P. 1
Brink's Internal Audit

Brink's Internal Audit

|Views: 8,158|Likes:
Published by kepler!

More info:

Categories:Topics, Art & Design
Published by: kepler! on May 12, 2011
Copyright:Attribution Non-commercial


Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See more
See less






There are multiple factors that both encourage and limit effective coordination
between internal and external auditors. Some of these factors tend to overlap, and
they range from relatively low-level to those of high-level importance. Coordina-
tion at a lower level may, for example, be as basic as ensuring that representatives

c10.fm Page 229 Friday, November 19, 2004 12:18 PM



of the two audit groups do not arrive at a given location simultaneously, each
with different objectives but seeking to examine some of the same records or
interview the same employees. Coordination can also involve internal audit per-
forming specified work directly under the supervision of members of the external
auditing firm. In this instance, the motivation often is to reduce external audit
staff time and thus reduce the cost of the external audit. However, the motivating
factor can be one of higher-level cooperative assistance, including the coverage of
defined portions of the audit work by internal audit with a later, relatively limited
review of that work by the external auditors. Coordination could also include the
exchange of findings and related information, together with joint discussions and
agreement on further follow-up on the correction of identified deficiencies. Moti-
vation at higher levels does not ignore the more elementary types of benefits, but
it also focuses on the deeper common interests of achieving an effective system of
internal controls.

Internal audit should have a special responsibility to encourage effective
audit coordination because of its in-depth involvement with total organization
operations. In many organizations, internal audit is in an especially advanta-
geous position to know and understand various potential audit problems. Fur-
ther, internal auditors often will have a good professional understanding of the
work of external auditors, or will at least generally understand the external
audit standards. Internal audit, therefore, can often take the initiative in propos-
ing and helping to work out arrangements that will better satisfy external audit’s

Internal audit’s responsibilities may also extend to exerting reasonable pres-
sure on various members of management to ensure their support in working
with the external auditors. This is often necessary because some members of
management may not understand the differing roles of internal and external
audit. Internal audit should attempt to explain to its line management the differ-
ences in audit scope and objectives. Internal audit often needs to negotiate vari-
ous planned audit projects with external auditors. For example, if internal audit
has performed a review in an area where external audit now plans to visit, inter-
nal audit should question why external audit cannot rely on the work of internal
audit. Sometimes, internal audit may want to question a planned area of review
if they have reasons to believe that external audit does not understand the audit
risks in the area to be reviewed. External auditors often perform only a very lim-
ited risk assessment as part of their planning work and may decide to perform
procedures that may not be all that necessary. Internal audit, because of its close
knowledge of the organization, can suggest alternative audit approaches. This
may even result in audit fee savings to the organization.
Internal audit must recognize, however, that external auditors are independent,
and, thus, can perform their reviews in any area they feel necessary for perform-
ing their attest function. Internal audit can only recommend changes. However, if
the external auditors are performing work that does not appear to be cost effective
in the professional judgment of internal audit, this should be discussed initially
with the external audit engagement partner. If the matter cannot be resolved,
internal audit should bring these concerns to the audit committee and senior

c10.fm Page 230 Friday, November 19, 2004 12:18 PM



When internal audit has serious reservations about some planned external
audit procedure, an effective way to challenge that work is to request documen-
tation covering their risk assessment of the area to be reviewed or the tests per-
formed. External auditors should go through a set of risk assessments similar to
those discussed in Chapter 5, “Understanding and Assessing Risks: Enterprise
Risk Management,” for internal auditors. Where there is a difference of opinion
or where internal audit has performed a risk assessment over the same area but
with different results, internal audit may want to go to the audit committee or
senior management to raise these concerns. However, internal audit must
always recognize that external audit is independent. If there is a serious dispute
over audit procedures or other matters, the organization can always retain a new
external auditor. This is a serious step, however, and should not be done casu-
ally. In addition, changing auditors sends bad signals to investors who may
assume that problems exist. In addition, in today’s post-SOA world, there are
only a limited number of external audit firms, limiting options.
Potential constraints can stand in the way of effective audit coordination,
ranging from very low-level, personnel-related conflicts to very significant
management- or audit approach–related differences. Barriers to effective coordi-
nation concern anything that directly or indirectly weakens the overall audit
effort. Many of these are based on the overall competency and charter of the
internal audit function. As discussed previously, external auditors are required
to assess the competency and objectivity of the internal audit function per SAS
No. 65. Some of the SAS No. 65 factors that may be considered include:

•Independence of the Internal Audit Function.Chapter 1 discussed the
necessity that internal audit should be an independent function within
the organization. However, external auditors have somewhat different
standards for their assessment of independence. For example, an internal
auditor may be totally independent in action but may also be a cousin or
some other relative to a key member of the organization’s management.
External audit might not view that auditor as independent. Similarly, the
internal audit function may report to the organization’s CFO or even a
lower-level accounting director with only minimal connection to the audit
committee. External auditors may not consider that internal audit func-
tion to be independent from the pressures of their direct management.

•Adequacy of Internal Audit Standards.SAS No. 65 requires that external
auditors obtain an understanding of the internal audit function, including
its standards. If internal audit follows the IIA’s professional standards, as
discussed in Chapter 12, or a related internal audit standards–setting
group such as the General Accounting Office (GAO) standards for govern-
mental auditors, there can be a basis for coordination. However, if such
standards are not followed in spirit or action, external audit could decide
to severely limit any internal audit coordination. In all fairness to external
auditors, their professional reputations are always on the line, and the
work of internal audit must meet adequate professional standards. A real
constraint can exist, however, when internal auditors are not sufficiently
objective to recognize the need to perform their own work using proper
standards and practices.

c10.fm Page 231 Friday, November 19, 2004 12:18 PM



Sometimes, internal audit may expect a level of external audit reliance
on their work beyond that which is justified. For example, internal audit
may have performed a review in a given area but not properly documented
it through adequate workpapers. External audit may have to reperform
some or all of these tests due to this inadequate internal audit documenta-
tion. They may feel that it is easier to just do all of the work themselves.
Although the problem of achieving proper standards typically relates to
internal audit, the problem can also exist in reverse. For various reasons,
the work of external audit may not always meet the desired standards. For
example, an external auditor may not have an adequate understanding of
information systems controls. While this is a significant problem that must
be communicated to senior management, internal audit may also decide to
limit any coordination activities in this area. There may be other situations
where internal audit may look upon such coordination with considerable
skepticism. This is particularly the case when internal audit believes its
competence and understanding of a specialized area is superior.

•Possible External Auditor Organizational Deficiencies.The condition can
sometimes exist where partner-level persons responsible for the effective
audit support coordination are aware of the situation, but where that
message never reaches lower-level external audit personnel assigned to
the engagement, such as in-charge auditors or managers based in differ-
ent locations. The typical public accounting firm often has somewhat
autonomous offices in various cities. If an audit engagement uses
resources from multiple city offices, messages to coordinate the engage-
ment with internal audit can sometimes be lost. Major problems can also
exist in the form of overly rigid budgetary controls, where audit fee or
schedule pressures do not allow sufficient time for properly planning
internal audit participation. The external audit firm may set its own bud-
gets and schedules without consulting with internal audit, which may not
be aware of any plans for coordination until it has already made other
plans for audit resources. These practical problems can become signifi-
cant barriers to effective internal-external audit coordination.

•Potential Legal Liability of External Auditor.Another significant constraint
to effective coordination is that external auditors are increasingly faced
with legal responsibility for losses due to audit failures. Corporate failures
after the fall of Enron and the enactment of SOA have exacerbated this situ-
ation. A frequent assertion made in legal proceedings against external
audit is that injured parties relied on the auditor’s “clean opinion,” and the
financial deficiencies that were disclosed later could have been identified if
there had been a proper external audit effort. If internal audit standards or
work quality is weak, the external audit team may be reluctant to place
much reliance on the work of internal audit. Undue reliance by external
audit on internal audit work could potentially be asserted or believed to be
one of the bases for the failure to discover an audit deficiency.

As a result of these constraining factors, external auditors may sometimes be
extremely cautious about entering into any significant audit coordination efforts.

c10.fm Page 232 Friday, November 19, 2004 12:18 PM



If they do not see compliance with the internal audit standards, or see inade-
quate procedures, they may decide not to work with internal audit in any coordi-
nated manner. However, they should always communicate these concerns to the
organization’s audit committee. If the concerns are valid, internal audit should
consider improving its standards and procedures so that its work will be
accepted by the external auditors in the future. The AICPA’s SAS No. 65, as dis-
cussed previously, defines the factors external audit should consider when using
the work of internal auditors. Since external audit is ultimately the party that will
express an opinion on the fairness of the organization’s financial statements, they
must also make the final decision on using the work of internal auditors. Some-
times, external audit will fail to properly coordinate audit efforts despite the ade-
quacy of internal audit standards and procedures. The CAE should determine
the reasons for this failure. If the two parties cannot resolve the matter, both may
want to bring their dispute to senior management or to the audit committee.

You're Reading a Free Preview

/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->