Topic 11-Cost benefit analysis of Internal Audit/Internal Review for a company

@marodzam – take a look at the Risk Radar.

https://www.ey.com/Publication/vwLUAssets/EY_Key_considerations_for_your_internal_audit_plan_1/$FILE/ATT5QP7A.pdf

Normally the areas around the bull’s eye are red (significant risks that could be catastrophic or very costly) and move out to amber (potential risks with a medium cost) through to green (possible but minor risks in terms of chance of occurrence and likely cost).

To do this topic successfully you really need to be either be working in the IA department or have close connections to it in your chosen organisation. Ideallly you could apply this Risk Radar to the main risks identified by the IA department. Assign the amount of loss to each risk identified and give probabilities of the loss occurring per annum with regard to that risk (but you would need help with this).

This article:

https://www.telavance.com/advantage/previous-issues/current-issue/risk-management-how-internal-audit-can-play-a-key-role/

briefly sets out the areas you should try to assess e.g. you might be able to look at their importance to the organisation and the weighting given to them by the IA. You can then evaluate whether these are sufficient or greater emphasis should be dedicated to the aspects and the potential cost and its potential impact on the bottom line to the organisation.

Another way of assessing the effectiveness of IA in addition to the above is assessing how much having an IA department reduces the external audit fee and any other potential benefits such as better control over the agency problem.

With this topic you need to show that you have looked at the costs of the IA function and evaluated any benefits and provide the evidence of this. Just describing what the IA does, conducting a shallow survey and making sweeping statements that the IA does a good job (without any objective proof) will not get a pass. As with all topics it is your original input that counts.

@benjybabs – just because in your particular organisation the departments are split into internal audit and internal review activities does not mean that you have to chose one or the other. Provided you have sufficient information you can (and probably should) use both (that way you have more material to work from).

It is not always difficult to find data relation to actual financial and operational costs (it depends on the organisation and your position in it) if you have access to internal control reports. The costs would be mainly salaries and overheads (actual and apportioned) and this sort of thing normally appears in the monthly management reports. Assessing the financial and operational benefits are a lot harder as it can be difficult if not impossible to obtain precise figures relating to these – it ends up being a ‘best guestimate’. I made some suggestions in my reply to marodzam. You should research the subject in a general way (you could also try using a few key words on Google Scholar to find some research articles) and from these searches and my suggestions above you might develop some ideas for yourself on how to address the topic in your organisation.

If you are good at quantitative techniques you might be able to give weightings to the identified risks and probabilities of the risks occurring over a certain time frame and the estimated costs if the risks materialised (a sort of expected value/cost ). Against this you might be able to assess the current IA costs and extrapolate (probably with regression analysis) what the expected cost of IA over this time period would be. With costs of risks you might need to factor in potential loss of reputation, potential 3rd party claims for damages as well as obvious operational losses (depending on the type of risk identified) and with costs of IA you would need to consider the amount of training required for staff to deal with such risks and IA staff turnover during the period and include these costs. You could then analyse this mathematical model as a main part of your analysis.

Of course people have passed doing this topic.

You have to be objective in the way you present the data and scrutinise it and, as with all topics, demonstrate some original analysis of your own – you cannot just report what you find. You say you have read the posts on this forum – you need now to see how you can apply the advice given.

Take a look at this document and do a search on Google Scholar about evaluating the effectiveness of Internal Audit as it may give you further ideas

https://www.google.co.uk/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0ahUKEwiM27fbgI_PAhVpBMAKHTquC04QFggeMAA&url=https%3A%2F%2Fwww.iia.org.uk%2Fmedia%2F91943%2Fmeasuring_internal_audit_effectiveness_and_efficiency.pdf&usg=AFQjCNETknDbUH6d5V2yVaZNLZXJiX5Qcg&sig2=U_DF8wnrr85XHnuo8ohN5A

Am confused as what could be the right business model to use, as i see there are many models that talks about internal audit and internal controls but does not talk on costs and benefits

As with exam questions you need to READ and ANSWER the question/ title set and deal with those. The title of Topic 11 is “An investigation into the financial and operational costs and benefits of the internal audit / internal review activities within an organisation” . It is NOT a straight application of cost benefit analysis in relation to internal audit.

It requires an objective discussion of the finanicial and operational benefits of internal audit in your particular organisation (not a general discussion of the hypotheticall benefits of having an internal audit department) and an objective appraisal of the costs involved in providing the services your organisation’s internal audit department delivers.

Any models need to deal with aspects of the activities. (If the title had been “An investigation into the financial and operational benefits and costs of the internal audit / internal review activities within an organisation” the requirements might have been clearer and perhaps the topic not misinterpreted….)