Internal and external audit

1 Audit is a form of assurance

YouTube videoLoad YouTube video

An audit is a form of assurance, which means that:

• an independent expert examines

• specified subject matter, to

• agreed standards,

• where that subject matter is the responsibility of one party,

• and produces a report

• for a second party.

For example, in the UK once a car reaches a certain age it must have an annual safety test, to provide assurance that the vehicle is safe to drive. That assurance works like this:

In an external audit the same five elements appear:

There are two types of audit, and the difference between them is who the report goes to:

• External audit — the report goes to the members (the shareholders).

• Internal audit — the report goes to the board, usually through the audit committee.

2 The need for external audit

2.1 The principal-agent relationship

As Chapter 3 explained, shareholders are the legal owners of a company. In a very small business the shareholders will also run it day to day. Once a business grows, though, the shareholders appoint directors and managers to run the company for them.

Shareholders (also called members) are the principals; the directors are their agents. An agent should act in the best interests of the principal — but that leaves a conflict of interest wide open. Shareholders want profits and dividends; directors may want large salaries, generous pensions and bonuses, first-class travel and expensive cars. The word stewardship is also used for the duty directors have to look after what belongs to the shareholders.

Companies are required to produce annual financial statements for their shareholders, showing how the company has done during the year. The directors are responsible for preparing those statements — and there is an obvious temptation not to report the results accurately or fairly. Directors might overstate profits to keep their jobs or to qualify for bonuses.

So independent, external auditors are appointed by the members to examine the financial statements objectively and to report to the members on whether the statements give a true and fair view of the company's affairs and its results. The auditors' conclusion is published as the audit report inside the financial statements.

Two things in that picture do the work. The auditor is appointed by, and reports to, the shareholders — not the directors whose work is being examined. And the loop closes only once a year, on information that is already historical, which is why governance codes add continuous structures such as the audit committee on top of it (Chapter 4).

3 What the external auditors do

3.1 Who must have an audit, and who appoints the auditor

The detail here is national, and the English position is used as the illustration; the pattern is very similar in most company-law jurisdictions.

• Not every company is audited. Public companies and larger private companies must have their financial statements audited. Small companies below statutory size thresholds are usually exempt, and so are dormant companies — although the shareholders of an exempt company can still require an audit, and a bank or a major supplier may ask for one.

• The shareholders appoint the auditor, and the shareholders remove the auditor, by resolution in general meeting. That is the foundation of the auditor's independence. In practice the audit committee runs the selection and recommends a firm (Chapter 4 §6.3), but the appointment is the members'.

• The auditor has statutory rights which the directors cannot withhold: a right of access at all times to the company's books and records, a right to require from officers and employees whatever information and explanations the auditor thinks necessary, and a right to receive notice of and to be heard at general meetings.

• An auditor who resigns or is removed can make a statement of the circumstances to the members. This exists so that a company cannot quietly dismiss an auditor who is asking awkward questions.

• The auditor must be independent and qualified — a member of a recognised supervisory body, not an officer or employee of the company, and free of the relationships that would compromise objectivity (Chapter 2, CIMA's Code of Ethics).

3.2 What is audited, and what is not

The auditors report on a company's financial statements, which are prepared from its financial records. The financial statements consist of:

• a statement of financial position

• a statement of profit or loss

• a statement of cash flows

• a statement of changes in equity (movements in reserves)

• the notes to the financial statements

Companies also produce directors' reports, chairman's statements, graphs, forecasts and public relations material, and combine them with the financial statements into an annual report — often a glossy booklet designed to impress investors. The audit report covers only the financial statements, not the rest of that document. That single sentence is the answer to more exam questions than any other in this chapter.

3.3 True and fair — what fair presentation means

The prime purpose of the audit report is to state whether the financial statements give a true and fair view of the company's financial position at the year end and of its performance during the year. Some frameworks use the phrase present fairly instead; they mean the same thing.

The last point is worth an illustration, because it is what separates fair from true. A statement of financial position should show current assets and current liabilities separately and in reasonable detail:

A reader can see that liquidity is poor: suppliers expect $12,000 within a few weeks, but not much is coming in from customers or in cash, and inventory can take a long time to turn into cash. Now compare:

3.4 Modified audit opinions

If the auditors cannot say that the financial statements give a true and fair view, they issue a modified opinion explaining what the problem is. Problems arise for two reasons, and each can be either isolated or pervasive — which gives three modified opinions:

Read the table by column and the logic is easy to keep: qualified for an isolated problem of either kind; adverse for a pervasive misstatement; disclaimer for a pervasive lack of evidence. Directors dislike all three, because any of them tells the world something is wrong.

3.5 The basic audit process

An audit is not a re-performance of the bookkeeping. It is a planned, risk-driven exercise in gathering enough evidence to support an opinion, and it runs in five stages:

1. Accept and plan. The firm satisfies itself that it can act — that it is independent, competent and not conflicted — agrees the terms in an engagement letter, and plans the work.

2. Assess risk and set materiality. Where in this company is a material misstatement most likely? The auditor forms an understanding of the business and its environment, and decides what size of error would matter to a user.

3. Test the controls. If the company's internal control system is well designed and operating, the auditor can rely on it and test less of the detail. If it is not, the auditor tests more.

4. Substantive testing. Direct testing of the figures themselves — inspecting documents, confirming balances with third parties, attending the inventory count, recalculating, checking cut-off, reviewing for reasonableness.

5. Review, conclude and report. The evidence is reviewed, the going-concern assessment and post-year-end events are considered, and the opinion is formed and issued.

The single most important feature of that process for this paper is that stages 3 and 4 are carried out on a test basis — a sample, chosen by reference to risk. That is why the next section says what it says.

4 What auditors do not do

Auditors do not:

• Prepare the financial statements. That is the job of the directors and their staff.

• Double-check every transaction. That would take too long and cost too much. Auditing is carried out on a test basis, often by testing the internal control system the company has set up, to assess whether that system should prevent or detect fraud and error. (Internal control is explained in Chapter 6, Error and fraud.)

• Manage the company.

• Warn shareholders that the company has made a loss. The loss is already shown in the financial statements.

• Undertake to discover every fraud or error. Auditors look for material misstatements.

• Guarantee that the financial statements are free of fraud and error. Transactions are examined on a test basis, so there is always a risk that, even in a properly conducted audit, an error or a fraud goes undiscovered.

5 Advantages and disadvantages of an external audit

6 Internal audit

6.1 Definition

Every phrase in that definition earns its place. Internal audit is independent of the activities it examines; it is established within the organisation, so it is part of it; it is a service to the organisation rather than a policing function imposed on it; and it is itself a control that examines other controls.

6.2 Who are the internal auditors?

• Usually they are employees of the company, though it is possible to sub-contract the function to an outside firm.

• They report ultimately to the board, in practice through the audit committee. That reporting line is what preserves their independence: if internal audit reported only to the finance director, it could not report on the finance director.

• Their main function is to make sure the company's system of internal control is adequate and is working correctly.

• Although they often concentrate on financial controls and the accuracy of the accounting records, they can be given work anywhere in the business — for example examining how staff are recruited, to confirm that the procedures represent best practice and comply with the law.

6.3 Types of internal audit assignment

6.4 Financial controls, audit checks and audit trails

The syllabus names three things together, and they are three links in one chain.

The point of the chain is that an audit check is impossible without an audit trail. If a payment cannot be traced back to the document that authorised it, no amount of testing will show whether the control worked. This is also why computerised systems must keep transaction logs: a record that can be overwritten without trace has destroyed the evidence a control depends on.

6.5 Internal audit beyond the numbers — non-financial monitoring and control

Internal audit is often assumed to be a financial function. It is not — the syllabus asks specifically for its role in non-financial monitoring and control activities. Its remit is the whole of the organisation's system of control, and much of what goes wrong in an organisation is not a bookkeeping failure:

• Operational work — whether a process is effective, efficient and economical, and whether it does what management thinks it does.

• Compliance work — whether the organisation is meeting the legal and regulatory obligations it is subject to, from health and safety to data protection.

• Information systems work — access rights, change control, back-ups, and whether the reports management relies on are produced from the data they claim to use.

• Social and environmental work — the subject matter of Chapter 7, checked rather than asserted.

• Value-for-money work — whether the money spent has bought what it was supposed to buy.

The value internal audit adds is not the report. It is the recommendation that gets implemented — which is why internal auditors follow up their findings, and why their reports go to a body with the authority to make something happen. Two things protect the independence that makes the advice worth having: internal audit reports to the audit committee, not to the managers whose areas it examines; and it does not audit a system it designed or operates itself.

7 Internal audit compared with external audit

What the two do not differ in is technique. Both plan, both assess risk, both test controls and then test detail, both document their evidence. The differences are all about who they answer to and what they are for.

8 Test your knowledge

Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.