Courtesy: Internal auditor training
Integrated audits
In the US, audits of publicly traded companies are governed by rules laid down by the Public Company Accounting Oversight Board (PCAOB), which was established by Section 404 of the Sarbanes–Oxley Act of 2002. Such an audit is called an integrated audit, where auditors, in addition to an opinion on the financial statements, must also express an opinion on the effectiveness of a company’s internal control over financial reporting, in accordance with PCAOB Auditing Standard No. 5.
There are also new types of integrated auditing becoming available that use unified compliance material (see the unified compliance section in Regulatory compliance). Due to the increasing number of regulations and need for operational transparency, organizations are adopting risk-based audits that can cover multiple regulations and standards from a single audit event. This is a very new but necessary approach in some sectors to ensure that all the necessary governance requirements can be met without duplicating effort from both audit and audit hosting resources.
Assessments
The purpose of an assessment is to measure something or calculate a value for it. An auditor’s objective is to determine whether financial statements are presented fairly, in all material respects, and are free of material misstatement. Although the process of producing an assessment may involve an audit by an independent professional, its purpose is to provide a measurement rather than to express an opinion about the fairness of statements or quality of performance.
Auditors
Auditors of financial statements & non-financial information (including compliance audit) can be classified into various categories:
- External auditor/Statutory auditor is an independent firm engaged by the client subject to the audit to express an opinion on whether the company’s financial statements are free of material misstatements, whether due to fraud or error. For publicly traded companies, external auditors may also be required to express an opinion on the effectiveness of internal controls over financial reporting. External auditors may also be engaged to perform other agreed-upon procedures, related or unrelated to financial statements. Most importantly, external auditors, though engaged and paid by the company being audited, should be regarded as independent and remain third party.
- Cost auditor/Statutory cost auditor is an independent firm engaged by the client subject to the cost audit to express an opinion on whether the company’s cost statements and cost sheet are free of material misstatements, whether due to fraud or error. For publicly traded companies, external auditors may also be required to express an opinion on the effectiveness of internal controls over cost reporting. These are Specialized Persons called Cost Accountants in India & CMA globally either Cost & Management Accountants or Certified Management Accountants.
- Government Auditors review the finances and practices of federal agencies. These auditors report their finds to congress, which uses them to create and manage policies and budgets. Government auditors work for the U.S. Government Accountability Office, and most state governments have similar departments to audit state and municipal agencies.
- Secretarial auditor/Statutory secretarial auditor is an independent firm engaged by the client subject to the audit of secretarial and applicable laws/compliances of other applicable laws to express an opinion on whether the company’s secretarial records and compliance of applicable laws are free of material misstatements, whether due to fraud or error and inviting heavy fines or penalties. For bigger public companies, external secretarial auditors may also be required to express an opinion on the effectiveness of internal controls over compliances system management of the company. These are Specialized Persons called Company Secretaries in India who are the members of Institute of Company Secretaries of India and holding Certificate of Practice. (http://www.icsi.edu/)
- Internal auditors are employed by the organizations they audit. They work for government agencies (federal, state and local); for publicly traded companies; and for non-profit companies across all industries. The internationally recognized standard setting body for the profession is the Institute of Internal Auditors – IIA (www.theiia.org). The IIA has defined internal auditing as follows: “Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes”. Thus professional internal auditors provide independent and objective audit and consulting services focused on evaluating whether the board of directors, shareholders, stakeholders, and corporate executives have reasonable assurance that the organization’s governance, risk management, and control processes are designed adequately and function effectively. Internal audit professionals (Certified Internal Auditors – CIAs) are governed by the international professional standards and code of conduct of the Institute of Internal Auditors. While internal auditors are not independent of the companies that employ them, independence and objectivity are a cornerstone of the IIA professional standards; and are discussed at length in the standards and the supporting practice guides and practice advisories. Professional internal auditors are mandated by the IIA standards to be independent of the business activities they audit. This independence and objectivity are achieved through the organizational placement and reporting lines of the internal audit department. Internal auditors of publicly traded companies in the United States are required to report functionally to the board of directors directly, or a sub-committee of the board of directors (typically the audit committee), and not to management except for administrative purposes. As described often in the professional literature for the practice of internal auditing (such as Internal Auditor, the journal of the IIA) -, or other similar and generally recognized frameworks for management control when evaluating an entity’s governance and control practices; and apply COSO’s “Enterprise Risk Management-Integrated Framework” or other similar and generally recognized frameworks for entity-wide risk management when evaluating an organization’s entity-wide risk management practices. Professional internal auditors also use control self-assessment (CSA) as an effective process for performing their work.
- Consultant auditors are external personnel contracted by the firm to perform an audit following the firm’s auditing standards. This differs from the external auditor, who follows their own auditing standards. The level of independence is therefore somewhere between the internal auditor and the external auditor. The consultant auditor may work independently, or as part of the audit team that includes internal auditors. Consultant auditors are used when the firm lacks sufficient expertise to audit certain areas, or simply for staff augmentation when staff are not available.
The most commonly used external audit standards are the US GAAS of the American Institute of Certified Public Accountants and the International Standards on Auditing (ISA) developed by the International Auditing and Assurance Standard.
Performance audits
Performance audit refers to an independent examination of a program, function, operation or the management systems and procedures of a governmental or non-profit entity to assess whether the entity is achieving economy, efficiency and effectiveness in the employment of available resources. Safety, security, information systems performance, and environmental concerns are increasingly the subject of audits. There are now audit professionals who specialize in security audits and information systems audits. With nonprofit organizations and government agencies, there has been an increasing need for performance audits, examining their success in satisfying mission objectives.
Quality audits
Quality audits are performed to verify conformance to standards through review of objective evidence. A system of quality audits may verify the effectiveness of a quality management system. This is part of certifications such as ISO 9001. Quality audits are essential to verify the existence of objective evidence showing conformance to required processes, to assess how successfully processes have been implemented, and to judge the effectiveness of achieving any defined target levels. Quality audits are also necessary to provide evidence concerning reduction and elimination of problem areas, and they are a hands-on management tool for achieving continual improvement in an organization.
To benefit the organization, quality auditing should not only report non-conformance and corrective actions but also highlight areas of good practice and provide evidence of conformance. In this way, other departments may share information and amend their working practices as a result, also enhancing continual improvement.
Project audit
A project audit provides an opportunity to uncover issues, concerns and challenges encountered during the project lifecycle. Conducted midway through the project, an audit affords the project manager, project sponsor and project team an interim view of what has gone well, as well as what needs to be improved to successfully complete the project. If done at the close of a project, the audit can be used to develop success criteria for future projects by providing a forensic review. This review identifies which elements of the project were successfully managed and which ones presented challenges. As a result, the review will help the organization identify what it needs to do to avoid repeating the same mistakes on future projects
Projects can undergo 2 types of Project audits:
- Regular Health Check Audits: The aim of a regular health check audit is to understand the current state of a project in order to increase project success.
- Regulatory Audits: The aim of a regulatory audit is to verify that a project is compliant with regulations and standards. Best practices of NEMEA Compliance Centre describe that, the regulatory audit must be accurate, objective, and independent while providing oversight and assurance to the organization.
Other forms of Project audits:
Formal: Applies when the project is in trouble, sponsor agrees that the audit is needed, sensitivities are high, and need to be able prove conclusions via sustainable evidence.
Informal: Apply when a new project manager is provided, there is no indication the projects in trouble and there is a need to report whether the project is as opposed to where its supposed to Informal audits can apply the same criteria as formal audit but there is no need for such a in depth report or formal report.