Importance of internal audit

As an insider, you might think your company’s internal controls are working well. You ask, is internal audit even necessary? However, companies without an internal audit function will not perform at its peak and may even become victims of corporate scandals. Once accustomed to business as usual (“BAU”), it is not so easy to identify the flaws and inherent limitations.

This is where internal audit steps in.

In truth, a company, whether large or small, needs an internal audit function. It is the key to good corporate governance and sets the tone at the top. It is an independent, objective appraisal and monitoring function within the organization, and provides assurance that the controls, processes and systems are functioning effectively and efficiently. It also acts as the last line of defense for the company by detecting human error and fraud.

Internal audit’s roles and responsibilities

How can internal audit achieve the above objectives?

• Independence and objectivity: Internal audit should have a direct line of report to the Board and are not involved in the execution of the BAU activities.
• Risk assessment and management: Internal audit assists the management in assessing the risks facing the business. The risks identified are prioritized based on their severity and pervasiveness. Depending on the business risk appetite, internal auditors will design controls to mitigate and control the risks.
• Evaluate the operating effectiveness of internal controls: Internal audit conducts testing and monitoring activities throughout the year. This ensures the controls protect the company’s assets, meet business objectives and fulfill regulatory requirements.
• Reporting: Internal auditors should keep good record of their observations and testing results. Based on their work, they report control deficiencies and recommend control enhancements.

Implementation of an internal audit system

A successful internal audit must be:

• Objective: It must be independent of the management and operates without any constraints or restrictions.
• Competent: The department is fully resourced and the staff possesses required knowledge and skill set (i.e. members of professional bodies).
• Systematic and disciplined: The function has quality control procedures, policies and guidelines, and work programs.

To achieve this, internal audit can be in-house, co-sourced or fully out-sourced. There is no one-size-fits-all model: it depends on your organization’s strategy, size, resources, regulatory environment etc. You should consider the factors holistically to determine which model suits your company.

PKF Hong Kong can provide internal audit solutions to your company. Whether you adopt an in-house or out-sourced model, we will be here for you every step of the way. We provide immediate access to audit expertise, insight into the best practices, and higher audit productivity. With our help, you can be confident that your internal controls are functioning well.