All about of internal audit by ca. sharad b. bhararia at ica

Lecture Meeting

All About “Internal Audits”

Thursday, 12th July, 2012

Venue
Institute of Computer Accountants (ICA)
Borivali, Mumbai

Introduction
Introduction

CA. Sharad B. Bhararia
CA. Sharad B. Bhararia
B.Com., C.S., A.C.A.
B.Com., C.S., A.C.A.

PRACTICING CHARTERED ACCOUNTANT
PRACTICING CHARTERED ACCOUNTANT

Bhararia & Associates
Bhararia & Associates
Chartered Accountants
Chartered Accountants

Cell: 81490 80427 | | Email: casharad27@yahoo.com | | casharad@icai.org
Cell: 81490 80427 Email: casharad27@yahoo.com casharad@icai.org

All about "Internal Audits" byby CA. Sharad B. Bhararia, ICA, Borivali onon 12th July, 2012
All about "Internal Audits" CA. Sharad B. Bhararia, at at ICA, Borivali 12th July, 2012

Sr. No Topic Slide No
A What is Audit 4–5
B Who is an Auditor 6
C Types of Audits 7 – 13
D What is Internal Audit 14– 16
E Evolution of Internal Audit 17 – 18
F Need for Internal Audit 19 – 21
G When is Internal Audit Initiated 22
H Internal Audit - Indian Scenario 23 – 28
I Internal Audit Standard Board (IASB) 29 – 31
How is Internal Audit Done
 Internal Audit Program
J  Pre Audit 32 - 42
 At the Time of Audit
 Post Audit
K Internal Audit – “The Dark Side” 43
L Internal Audit – “The Good Side” 44 -45
M Interview and other related topics 47 - 50
N Questions and Answers 51

What Is Audit????

All about "Internal Audits" by CA. Sharad B. Bhararia, at ICA, Borivali on 12th July, 2012 4

Dictionary definition of Audit
Audit (noun)
“An examination of accounts by one or more duly
authorised persons.”

Audit (verb)
“To examine by reference to vendors.”

Definition of quality audits
“A systematic and independent examination to
determine whether quality activities comply with
planned arrangements and whether these arrangements
are implemented effectively and are suitable to achieve
objectives.”


Who is an Auditor ???

“An auditor is a person who makes an
independent report to a company's stakeholders,
as to whether its financial statements have been
properly prepared in accordance with the Laws
of Land. The report must also say if a
company's accounts give a true and fair view of
its state of affairs.”


Types of Audit
Audits may be described using a number of different terms

 Internal Versus External
 1st Party
 2nd Party
 3rd Party

Since we come across these terms frequently,
when discussing different types of audits, it is
important to understand how they are used.


Internal Audit
 An audit that is performed for an organization
by or on behalf of itself is commonly called an
internal audit.

 The actual auditors may be internal employees,
or may be contracted auditors to perform the
auditing services.


External Audit
 An audit that is performed for an
organization by or on behalf of a separate
organization is commonly referred to as an
external audit.

 There may be several different kinds of
external audits, depending on the nature of
the client and the purpose of the audit.


1st Party Audit
 A 1st party audit is another term used for
„internal audits‟. Where an organization
commissions an audit of itself, for its own
internal purposes.

 May be performed by external auditors or
internal auditors, but never by 2nd or 3rd
party auditors.


2nd Party Audit
 A 2nd Party Audit is one type of external
audit, where an organization is audited by
an outside, external organization for the
purposes of the outside organization.

 Common examples would include a supplier
audit (an audit by a potential customer
performed on a potential supplier), an audit
of a potential financial partner (joint venture
or purchase etc.)


3rd Party Audit
 A 3rd party audit is a specific type of
external audit that is done for the purpose of
objectively verifying the auditee‟s
circumstances.

 An ISO 14001 certification audit is the most
common example of a 3rd party verification
audit.


AUDIT CLIENT AUDITOR AUDITEE

Internal or
1st Party Audit Internal Internal
External

2nd Party Audit External External Internal

3rd Party Audit Internal External Internal


What Is An Internal Audit ??

First Thoughts !!!


Common Replies are…

 “NCAA” (No Clue At All)
 “Accounting Practice”
 “Boring”
 “Reviewing Accounting Records”
 “Bean Counting”


The Institute of Chartered Accountants of India (ICAI)
defines Internal Audit as follows -

“Internal audit is an independent management
function, which involves a continuous and critical
appraisal of the functioning of an entity with a view
to suggest improvements thereto and add value to
and strengthen the overall governance mechanism
of the entity, including the entity's strategic risk
management and internal control system.”


EVOLUTION OF INTERNAL AUDITS
K. H. Spencer Pickett , a noted author in the field of internal audit, has
identified following stages in the evolution of modern internal audit:

As a Sibling of External Audit
In the initial stages, internal audit began as an extended arm of an
external/statutory audit of financial statements. The main, but rather
restricted, function of the internal audit at this stage was verifying the
reliability of the financial information included in the financial
statements. The internal audit function in this stage of evolution could
not understandably add much value to functioning of the entity.

As a Cross Check
In this stage of its evolution, internal audit was also required to test non
financial information and transactions in terms of their correctness and
compliance with the laid down policies and procedures.


As a Probity Police
At this stage of its evolution, the internal audit came to be more
concerned about the probity aspects of the transactions especially
those involving liquid and highly movable assets such as cash,
stocks, etc.

As a Non Financial Systems Police
As the global economy surged forward full steam, the need for
having a full fledged, strategically directed internal audit emerged as
an inevitable service that could assist management in decision
making, moving away from being merely a police on financial
transactions. Thus, emerged the modern internal audit where the
latter was established as a separate function, in house or outsourced,
with clearly laid down missions and objectives to be achieved. As of
today, internal audit undeniably is the backbone of a sound
corporate governance system.


Need for Internal Audit ?
Increased size and complexity of businesses
Increased size and business spread dilutes direct management oversight
on various functions, necessitating the need for a full time, independent
and dedicated team to review and appraise operations.

Enhanced compliance requirements
Increase in the geographical spread of the businesses has also led to
crossing of political frontiers by businesses in a bid to tap global capital.
This has thrown up compliance with the laws of the home country as
well as the laws of that land as a critical factor for existence of
businesses abroad.

Focus on risk management and internal controls to manage them
Internal auditors can carry out their job in a more focused manner by
directing their efforts in the areas where there is a greater risk, thereby
enhancing the overall efficiency of the process and adding greater value
with the same set of resources.


Unconventional business models
Businesses today use unconventional models and practices, for example,
outsourcing of non-core areas, such as accounting.

Intensive use of Information Technology
Information technology (IT) is invariably embedded in all spheres of
activities of a modern business enterprise today, from data processing to
resource planning to online sales and ecommerce. Use of IT has, however,
increased the threat of data thefts or losses on account of systems failure
or hacking, as well as the need to comply with the cyber laws, etc.

Stringent norms mandated by regulators to protect investors
The regulators are coming up in a big way to protect the interests of the
investors. The focus of the latest regulations being ethical conduct of
business, and enhanced corporate governance and financial reporting
requirements, etc.


Others
 Check Administrative Efficiency of Polices and Procedures (P&P‟s)
 Ascertain the Extent to which Company Assets are Accounted
 Safeguard from Losses of All Kinds
 Determine the Reliability of Management Data developed within the
Organization
 To determine conformity or non-conformity of the System with
specified requirements
 To determine the effectiveness of the implemented quality system in
meeting specified quality objectives.
 To afford an opportunity to improve the quality system.
 To provide managers with information.
 Determine the Extent of Actual Compliance
 Appraise P&P‟s for Possible Improvement
 Increase Efficiency by identifying any other means by which the
activity/function can be made More Effective

21

When is Internal Audit initiated ?

a. As a Routine / Regular Task

b. As a consequence of particular Event
a. Variation in the product quality (Cadbury Eg.)
b. Organizational Modifications
c. Fraud findings
d. Follow up corrective actions from a previous audit.

c. For evaluation of the organization's quality system
against quality systems standards.

d. For Compliance of Regulatory / Legal requirements.


Internal Audit - Indian Scenario
Clause 49 of Listing Agreement
The Securities and Exchange Board of India (SEBI) has introduced certain
mandatory as well as certain recommendatory corporate governance
provisions in Clause 49 of the Listing Agreement applicable to listed entities.
Some of the important requirements of Clause 49 pertaining to internal audit
are as follows -

8 The Audit Committee is required to review:

The adequacy of the internal audit function, if any, including the
structure of Internal audit department, staffing and seniority of the
official heading the department, reporting structure coverage and
frequency of internal audit, including appointment, removal and terms
of remuneration of the chief internal auditor.


8 The Audit Committee is required to review…..

- Internal audit reports relating to Internal Control weaknesses.

- The findings of any internal investigations by the internal auditors
into matters where there is a suspected fraud or irregularity or a
failure of internal control systems of a material nature and
reporting the matter to the Board.


8 The CEO and the CFO is required to CERTIFY that -
They accept responsibility for effectiveness of internal controls and that
they have disclosed to the auditors and the Audit Committee deficiencies in
the design and operation of the internal controls and steps taken for
rectification of the same.

They have indicated to the Audit Committee and the Internal as well as
External auditors as to the following aspects:

 Any significant changes in internal controls.
 Any significant changes in the accounting policies and instance of
significant fraud, if any, and that the same have been disclosed in the
notes to the financial statements.
 Instances of any significant fraud and involvement, therein of the
management or any employee having a significant role in the internal
control systems of the company.


Thus, it is amply evident from the above that the management,
especially the functional management as well as the Audit
Committee needs extensive support from the Internal Audit
Function to give it the primary assurance about controls and
compliances before giving the required reports/ certificates or to
appropriately review the necessary aspects and make informed
decisions.

Section 292A of the Companies Act, 1956

In addition, Section 292A of the Companies Act,
1956, requires public companies having paid up
capital of Rs. 5 crores or more to constitute a
committee of the Board, i.e., the Audit Committee. In
terms of sub section 5 of the said Section, the internal
auditor is required to attend and participate at the
meetings of such Audit Committees.


Companies (Auditor's Report) Order, 2003

The Central Government, in terms of the power vested under Section 227(4A) of
the Companies Act, 1956 had notified the Companies (Auditor's Report) Order,
2003. Clause (vii) of the said 2003 order requires the auditor to report as follows:

“whether in case of listed companies and / or other companies having
paid-up capital and reserves exceeding Rs. 50 lakhs as at the
commencement of the financial year concerned, or having an average
annual turnover exceeding five crore rupees for a period of three
consecutive financial years immediately preceding the financial year
concerned, whether the company has an internal audit system
commensurate with its size and nature of its business.”

Though the clause does not by itself mandate internal audit in the subjected
companies, yet a company to which the same is applicable, would incur a
negative remark from the auditor if it does not have an internal audit system.


Others
 Section 581ZF of the Companies Act, 1956 requires that every Producer
Company shall have Internal Audit of its accounts carried out by a
Chartered Accountant, at such interval and in such manner as may be
specified in articles.

 The Securities and Exchange Board of India (SEBI) has mandated complete
internal audit on a half-yearly basis for stock brokers / trading members /
clearing members.

 IRDA (Investment) (Fourth Amendment) Regulations, 2008 has introduced
requirements of quarterly Internal Audit for Insurers.

 Companies going in for tapping the international capital market, especially,
those seeking listing in US stock exchanges, NASDAQ, NYSE, etc., also
need a strong Internal Audit function to meet the stringent corporate
governance and internal control requirements of those stock exchanges. In
this context, the US companies, having US public as investor also needs to
comply with the requirements of Sections 302 and 404 of the Sarbanes
Oxley Act of 2002.


Internal Audit Standards Board (IASB)
The Internal Audit Standards Board (IASB) is constituted as the
Committee on Internal Audit, with the mission of reinforcing the
primacy of the Institute of Chartered Accountants of India (ICAI) as a
promoter, and source of knowledge relating to internal audit to enable
its members to provide more effective and efficient value added
services related to this field to the Industry and others and help them to
strengthen their governance process, their control and risk management
process.

Standards on Internal Audit (SIAs)

The SIAs aim to codify the best practices in the area of internal audit
and also serve to provide a benchmark of the performance of the
internal audit services. The Board has till date issued 17 SIAs.


SIA 1 Planning an Internal Audit
SIA 2 Basic Principles Governing Internal Audit
SIA 3 Documentation
SIA 4 Reporting
SIA 5 Sampling
SIA 6 Analytical Procedure
SIA 7 Quality Assurance in Internal Audit
SIA 8 Terms of Internal Audit Engagement
SIA 9 Communication with Management
SIA 10 Internal Audit Evidence
SIA 11 Consideration of Fraud in Internal Audit
SIA 12 Internal Control Evaluation
SIA 13 Enterprise Risk Management
SIA 14 Internal Audit in an Information Technology Environment
SIA 15 Knowledge of the Entity and its Environment
SIA 16 Using the Work of an Expert
SIA 17 Consideration of Laws and Regulations in an Internal Audit


Technical / Generic Guides

The IASB also brings out various technical
publications for the benefit of the members

i. Technical Guide on Internal Audit of Retail Industry
ii. Technical Guide on Internal Audit of Life Insurance Business
iii. Compendium of Technical Guides on Internal Audit
iv. Handbook on Professional Opportunities in Internal Audit
v. Technical Guide on Internal Audit of Mutual Fund
vi. Guide on Environnemental Audit
vii. Technical Guide on Stock and Receivables Audit

…..and many more


How is Internal Audit done ?


We‟re Here to Help!

• Identify Risks
• Find Better Ways and Best Practices
• Partner With You to Find Solutions
• Prevent Problems


Internal Audit Program
 Risk Assessments (Risk Based Internal Audit)
Size, Amount of Change, Previous Reports
 Cycle Approach
Based on Risk
High Risk First
Visit Everyone within 2 to 5 year Cycle
 MIS Implications (Security Systems)
External Hackers
Internal Theft
Disgruntled Employees Statistics
 Pinpoint problems by Variance Analysis
 Decide upon the Risk Acceptance Criteria


Internal Audit Program…..

 Based on risk assessment and available man hours
 Includes estimated budget hours and completion date.
 Approved by Audit Committee

 List of Audits
 General Internal Audit  Information Systems (IS) Audit
 HR and Payroll Audit  Assets Audit
 Treasury Audit  Procurement to Pay (P to P) Audit
 Payables Audit  Legal Compliances Audit
 Receivables Audit  Purchase Audit, Sales Audit
 Process Audit  Expense Audit
 Product Audit  Follow Up Audit

and many more….


PRE - AUDIT
 What type of audit ?
 Gather preliminary information.
 Develop check lists.
 Who will perform audit ?
 Arrange time of audit.
 Examine previous audit results.
 Talk to other departments.
 Prepare audit plan.


PRE – AUDIT….
AUDIT CHECK LISTS
An extremely powerful audit tool, if used correctly

CHECK LISTS CAN BE

Based on recognized quality standards.
Developed around departments operating system.
Based on company standards and procedures.
Based on product /customer requirements.

CHECK LISTS ACT AS

A guide.
An aide memoire.
Provider of continuity.
A record of audit coverage.


At the time of AUDIT
 Identify the major Risk Areas in the Organization
 Check the Internal Controls in Place to counter these risk areas
 Check whether the Internal Controls are effective, efficient and
continuous all the time (Compliance Testing)
• Preventive Controls (Eg. Biometrics Locks, Segregation of Duties)
• Detective Controls (Eg. Computer Logs)
• Corrective Controls (Eg. Backups, BCP & DRP)
 Take appropriate Sample to be vouched (Substantive Testing)
 Identify the root cause of the Problem
 Check Statutory Compliance Requirements
 Maintain Confidentiality of Client‟s Data

Focus on the Cause, Not on the Symptoms.


At the time of AUDIT…
 Interview the Right People
 Check the Industry Trends vis-à-vis the Organization's statistics
 Benchmarking of company‟s data vis-à-vis other and external data.
 Record all the Audit Findings
 Take sufficient and appropriate Audit Evidences.
 Develop the Report simultaneously
 Take Management Comments in the Report for every qualifications.

Think Out of the Box !
A Bad Auditor is One Who Cultivates One-way Communication !


POST AUDIT
Internal Audit Report
 The Audit Report is the principal instrument by which audit
findings are communicated to management and the Audit
Committee.

 Internal Audit reports should be accurate, objective, constructive,
clear, concise, and timely.

 Each audit finding should be classified as a major control
weakness, minor control weakness, exception, observation, or a
violation of law.

 The audit findings summary should be of sufficient detail to
identify the control weaknesses, exceptions, observations or
violations of law, rule, or regulation, and should include
supporting facts to the extent considered necessary.


Internal Audit Report Contents

 Audit Name and Report Issuance Date
 Audit Report Addressee: Identifies the process owners to whom the
Audit Report is directed
 Report Distribution List: Identifies all parties to whom the Audit
Report is distributed
 Scope and Objective of the Audit: Identifies the major activities,
processes and functions reviewed and identifies the time period the
audit is meant to review (dates of sample tested documents and
procedures)
 Auditor‟s Conclusions and Internal Control Rating: Identifies the
auditor‟s opinion regarding the adequacy and effectiveness of internal
controls to include an internal control rating.
 Narrative overview of the business activity and its associated internal
controls
 List and detailed explanation of the Major Control Weaknesses, Minor
Control Weaknesses, Exceptions, Observations and Violations of Law,
Rules and Regulations noted during the audit
 Disclaimer Clause.


 Internal Auditor's Recommendation for corrective action as it
applies to each audit finding

 Management Response: A section for management to include its
written response to the audit finding and state any corrective
action taken or planned

 Target Completion Date: Identifies the date corrective action will
be completed by management

 Comment Owner: Identifies the manager responsible for ensuring
corrective action is taken as it applies to the audit finding

 Appraise Policies &Procedures for Possible Improvement.
 Increase Efficiency by identifying other means by which the
activity / function can be made more Effective.
 Future Oriented and not just fault finder.


☻Internal Audit – „the Dark Side‟ ☻

☻ Testing Compliances can be Boring
☻ Many people think its Not a good work experience
☻ You Travel a Lot (60% on the Road)
☻ “What Personal Life ?”


☺ Internal Audit – „the Good Side‟ ☺
☺ Audit Improves MPNW (My Personal Net Worth)

☺ Broad Exposure to a Business‟s Operations

☺ Interaction & Exposure to Senior Management

☺ Opportunities to Learn How Business really Works in different
Markets

☺ Excellent Opportunity for Networking in the Organization

☺ Great way to Learn about other Areas of the business from a
career perspective


☺ Internal Audit – „the Good Side‟ ☺ …
☺ Can Scope out Future / Potential Roles

☺ Unusual for Entry Level jobs to have such exposure to
Senior Management

☺ Develops Communication Skills
- the ability to think on your feet!

- the ability to communicate to large amounts of people

☺ Great Travel.

☺ Experience what it‟s like to live all over the world without
having to move.

☺ Gives you more career paths as you‟re learning processes
and operational capabilities, not just finance.


At the time of Interview

1. Be very specific
2. Never lie, accept if you don‟t know some answers.
3. Maintain a pleasant smile
4. Extend a heavy hand shake
5. Memorize the name of everyone you meet
6. Be a good listener, accept other‟s view point.
7. Be open minded and tolerant
8. Say Thank You expressively, not just politely
9. Be Confident, Handle yourself properly, well dressed


Expectation of an Employer…

1. Sincerity, Dedication and Discipline
2. Hard Work is most Important
3. Handle yourself properly, well dressed, etc
4. Time of Specialization


Attitude required to get and maintain Job

1. Know what you actually want
2. Search top employers of your interested area
3. Resume should be excellent
4. Hard Work is most Important
5. Always be Punctual, loyal and sincere.
6. Be Confident, Handle yourself properly, well
dressed, etc


Accounts and Taxation - requirements

1. Dynamic Fields
2. Always changing with time- Eg. Revised Sch VI,
DTC, IFRS, GST, etc
3. Should be updated on all Taxation matters on macro
basis.
4. General Logic is required
5. Reading Business newspapers of can by great help.


Any Questions ???


Thank You !!!


All about of internal audit by ca. sharad b. bhararia at ica

Recommandé

Recommandé

Contenu connexe

En vedette

En vedette (16)

Similaire à All about of internal audit by ca. sharad b. bhararia at ica

Similaire à All about of internal audit by ca. sharad b. bhararia at ica (20)

Dernier

Dernier (20)

All about of internal audit by ca. sharad b. bhararia at ica