External and internal audit

Transcription

1 Chapter 2 Exteral ad iteral audit Cotets Itroductio 8 Exteral audit 8 Exteral auditor s reports to users ad to maagemet 8 Maagemet represetatio letters 9 The maagemet letter 10 Exteral audits i the public sector 10 Auditor liability 11 What are the auditor s duties? 12 Relatioship betwee exteral ad iteral audit 14 Iteral audit 14 Idepedece 15 Staffig ad traiig 16 Relatioships 16 Due care 17 Plaig, cotrollig ad recordig 17 Evaluatio of the iteral cotrol systems 17 Evidece 18 Reportig ad follow-up 18 The image ad marketig of iteral audit 20 Performace idicators for iteral audit 22 Exteral audit reviews of iteral audit 22 Summary 24 Practice questio 24 Objectives After readig this chapter you should: uderstad the role ad fuctio of exteral audit; be aware of key case law; uderstad the role ad fuctio of iteral audit; be able to discuss how to measure the effectiveess of iteral audit. 7

2 Chapter 2 Exteral ad iteral audit Itroductio This chapter builds o Chapter 1 but takes the issues of exteral ad iteral audit a step further ad cosiders the importace of a good workig relatioship. Exteral audit Accoutacy bodies have a resposibility for ispectig ad moitorig their registered auditors o a regular basis. This is udertake by the Professioal Oversight Board s Audit Ispectio Uit. The followig features should be trasparet i each accoutig/audit practice: recruitmet of suitable staff; proper traiig, both academically ad o the job; cotiuig professioal developmet; quality cotrol ad supervisio of work; proper plaig ad approach; appropriate fee-chargig policy, which is based either o a hourly rate or a percetage of turover; a commitmet to ethical guidelies; iteral peer review at appropriate itervals. The visit durig the moitorig process is substative or compliace-based. The ispectors will assess a certai umber of audit files selected at radom, ad also files from categories kow to be high-risk. The substative approach will seek to verify that: plaig, recordig, supervisio ad review work have bee carried out to a satisfactory professioal stadard; the work recorded provides a soud basis for the audit opiio. Each ispectio eds with a iterview, ad the fidigs of the ispectio are fully discussed together with ay recommedatios. If the ispectio is ot satisfied the the auditor or the firm will have their practisig certificate withdraw as a last resort. The typical structure of a audit departmet i a audit firm is show i Figure Exteral auditor s reports to users ad to maagemet Audit reports are the ed product of the work ad must be completed to the highest stadard. They are govered by the 1985 Compaies Act as ameded by the Compaies Act 1989 ad 2006 ad also by the iteratioal auditig stadard ISA 700, The Auditor s Report o Fiacial Statemets. The 1985 Act places a duty o auditors to examie the fiacial statemets ad to express a opiio o whether they show a true ad fair view at the year ed. The auditor should ot express a opiio o the statemets util they have bee approved by the directors ad the auditors have cosidered all available evidece.

3 Exteral audit Figure 2.1 Structure of a audit firm Parter Audit maager Audit maager Assistat maager Assistat maager Assistat maager Assistat maager Audit seiors Audit seiors Audit seiors Audit seiors Audit juiors Audit juiors Audit juiors Audit juiors There are two types of audit report, a uqualified report ad a qualified report. Uqualified reports This is the most commo report issued with the fiacial statemets. It is kow as a clea report. The auditig stadard ISA 700 states that A uqualified opiio o fiacial statemets is expressed whe i the auditor s judgemet they give a true ad fair view ad have bee prepared i accordace with relevat accoutig or other requiremets. This judgmet cocludes: The fiacial statemets have bee prepared usig appropriate accoutig policies which have bee cosistetly applied. The fiacial statemets have bee prepared i accordace with relevat legislatio regulatios or applicable accoutig stadards (ad that ay departures are adequately explaied i the fiacial statemets). There is adequate disclosure of all iformatio relevat to the proper uderstadig of the fiacial statemets. Qualified audit reports There are three types of qualified report, which become appropriate depedig o the circumstaces. These reports will cotai: a except for opiio a adverse opiio a disclaimer of opiio. This type of reportig is covered i Chapter 17. Maagemet represetatio letters As part of the completio stage of the audit, a letter is prepared by the auditor o behalf of the maagemet of the compay to remid the directors that the resposibility for the preparatio of the fiacial statemet is theirs. Because the auditor frequetly has to rely o iformatio provided by maagemet, it is 9

4 Chapter 2 Exteral ad iteral audit usually good practice to cofirm this i writig. The cotet of such a letter is as follows: Directors ackowledge their resposibilities uder the Compaies Acts. Issues arisig from the audit where maagemet judgmet ad opiio are oted. The draft fiacial statemets do ot eed to be revised because of post balace sheet evets kow to the directors but ot reported to the auditors. There are o sigificat fixed assets held off the balace sheet which would ecessitate its revisio. There are o liabilities of a material ature ot icluded i the balace sheet. There are o cotiget liabilities of a material amout for which provisio has ot bee made. This letter of represetatio is siged by the chairma ad compay secretary ad miuted by the board of directors. The maagemet letter A effective writte report to the board of directors preceded by a executive summary is a essetial part of commuicatio. Auditors will report o matters that have come to their attetio durig the course of the audit. These will iclude: chages i risk assessmet which are a issue; weakesses i iteral cotrols; weakesses withi maagemet iformatio systems; commets o the work ad reliace of iteral audit; issues that relate to the fiacial statemets; recommedatios for chage. Maagemet letters are private commuicatios which the board may well delegate to the Audit Committee. They are cosidered by all parties to be importat ad fudametally useful. Exteral audits i the public sector Exteral audit reports of cetral govermet departmets ad quagos are udertake by the Comptroller ad Auditor Geeral (C&AG) who is ot a civil servat but a officer of the House of Commos. The C&AG is resposible for the Natioal Audit Office, with a duty ot oly to carry out value-for-moey reviews but also to audit the govermet s appropriatio accouts. The C&AG is required to give a opiio that sums expeded have bee applied for the purposes authorised by parliamet ad that the accout properly presets the expediture ad receipts for the year. Audits i local govermet ad the Natioal Health Service are carried out by the Audit Commissio i Eglad, a body that cotrols the audit ad ispectio process of these public sector bodies. The Audit Commissio is a idepedet body made up of the District Audit Service, comprisig civil servats with a fiacial backgroud ad the large firms of chartered accoutats that apply for 10

5 Auditor liability this type of work. Oe sigificat feature i this area is that the audit is rotated ad fees are paid by the Audit Commissio itself. It is a commoly stated view that this system promotes audit idepedece ad should be used by the private sector. However, this was cosidered by the Smith Report i Jauary 2003 (see Chapter 5 for a discussio of this report) ad rejected as iappropriate, which some might argue was a missed opportuity. (The Smith Report is ow icorporated ito the Fiacial Reportig Coucil s combied code.) A importat differece betwee local govermet ad the private sector is that fiacial statemets ad appropriate supportig documets are put o public view for ispectio ad query. Members of the public o the electoral roll may take this further by raisig objectios if they feel expediture or icome is ulawful ad the local authority or its employees or elected members have acted with culpable eglect. The auditor has the power to issue a certificate of loss, which is a surcharge requestig the retur of public moey from a idividual. The most famous case ivolved the surcharge issued to Dame Shirley Porter who was leader of Westmister City Coucil. She faced accusatios of gerrymaderig, resultig from several major housig costructio projects aimed at importig affluet voters to Lodo s Westmister costituecy. Dame Shirley later faced a surcharge of 27 millio after beig accused of sellig houses for votes by the Audit Commissio. She evetually settled i 2004 with a paymet of 12m. Oce agai the auditor must provide a opiio which if uqualified would state that the statemet of accouts presets fairly the fiacial positio of the Coucil for the year ed. Auditor liability A major error or oversight by the auditor ca result i a icorrect opiio. If this happes, the auditor the has a liability to parties who suffer a loss. There are cases of early law which are covered here but the most recet ifluetial cotemporary case was the House of Lords rulig i the Caparo case i Some of the early case law is cosidered briefly as this is a major subject area. Figure 2.2 outlies the auditor s legal positio. Figure 2.2 Auditor liability legal aspects Auditor liability Civil liability Statute (cliets) Crimial liability Commo law (cliets, cotract law, third parties, tort) Negligece Paymet of damages Fie, imprisomet Breach of due professioal care ad due diligece 11

6 Chapter 2 Exteral ad iteral audit Re Lodo ad Geeral Bak (1895) I this case the compay had take credit for iterest accrued o loas which were ever likely to be repaid. May of these loas were statute barred (i.e. ucollectable). The auditor was aware of the problem ad reported oly to the directors ad ot to the shareholders. Subsequetly the fiacial statemets did ot show a true ad fair view. I summig up, the judge stated that the auditor had a duty to shareholders to report ay dishoest acts that had occurred. He said the auditor could ot expect to fid every error but had a duty to use due care ad skill. Re Kigsto Cotto Mill Co. Ltd (1896) I this case the accouts had bee falsified to a very cosiderable extet by the maagig director, by extesive overvaluatios of stock. I this istace the auditors were deceived, ad although they acted with due care, they had uderstadably missed the deceptio. Lord Justice Lidley stated that the auditor is ot boud to be a detective; he is a watchdog ad ot a bloodhoud. I this istace the directors are liable to the shareholders for fraud. Both this case ad Re Lodo ad Geeral Bak represet a corerstoe for auditor liability. What are the auditor s duties? The Compaies Acts do ot expressly state how a auditor should discharge their duty of care. L. J. Lopes, i Re Kigsto Cotto Mill, stated. It is the duty of the auditor to brig to bear o the work he has to perform that skill, care ad cautio which a reasoably competet, careful ad cautious auditor would use. What is reasoable skill, care ad cautio must deped o the particular circumstaces of each case. Dooghue v. Steveso (1932) This case established that a duty of care is owed to parties outside a cotractual relatioship. This case refers to the sale of goods ad relates to a situatio where a customer was sold a bottle of drik with a slug at the bottom. It established the priciples of duty of care. Cadler v. Crae Christmas (1951) Although the court cofirmed that o duty of care is owed to third parties outside a cotractual agreemet, the dissetig judgmet of Lord Deig sigalled the way the law would develop i the future by statig that the accoutat owes a duty to ay third party who sees the accouts ad ivests moey but that this duty caot be exteded to iclude stragers. Hedley Byre & Co. Ltd. v. Heller & Parters (1963) The court accepted the Deig reasoig that a duty of care is owed to third parties where it ca be show that a special relatioship exists. The cousel s opiio was that there is a duty of care oly if: It is clear that the fiacial loss is attributable to reliace upo the egligetly prepared documet ad o other cause. 12

7 Auditor liability The party issuig the documet kew the purpose for which it was beig prepared ad kew (or ought to have kow) that it was to be relied upo i that particular cotext. Therefore, there was o duty of care to idividual shareholders who place reliace o the audit report for ivestmet decisios. The fiacial statemets ad the audit report are prepared for the purpose of stewardship ad ot for future ivestors. Hedley Byre v. Heller ad Parters (1963) I this case it was determied that the judgmet i Cadler v. Crae was wrogly decided. Hedley Byre were advertisig agets who wished to exted credit to the compay Easipower Ltd. They asked Heller, as the compay s bakers, for a referece i relatio to the compay s creditworthiess. The referece was give that the compay was respectable but the referece icluded a disclaimer o the part of the bak if the iformatio was relied o for ay ivestmet or busiess decisios. The advertisig agecy lost moey ad sued the bak for egligece. The case was dismissed because of the disclaimer; however, the judge i this istace held that there was a duty of care eve though o cotractual or fiduciary relatioship existed. Jeb Fasteers Ltd v. Marks, Bloom & Co. (1981) I this istace, the auditors coducted a audit for a compay facig solvecy difficulties. They were also subject to a takeover. The assets i the balace sheet were seriously overvalued, hece forcig the compay to be take over at a artificial price. Lord Justice Woolf said that the auditors could reasoably foresee that a takeover compay would rely o the audited accouts ad therefore suffer a loss if they were iaccurate. Caparo Idustries plc v. Dickma & Others (1990) I 1984 Caparo Idustries acquired a compay called Fidelity o the basis that the compay profits were i excess of 1 millio. After the takeover, Caparo claimed that the accouts were iaccurate ad the reported profit should have bee a substatial loss. Caparo claimed that the auditors Touche Ross owed a duty of care to ivestors ad sued them. They claimed Touche Ross should have see the vulerability of the compay ad therefore foresee the likelihood of a takeover. However, the Law Lords were uaimous that auditors do ot have a duty of care to idividual shareholders or future ivestors. They also came to the coclusio that some previous cases, icludig Jeb Fasteers v. Marks Bloom & Co., had bee decided wrogly. However, Caparo wet o to successfully pursue their actio for damages agaist the directors of Fidelity, amely the Dickma brothers. I relatio to the Caparo judgmet, Lord Bridge laid dow the followig circumstaces i relatio to proximity: the auditor will oly be liable to the third party if the followig circumstaces are met: 1. The auditor is aware of the ature of the trasactio which the third party is cotemplatig. 13

8 Chapter 2 Exteral ad iteral audit 2. The auditor kows that the report will be commuicated to the third party either directly or idirectly. 3. The auditor kows that the third party is likely to rely o the report i decidig whether or ot to egage i the trasactio i cotemplatio. The Caparo judgmet is a sigificat oe sice the courts are clearly reluctat to impose a uacceptable burde o auditors. Yet give the costs ivolved i legthy court cases, it is ot a surprise that so may cases i recet years, such as Barlow Clowes, BCCI, Maxwell Eterprises ad Polly Peck, have bee settled out of court. I recet years the collapse of Ero ad WorldCom i the USA ad the cosequeces for the auditors Arthur Aderse, who were implicated i the scadal, resulted i the USA itroducig the Sarbaes Oxley Act I the UK the courts have bee cocered about the burde placed o exteral auditors sice the Caparo case. I order to limit this burde, some auditors have formed limited liability compaies; i other cases limited liability parterships were created as a alterative. Relatioship betwee exteral ad iteral audit Durig the course of their plaig, the exteral auditors should perform a prelimiary assessmet of the iteral audit fuctio, whe it appears that certai iteral audit work is relevat to their exteral audit. A favourable assessmet might allow the exteral auditors to modify the ature, timig ad extet of exteral audit procedures. Exteral auditors may make use of the work of iteral audit i formig their opiio. Durig the course of their work they will wat to measure the effectiveess of iteral audit. They do this agaist the Iteral Audit Guidelies approved by the Auditig Practices Board (APB) i However, it must be stated that exteral auditors have sole resposibility for their statutory resposibility to provide a audit opiio. 14 Iteral audit The Istitute of Iteral Auditors defie iteral audit as a idepedet assurace ad cosultig activity desiged to add value ad improve the orgaisatio s objectives. It also helps a orgaisatio accomplish its objectives, ad it improves the effectiveess of risk maagemet, cotrol ad goverace processes. Figure 2.3 for the typical structure of a iteral audit departmet. Iteral audit is defied by the APB i its 1990 Iteral Audit Guidelies as a idepedet appraisal fuctio established by the maagemet of a orgaisatio for the review of the iteral cotrol system as a service to the orgaisatio. It objectively examies, evaluates ad reports o the adequacy of iteral cotrol as a proper, ecoomic, efficiet ad effective use of resources. The essetial features of a effective iteral audit departmet are as follows: idepedece appropriate staffig ad traiig

9 Iteral audit Figure 2.3 Typical structure of a iteral audit departmet Chief executive Director of fiace Chief iteral auditor Group auditor Group auditor Audit team leader Audit team leader Audit team leader Audit team leader Audit assistat Audit assistat Audit assistat Audit assistat relatioships due care plaig, cotrollig ad recordig evaluatio of the iteral cotrol system evidece reportig ad follow-up. It is a maagemet resposibility to determie the extet of iteral cotrol ad ot to deped o iteral audit as a substitute for those cotrols. Iteral audit will assist maagemet i its assessmet of risk ad its corporate goverace resposibility of iteral cotrol. Oe of iteral audit s objectives is to assist maagemet i the pursuit of value for moey. It is maagemet s resposibility to maitai the iteral cotrol system ad to esure that resources are properly directed. This, of course, will iclude a resposibility for the prevetio ad detectio of fraud. If a iteral auditor discovers evidece of, or suspects, fraud or some other malpractice, they should report their suspicios to the appropriate level of maagemet. It is a maagemet resposibility to determie what further actio to take. Idepedece This is achieved through the orgaisatioal status of iteral audit. Clearly it should have freedom to fuctio effectively. The support of maagemet is essetial ad iteral audit should determie its ow policies, i cosultatio with maagemet. The head of iteral audit should have direct access to, ad freedom to report to, all seior maagers, icludig the chief executive, fiace director, board of directors ad, of course, the Audit Committee. The key attribute of idepedece is the ability to report uedited i the head of audit s ow ame to 15

10 Chapter 2 Exteral ad iteral audit the highest level of maagemet. Each iteral auditor should have a objective attitude of mid ad be able to exercise idepedet judgmet, express opiios ad make recommedatios without ay degree of pressure. Staffig ad traiig The APB guidelies state that: The effectiveess of iteral audit depeds substatially o the quality, traiig ad experiece of its staff. The aim should be to appoit staff with the appropriate backgroud, persoal qualities ad potetial. Thereafter, steps should be take to provide the ecessary experiece, traiig ad cotiuig professioal educatio. The iteral audit uit should be maaged by a head of iteral audit who should be suitably qualified ad should possess wide experiece of iteral audit ad of its maagemet. They should pla, direct, cotrol ad motivate the resources available to esure that the resposibilities of the iteral audit uit are met. The full rage of duties may require iteral audit staff to be draw from a variety of disciplies. The effectiveess of iteral audit may be ehaced by the use of specialist staff, particularly i the iteral audit of activities of a techical ature. The iteral audit uit should employ staff with varyig types ad levels of skills, qualificatios ad experiece i order to satisfy the requiremets of each iteral audit task. Auditors eed to be traied ad kept up to date with chages of procedure ad legislatio. All audit staff should udertake cotiuig professioal developmet i order to keep themselves up to date. This should be checked by the aual staff appraisal process. Source: After APB Guidelies for Iteral Audit, Auditig Practices Board, Fiacial Reportig Coucil (FRC). Adapted ad reproduced with the kid permissio of the Fiacial Reportig Coucil. All rights reserved. For further iformatio please visit or call +44 (0) Relatioships Auditors have dealigs with a wide rage of employees ad maagers ad it is importat for them to have cofidece i the audit process. May seior maagers feel a real eed for iteral audit i helpig them verify that their systems work i accordace with their expectatios. It is ackowledged that at the lower ed of the compay some first-lie maagers do questio the eed for audit as see it as a drai o their time. Audit iterpersoal skills are very importat i this istace. Discussios with maagemet are a importat part of the audit, ad the preaudit iterview is a essetial igrediet i the plaig process. Whe the audit is completed, the auditor will wat to discuss the fidigs ad recommedatios with maagemet prior to the report beig issued. This is a essetial ad importat feature of a good workig relatioship betwee the auditor ad maagemet. 16

11 Iteral audit Due care The auditor ca ever give a total assurace that cotrol weakesses do t exist but they must be able to demostrate that due care is exercised ad their workig papers are cosistet. The ethical guidelies published by the professioal accoutacy bodies are particularly relevat to the work of auditors. The head of iteral audit should exercise some degree of quality cotrol over the work of the departmet s staff. Plaig, cotrollig ad recordig The head of iteral audit will wat to agree a strategic audit pla with the Audit Committee, which will address the audit approach over a period of 2 5 years, the miimum level of cover required (i.e. perso-days) ad the balace betwee valuefor-moey reviews, systems-based ad other types of approach. The APB s iteral audit guidelies state the mai purposes of iteral audit plaig as follows: to determie priorities ad to establish the most cost-effective meas of achievig audit objectives; to assist i the directio ad cotrol of audit work; to help esure that attetio is devoted to critical aspects of audit work; to help esure that work is completed i accordace with pre-determied targets. Accordig to the guidelies, the stages of iteral audit plaig are as follows: to idetify the objectives of the orgaisatio; to defie iteral audit objectives; to take accout of relevat chages i legislatio ad other exteral factors; to obtai a comprehesive uderstadig of the orgaisatio s systems, structure ad operatios; to idetify, evaluate ad rak risks to which the orgaisatio is exposed; to take accout of chages i structures or major systems i the orgaisatio; to take accout of kow stregths ad weakesses i the iteral cotrol system; to take accout of maagemet cocers ad expectatios; to idetify audit areas by service, fuctios ad major systems; to determie the type of audit, e.g. systems, verificatio or value for moey; to take accout of the plas of exteral audit ad other review agecies; to assess staff resources required, ad match with resources available. Source: After APB Guidelies for Iteral Audit, Auditig Practices Board, Fiacial Reportig Coucil (FRC). Adapted ad reproduced with the kid permissio of the Fiacial Reportig Coucil. All rights reserved. For further iformatio please visit or call +44 (0) The audit pla is broke dow ito a list of weekly or mothly tasks to be udertake by staff. Agaist this pla, the head of audit cotrols, records ad approves the release of the audit report. Evaluatio of the iteral cotrol systems A systems-based approach to iteral audit is advised ad recommeded. This meas that the iteral auditor is a cotrol expert. The APB guidelie for iteral 17

12 Chapter 2 Exteral ad iteral audit 18 auditors clearly states that cotrols should esure that processes meet the systems objectives. The mai objectives of the iteral cotrol system, accordig to the guidelies, are as follows: to esure adherece to maagemet policies ad directives i order to achieve the orgaisatio s objectives; to safeguard assets; to secure the relevace, reliability ad itegrity of iformatio, so esurig as far as possible the completeess ad accuracy of records; to esure compliace with statutory requiremets. Whe evaluatig iteral cotrol systems the iteral auditor should cosider the effect that all the cotrols have o each other ad o related systems. As part of the plaig process, the iteral auditor should idetify the whole rage of systems withi the orgaisatio. For those systems to be examied, the iteral auditor should establish appropriate criteria to determie whether the cotrols are adequate ad assist i achievig the objectives of the system. The stages of a system audit would ormally be: to idetify the system parameters; to determie the cotrol objectives; to idetify expected cotrols to meet cotrol objectives; to review the system agaist expected cotrols; to appraise the cotrols desiged ito the system agaist cotrol objectives; to test the actual cotrols for effectiveess agaist cotrol objectives; to test the operatio of cotrols i practice; to test a opiio based o audit objectives as to whether the system provides a adequate basis for effective cotrol ad whether it is properly operated i practice. Source: After APB Guidelies for Iteral Audit, Auditig Practices Board, Fiacial Reportig Coucil (FRC). Adapted ad reproduced with the kid permissio of the Fiacial Reportig Coucil. All rights reserved. For further iformatio please visit or call +44 (0) Evidece Evidece is iformatio obtaied by the auditor which eables coclusios to be draw. This will come from the output obtaied by substative testig. The head of audit must be satisfied that evidece is sufficiet, reliable ad relevat, because judgmet will be exercised ad a opiio give. Reportig ad follow-up The APB Iteral Audit Guidelies clearly state that the primary purposes of iteral audit reports are to provide maagemet with a opiio as to the adequacy of the iteral cotrol system, ad to iform maagemet of sigificat audit fidigs, coclusios ad recommedatios. The aim of every iteral audit report should be: to prompt maagemet actio to implemet recommedatios for chage leadig to improvemet i performace ad cotrol; to provide a formal record of poits arisig from the iteral audit assigmet ad, where appropriate, of agreemets reached with maagemet.

13 Iteral audit Reportig arragemets, icludig the format ad distributio of iteral audit reports, should be agreed with maagemet. The head of iteral audit should esure that reports are set to maagers who have a direct resposibility for the uit or fuctio beig audited ad who have the authority to take actio o the iteral audit s recommedatios. Iteral audit reports are cofidetial documets ad their distributio should be restricted to those maagers who eed to kow, to the audit committee ad to the exteral auditor. Audit reports i the mai ca be issued quickly because the auditor is satisfied that system cotrols are workig ad meet the cotrol objectives. These reports will therefore have o specific or detailed recommedatios. Their formats are held o computer file ad they ca be quickly ru off oce the head of audit has approved them. Auditors are expected to report o the ature of the audit ad, i particular, the remit which may come from the board but is more likely to be approved by the audit committee. The report will iclude details of fidigs, the impact ad effect of the fidigs ad, specifically, recommedatios for improvemet. I some cases a draft report is issued, the facts are verified ad discussios held with maagers. I other cases, a implemetatio schedule is attached (see Figure 2.4). Figure 2.4 Implemetatio schedule for a iteral audit report SUBJECT: Vehicle Purchasig REF. NO.: TR/06/08 REPORT PARA. RECOMMENDATION * ACCEPT * REJECT DATE OF PROPOSED IMPLEMENTATION 6 Vehicles should be purchased from two competig orgaisatios Suppliers should be asked to teder o price ad provide a discout for bulk buyig A B 30/9/XX To be discussed after a schedule of local suppliers is completed SIGNED: P. Catley DATE: X *CODE FOR REPLY NOTE: This form should be detached from the audit report ad, after completio, retured to the head of audit ot later tha... Please attach separate memoradum to amplify recommedatios replied to codes B, C or D A. Agreed i full B. Agreed i priciple, more research ecessary C. Disagree i preset form D. Disagree reject completely 19

14 Chapter 2 Exteral ad iteral audit Reports are received differetly accordig to the varyig temperamets of the perso beig audited. However, the audit becomes a positive tool whe logical, workable ad pragmatic recommedatios are produced. Maagers are asked to give their respose i writig. Reactios to audit reports should be moitored as a performace idicator for measurig the effectiveess of the iteral audit divisio. Oce recommedatios have bee agreed, a follow-up audit is advised i order to see that these have bee implemeted ad whether the system has improved. I some cases it ca be left util the ext audit. This is importat because, all too ofte, recommedatios are quickly accepted ad the forgotte oce the audit has bee completed. The image ad marketig of iteral audit Perceptio is a real skill for the auditor to have. It draws o istict or gut feelig. While it is ot, i itself, evidece, it ca be used to direct time, attetio ad effort. The image of audit has always bee a matter of some cocer. I our experiece, some directors of fiace have used iteral audit as a dumpig groud for staff who could cotribute very little, whose career path was horizotal ad would remai so util they retired. Key staff i the audit sectio have teded to leave for pastures ew. I some cases their posts were cut, froze or filled with somebody uacceptable to the chief iteral auditor. Whe it comes to promotio, chief iteral auditors are judged o their work record ad the positive results they have obtaied, so it is iterestig to ote how few of them become directors of fiace. May audit sectios, icludig some of the smaller oes, egage i a multitude of o-audit fuctios. They become part of the system, doig mudae work such as checkig refuds, calculatig pesios or issuig statioery. Cheques are examied prior to despatch ad cotract fial accouts receive 100% of iteral audit s attetio. This caot be right ad it makes oe woder what the barriers to chage are. If these could be addressed perhaps chief iteral auditors would have a free had to cocetrate o audit issues. The threat of competitio ad the chagig eviromet mea that the icetive for review ad chage is great. No matter how good a service looks, it ca be improved. Ad service delivery, presetatio ad reportig are amog the areas that must be addressed. Auditors must look at their ow rage of maagemet skills ad cosider how they deal with coflict ad assertiveess as well as their iterpersoal skills. Cotact, marketig ad sellig skills must also be developed as seior audit staff will become familiar visitors to the offices of the chief officers. The promotio of the iteral audit brad is a key feature of raisig the departmet s image withi the compay. A busiess card ad a brochure with cotact details ca help to do this ad should be provided so that maagers are aware of the rage of services o offer (see Figure 2.5a c for examples). 20

15 Figure 2.5 (a) Audit card. (b) Frot cover of audit brochure. (c) Iside of audit brochure. Iteral audit ABC INTERNAL AUDIT SERVICE Matt Ferdiados HEAD OF AUDIT Tel: Fax: HQ Coucil Aveue Guildford Surrey GU1 2SA (a) Quality, Efficiecy, Reliability ABC AUDIT SERVICE FOR: Mr J. Ashtead YOUR AUDIT MANAGER WILL BE: Mrs V.F. Muy, FCA Tel.: Fax: (b) Quality, Efficiecy, Reliability ABC INTERNAL AUDIT SERVICE Services offered: l l l l l l l Regulatory/probity audits Systems audits Computer audits VFM reviews Moitorig studies Pre- ad post-audit iterviews with cliet Easy access to staff throughout the week to discuss ay issue, however small (c) Quality, Efficiecy, Reliability 21

16 Chapter 2 Exteral ad iteral audit Exhibit 2.1 Performace idicators Audit time Productive time actual vs. plaed (%) Reports produced withi target time (%) Reports exceedig target time (%) Time spet o o-audit work (%) Audit cost Average cost per day Total iteral audit costs budget vs. estimate Total costs recharged Audit plas Progress agaist aual pla Progress agaist log-term pla Number of reports issued Staff ad skill levels Staff i post vs. those required Staff turover rates Numbers of professioally qualified staff vs. part-qualified Ratio of traiees to total staff Fidigs ad recommedatios Recommedatios accepted vs. recommedatios made (%) Recommedatios implemeted withi 6 moths (%) Cliet reactio Customer satisfactio survey Performace idicators for iteral audit The head of iteral audit is usually expected to prepare a aual report to the Audit Committee. Some of the performace idicators that might be icluded i such a report, for iteral maagemet iformatio, are show i Exhibit 2.1. Exteral audit reviews of iteral audit It is a fuctio of exteral audit to evaluate the effectiveess of iteral audit work. Exteral auditors must feel a degree of assurace as to its quality, ad they will wat to assess the performace of iteral audit. The Auditig Practices Board Iteral Audit Guidelies provide a appropriate bechmark to do this. Some exteral auditors measure iteral audit o a scale of A to D. I this istace, full compliace with the guidelies would receive a A, while complete o-compliace would receive a D. There is a stadard, ISA 610, which requires the exteral auditor to assess the quality of the work of iteral auditor. A checklist is provided i Figure 2.6, which ca serve as a guide i measurig the effectiveess of iteral audit. 22

17 Exteral audit reviews of iteral audit Figure 2.6 Exteral audit s checklist for the assessmet of iteral audit Iteral Audit Assessmet Year edig 31 March 201X Date: Status Aswer Referece 1. Are role ad objectives clearly established? Does IA have urestricted access to records? Is IA idepedet of lie maagemet? Is IA well regarded i the authority? Staffig 5. Is staffig adequate for size ad scope? Is complemet complete i year? Are specialist skills available, e.g. computers, cotracts? 8. Do ay staff have o-audit duties? Plaig 9. Does IA have a strategic pla? Is a satisfactory aual pla prepared? Is the pla beig met i this year? Scope ad procedures 12. Is there a maual or equivalet? Are istructios/work programmes adequate? Are audit procedures satisfactory? Have matters of cocer bee discovered? Is balace of coverage satisfactory mai systems, sub-systems, other regularity, projects, VFM etc.? Maagemet 17. Is IA work properly supervised? Does CIA maage effectively? Reportig 19. Is the method of reportig satisfactory? Is progress o recommedatios moitored? Is a aual report prepared? Does IA have access to top maagemet Overall coclusio

18 Chapter 2 Exteral ad iteral audit Summary This chapter builds o Chapter 1 ad goes ito more depth of the features of exteral audit ad iteral audit. The statutory requiremet of exteral audit is ivestigated ad its key fuctio, which is to provide a opiio o the fiacial statemets, is aalysed. Exteral audit case law is examied from early times through to the Caparo case, which is curretly the legal precedet for the Uited Kigdom. There has always bee a debate about the effectiveess ad usefuless of exteral audit ad the issue of liability should thigs go wrog. However, its role remais a corerstoe to certify the itegrity of the fiacial statemets. Withi the regulatory framework, exteral auditors have a duty to shareholders to perform the role of a watchdog. They are required to check ad verify iteral audit s work as part of the process, so that they ca be reassured as to the reliability of iteral cotrol verificatio. Iteral auditors, whilst havig a degree of idepedece, are salaried employees of the compay ad are cosidered to be idepedet by virtue of their objectivity ad provide a appraisal fuctio as a service to maagemet. They are a itegral part of the fuctio of iteral cotrol.? PRACTICE QUESTION As part of their review, exteral auditors must commet o the reliace ad effectiveess of iteral audit. Discuss how they will go about doig this. 24