[FAQs] Internal Audit of the Company

Internal Audit has become an important management tool in the modern time for the following reasons:

• • It is a specialized service to look into the standards of efficiency of business operations.
  • It can evaluate various problems independently in terms of overall management control and suggest improvements.
  • Internal Audit’s independent appraisal and review can ensure the reliability and promptness of MIS and the management reporting on the basis of which the top management can take firm decisions.
  • Internal Audit system makes sure the internal control system including accounting control system in an organization is effective.
  • This ensures the adequacy, reliability and accuracy of financial and operational data by conducting appraisal and review from an independent angle.
  • It can break through the power ego and personality factors and possible conflicts of interest within the organization.
  • It ensures compliance of accounting procedures and accounting policies.
  • It can be of valuable assistance to management in acquiring new business, in promoting new products and in launching new projects for expansion or diversification of business.

• • Areas of operations of Internal Audit:
    As defined by the Institute of Internal Auditors (IIA), internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. The internal audit activity evaluates risk exposures relating to the organization’s governance, operations and information systems in relation to:

1. Effectiveness and efficiency of operations.
2. Reliability and integrity of financial and operational information.
3. Safeguarding of assets.
4. Compliance with laws, regulations, and contracts.

• • Features of Internal Audit: Following are features of Internal Audit:

1. It is an independent appraisal activity within the organisation.
2. It can be conducted by the staff of the entity or by an independent professional appointed for that purpose.
3. It is conducted for review of accounting, financial and other operations and controls established within an organisation.
4. It is conducted as a service to the organisation and is not a part of the organisation.
5. It intends to furnish the analysis, appraisal, suggestions and information concerning the activities reviewed to the management.

• • As per Section 138 of Companies Act, 2013 and Rule 13 of Companies (Accounts) Rules, 2014, every private company having turnover of two hundred crore rupees or more during the preceding financial year or outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year.
  • As per Section 138 of Companies Act, 2013 provides that such class or classes of companies as may be prescribed shall be required to appoint an internal auditor, who shall either be a Chartered Accountant or a Cost Accountant or such other professional as may be decided by the Board of Directors to conduct internal audit of the functions and activities of the Company.

(i) Therefore, a private company falling under above mentioned criteria is mandatorily required to appoint an internal auditor.
(ii) The Board of Directors of the Company to appoint any Practicing Chartered Accountant or Cost Accountant or any other professional to whom it deems fit to be appointed as an internal auditor. If Board decides to appoint Practicing Company Secretary as internal auditor then such appoint is valid.

• • According to Section 138(1) of the Companies Act, 2013 read with the rule 13 of the Companies (Accounts) Rules, 2014, following persons may be appointed as an internal auditor of the company Chartered Accountant or Cost Accountant or such other professional as may be decided by the Board to conduct internal audit of the functions and activities of the Company.
  • As per Rule 13 of the Companies (Accounts) Rules, 2014 inter alia provides that the internal auditor may or may not be an employee of the Company.

• • Meaning of Efficiency Audit:

1. 1. 1. Efficiency audit refers to comparing the actual results with the desired/projected results.
      2. It is directed towards the measurement of whether plans have been effectively executed.
      3. It is concerned with the utilisation of the resources in economic and most remunerative manner to achieve the objectives of the concern.
      4. It comprises of studying the plans of organisation, comparing actual performance with plans and investigating the reasons for variances to take remedial action.

• • Efficiency audits can:

1. 1. 1. help managers and staff to be more sensitive to their obligation of due regard to efficiency;
      2. underline the importance of measuring efficiency and of using that information for managing operations and providing accountability;
      3. identify means for improving efficiency, even in operations where efficiency is difficult to measure;
      4. demonstrate the scope for lowering the cost of delivering programs without reducing the quantity or quality of outputs or the level of service;
      5. increase the quantity or improve the quality of outputs and level of service without increasing spending; and
      6. identify needed improvements in existing controls, operational systems, and work processes for better use of resources.

Limitations of Internal Audit are as follows:

• • Extra Cost: The expense related to Internal Audit of the Company increase to the expenses of the Company. Thus, small companies cannot meet this cost burden but larger businesses can meet.
  • Time Limit: The limitations of Internal Audit starts when there is time gap between recording and checking of entries. The accounting and internal audit must go side by side with minimum time gap.
  • Deficiencies: Internal audit becomes as better as it is used by managers. There are occasions when managers cannot accept the finding of internal audit and take consequent actions.
  • Lack of Professionals: Internal auditors are not required to be professionally qualified and so there may be limitations in their knowledge and technical expertise.
  • Lack of Transparency: Internal audits are employed by the organization. This fact impact their independence and objectivity as well as ability to report fraud/error to senior management.

Applicability of Internal Audit: The concept of the Internal Audit has been recognized as a statutory requirement under Section 138 of the Companies Act, 2013 read with Rule 13 of Companies (Accounts) Rules, 2014, and has been made mandatory on the following class of companies:

(a) Every listed company;
(b) Every unlisted public company having

• • paid up share capital of fifty crore rupees or more during the preceding financial year; or
  • turnover of two hundred crore rupees or more during the preceding financial year; or
  • outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year; or
  • outstanding deposits of twenty five crore rupees or more at any point of time during the preceding financial year;

(c) Every private company having:

• • turnover of two hundred crore rupees or more during the preceding financial year; or
  • outstanding loans or borrowings from banks or public financial institutions exceeding one hundred crore rupees or more at any point of time during the preceding financial year.

These companies are required to appoint an internal auditor which may be either an individual or a partnership firm or a body corporate.

• • As defined by the Institute of Internal Auditors (IIA), Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization to accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.
  • Core principles of internal audit are:

1. Demonstrates integrity.
2. Demonstrates competence and due professional care.
3. Independent and objective exercise.
4. Aligns with the strategies, objectives, and risks of the organisation.
5. Is appropriately positioned and adequately resourced.
6. Demonstrates quality and continuous improvement.
7. Communicates effectively.
8. Provides risk-based assurance.
9. Insightful, proactive, and future-focused.
10. Promotes organisational improvement.

Following are Step-wise approach for Internal Audit Process:

• • Step 1: Establish and communicate the scope and objectives for the audit to appropriate management.
  • Step 2: Develop an understanding of the business area under review. This includes objectives, measurements and key transaction types. This involves review of documents and interviews. If required, flow charts and narratives may be created.
  • Step 3: Describe the key risks facing the business activities within the scope of the audit.
  • Step 4: Identify control procedures used to ensure each key risk and transaction type is properly controlled and monitored.
  • Step 5: Develop and execute a risk-based sampling and testing approach to determine whether the most important controls are operating as intended.
  • Step 6: Report issues and challenges identified and negotiate action plans and solutions with management to address the problems.
  • Step 7: Follow-up on reported findings at appropriate intervals. Internal audit departments maintain a follow-up database for this purpose.

Following steps required to be followed in appraisal of management decision:

1. Internal Audit is a vital constituent of internal control mechanism. It is important to constitute and maintain an audit committee that shall provide assistance to the board of directors in fulfilling their oversight responsibility to the shareholders relating to:

• • • The integrity of the financial statements and the financial reporting process and principles;
    • Internal controls;
    • The qualifications, independence, remuneration, and performance of the independent auditors;
    • Staffing, focus, scope, performance, and effectiveness of the internal audit function;
    • Risk management; and
    • Compliance with legal, regulatory, and corporate governance requirements.

2. The internal auditor should focus towards improving the internal control structure and promoting better corporate governance. The role of the internal auditor encompasses:

• • • Evaluation of the efficiency and effectiveness of controls.
    • Recommending new controls where needed or discontinuing unnecessary controls.
    • Using control framework.
    • Developing Control self-assessment.

• • The internal control may be defined as

“The process designed, implemented and maintained by those charged with governance, management and other personnel to provide reasonable assurance about the achievement of an entity’s objectives with regard to reliability of financial reporting, effectiveness and efficiency of operations, safeguarding of assets, and compliance with applicable laws and regulations.”

Objectives of Internal Control:

• • To ensure that the transactions are executed in accordance with management’s general or specific authorization;
  • To ensure assets are safeguarded from unauthorised access, use or disposition; and
  • To make sure that appropriate action is taken with regard to any differences between the recorded assets are compared with the existing assets at reasonable intervals.

The Secretarial auditor should document his evaluation and conclusions on the following important aspects:

• • Scope of Audit Function – The external auditor should ascertain the nature and depth of coverage of the assignment which the internal auditor discharges for management.
  • Technical Competence – The external auditor should ascertain that internal audit work is performed by persons having adequate technical training and proficiency.
  • Due Professional Care – The external auditor should ascertain whether internal audit work appears to be properly planned, supervised, reviewed and documented.
  • Monitoring of internal control: The internal audit function may be assigned specific responsibility for reviewing controls, monitoring their operation and recommending improvements thereto.
  • Review of operating activities: The internal audit function may be assigned to review the economy, efficiency and effectiveness of operating activities, including non-financial activities of an entity.
  • Review of compliance with laws and regulations: The internal audit function may be assigned to review compliance with laws, regulations and other external requirements, and with management policies and directives and other internal requirements.
  • Risk management: The internal audit function may assist the organization by identifying and evaluating significant exposures to risk and contributing to the improvement of risk management and control systems.

Four technique which are used by an Internal Auditor are:

• • Review of Operating Environment: An operating environment describes management’s ethical qualities, leadership style and business practices. An internal auditor also could determine how a corporation operates by evaluating industry trends and regulations.
  • Review Controls: An internal auditor determines how a company’s segment or departmental controls operate by reading prior audit reports or working papers and by inquiring from segment employees who perform such controls on a regular basis.
  • Test Controls: Effective controls remedy deficiencies and problems properly. Controls are adequate if they provide detailed step-by-step procedures and guidelines for task performance, decision-making processes and lines of hierarchy.
  • Account Details: An internal auditor performs tests of account details to ensure that financial statements of a business entity are not “materially misstated”. Tests of account details and account balances are referred to as substantive tests.

As per the Institute of Internal Auditors (IIA), core principles of Internal Audit hovers around the performance of effective internal auditing and all of them must be present and working well. Core principles of internal audit are:

• • Demonstrates integrity.
  • Demonstrates competence and due professional care.
  • Independent and objective exercise.
  • Aligns with the strategies, objectives, and risks of the organisation.
  • Demonstrates quality and continuous improvement.
  • Communicates effectively.
  • Provides risk-based assurance.
  • Insightful, proactive, and future-focused.
  • Promotes organisational improvement.

Internal Audit’s Manual (terms of reference) should provide clarity about its:

• • Strategy and objectives;
  • Role and responsibilities within the organisation;
  • Scope of work;
  • Accountability to the audit committee;
  • Reporting lines for line management purposes;
  • Accessibility to the board and the audit committee; and
  • Unfettered access to all information, people and records across the organisation.