MULUNGUSHI UNIVERSITY

SCHOOL OF BUSINESS STUDIES

PROJECT PROPOSAL

BY

STUDENT NUMBER: 201701040

SUPERVISOR: Mrs. Njebele Nsama

FACTORS THAT DETERMINE THE EFFECTIVENESS OF INTERNAL AUDIT

FUNCTIONS IN THE PUBLIC SECTORS

1.0 INTRODUCTION

The internal audit profession has undergone major changes due to financial crises. With the latest
global economic collapse and increasing cases of fraud, internal audit functions are becoming
vital in the public and private sectors. The management of public sector organizations is urged to
maintain an effective internal control system and, therefore, the roles of internal audit must be
well implemented. In accordance with the definition of internal audit defined by the Institute of
Internal Auditors (IIA), this study examining the roles and directives of internal auditors in
public sectors with respect to public sectors, the central objective of internal audit is to help to
the public The sector achieves its objective through an orderly and disciplined approach. This
can be achieved by improving the performance of the control and governance process. In the
field of work of the Internal Audit Unit in public sectors, all Divisions / Branches in Ministries /
Departments and Federal Statutory Bodies (which do not have the Internal Audit Unit) are
covered under the supervision of the Ministries. In accordance with the regulatory requirements
of the Auditor General

2.0 BACKGROUND OF STUDY

Risk is inherent in the decisions an organization makes to manage and administer its business
and in established business processes to help achieve its business objectives. Changes in the way
organizations carry out their normal activities as a result of, for example, business expansion or
changes in the regulatory framework, can put enormous pressure on an organization's control
mechanisms and become important sources of risk. That is why establishing, implementing and
incorporating effective elements of risk and control of the general corporate governance
framework are of fundamental importance for all organizations. Internal auditing can play an
important assurance role in an organization's governance processes, particularly in the area of
risk management and control. In many organizations, expectations placed on internal audit have
increased and paper is relied on to make a significant contribution. The primary objective of
internal audit is to help the Government achieve sound public financial and operational
management through effective public spending, financial accountability, and transparency.
Internal audit can be effective.
-If the organization meets its objectives by providing a systematic and disciplined approach to
evaluate and improve the effectiveness of risk management, control and governance processes.
"This definition recognizes two roles for internal audit:
- to provide an independent assurance service to the board, the audit committee, and
management, focusing on reviewing the effectiveness of the governance, risk management, and
control processes that management has implemented.
- Provide management advice on governance risks and controls, for example the controls that
will be needed when starting new business ventures.

- if they can achieve the objectives of the administration adding value and improving the
operations of the organization
- whether they can help the organization achieve its objectives by providing a systematic
disciplined approach
- if you provide the audit committee and executive management with the assurance they need as
well by providing assurance about the risk that matters to the organization and making
recommendations for improvement that management adopts and implements.
- The other way to determine if internal audit is effective is to ask stakeholders if they are
comfortable, that is, if they are receiving the security they need.
- However, internal audit has not achieved this objective, as evidenced by the numerous frauds
and scandals in the public sector. Public sector scandals like the above raise questions about the
effectiveness of internal audit in the public sector. Corruption, lack of transparency and
responsibility are integral parts. Therefore, it is important that Internal Audit functions are an
integral part of Public Financial Management Reforms in Ministries / Departments and counties
to enable the country to achieve its intended objectives, as many other developing countries
suffer severe Internal Audit deficiencies with few staff. Inadequate administrative support,
training and development, and many more. There is a high percentage of these organizations
where internal audit units or departments cannot operate effectively as a result of severe staff
shortages and lack of proper audit skills, cynical exploitation of internal audit units, such as
simply further training the rationale for its personnel requirements weaken the effectiveness and
credibility of internal audit units in all government departments and agencies. Decisive study on
the above issues has been lacking while focusing on the underlying factors in a successful
internal audit, especially in the public sector. Therefore, this study will be carried out to examine
the factors that affect the effectiveness of internal audit in the public sector in government
ministries.

2.1 Problem Statement

As Ministry of Agriculture and Ministry of Fisheries and Livestock, the challenges are the same
of having misapplications, misappropriations, stores, irregular payments, and fuel, as a result
you can tell that internal audit is not effective by number of external audit Queries, The more
external queries, the more ineffective they are

2.2 Purpose of the study

the purpose of the study is to identify the factors that determine the effectiveness of internal audit
compared to external audit in the public sector.
2.3 Research objectives
This research report will be guided by the following research objectives;
2.3.1 General objective
The overall objective of the study is to identify the factors that determine the effectiveness of
internal audit compared to external audit in the public sector.

2.3.2 Specific objectives

• Examine whether it is a relationship between internal audit and external audit in an efficient
department.

• Identify whether internal audit contributes to the achievement of management objectives in

relation to external audit.
Evaluate whether internal audit can help organizations achieve their objectives by also providing
a systematic disciplined approach
• Examine the contributions of management's perception to the effectiveness of internal audit in
organizations.
2.4 Research questions
Here are the research questions from the study;
1. Is the relationship between internal audit and external audit effective?
2. Does internal audit help achieve management objectives compared to external audit?
3. Is internal audit capable of helping organizations achieve their objectives by also providing a
systematic disciplined approach?
4. Are the contributions to management's perception useful for the effectiveness of internal audit
in organizations

3.0 LITERATURE REVIEW

3.1 Public Sector Governance

The public sector is made up of governments and all publicly controlled or financed agencies,
companies, and other entities that offer public programs, goods, or services. A public sector
organization may exist at any of these four levels, which include international, national, regional,
and local government. On the other hand, public sector governance encompasses the policies and
procedures used to direct the activities of an organization to provide reasonable assurance that
objectives are met and that operations are carried out in an ethical and responsible manner. The
various public sector reform programs have been launched with the aim of ensuring good
governance and better accountability of public agencies. The general objectives of improvement
programs are to guarantee better service delivery and, subsequently, to guarantee more
transparent, responsible and inclusive and participatory decision-making processes of public
agencies. However, the public sector continues to be criticized for poor governance. This is
evidence through the speech delivered by the Auditor General:
"... Year after year, the Parliamentary Audit Committee (PAC) has highlighted weaknesses and
irregularities in public procurement at all levels, be it at the federal, state and local government
level, as well as statutory bodies. Some of these weaknesses and irregularities involve serious
violations of established procurement guidelines and procedures. Based on the above scenario, it
is therefore imperative that the public sector governance and performance needs to be improved.
In order to make that happen, the internal audit unit of the public sector must play an important
role in ensuring the transparency and accountability of the public sector governance.

3.2 Internal Audit Function

International auditing standards define the evaluation of internal audit activity as an entity
organized as a service for it. The internal audit functions are, among others:
- exam;
- evaluation;
- monitoring the adequacy and effectiveness of internal control.
The internal audit reviews the entity's activities and services, mainly to improve them. It leads to
strict policies and procedures established by that entity and are not limited to financial matters.
The internal audit is: - a permanent review of the entity's economic activity; - an independent
evaluation activity for the management of the economic entity, by examining financial
operations, accounting and other services in general; - an assessment of conformity assessment
tasks and accounting records, reports, assets, capital and results; - a certificate or certification of
financial accounting documents. Internal audit is a function of the entity's control structure. It
should not be confused with the entity's internal control structure. The two departments are
separate and independent; they are not in the subordinate relationship. Responsible for carrying
out internal audits, coordination of work or commitments, the signing of internal audit reports
must be internal audit. The internal auditors are permanent employees of the entity and are
directly responsible to the entity's management or the General Assembly of Shareholders.
Internal auditor: advising, helping, recommending, but not deciding, their obligation is to provide
a means to improve the control that each manager has over his activities and those in
coordination to achieve the objectives.

In public sector organizations, the internal audit function has a high potential to promote
accountability and improve government performance. In view of this development, several
countries have developed policies aimed at strengthening the internal audit functions of the
public sector to increase its capacity to contribute to these objectives. The establishment of
internal audit units, professional standards to carry out audit work, training and allocation of
resources were some of the few steps taken by the government of certain countries to promote
responsibility in internal audit. However, public sector operations are inflexible where there are
more laws and regulations authorizing internal audit activities. There are two types of audits that
are applicable to the public sector: finance-related audits and performance audits. Audits related
to finances are audits that contain ideas about financial statements or were based on the audit of
financial statements. The objective of a financial statement audit is to decide whether the
financial statements are fair. The performance audit highlights whether public assets are being
used properly, with the aim of recognizing and reducing waste. The public sector audit is divided
into two, which is the internal audit and the external audit. Internal auditors are government
employees and external auditors are actually employees of the Auditor General who are in
different government ministries or agencies for a period of time before they are transferred to
another department. According to the main difference between the internal and external auditor
in the public sector is that the head of reports of the internal auditor is the Permanent Secretary of
the Ministry in which they are located, while the head of reports of the external auditor is the
Auditor General (de shareholders) itself.

3.3 Investigations on internal audit in the public sector.

The internal audit of the public sector has been reviewed by several investigators around the
world. Not surprisingly, many countries face dilemmas in managing internal audit in their
country. It used to be that internal auditing in the public sector served as a simple administrative
procedure that consisted primarily of verifying the accuracy of transactions, verifying and
controlling prepayment, counting assets, and reporting past events to various types of
administration. Based on a combination of forces, it has led to a silent revolution in the
profession in recent years. Governments moving towards higher levels of transparency must
demonstrate responsibility for the use of public money and efficiency in the provision of
services. Larger and more complex operations require greater competence and professionalism
from internal auditors to minimize and manage risk. Very few researchers have conducted
internal audit studies in the public sectors. Research also of

4.0 FINDINGS AND DISCUSSION

4.1 Independence of Internal Auditors

For both external and internal auditors, their independence from those whom they audit is crucial
for the success of their function. For internal auditors, it is more difficult to achieve
independence because they are actually “employees of the (ministries) organization”, the
Permanent Secretary is the superior officer for all internal auditors. Therefore, reports made by
the internal auditors will usually favor the Permanent Secretary which disturbs the independency
of internal auditors

Discussion of findings

Findings from the interviews conducted on internal auditors from two government ministries
shows that the independence level of internal auditors varies according to the ministries they
work in. The independence of internal auditor affects the internal audit effectiveness as the
auditors face dilemma on whether being independent and objective in doing their duty although
they might face problems with the Secretary General and other employees of the ministry or
produce a report that favors the ministry. In a research done on Internal Audit in the Statutory
Bodies and Government-linked Companies, I interviewed several internal auditors in regards to
their opinion on the independence of internal auditors in the public sector. The results of the
interview were shocking as the independence of internal auditing in public sector has many
loopholes. The situation is quite serious where one of the auditors lamented that once an audit
head was demoted due to his or her “aggressive” reporting. I came up with this statement in my
report explaining that the independence of internal auditor is still a dream. “There is perhaps no
surprise why the independence of the audit unit is still such a long way from being achieved. As
disclosed by the auditor, the audit committee which, even though it is around, is not that active!
Indeed, when a body such as an audit committee, whose function among others is to work
closely with the auditors, is around merely to look good on paper, what does one expect to take
place on the ground? The internal auditor effectiveness is very much affected by the
independence of internal auditors. If the internal auditors were not independent, the report they
produce will be biased which in turn is useless in improving the accountability and transparency
of the public sector as a whole. The objective and independent report produced by the internal
auditor is one of the main keys to prevent scandals and frauds happening in the public sector. In
fact, this is the main reason the internal audit function is set up in the ministry the first place.
Government auditing is a cornerstone of good public sector governance. By providing unbiased,
objective assessments of whether public resources are responsibly and effectively managed to
achieve intended results, auditors help government organizations achieve accountability and
integrity, improve operations, and instill confidence among citizens and stakeholders

4.2 Competency of Internal Auditors

Competency is the ability of an individual to perform a job or task properly, being a set of
defined knowledge, skills and behavior. In order to achieve competency, various types of
training and development should be provided to internal auditors. A competent internal auditor
will have all the skill necessary to produce a good audit report

Discussion of findings

Findings from the interviews conducted on internal auditors from two government ministries
indicated that competency of internal auditor is very crucial in maintaining the effectiveness of
public sector internal audit. Training and development and knowledge of internal auditors are the
main key towards an effective audit committee. An auditor without sufficient knowledge cannot
be trusted in producing a good audit report.

4.3 Relationship between Internal Auditor and External Auditor

External audit and internal audit are clearly separate and distinct in their respective roles and
duties, but there must be regular communication between the two. In this, the second of two
articles, I look at the working relationship between the internal auditor and the external auditor.
1. Legal right of access of an auditor
A company's auditor (this refers to the external auditor) has a right of access to information
(Companies Act 2006, section 499) and this would include finalized internal audit reports,
supporting working documents and the right to obtain information and explanations of any
employee and officer, including internal auditors, of the company.
The internal audit function must also have an unlimited right of access to all the information,
explanations and records necessary to carry out its work. This right must be clearly established in
the organization's internal audit letter approved by the audit committee.
2. under International Standards on Auditing (ISA) (United Kingdom)
The relationship is described in several of the ISAs (United Kingdom), namely ISAs 240, 315,
600 and, above all, ISA (United Kingdom) 610.
• ISA (United Kingdom) 240: The auditor's responsibilities in relation to fraud in an audit of
financial statements, establishes in paragraph 19 that “For those entities that have an internal
audit function, the auditor should make inquiries to individuals appropriate within the function to
determine whether they are aware of any real, suspected or suspected fraud affecting the entity,
and to obtain their views on the risks of fraud. "
Internal audit can also provide information on weaknesses in fraud controls and / or fraud risk
indicators within the organization.
• ISA (United Kingdom) 315: identifies and evaluates the risks of material misstatement through
the understanding of the entity and its environment, establishes in paragraph 23: “If the entity has
an internal audit function, the auditor will obtain an understanding the nature of the
responsibilities of the internal audit function, its organizational status and the activities carried
out or to be carried out. "
The external auditor will want to know at least the following regarding the internal audit
function:
• Is there an internal audit letter?
• What is the size of the internal audit section?
• Qualifications and ongoing professional development of internal audit staff.
• Reporting structure to management.
• Details about the audit committee, if it exists.
• Annual audit plan and performance against that plan.
The external auditor will also want to read copies of the reports issued during that exercise and
meet with the Chief Internal Auditor, or equivalent.
• ISA (UK) 610: The use of the work of internal auditors contains an important condition at the
beginning of the rule that “Nothing in this ISA (UK) requires the external auditor to use the work
of the audit function. Internal to modify the nature or timing, or reduce the length, of the audit
procedures to be performed directly by the external auditor; it remains a decision of the external
auditor in establishing the overall audit strategy. "
Paragraphs 21-25 of ISA (United Kingdom) 610 state that “if the external auditor plans to use the
work of the internal audit function, the external auditor should discuss the planned use of his
work with the function as the basis for coordinating their respective activities. "
ISA (UK) 610 imposes restrictions on the extent to which external auditors can trust the work
performed by internal audit. The use of direct assistance is prohibited under Paragraph 5-1 of
ISA (United Kingdom) 610 which states that "The use of internal auditors to provide direct
assistance is prohibited in an audit conducted in accordance with ISAs (United Kingdom)".
Direct assistance is defined in the International Auditing and Assurance Standards Board as: "the
use of internal auditors to perform audit procedures under the direction, supervision and review
of external auditors". Paragraph 30 of ISA (United Kingdom) 610 states that "the external
auditor shall not use internal auditors to provide direct assistance in performing procedures that:
• It involves making significant judgments in the audit.
• Relate to higher assessed risks of material misstatement when the judgment required to perform
the relevant audit procedures or evaluate the collected audit evidence is more than limited.
• Relate to work in which internal auditors have been involved and that has already been or will
be reported to management or those charged with governance by the internal audit function.
For example, if stock/inventory is a material item, and is considered by the external auditor to be
an area of higher risk, it would be acceptable for the external auditor to request that internal audit
review the processes and controls relating to stock management, but it would not be appropriate
for them to request that internal audit assess the adequacy of stock provisions as this would
involve more than limited judgment

3. Advantages of coordination and collaboration between external and internal

audit 

 Close communication and planning ensures that audit resources can be directed towards
the area of most need i.e. high-risk areas of the organization. This means that internal
audit can plan their work to minimize duplication with external audit testing and to
provide assurance over those systems and controls on which external audit may wish to
place reliance, subject to appropriate review procedures being applied.
 The audit teams can plan the timing of their work to minimize disruption and interference
with key members of staff.
 The audit team can share intelligence on key events, changes and plans that may impact
on the risk profile of the organization and therefore, on their work.

4. Challenges that may arise within collaboration between external and internal
audit

 The Head of Internal Audit must balance requests from external audit against the need to
provide appropriate coverage over the organization’s key risk areas, to enable them to
provide an annual opinion. This may result in high demand for limited resources and the
Head of Internal Audit will need to ensure appropriate compromises are reached.
 A close relationship with external audit may cause a shift in the perception of internal
audit from being a critical friend to a policing function. It is crucial for internal audit to
retain the trust of the management team and staff so that they can perform their work
effectively.

5. Examples of good practice of effective communication between external and

internal audit
To have a smooth working relationship between the two sets of auditors, it is crucial that there is
effective and regular communication between the Chief Internal Auditor (or senior team
member) and the External Auditor (e.g. the audit engagement partner or one of the senior team
members). This will be helped by:

 Discussions at appropriate intervals during the year on any major matters which may
affect the work of either party.
 Full and prompt access to reports issued by the internal audit function during the year.
 Full and prompt access to the internal audit plan of work, audit files and testing.
 The audit committee facilitating communication between internal audit and external
audit.

It is very important for both Internal and External auditors to have a good professional
relationship. Coordination and cooperation between internal and external auditors has major
influence in producing a quality audit report. Examples of such coordination and cooperation
include joint planning and exchange of information, opinions, and reports to facilitate higher-
quality audits and prevent unnecessary duplication of work. Both these audit parties should
establish a professional working relationship, share information and coordinate audit activities.
Auditors from three different departments have shared their relationship level among each other.

Discussion of findings

Interviews conducted on the internal auditors from the two ministries depicted the different types
of relationship each internal audit department have with their external auditor. The importance of
a good relationship between internal and external auditor cannot be denied in maintaining an
effective internal audit system in the public sector. There are five types of relationship between
internal auditor and external auditor. These are: information sharing; planning the whole of the
audit program together; allocating specific tasks; serving as assistant to the external auditors in
preparing schedules; and, receiving training from the external auditor. Other than that, informal
communication is also important for a good relationship between the two parties. In my study, i
have identified through these cases of the importance of interaction between two parties. The
internal auditor may face independence issue as they are the staff of the organization, however
the external auditors do not face these problems as they report directly to the shareholders.
A good relationship will help internal auditors to solve the on-going mismanagement in the
organization whereby they can suggest the external auditor to audit certain topic that needs
attention and it is Stated that over 80 percentage of internal audit unit have some sort of working
relationship with external auditor and over half of the internal auditor from these audit units
claims to have a close working relationship with external auditor.

4.4 Other Findings

4.4.1 Ad hoc Duties

In the public sector, there is so much for the internal auditors to cover in spite of the staff
restraints however they also need to carry out the organization’s operational responsibilities
alongside their internal audit duties, for example answering the audit observations and doing ad
hoc works. In my interview, i have received different opinions on how the ad-hoc duties affect
the effectiveness of internal auditing in the public sector. The additional organizational task
internal auditors have to perform seems to be another dilemma faced by internal auditors in the
public sector. In the three audit units i interviewed, the internal auditors came up with different
responses on this matter. Some of them have no problem with the ad hoc duties given to them
while others admit that they are facing troubles due to these additional organizational tasks.
At the Internal Audit, Internal Control & Compliance, there is so much for the internal auditors
to cover despite the staff constraints, therefore in certain cases, the independence of internal
auditors seems to have been compromised by them being required to perform the organization’s
operational tasks alongside their internal audit duties, for example replying the audit
observations and doing ad hoc jobs. As a result, the quality of auditing is affected and it is not
surprising therefore that what little audit they could conduct is just confined to the financial
control assessment instead of mitigating potential fraud cases. In the research I conducted on the
internal audit , From this report, there was also one particular case where, in the closed-ended
section of the interview session, the responses indicated that the internal audit personnel do not
conduct operational activities for the organization. However, in the open-ended section of the
interview, the responses clearly indicated that the head of the organization specifically assigned
the audit head the task of preparing group account for the organization. All in all, it can be said
that the ad hoc duties internal auditors have to perform affects the quality of the auditing. This in
turn affects the internal audit effectiveness in the public sector.

4.4.2 Interaction between Auditor and Auditees

It is significant that a good relationship exists between the auditors auditees in the organization.
Without such connection, the auditors might as well not be around; and if they are still around,
their job experience usually becomes quite a painful one. The auditees are typically all the other
parties in an organization that the internal auditor audits. A good relationship between internal
auditor and the other parties in an organization is important so that coordination and cooperation
can be established which will ease the process of internal auditing. However, what happens in
the public sector is that the relationship between internal auditors and the auditee is not as
smooth as we thought it would be. Based on the cases above, most of the auditors face
difficulties in communicating to other parties in the organization. There is a lack of
understanding regarding the role of internal auditor as independent examiner in the organization,
and that there is also a lack of appreciation of the value and importance of the audit unit in the
organization. All the evidences above shows that majority of the internal audit function in the
public sector have a negative relationship with the auditees in the public sector. Without a good
support from the auditee, the internal auditors will have a hard time in completing the auditing
process which definitely will affect the internal audit effectiveness.

5.0 CONCLUSION AND RECOMMENDATION

For audit of any kind to be successful in achieving its potential, it needs to operate in an
environment where transparency and public accountability are normal occurrences, In public
sector, transparency and accountability plays an important role in ensuring a good and successful
audit. However, it is still far away from achieving transparency and accountability in its public
sector management. Auditor General has lamented in his speech on the question that always arise
on what really happen to those responsible for all the wastefulness, extravagance and fraud
highlighted by audit be they high profile cases. How many people been taken to court, how many
have disciplinary action taken against them? Some may even feel that there is no point for the
AG to prepare his report when at the end of the day nothing happens! At the end, all the
problems reflect to the internal audit department of the public sector. The public began to
question on the effectiveness of internal auditing in the public sector. In my research i have
identified the main factor that affects the effectiveness of internal auditing in public sector and
how this factors cause dilemmas does to the internal auditors. The findings are obtained from
qualitative interview with the internal auditors in public sector.

RECOMMENDATION

“Internal auditors, as custodian of public trust, and being independent and professional, are in a
good position to help the nation spend wisely. More so with the explicit Government
encouragement of good governance, accountability and integrity in the public service.” (This is
the statement by our Auditor General in his speech on Enhancing Accountability and Integrity in
Public Sector- Are we doing enough). From this statement, it can be seen that internal auditors
plays an important role in public sector. However, the dilemmas internal auditors are facing must
be solved to ensure effectiveness in public sector internal auditing.
The first recommendation is on the independence of internal auditor in the public sector. The
internal auditor should have maximum independence from the ministry they work in. The
internal audit activities must be positioned in such a way that it may obtain cooperation from
ministry that being audited that have free, unrestricted access to all functions, records, property
and personnel including those charged with governance In order to achieve this, they must report
to the Auditor General and not to the Permanent Secretary of the Ministry.
Management must ensure that the right controls are in place to monitor and measure business
practices and behaviour, that the right management team is put together, and the culture includes
an enterprise wide commitment to understanding and embracing corporate values. Good
governance starts and ends in the boardroom and senior managers’ offices. It does not start or
end in a statute. The internal auditors should not be randomly moved in and out of the ministries
but the movement should be based on their work performance and skills.
As for the competencies, the internal audit staffs need to collectively possess or develop their
knowledge or skills through appropriate professional training and development program such as
obtaining Chartered Internal Auditor (CIA) qualifications.In order to improve the relationship
between internal auditor and auditee, internal auditor should engage with auditee on a periodic
basis from the beginning till the end of the audit process to discuss audit objectives, audit plan,
audit findings and audit conclusions. The discussion should go beyond the audit process to
discuss potential solutions to the business issues observed from an operational perspective as
well as their impact on risk and compliance.

6.0 LIMITATIONS AND FUTURE RESEARCH

Throughout this research, there were some unavoidable and unfixable issues. Although this
research is done to show the effectiveness of internal auditors in public sector, only two
ministries involved in this research. The interview was conducted on few auditors only. Thus,
this research will not be able to portray the whole public sector.
Besides that, there were also some restrictions in the interview sessions. Some of the
interviewees did not allow their conversation to be recorded. There were also some interviewees
who allowed their conversation to be partially recorded. Hence, interviewers faced difficulties to
recap their good points. The results of this research may seem to be biased as the majority of the
interviewees were internal auditors. The number of external auditors and internal auditors
interviewed were not equal. This research should serve as a reference for the future researches on
internal auditing in public sector especially in the public sector. An in-depth study should be
conducted on the internal auditing in public sector in order to fully identify the weaknesses of the
internal auditing system