Who a client's internal audit should report to
Who a client's internal audit function should report to, why separation from finance matters, and what the external auditor should ask about it.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
In many mid-sized clients the internal audit function is one or two people with a title on the organogram. Whether they are really internal audit, or an extra pair of hands in the finance department, depends less on their skills than on a single line on that chart: who they answer to.
For the external auditor, that line matters in two ways. It says something about the client's control environment, and it decides how much weight, if any, internal audit's work can carry. This article looks at where the line should run and how to test where it actually runs.
How ACCA defines internal audit
ACCA defines internal audit as an independent appraisal function established within an organisation to examine and evaluate its activities, and says its head should report to the board of directors or the audit committee. ACCA adds that internal audit should be totally segregated from the finance department. Its article on internal controls places internal audit within the wider system of control and is a useful primer for a client's new board member.
Three words in that definition do the work. "Independent" means free from the activities it reviews. "Appraisal" means it evaluates rather than operates. "Examine and evaluate" means its output is findings, not transactions.
Reporting to the board or the audit committee
The reason for the reporting line is simple. An internal auditor who reports to the financial director will find it hard to report frankly on the financial director's area, and anything critical will pass through the person criticised before it reaches anyone else.
ACCA explains that in a limited company the board of directors is responsible for ensuring appropriate internal controls are in place. Internal audit is one of the ways a board checks that its controls work, so it makes sense for the function to report to the board, or to an audit committee acting for it.
It helps to separate two kinds of reporting:
- Functional reporting: who approves the internal audit plan, receives the findings, and appoints, assesses and removes the head of internal audit. This should run to the board or audit committee.
- Administrative reporting: who approves leave, office space and day-to-day matters. This can sit with the chief executive or another senior manager, provided it does not become a back door for influence.
Many smaller companies have no audit committee. There, the board as a whole, or a non-executive director the board appoints, can take the functional role.
Separation from the finance department
Signs that internal audit is not really separate from finance:
- internal audit staff prepare reconciliations, post journals or help with the year-end close;
- the head of internal audit is appraised, or paid a bonus, on the financial director's recommendation;
- the internal audit budget is controlled by finance;
- reports are edited by management before they reach the board;
- the plan avoids finance processes year after year.
None of these proves the function is ineffective. Each one gives the external auditor a reason to look harder before relying on its work.
Internal audit as monitoring in the COSO framework
COSO states that effective monitoring of internal control is one of the five components of effective internal control delineated in its Internal Control — Integrated Framework. Internal audit is one of the main ways that monitoring happens in a larger organisation: checking that controls designed on paper actually operate.
The reporting line also tells you about the control environment. Investopedia explains that the control environment, set by the board and by management leading by example, establishes for all employees the importance of integrity and a commitment to rooting out improprieties. A board that gives internal audit a direct line, and reads what it sends, is showing that commitment. A function that reports to the people it monitors weakens both monitoring and tone. For the framework itself, see the COSO framework for auditors.
Firms that provide internal audit, and Achekam
Many practices provide internal audit as an outsourced service. In Achekam, staff choose an engagement's type when they create it, such as an annual financial statements compilation, an independent review or a statutory audit, and a firm can add its own named types, so outsourced internal audit can sit as its own type of engagement rather than under a general heading. Achekam also ships working-paper template packs written in its own words, including internal audit and forensic packs, for a firm to adopt and approve; until the firm adopts them they are marked as unapproved platform content.
The same reporting principle applies to the firm. The engagement letter for an outsourced internal audit should say that the firm reports to the board or audit committee, not to the financial director. Where the client is also an audit client, the ethics rules on providing non-assurance services to audit clients need checking first. Internal audit and forensic assignments covers running those engagements.
Questions the external auditor should ask
Before relying on any of internal audit's work, the external auditor needs to be satisfied about the function's objectivity, its competence and the quality of what it does. The reporting line is the place to start:
- To whom does the head of internal audit report, functionally and administratively?
- Who approves the internal audit plan, and who can change it during the year?
- Who appoints and removes the head of internal audit, and who sets the budget?
- Does internal audit carry out any operational duties in finance?
- Do its reports reach the board or committee without being edited by management?
- Does the board or committee meet internal audit without management present?
- What did internal audit find this year, and what did management do about it?
Record the answers and the evidence behind them. A client whose internal audit reports to the right people, and is heard by them, has a stronger control environment, and the file should be able to show how the team knows that.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
