
Chapter 13: Internal audit and outsourcing
© EWP Go to www.emilewoolfpublishing.com for Q/As, Notes & Study Guides 293
Many entities use complex IT systems. Specialist internal auditors can help
management to review the effectiveness of controls within IT systems (by means
of IT audits).
The increasing cost of the external auditor’s services means that it may be
cheaper to use internal auditors to perform audit tasks whenever possible. (The
reliance of external auditors on work done by internal auditors is considered
later. However, an internal audit department may be used for work not related
to the external audit that might otherwise be given to an external firm of
accountants as non-audit work.)
There is no legal requirement for an entity to establish an internal audit function.
The fact that many organisations do so indicates that there are significant benefits to
be gained.
For companies that operate over multiple sites, internal audit may be an essential
tool for effective management. Senior management can use an internal audit
department to carry out ‘external’ checks on its operational departments. Random
visits or surprise visits by internal auditors may be used to confirm that all locations
are applying internal controls properly, and are complying with relevant laws and
regulations. The largest locations, or locations where there is a high risk of control
failure, may be visited more frequently by the internal auditors.
1.3 Typical functions of internal audit
The scope and objectives of internal audit vary widely, and depend on:
the size and structure of the entity, and
the requirements of its management.
However, internal audit activities usually include one or more of the following:
Monitoring of internal control. Senior management need to reassure themselves
that internal controls are functioning effectively. In a large organisation, they do
not have the time to carry out this task personally, for example through
observation. Monitoring controls, and making sure that the controls are working
properly, needs attention on a continuous basis. An internal audit department is
usually given the specific responsibility by management for reviewing controls,
monitoring their operation and recommending improvements.
Examination of financial and operating information. An internal audit
department might be given the responsibility for a detailed examination of
financial and operating information, and in particular, its reliability and
usefulness. Internal auditors may investigate how information is identified,
measured, classified and reported, and recommend improvements where
appropriate. The audit work may involve investigations into specific items of
information, including the detailed testing of transactions, balances and
procedures.
Review of the economy, efficiency and effectiveness of operations, including
non-financial controls of an entity. Audits of economy, efficiency and
effectiveness can be carried out on any aspect of operations, and are usually
called value for money (VFM) audits.