1. INTRODUCTION TO INTERNAL AUDITING (4 - 7%)
MODULE 1
INTRODUCTION TO INTERNAL AUDITING
(4 - 7%)
Lecturer:
Dale Neuls, BA, CGA
DN 14/15

2. MU1 OVERVIEW
Module 1: Introduction to IA Module 2: Internal auditing standards Module 3: Risk management, control frameworks and governance Module 4: Planning the internal audit Module 5: Examination phase of IA Module 6: Internal audit communications and reporting Module 7: IT auditing Module 8: Marketing, purchasing and production Module 9: Human resources management, treasury and strategic planning Module 10: Internal auditing in the public and not-for-profit sectors

3. MANITOBA IN CLASS LECTURE NOTES
1. Log into MyCGA Web Services (
2. Go to the Student Centre > Course Info/History & Marks
3. Select the CGA Manitoba In-Class Lecture Schedules and Notes
4. Select MU1 from left hand navigation

4. INTERNAL AUDITING FAQs
Internal Auditing What is internal auditing? Why should an organization have IA? What should be reporting lines for IA? How does internal auditing maintain independence and objectivity? How do internal and external auditors differ and how should they relate? What is Enterprise Risk Management and internal auditing role? Is it mandatory to have an IA activity?

5. Audit Committees/Governance What is appropriate relationship between IA and audit committee? What services can the internal auditors provide for audit committee? Why should an organization have an audit committee?
Fraud What is role of internal auditing in preventing, detecting and investigating fraud?

6. Guidance What standards guide work of internal audit professionals?
Staffing/Resources What are skill sets and staffing needs of IA activity? How does IA prioritize its resources? How should an organization go about sourcing its IA activity?

7. INTERNAL AUDITING
an independent, objective assurance and consulting activity designed to add value and improve an organization operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes

8. independence - freedom from conditions that threaten the ability of IA to carry out responsibilities in an unbiased manner
objectivity - unbiased mental attitude in performing audits with no subordination of judgment on audit matters
assurance - objective examination to provide an independent assessment on risk management, control and governance processes
three party reporting - IA reports to board about management

9. consulting - advisory services to client to improve risk management, control and governance processes
two party reporting - IA reports to management
adding value - in performing assurance and consulting activities IA identify opportunities for improvement and to reduce risks
helping the organization - how IA can help management/board achieve organization objectives i.e. “think like management”

10. risk management processes - put in place by management to identify, assess, manage and control potential events that may impact achievement of goals
control processes - policies and procedures designed to ensure that risks are within the tolerances established by risk management processes
governance processes - the processes and structures implemented by board to direct, manage and monitor activities of organization toward achievement of objectives

11. Board Governance Accountability Framework
Assessing Board Effectiveness
The Board should have a process in place to assess how well it discharges its roles and responsibilities as part of the organization’s overall effectiveness.
Approving and Monitoring Mission, Vision and Strategy
The Board should approve and monitor the mission, vision and strategy of the agency, ensuring a plan of action is set for the future, thereby ensuring its continuing relevance in a changing environment and ensuring the organization’s chances of viability and success.
Approving and Monitoring the Agency’s Ethical Values
The Board should act as guardian of the agency’s values, promoting public confidence in how it is being operated from an ethical perspective.

12. Approving and Monitoring By-laws, Policies and Practices
The Board should be approving and monitoring both governance and key operational policies.
Monitoring Management Control
The Board should have an appropriate understanding of the systems and controls that allow agency management to manage its resources efficiently and effectively.
Ensuring Financial Stability
The Board should be ensuring the agency could meet its current and future financial responsibilities.

13. Evaluating Senior Management
The Board should be evaluating the chief executive officer on a regular basis.
Overseeing External Communications
The Board should be overseeing the agency’s communication to and from external parties.
Advocacy
The Board should be communicating to the public and its stakeholders, the mission and purpose of the agency, and should be advocating both public involvement and financial support for the program.

14. SCOPE OF IA
IIA Performance Standards 2100 to describe nature of work for IA - evaluate risk exposures and adequacy/effectiveness of controls in responding to risks relating to governance, operations and information systems
IA assess
ACHIEVEMENT of organization strategic objectives
INTEGRITY and RELIABILITY of financial/operating information
COMPLIANCE with laws, policies and contracts
SAFEGUARDING of assets
3 E’s - economy, efficiency, effectiveness of operations and programs

15. ECONOMY (acquisition)
3 E's
ECONOMY (acquisition)
terms and conditions where human and physical resources acquired
appropriate quality and quantity at lowest cost
EFFICIENCY (utilization)
relationship between goods and services produced and resources used to produce them
maximize output for resource input
desire to increase productivity and profitability
EFFECTIVENESS
achievement of goals/objectives

16. FUNCTIONS OF MANAGEMENT
IA must understand and support management functions
Planning
develops clear purpose of organization
long term and short term plans
policies, procedures, code of ethics
Organizing and Staffing
internal structure (centralization vs decentralization, line and staff)
delegation of authority and responsibilities (job descriptions)
human resource management
recruitment, labour relations

17. Directing Controlling
inducing members of organization to perform roles - communication and motivation
Controlling
comparing actual performance with predetermined standards/plans
management control systems should be cost effective, focus on exceptions and be flexible - 6 steps
set standard
measure performance
compare performance vs standard
evaluate differences
determine corrective action
follow up corrective action

18. IIA Standards define risk
ENTERPRISE RISK
IIA Standards define risk
possibility of an event occurring that will have an impact on the achievement of objectives
risk measured in terms of impact and likelihood
internal controls are designed and implemented to address business risks e.g. bad debts, security violations, fraud

19. Enterprise Risk Management (ERM) is process put in place by board and management, applied in strategy setting across the entire enterprise designed to
identify potential events that may affect the entity
manage risks to be within its risk appetite
provide reasonable assurance regarding the achievement of entity objectives
Consists of
1. risk identification
2. establishing acceptable tolerance limits for risks
3. putting controls in place to ensure risks remain within established tolerances

20. ROLE OF INTERNAL AUDITOR
business consultant
proficient in controls
familiar principles of management
cooperation between auditor and client (people skills)
assist management
identifying risks, evaluating design and implementation of control systems and making recommendations for improvement
assist board
corporate governance and accountability to shareholders

21. objective and scope of IA wider than financial audit (EA)
IA more concerned with efficiency and effectiveness of wide range of activities defined under scope of IA
IA more concerned with design and implementation of management processes
EA concerned with opinion on f/s and completeness, accuracy and authorization of financial transactions
EA obtain audit evidence to support opinion and may not test internal controls and rely on substantive testing of transactions/balances
EA primary responsibilities to s/h, creditors, general public

22. TYPES OF INTERNAL AUDITS
compliance audits
review both controls and transactions to assess compliance with internal policies/procedures and external laws/regulations
internal financial audits
review processes used to generate financial information for management
SOX 2002 requires CEO, CFO to attest to integrity of financial reports filed with regulatory agencies (IA conduct assurance reviews of reports)

23. comprehensive audits (public sector)
operational audits
review/evaluate performance of client operations (3E's)
comprehensive audits (public sector)
combination of compliance, internal financial and operational audits (value-for-money audits)
information technology audits
review design, implementation, operation (controls) and security of systems

24. fraud audits environmental audits
special investigation which relies on company policies, procedures and controls to determine fraud (Corporate Code of Ethics)
environmental audits
assess compliance with internal policies/procedures and external environmental laws/regulations

25. INTERNAL AUDITING AND PERFORMANCE MEASUREMENT
based on identifying measures critical to organizational success and setting measurable targets
measurements form basis to assess performance and for managers to plan and structure organization and to control results
measures should be SMART
specific
measurable
attainable
realistic
trackable

26. e.g. Balanced Scorecard
framework for developing set of performance measures (KPIs - key performance indicators) which links measures from 4 perspectives
financial perspective “How do we look to shareholders?”
business perspective “What must we excel at?”
learning and growth perspective “Can we continue to improve and create value?”
customer perspective “How do customers see us?”

27. KPIs
developed using selection team which evaluates each measure against following set of criteria
Does the measure support strategies?
Does the measure support business processes?
Is the measure easy to understand?
Can the measure be calculated from obtainable data?
Overall is the measure a good indicator of company performance?
reported to senior management on monthly or quarterly basis

28. IA not generally involved with determination of KPIs but involved with continuous monitoring of indicators using computerized analytic tools to monitor business processes (changes in pattern)
examples KPIs
% staff attending training courses
performance to budget
inventory turnover
# staff complaints per month
% overall revenue generated from new products and services
% customer orders processed incorrectly

29. # staff recognized for improvement suggestions
gross margin per service/product
# customer complaints per month
% staff surveyed who view working environment as good or excellent
# sick days per staff
return on investment by product
# customer improvement suggestions implemented per year
processing cost per service
actual versus planned processing volume

30. IA PERFORMANCE MEASUREMENT
Client Feedback
post audit client surveys
Benchmarking audit processes and practices with other professionals counterparts
audit budget
number and average salaries of auditors
Setting performance targets and measuring actual performance to targets
annual audit plan

31. Monitoring career progression of IA staff within organization
Measuring employee satisfaction
annual performance appraisal
PD/training/project rotation

32. ETHICAL CLIMATE AND CONSIDERATIONS
ethical standards - IIA and CGA Code of Ethics
provide code of behaviour to guide professional conduct
provide public with reasonable expectation of behaviour from members of profession
ethical situations
monitoring compliance with conflict of interest guidelines
carrying out fraud investigations which involved unethical actions
respecting confidentiality of financial, operational and personal information obtained during audits
aware of unethical business practices which could harm corporate environment and business reputation e.g. changing accounting principles, employee gifts, personal use property