Internal Audit - CA Sri Lanka

Internal AuditLecture # 09By: Kanchan Damithendra

What is Internal Audit?

Scope and Objectives of Internal Auditing Monitoring of internal control. The establishment of adequate internal control is aresponsibility of management which demands proper attention on a continuous basis.Internal auditing is ordinarily assigned specific responsibility by management forreviewing controls, monitoring their operation and recommending improvements thereto. Examination of financial and operating information. This may include review of themeans used to identify, measure, classify and report such information and specificinquiry into individual items including detailed testing of transactions, balances andprocedures. Review of the economy, efficiency and effectiveness of operationsfinancial controls of an entity.including non Review of compliance with laws, regulations and other external requirements and withmanagement policies and directives and other internal requirements.

International Standard The International Auditing and Assurance Standards Board (IAASB) isan independent standard-setting body Serves the public interest by setting high-quality internationalstandards for auditing, quality control, review, other assurance, andrelated services, and by facilitating the convergence of internationaland national standards. In doing so, the IAASB enhances the quality and uniformity of practicethroughout the world and strengthens public confidence in the globalauditing and assurance ified-standards

Local Standard (SLAuS)General Principles and ResponsibilitiesSLAuS 200 StatementsObjective and General Principles Governing and Audit of FinancialSLAuS 210 -Terms of Audit EngagementsRISK ASSESSMENT AND RESPONSE TO ASSESSED RISKSSLAuS 300 StatementsPlanning an Audit of FinancialSLAuS 315 Understanding the Entity and Its Environment and Assessing the Risksof Material MisstatementSLAuS 320-Audit Materiality

AUDIT EVIDENCESLAuS 500-SLAuS 501 ItemsSLAuS 505 -Audit EvidenceAudit Evidence – Additional Considerations for SpecificExternal ConfirmationsUSING WORK OF OTHERSSLAuS 600-Using the Work of Another AuditorSLAuS 610-Considering the Work of Internal AuditAUDIT CONCLUSIONS & REPORTINGSLAuS 700-The Auditor’s Report on Financial StatementsSLAuS 710-Comparatives

Relationship Between Internal Auditing and theExternal Audit

Relationship Between Internal Auditing and theExternal Audit

AUDITPROCESSPlanningAudit Follow-UpFieldworkAudit ReportAnnouncementLetterTransaction TestingDiscussion DraftFollow-up ReviewInitial MeetingAdvice & InformalCommunicationsExit ConferenceFollow-up ReportPreliminary SurveyInternal ControlReviewAudit ProgramAudit SummaryFormal DraftWorking PapersFinal ReportClient ResponseClient CommentsAudit Annual Reportto the Board

Audit Planning The audit process is similar for most engagementsand normally consists of four stages: Planning(sometimes called Survey or Preliminary Review),Fieldwork, Audit Report, and Follow-up Review. Clientinvolvement is critical at each stage of the auditprocess. As in any special project, an audit results in acertain amount of time being diverted from yourdepartment's usual routine. One of the key objectivesis to minimize this time and avoid disrupting ongoingactivities.

Planning During the planning portion of the audit, the auditor notifies theclient of the audit, discusses the scope and objectives of theexamination in a formal meeting with organization management,gathers information on important processes, evaluates existingcontrols, and plans the remaining audit steps.

Announcement Letter: The client is informed of theaudit through an announcement or engagementletter from the Internal Audit Director. Initial Meeting: the client describes the unit orsystem to be reviewed, the organization, availableresources (personnel, facilities, equipment, funds),and other relevant information.

Preliminary Survey: In this phase the auditor gathersrelevant information about the unit in order to obtaina general overview of operations. Internal Control Review: The auditor will review theunit's internal control structure, a process which isusually time-consuming.

Audit Program Preparation of the audit program concludes the preliminary reviewphase. This program outlines the fieldwork necessary to achieve theaudit objectives.

AUDIT REPORT.Audit Step : To communicate the results of the audit to managementA.Prepare a Draft Report:1.2.3.4.5.6.B.Obtain Corrective Action Plan1.2.C.Write report introduction, background & scope.Consolidate conclusion summaries into a report, x-refWrite memo for less significant items.Submit report for review & clear review notes.Set up the Exit Conference and distribute Draft ReportConduct Exit Conference to brief on the audit results and request a date for completion of thecorrective action plan. (Note: If any material changes to the audit report are identified,establish the date for revised report to be issued.)Analyze the Corrective Action Plan for adequacy and document.Advise agency management of any apparent inadequacies in the Corrective ActionPlan & resolve.Prepare a Final Report:1.2.3.Add the revised Corrective Action Plan to the Draft Report to prepare the Final Report.Submit report for review & clear review notes.Distribute the final report.REPORTING: Date Completed April 4, 201069 Total Hours:W/PNo.Est.Hrs.Act.Hrs.

Discussion DraftAt the conclusion of fieldwork, the auditor drafts thereport. Audit's goal is to complete the audit and issue adraft audit report within 30 days after the completion offieldwork.Audit management reviews the audit working papersand the discussion draft before it is presented to theclient for comment. This discussion draft is submitted tothe client for review before the exit conference.

Exit ConferenceInternal Audit meets with the unit's managementteam to discuss the findings, recommendations, andtext of the discussion draft. At this meeting, the clientcomments on the draft and the group works to reachan agreement on the audit findings.

Exit ConferenceIs an opportunity for the auditor, department management, process owners,and other to review and validate audit outcomes.The Exit Conference should accomplish the following:1) Present observations and determine if the current operating context mightaffect past transactions.2) Confirm facts, observations, and conclusions, e.g., that the findings areaccurate.3) Validate the cause leading to findings and present recommendations.4) Estimate the effect of the findings on operations or its risk management.5) Solicit draft management comments on the audit findings and determine ifalternative recommendations adequately eliminate the cause of findings.6) Define the timeline for issuing the final audit report and implementingrecommendations.

Audit FindingAudit FindingsReconciliation Supervisory Review (Urgent)During our sample review of account reconciliations, it was notedthat many account reconciliations were not being reviewed by thesupervisor in Item Processing and Deposit Operations.RecommendationWe recommend management review all accounts at least monthly.Action PlanThe Supervisor of the Item Processing Department was advised ofthis requirement and has implemented changes as requested.The Deposit Operations Manager will sign and review all accountreconciliations. A secondary signature by the balancing associateand/or supervisor will also be implemented. This procedure iscurrently in place.

Exit Conference ChecklistProcedureSet the date, time, and location of the exit meeting.The agenda should include the following: Accomplishment of the audit objectives (theirs and ours). Discussion of potential audit findings andrecommendations. Discussion of when management’s responsewill be due. Audit reporting process. Follow up process.Document results of the exit meeting.

Exit ConferenceThis section of the report summarizes the pertinentinformation regarding the Audit Exit Conference. Itincludes:The date the conference was held.The persons in attendance and their titles.A statement that a summary of the Findings andRecommendations was discussed.

Audit Exit Conference WPAudit Location (Faculty --Audit ---------------------------Lead ---------------------------Audit team ----------------JOSEThe main purpose of this meeting is to immediately present audit observations to the senior management in a timely manner at the end ofthe audit and in such a manner so as to ensure that they clearly understand the results of the audit.List Observations:The lead auditor should present observations, taking into account theirperceived significance and identifying key non-conformance areas.Key Non-conformances:

Formal DraftThe auditor then prepares a formal draft, taking intoaccount any revisions resulting from the exitconference and other discussions. This report isissued to the audited requesting a written responsetoany audit findings and recommendations.When the changes have been reviewedby audit management and the client,the final report is issued.

AUDIT REPORTOur principal product is the final report in which we present theaudit findings and discuss recommendations for improvements.Once the fieldwork is completed, Internal Audit will draft a reportto include the result of the audit including recommendations forimprovement. After the draft report is completed, it will beforwarded to department management for review and discussionat a scheduled exit conference.

Report Issuance Control SheetSpelling and Grammar CheckPerformed by: PABLOQuality Assurance Review (QAR)Approval of final draft with responsesPerformed by: VILMARIDirector of Audits: AMANDAEngagement Manager: JOSECheck all reports (original and all copies). Verify the following:1. They contain all pages, in the appropriate order2 All copies are straight and legible; and3. The signature page has been signed.Report Distribution*:PresidentClient ManagementChief Business OfficerDirector of Internal AuditChancellorVice Chancellor for Academic AffairsExecutive Vice Chancellor for Health AffairsExecutive Vice Chancellor for Business AffairsInstitution Compliance OfficerOthers (list)Reading File (unbound hard copy – stamped and placed in Reading File)Unbound hard copy provided to Office Associate* As determined by type of audit and institution where engagement is conducted (Academic, Medical, or System Administration).Compliance Officer should be included in report distribution if engagement involves a compliance issue.

Final ReportAfter audited management has been given anopportunity to respond to the Preliminary Draft, theFinal Draft Report is presented to the AccountabilityOversight Committee for approval. Upon approval ofthe Final Draft the Final Report is issued.Auditor distributes the final report the Chief FinancialOfficer, the Chief Accountant, the President, the Boardof Directors, and other appropriate members of seniormanagement. Final Reports are considered publicinformation and will be available to anyone.