Internal audit and forensic assignments
How a firm can run internal audit and forensic work beside statutory audits, the independence questions it raises, and how to keep each file confidential.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A school board asks the firm to investigate irregular payments by its bursar. A manufacturing client wants someone to run its internal audit function for a year while it recruits. A municipality's supplier wants an independent look at a disputed claim. These assignments are a natural extension of an accounting firm's skills, and for many small and medium practices they are a valuable part of the work. They also bring two risks that statutory audit work does not: independence problems when the client is also an audit client, and confidentiality problems when the subject of the work sits in the same building as the people doing it.
How these assignments differ from an external audit
| External audit | Internal audit | Forensic assignment | |
|---|---|---|---|
| Who it serves | Shareholders and other users of the statements | Management and the board or audit committee | Whoever commissioned it: a board, lawyers, a regulator |
| What sets the scope | Law and the ISAs | The client's plan and risk priorities | The allegation or dispute |
| Output | An opinion on the statements | Findings and recommendations | A factual report of what the evidence shows |
| Typical standards | ISAs | The Institute of Internal Auditors' standards, or the client's own charter | The firm's methodology; legal rules of evidence where proceedings may follow |
The forensic column deserves care. Evidence may end up in a disciplinary hearing or in court. That changes how documents are collected and kept, who may see them, and how the report is worded. A forensic report states what was found and how; it does not declare anyone guilty.
Independence when the client is also an audit client
If the client is also an audit client, the firm must consider the independence requirements of the code that binds it. In South Africa that is the IRBA Code of Professional Conduct for registered auditors; in Kenya, ICPAK applies the IESBA Code; in Nigeria, the ethics requirements of ICAN or ANAN and of the FRC apply.
The main threats are familiar:
- Self-review, where the audit team would later rely on systems, controls or figures the firm's internal auditors helped design or evaluate;
- Management responsibility, where the firm effectively runs a function the client should own, such as deciding which internal audit recommendations to implement;
- Advocacy, where a forensic or litigation-support role puts the firm on the client's side of a dispute.
For audit clients that are public interest entities, the IESBA Code prohibits non-assurance services that might create a self-review threat, which captures much internal audit work on financial reporting. For other audit clients, the firm evaluates the threats and applies safeguards, such as using a separate team and making sure management takes the decisions. The detail is covered in non-audit services for audit clients.
In Achekam, staff record annual independence declarations and any interest, relationship or gift involving a client, and anyone can check whether a person has an active independence exception for a client. There are limits to plan around: Achekam has no way to approve an independence declaration, and assigning a person to an engagement does not check the independence register. Every declaration stays awaiting the quality partner. Before staffing a forensic or internal audit assignment for an audit client, the partner should check the register by hand and record that check.
Restricting a forensic file to named people
A forensic file about a client's employee is sensitive inside your own firm. Someone on the audit team may know the person under investigation socially; a junior who works on the client's books may be a witness.
Partners and administrators can restrict a client, or one engagement, to named people with a reason. A restriction is lifted rather than deleted, and who did what and when is recorded. Note who can always open a restricted record: the account manager and the engagement's own partner and manager. Choose those people with the restriction in mind; if the account manager is close to the subject of the investigation, change the account manager before restricting.
Restriction reaches the calendar too. A meeting about a restricted client shows only as "busy" to people not on that client's access list, so interview schedules do not leak through shared diaries. How restrictions work across the firm is explained in restricting access to a client.
Using the firm's own methodology for the work
Internal audit and forensic work do not follow the ISAs, so the file needs a methodology that fits. A firm's partners keep their own methodology and working-paper templates beside Achekam's platform methodology, which they can adopt, and a template version is published only by someone other than its author.
Achekam ships working-paper template packs written in its own words, including internal audit and forensic packs, for a firm to adopt and approve. The catalogue is marked unapproved platform content until the firm adopts it, and whether a pack has been installed on your deployment should be checked first.
When creating an engagement, staff choose its type, and a firm can add its own named types, such as "Forensic investigation" or "Outsourced internal audit". Using a separate type keeps these engagements visibly apart from statutory work in every list.
Staff can then generate the engagement's working papers from the methodology: Achekam reads the engagement's facts, a person confirms what it cannot read, another person approves the profile, and a dry run shows which papers will be created before any are.
Reporting to whoever commissioned the work
Agree at the start who the report goes to and who may see it. For internal audit, that is usually the audit committee or board, with management responses included. For a forensic assignment, it may be the board, a lawyer acting for the client, or a regulator, and distribution should be restricted in the engagement letter. Where proceedings are likely, take legal advice on who should formally instruct the firm and how the report will be used.
A checklist before accepting:
- Is the client, or any related entity, an audit client of the firm?
- Has the independence register been checked by hand for everyone proposed?
- Who commissioned the work, and who will receive the report?
- Should the engagement be restricted to named people from day one?
- Which methodology and template pack will the file follow?
The IESBA's announcement on strengthening auditor independence explains the revisions to the Code's non-assurance services and fee provisions, including the ban on services that create a self-review threat for public interest entity audit clients.
Start with the client list
Before marketing these services, cross-check the prospects against the audit client list. The assignments the firm should decline are much cheaper to identify before the proposal than after the fieldwork has started.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
