Courtesy: ISO 9001 lead auditor training
Under the COSO enterprise risk management (ERM) Framework, an organization’s strategy, operations, reporting, and compliance objectives all have associated strategic business risks – the negative outcomes resulting from internal and external events that inhibit the organization’s ability to achieve its objectives. Management assesses risk as part of the ordinary course of business activities such as strategic planning, marketing planning, capital planning, budgeting, hedging, incentive payout structure, credit/lending practices, mergers and acquisitions, strategic partnerships, legislative changes, conducting business abroad, etc. Sarbanes–Oxley regulations require extensive risk assessment of financial reporting processes. Corporate legal counsel often prepares comprehensive assessments of the current and potential litigation a company faces. Internal auditors may evaluate each of these activities, or focus on the overarching process used to manage risks entity-wide. For example, internal auditors can advise management regarding the reporting of forward-looking operating measures to the board, to help identify emerging risks; or internal auditors can evaluate and report on whether the board and other stakeholders can have reasonable assurance the organization’s management team has implemented an effective enterprise risk management program.
In larger organizations, major strategic initiatives are implemented to achieve objectives and drive changes. As a member of senior management, the chief audit executive (CAE) may participate in status updates on these major initiatives. This places the CAE in the position to report on many of the major risks the organization faces to the audit committee, or ensure management’s reporting is effective for that purpose.
The internal audit function may help the organization address its risk of fraud via a fraud risk assessment, using principles of fraud deterrence. Internal auditors may help companies establish and maintain Enterprise Risk Management processes. This process is highly valued by many businesses for establishing and implementing effective management systems and ensuring quality is maintained & professional standards are met Internal auditors also play an important role in helping companies execute a SOX 404 top-down risk assessment. In these latter two areas, internal auditors typically are part of the risk assessment team in an advisory role.
Role in corporate governance
Internal auditing activity as it relates to corporate governance has in the past been generally informal, accomplished primarily through participation in meetings and discussions with members of the board of directors. According to COSO’s ERM framework, governance is the policies, processes and structures used by the organization’s leadership to direct activities, achieve objectives, and protect the interests of diverse stakeholder groups in a manner consistent with ethical standards. The internal auditor is often considered one of the “four pillars” of corporate governance, the other pillars being the board of directors, management, and the external auditor.
A primary focus area of internal auditing as it relates to corporate governance is helping the audit committee of the board of directors (or equivalent) perform its responsibilities effectively. This may include reporting critical management control issues, suggesting questions or topics for the audit committee’s meeting agendas, and coordinating with the external auditor and management to ensure the committee receives effective information. In recent years, the IIA has advocated more formal evaluation of corporate governance, particularly in the areas of board oversight of enterprise risk, corporate ethics, and fraud.