Learn about internal audit, its functions, and how it’s conducted in assessing organizational operations.
An internal audit is a systematic and independent examination process conducted within an organization to evaluate and improve its internal controls, risk management practices, and governance processes. It’s an integral part of an organization’s internal control mechanism and is typically carried out by a dedicated internal audit function or department.
The primary objective of an internal audit as part of an organization’s audit program is to provide assurance to management and the board of directors regarding the effectiveness and efficiency of the organization’s operations. Also, this helps ensure that internal controls are in place to mitigate risks, prevent fraud, and safeguard the organization’s assets.
Further, it contributes to enhancing operational efficiency and effectiveness. Internal audits identify areas where processes can be streamlined, costs can be reduced, and operational performance can be enhanced.
In a nutshell, here are the key functions of an internal audit:
Internal Control Evaluation
Compliance Review
Financial Audit
Operational Audit
Fraud Detection
Consulting and Advisory Services
Continuous Monitoring and Improvement
Reporting
Performing an internal audit involves a systematic and structured approach to evaluate and assess the effectiveness of an organization’s internal controls, risk management processes, and compliance with applicable laws and regulations.
Internal Audit Process
Generally, here’s what an internal audit process looks like:
Planning – This includes defining the scope and objectives of the audit, identifying the key areas and processes to be audited, and developing an audit plan and schedule.
Gathering Information – This may include financial records, policies and procedures, previous audit reports, and any other relevant documentation. Internal auditors may also conduct interviews with personnel to gain insights into the operations and controls in place. To help streamline this step, using an internal audit checklist is a must.
Risk Assessment – This is to identify and prioritize potential risks and areas of concern within the audited processes. The internal audit risk assessment evaluates the likelihood and impact of risks and helps focus the audit activities on high-risk areas.
Testing and Analysis – To assess the effectiveness of internal controls and processes, internal auditors review transactions, examine supporting documentation, and conduct sample testing. This is to determine whether controls are operating as intended and identify any control weaknesses or deviations from established policies and procedures.
Findings and Recommendations – Internal auditors compile their findings and document any control deficiencies, non-compliance issues, or areas for improvement. In addition, they can also provide recommendations to address the identified issues and improve the effectiveness of controls and processes.
Reporting – Internal auditors prepare a report summarizing the audit results, highlighting areas of concern, and presenting actionable recommendations for improvement. The report is typically shared with management and the board of directors.
Follow-up and Monitoring – After the audit report is issued, internal auditors may follow up on the implementation of their recommendations and monitor the progress made by management in addressing the identified issues.
A complete and in-depth internal audit report typically ends with a summary of the findings, following these 5 Cs:
Criteria – This refers to the standard (e.g., ISO 9001, ISO 14001), policy, procedure, or benchmark against which the condition is being evaluated. It serves as the reference point or expectation that is used to assess whether the observed condition meets the desired or required level.
Condition – This describes the current state or situation observed during the audit. It identifies the specific issue, deficiency, or non-compliance.
Cause – This involves an analysis of the underlying factors or root causes that have contributed to the condition being present.
Consequence – This describes the potential impact or effect of the identified condition on the organization. It highlights the risks, implications, or negative outcomes.
Corrective Action – This outlines the recommended or required steps to address the identified condition and prevent its recurrence. It provides specific actions or measures that should be implemented to resolve the issue and improve the current state.
Here are some practical internal audit examples on how it is conducted and reported in various industries:
Revenue Management
Assess the effectiveness of revenue management processes, including pricing strategies, reservation systems, and revenue recognition practices.
Review the accuracy of revenue records, analyze pricing discrepancies, and evaluate controls over discounts and promotions.
Food and Beverage Controls
Review controls related to food and beverage inventory purchasing, receiving, storage, and usage.
Assess compliance with food safety regulations and standards like ISO 22000, evaluate inventory tracking systems, and examine controls over wastage and spoilage.
Inventory Management
Evaluate the accuracy and effectiveness of inventory management controls over receiving, storage, and distribution of raw materials and finished goods.
Assess inventory valuation methods, review physical inventory counts, and analyze inventory turnover ratios.
Production Efficiency
Examine the efficiency of the utilization of resources, quality control measures, and adherence to production schedules
Test the effectiveness of production planning and scheduling, review production variance reports, and identify opportunities for process improvements
Unlock hidden efficiency
Middle managers lose over 5 hours each week on low-value tasks—time that could be spent driving meaningful progress. Learn why they hold the key to operational success.
Cash Handling and Point of Sale (POS) Systems
Verify controls over cash handling, cash register reconciliation, and the accuracy of sales transactions recorded in the POS system.
Review cash handling procedures and assess controls over discounts and refunds.
Inventory Controls
Audit the effectiveness of inventory controls, including receiving, storage, and inventory reconciliation processes.
Evaluate inventory counting procedures, assess shrinkage controls, and analyze stock movement and turnover rates.
When conducting internal audits, it’s crucial to be aware of common mistakes that auditors may make. Being mindful of these can help auditors improve the effectiveness and efficiency of their audit processes.
With that, here are some common mistakes to avoid:
Lack of Proper Planning
Inadequate Risk Assessment
Insufficient Evidence Gathering
Lack of Independence and Objectivity
Ineffective Communication
Inadequate Follow-up and Monitoring
Insufficient Professional Development
To guide organizations from various industries on how to conduct an internal audit, standards and regulations can be followed and complied with. These help ensure consistency in performing internal audits that follow a systematic approach.
The Institute of Internal Auditors (IIA) has established a set of standards known as the International Standards for the Professional Practice of Internal Auditing (Standards). These standards provide guidance and best practices for conducting internal audits. The current edition is the International Professional Practices Framework (IPPF), which includes the following core standards, among others:
Purpose, Authority, and Responsibility
Independence and Objectivity
Proficiency and Due Professional Care
Performance of the Internal Audit Engagement
Managing the Internal Audit Activity
Internal auditors need to familiarize themselves with these standards and apply them in their audit practices. Adhering to these standards helps ensure the credibility, effectiveness, and professionalism of internal audit activities and contributes to the value provided by the internal audit function within an organization.
To help organizations stay ahead of the curve, boost productivity, and achieve greater accuracy in their auditing practices, they must consider streamlining their internal auditing processes with the help of technology.
Using an internal audit software like Mitti (by SafetyCulture) is important for them, as it not only ensures safety and compliance but also drives operational improvement. With Mitti (by SafetyCulture), businesses can foster a culture of excellence, mitigate risks, and optimize their operations for long-term success using the following features:
Create and use internal audit checklists and templates from the Public Library to help you account for every aspect, process, and control across various sites in your organization.
Schedule regular internal audits to continuously monitor and improve your overall system performance.
Identify issues in your processes and assign corrective actions to respective personnel.
Generate internal audit reports in various formats, including PDF, Excel, Word, or Weblink, and store them on Mitti (by SafetyCulture)’s secure cloud.
Use the Analytics dashboard to gain insights into non-compliant processes for continuous improvement.
Conduct internal audit training for employees to ensure they’re aligned with the Standard Operating Procedures (SOPs) and best practices (e.g., using Personal Protective Equipment (PPEs) while working, properly maintaining and managing assets).
Use Heads Up when sharing audit results with relevant stakeholders.
