The essential elements of internal audit are:
a. Independence—see above
b. Staffing—the internal audit unit should be adequately staffed in terms of numbers, grades and experience.
c. Training—all internal auditors should be fully trained.
d. Relationships—internal auditors should foster constructive working relationships and mutual understanding with management, with external auditors with any review agencies (e.g. management consultants) and where appropriate with an audit committee. Mutual understanding is the goal.
e. Due care—an internal auditor should behave much as an external auditor in terms of skill, care and judgement. He should be up to date technically and have personal standards of knowledge, honesty, probity and integrity much as an external auditor. It is desirable that an internal auditor is qualified, because of ethical considerations as much as technical standards implied by membership of a professional body.
f. Planning, controlling and recording—fundamentally the internal auditors should behave much as external auditors in this respect. The plan should identify audit areas which may be:
i. Activity (e.g. payroll, income, stores, purchasing etc.)
ii. Nature of the audit (e.g. protective, systems audit, value for money)
iii. Level of audit required (e.g. degree of risk, frequency and extent of audit).
Internal auditors plan their work strategically (two to five years for all areas to be covered), periodically (typically one year when the strategic plan is translated into a schedule of work) and operationally (each piece of work, in detail).
Controlling includes supervision and review of internal audit work.
Working papers should be of a similar detail and standard as those of external auditors.
g. Systems control—the internal auditor must verify the operations of the system in much the same way as an external auditor i.e. by investigation, recording, identification of controls and compliance testing of the controls. However, the internal auditor is also concerned with:
• The organisation's business being conducted in an orderly and efficient manner
• Adherence to management policies and directives
• Promoting the most economic, efficient and effective use of resources and achieving the management's policies.
• Ensuring compliance with statutory requirements
• Securing as far as possible the completeness and accuracy of the records
• Safeguarding the assets
h. Evidence—the internal auditor has similar standards for evidence as an external auditor, he will evaluate audit evidence in terms of sufficiency, relevance and reliability.
i. Reporting—the internal auditor must produce timely, accurate and comprehensive reports to management on a regular basis. These should report on the matters outline in g. above and with the accuracy of information given to management and give recommendations for change.