Very large organisations (and some small ones) have found a need for an internal audit in addition to an external audit. Internal auditors are employees of the organisation and work exclusively for the organisation. Their functions partly overlap those of the external auditors but in part are quite different.
The precise functions of external auditors are either laid down by statute or embodied in a letter of engagement. The functions (which are rarely precisely laid down) of internal auditors are determined by management and vary greatly from organisation to organisation.
Internal audit can be defined as:
"an independent appraisal function within an organisation for the review of systems of control and the quality of performance, as a service to the organisation. It objectively examines, evaluates and reports on the adequacy of internal control as a contribution to the proper, economic, efficient and effective use of resources."
Internal auditing is thus:
a. Carried on by independent personnel. Internal auditors are employees of the firm and thus independence is not always easy to achieve. However it can be assisted by:
• having the scope to arrange its own priorities and activities
• having unrestricted access to records, assets and personnel
• freedom to report to higher management and where it exists to an audit committee
• Having internal audit personnel with an objective frame of mind
The ISA 610, deals with Reliance by External Auditors on the work of the Internal Auditor.
• IA personnel who have no conflicts of interests or any restrictions placed upon their work by management.
• IA personnel having no responsibility for line work or for new systems. A person cannot be objective about something he/she has taken responsibility for. On the other hand the IA should be consulted on new or revised systems
• IA personnel who have no non-audit work.
Since internal auditors are employees it is difficult to ensure that they are truly independent in mind and attitude.
b. an appraisal function. The internal auditor's job is to appraise the activity of others, not to perform a specific part of data processing. For example, a person who spent his time checking employee expense claims is not performing an internal audit function. But an employee who spent time reviewing the system for checking employee expense claims may well be performing an internal audit function.
c. as a service to the organisation.
The management requires that:
i. Its policies are fulfilled.
ii. The information it requires to manage effectively is reliable and complete.
iii. The organisation's assets are safeguarded.
iv. The internal control system is well designed.
v. The internal control system works in practice.
The internal auditor's activity will be directed to ensure that these requirements are met. The internal auditor can be seen as the eye of the board within the enterprise.
d. Other duties may include:
i. Being concerned. An example of this is in energy saving.
ii. Being concerned with the response to the internal control system to errors and required changes to prevent errors.
iii. Acting as a training officer in internal control matters.
iv. Auditing the information given to management particularly interim accounts and management accounting reports.
v. Taking a share of the external auditor's responsibility in relation to the figures in the annual accounts.