that they perform their
auditing function properly.
The Smith Report suggested how this should be done.
It is the responsibility of management to prepare complete and accurate financial
statements. This is not a responsibility of the audit committee.
However, the audit committee should monitor the preparation of the financial
statements. It should consider the significant accounting policies used by the
company (and any changes in policy that have been made) and also any
significant estimates and judgements that have a material effect on the figures in
the financial statements.
When transactions can be accounted for in two or more different ways,
management should explain to the audit committee which method of accounting
they have selected.
The audit committee should compare the information received from
management with the views of the external auditor, and decide whether the
accounting policies, estimates and judgements used in the financial statements
are appropriate.
2.2 Disagreements between the audit committee and management
A problem will arise whenever the audit committee is not satisfied with any
accounting policy, estimate or judgement. When it cannot reach a satisfactory
agreement with the management (and external auditors) the audit committee
should report the disagreement to the board.
Chapter 9: Internal control, audit and compliance
© Emile Woolf Publishing Limited 193
The Smith Report suggested that the audit committee should be strong-minded if
necessary. The audit committee has a role to ensure that if things go wrong, they are
put right. Audit committees must be capable of tackling the worst situations, for
example if an audit failure seems to lead to poor, or even deliberately misleading,
financial reporting decisions.
The Report goes on to state that an adversarial relationship between the audit
committee and the company’s management ‘is of course not typical’. When it
happens, there has been a failure in corporate governance. When corporate
governance is good, the relationship between the audit committee and the
company’s management should be based on openness and mutual respect.
Example
The management of a company propose to capitalise a large amount of development
costs, instead of writing them off as current expenditure, and the external auditors
have agreed with this accounting treatment of the costs. However, the three-man
audit committee disagree with this judgement, even though the technical issue is
fairly complex and the audit committee is opposing financial ‘experts’ (the finance
director and external auditors).
The audit committee meets only three times each year, for two hours. The members
have discussed the problem at one of these meetings, and in telephone calls to each
other.
There are nine members of the board of directors, five independent non-executives
and four executives. The four executive directors agree with the opinion of the
finance director. The other two non-executives, including the chairman, are inclined
to agree with the independent external auditors. The members of the audit
committee are therefore in a minority of 3 – 6 on the board of directors. What should
the audit committee members do?
Answer
There is no obvious answer to this problem.
The audit committee could accept the opinion of the finance director and
external auditors. If they did not agree, but accepted defeat to avoid a crisis, they
have possibly failed in their responsibility to the company’s shareholders, by
allowing the financial statements to be misleading.
The nuclear option would be to resign. Alternatively, the committee members
could accept the majority decision of the board but insist on explaining their
different point of view in the audit committee’s report to the shareholders (in the
annual report and accounts). If the committee members did either of these
things, investor confidence in the company might be damaged and the share
price might fall. Instead of protecting the interests of the shareholders, the audit
committee might therefore harm them.