George Nsamba As businesses develop and become complicated and as government institutions strive to provide better services to citizens, the need to have an internal audit increases. In order to understand why internal audit is required, one needs to know the following: what internal audit is all about and its value to the organisation, as well as know how to differentitate it from the other audits that organisations conduct with external auditors on a yearly basis, and where they can get internal auditors from. Internal audit, according to the Institute of Internal Auditors, is an independent and objective assurance designed to add value to an organisation’s processes. Internal auditors, therefore provide independent assurance that an organisation’s risk management, governance and internal control processes are operating effectively. Their scope is wide, and covers an organisation’s governance, risk management, reviewing of management controls over safeguarding of assets, compliance with laws and regulations and the reliability of financial and management reporting. That is why it is important for every organisation to conduct audits in these areas if it is to ensure good governance and become competitive. Therefore, internal audits deal with issues that are fundamentally important to the survival, growth and improvement of an organisation. Unlike external auditors, who come once or twice a year, internal auditors are constantly reviewing the organisation and look beyond financial risks and statements to consider wider issues such as the organisation’s reputation, growth, governance, its impact on the environment and the way employees are treated. Without these reviews, business hardly makes the required profits, and risks collapsing. Internal auditors work through a combination of assurance and consulting. Assurance work here involves telling management how well the systems and processes are designed to keep the organisation on track. Internal auditors then offer consulting help to improve those systems and processes where gaps have been identified. Internal auditors, therefore, have a professional duty to provide an unbiased and objective view. Internal auditors must be independent from the operations they evaluate and report to the highest level in an organisation. Typically internal auditors report to senior managers in the organisation which is usually the board of directors, the accounting officers or the audit committee. This helps management of these organisations to fulfil their duties efficiently and effectively. In order to be effective, companies must ensure they hire internal auditors who meet the qualifications and are registered with the Institute of Internal Auditors, not any individuals that masscrade as auditors. This also means that internal auditors are not those people who have failed to perform in other departments and, as a punishment, are pushed to the internal audit unit. It is important for managers to understand that audits conducted by external auditors on a yearly basis are mainly focused on accuracy and completeness of financial figures, which end up in the financial statements. Their emphasis is not on governance or processes, but rather on financial figures. On the other hand, the scope of internal auditing is broad, however, it does not put emphasis on financial figures, but rather on processes and governance. Internal auditing may also involve conducting proactive fraud audits to identify potentially fraudulent acts; participating in fraud investigations under the direction of fraud investigation professionals, and conducting post investigation fraud audits to identify control breakdowns and establish financial loss. Quite often, management assigns some operational activities in an organisation to internal auditors. This is wrong and should never be done. Internal auditors are not responsible for the execution of company activities and they should never get involved in execution. If your organisation is one of those practicing this kind of practice, please stop it because this is against the fundamental principle of internal audit, which is to be independent in order to give independent opinions. You can never give an independent opinion of the process that you have participated in developing. Therefore, those organisation leaders that force to carry out other duties are doing themselves a disservice, and should let internal auditors to focus on their core role: auditing. The writer is a senior manager advisory at EY Rwanda (formerly Ernest &Young). Email: george.nsamba@rw.ey.com
