Available online at www.sciencedirect.

com

ScienceDirect
Procedia Economics and Finance 15 (2014) 1265 – 1272

Emerging Markets Quueries in Finance and Business

Analysis of internal auudit practices on FTSE100

a
Cordoú George-Silviu
G *
a
Babeú-Bolyai University Cluj-Napoca, Faculty of Economics and
a Business Administration, Teodor Mihali St, No. 58-60, Cluj-Napoca,
4000591, Romania

Abstract

Internal audit is an activity of strategic importance whhen it comes to the management and control processes within a
company, especially in the current post-crisis period. Byy using diverse procedures and work techniques, the internal audit
function offers a comprehensive analysis and a complete overview of on-going activities – an image achieved by examining
work methods used within the company, its organizaational structure and its processes. Therefore, internal audit is
considered to bring added value to the business and offeers assurance that the internal control system is operational. As a
result, internal audit also conveys transparency when linked with the company’s corporate governance compliance.
This paper sheds light on the practices of internal auditt by observing work methods, the positioning and organizational
structure and the processes regarding the internal audit function, when applied in 40 listed companies in the FTSE 100
index, London Stock Exchange. This study plans to ansswer key questions like “Is the internal audit function efficient in
Great Britain’s most important companies?” but also “How does internal audit help achieve proposed objectives?”.
By firstly approaching the notion of internal audit from a theoretical point of view, we’ve outlined its conceptual frame, as
well as facts regarding its purpose, scope and organizatioonal matters. Later, and most significantly, we investigated internal
audit in practice, by trying to present our findings in a loggic and coherent sequence.
Hence, we’ve analysed internal audit practices at 40 listeed companies on the London Stock Exchange Financial Times 100
index (FTSE 100). Our results are synthesized by using a predefined frame containing key aspects regarding internal audit.
This study does not plan to represent a thorough investigaation of aspects on the topic of internal audit practices because it is
based solely on data collected from the 40 companiess. Thus, our results are limited, and if we had picked different
companies, our results might have been slightly altered. Either
E way, our conclusions confirm the fact that most companies
have implemented and use a worthy internal audit functioon.
© 2014 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license
© 2013 Published by Elsevier Ltd. Selection and/or peer-review under responsibility of Emerging
(http://creativecommons.org/licenses/by-nc-nd/3.0/).
SelectionMarkets Queries
and peer-review in Finance
under and of
responsibility Business loccalMarkets
the Emerging organization
Queries in Finance and Business local organization
Keywords: audit committee; corporate governance; FTSE100; Loondon Stock Exchange; internal audit; risk management

* Cordoú George-Silviu, PhD Student Accounting and Audit Department Tel.: +4072186542
E-mail address: george.cordos@econ.ubbcluj.ro

2212-5671 © 2014 The Authors. Published by Elsevier B.V. This is an open access article under the CC BY-NC-ND license
(http://creativecommons.org/licenses/by-nc-nd/3.0/).
Selection and peer-review under responsibility of the Emerging Markets Queries in Finance and Business local organization
doi:10.1016/S2212-5671(14)00587-5
1266 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272

1. Introduction and key concepts

Internal audit is an activity that bringsa long-term positive impact for the control and management processes
of the company. Internal audit offers a company a complete perspective of its operations, bringing added value
to the business and assuring the management that their activity and decisions are adequate. Internal audit also
examines work methods used within the company, its organizational structure, its processes and its link to
corporate governance guidelines.
Internal audit is defined by the I.I.A. (Institute of Internal Auditors) as an independent and objective activity
that provides an organization assurance regarding its operations; it guides it towards improving them and
contributes by bringing added value. Also, by evaluating the management process, the governance and
controlling process, but also risks the organization is exposed to, internal audit offers solutions to improve
efficiency and cover deficiencies. Regarding the internal audit link to corporate governance, Great Britain’s
Chartered Institute of Internal Audit, according to the Cadbury Report (1992) concludes that for the monitoring
of compliance with corporate governance guidelines, the internal audit activity examines and guides the
company to accomplish objectives related to ethics, responsibility and efficiency in administration (Tiron-
Tudor, 2007: 102-103). Irimieet. al (2007) states that internal auditor is responsible for risk, internal control and
the entity’s administration, that he must follow a deontological code and, as GhiĠăet al. (2005) also states, the
I.I.A. must and has regulated the way in which an expert can become a Certified Internal Auditor in of the 120
countries with national affiliated institutes.
GhiĠăet. al (2005) and BoĠa-Avram (2009)discuss about the organization of an internal audit department and
about the need of distinction and separation of internal audit and external audit. The internal auditor is, in many
cases, a direct employee of the company, but he still has great independence within the company, while the
external auditor is completely independent and out-sourced. This separation is also enforced, in the U.S. by the
Sarbanes-Oxley Amendment which states that a company cannot use the same audit company for both external
audit services and internal audit consultancy. As for the position of the internal audit department, ‫܉‬ingău
(2007) and Vlad (2012) argue that the I.A. department can report either to the Audit Committee, either directly
to management.

2. Research method

This paper firstly defines the concept of internal audit with its purpose, scope and organizational matters
and then, in a logic and coherent sequence, it presents our findings in internal audit practices, this being the part
this paper mostly relies on. To reach the objectives of this study with the main theme “internal audit practices”,
we have chosen a deductive approach, starting from theoretical aspects, but also an inductive approach because
we rely on observation and induction.
Weaim to analyse the internal audit practices on a sample of listed companies on the Financial Times 100
index on the London Stock Exchange, through an empirical study. To accomplish this, we’ve selected the first
40 listed companies, by market capitalization. The argument behind this selection is that these companies,
because of their reputation and performance, will offer a complete image regarding their internal audit
practices. For this, we’ve analysed the Annual Reports found on each company’s website, for the year
2012.After collecting the data, we’ve examined each company’s annual report for key information regarding
the internal audit function, by using a predefined array of questions, as presented in the Research findings
section of this paper. What we bring new is an analysis of internal audit practices of different sectors of activity
because we consider it to offer a better image of internal audit practices by their necessities and operations. To
offer consistency, we’ve only analysed sectors with at least 3 companies from the 40 initially picked. Thus,
only these sectors will be evaluated separately:
• Banking: HSBC Holdings, Standard Chartered, Lloyds Banking Group, Barclays, Royal Bank of
Scotland Group;
 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272 1267

• Mining: Rio Tinto, BHP Billiton, Xstrata, Anglo American, Glencore International, Fresnillo,
Antofagasta;
• Oil & Gas Producers: Royal Dutch Shell, British Petroleum, BG Group, Tullow Oil;
• Pharmaceuticals & Biotechnology: GlaxoSmithKline, Astra Zeneca, Shire.

3. Research findings

When it comes to external audit, we’ve come to the conclusion that all companies are audited by one of the
”BIG 4” auditing companies, as follows: 13 companies by PricewaterhouseCoopers (32%), 14 companies by
Deloitte (35%), 10 companies by KPMG (25%) and only 3 companies by Ernst&Young (8%).The first aspect
regarding internal audit practices is the query about the existence of an internal audit department and if not
implemented, any records in the Annual Report on the reasons why. We’ve found that only 2 companies have
not implemented an internal audit department; also, they’ve not stated their reasons in the Annual Report. The
rest of the companies have all created an internal audit department.
Another aspect is the examination of the departments’ independence within the company.Out of 40
companies, in 9 (22.5%) the position it not presented. In another 13 companies, the department and its chief are
subordinated to the Chief Executive Officer of the Chief Financial Officer. For another 29 companies (72.5%)
the department is subordinated to the Audit Committee. As we can see, in a number of companies, the internal
audit department answers to both the CEO/CFO and to the Audit Committee.
Furthermore, regarding internal audit roles and responsibilities we can conclude that the majority of the
companies have implemented and use a worthy internal audit function. In 38 of them (95%), the internal audit
function assists the management and the board (or the supervisory board) in improving the controlling and
risk management process. The same tendency is confirmed when verifying if the internal audit guarantees
compliance with the law and with internal standards/ procedures – 32 companies, or 80%. In only 65% of the
companies, or 26, the internal audit verifies compliance with corporate governance guidelines. The
efficiency of operations is being analysed by the internal audit department in 90% of the companies, whereas
the monitoring of the risk management process (together with the risk management department) is being
evaluated by the internal audit department in 77.5% of the cases, or 32 companies. In only 25% of the
businesses, the internal audit process includes examinations of financial reporting and accounting practices.
Last but not least, only 2 companies state in their Annual Reports that ad-hoc internal audit missions are being
undertaken, although we believe that these might occur in the other 38 companies as well, but the aspect is just
not specifically logged in their Annual Reports.
Another analysed aspect is the internal audit department organization. In more than half of the analysed
companies, the internal audit department is entirely staffed with specialists from within the company: 60% or
24 companies. Another 13 companies (32.5%) have preferred a co-sourced alternative, using both staff from
within the company and out-sourced specialists. One company has opted for an entirely out-sourced internal
audit department, and another two companies, as stated above, have not implemented the internal audit
department at all, thus information about its organisation cannot be found either.
We’ve searched for the internal audit reports, published either on the internet pages of the companies, or
bundled together with the Annual Report, but have found that these are not publically available at none of the
40 companies.An additional analysed section is the relationship between the internal audit department and
the audit committee. Our findings suggest that in the majority of cases, 95%, internal audit reports are
regularly presented to the audit committee. Also, the chief of the internal audit department is proposed and
appointed by the audit committee in 92.5% of the cases. The audit committee also monitors the efficiency of
the internal audit department (and its chief) in 92.5% of the companies, or 37 companies.
The internal audit reports are being sent to both the executive management and to the Audit committee in
92.5% of the companies. The rest have not specified in their Annual Reports who the internal audit report is
being addressed to, but we can speculate that in one case the report could be sent to the Audit Committee
and/or executive management, because the company has an internal audit department; whereas in the other two
1268 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272

cases, where no internal audit department exists, the reports, if compiled, are being addressed to the executive
management.

Internal audit practices analysis by sectors of activity

Regarding the existence of an internal audit department, we can report all the companies in this sub-analysis
have implemented an internal audit department.
Next, we went on to find several aspects regarding internal audit practices, which we present in the following
table (Table 1).

Table 1. Aspects of internal audit practices in different sectors of activity

Sector of activity (% if the companies)

Aspect Question
Banking Mining Oil&Gas Pharma&Biotech
Not defined 0% 14% 0% 0%
Internal audit The internal audit is subordinated to the Audit
100% 29% 25% 0%
position within the Committee
company The internal audit is subordinated to the
40% 71% 100% 100%
CEO/CFO
Internal audit assists management and the
Board in refining control and risk management 100% 100% 100% 100%
procedures
Internal audit assures management of the
company’s operations compliance with, on one
100% 100% 75% 100%
hand the law, and on the other hand the internal
procedures;
Internal audit The internal audit function monitors the
roles and 100% 100% 100% 67%
efficiency of tasks
responsibilities
Internal audit assesses the financial reporting
20% 0% 50% 67%
process
Internal audit verifies compliance with
80% 57% 75% 67%
corporate governance guidelines
Risk management process is evaluated by
80% 100% 50% 67%
internal audit
Ad-hoc internal audit missions are undertaken 0% 14% 0% 0%
The internal audit department is entirely staffed
Internal audit 100% 57% 25% 33%
with specialists from within the company
department
Co-sourced system of staffing 0% 29% 75% 67%
organization
Out-sourced department of internal audit 0% 14% 0% 0%
Not defined 0% 14% 0% 0%
The relationship Internal audit reports are presented to the Audit
100% 100% 100% 100%
between internal Committee
audit and the The internal audit chief is appointed by the
Audit Committee Audit Committee and the A.C. monitors the 100% 86% 100% 100%
efficiency of internal audit
Audit reports are presented only to
0% 0% 0% 0%
Internal audit management.
reporting Audit reports are presented to both
100% 100% 100% 100%
management and the Audit Committee.

• Banking sector particularities

Regarding the audit department position within the company, in two out the companies the department is
subordinated to both the Chief Executive Officer/ Chief Financial Officer, and to the Audit Committee. For the
rest, the internal audit department answers only to the Audit Committee.
 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272 1269

All the companies in the banking sector have an intternal audit department staffed with employees from within
the company solely - this could be because of confiidentiality concerns. Last but not least, in all companies the
internal audit reports are being presented on a reegular basis to the Audit Committee, which monitors the
departments’ efficiency. Internal audit findings and results are being reported to both the Audit Committee and
to the executive management. Correlated with thee fact that in only two companies the audit department is
subordinated to the CEO/CFO, we can conclude that in the case of the other 3 companies, they report to
executive management even if not obliged to.

• Mining sector particularities

mpany is not recorded in one of the seven companies. Also,
The position of the audit department within the com
we have found evidence in one company’s Annual Report
R that the internal audit department is being controlled
by both the executive management and the Audit A Committee;in another case only by the executive
management, whereas in the other 4 companies the internal audit department is exclusively subordinated to the
Audit Committee, as seen in Figure 1.

:ƵƐƚƚŚĞƵĚŝƚ
ŽƚŚƚŚ
ŚĞĞdžĞĐƵƚŝǀĞ ŽŵŵŝƚƚĞĞ͕͘ϳϭ͘ϰϯй
ŵĂŶĂŐĞŵĞŶƚĂŶĚƚŚĞ
EŽŝŶĨŽƌŵĂƚŝŽŶ14.29%
Ϭ͘ϬϬй ϭϬ͘ϬϬй ϮϬ͘ϬϬй ϯϬ͘ϬϬй ϰϬ͘ϬϬй ϱϬ͘ϬϬй ϲϬ͘ϬϬй ϳϬ͘ϬϬй ϴϬ͘ϬϬй

Fig 1. Internal audit department position within the company, miining sector

Regarding internal audit roles and responsibilitiees, in only 4 companies (57%) internal audit also verifies the
acquiescence with corporate governance recommenddations. Internal audit does not verify the financial reporting
process, all Annual Reports stating that the Audit Committee has this responsibility. Furthermore, only one
company states to have completed ad-hoc internal auudit missions.

Inteernal Audit department organization

ϭϰй Internal Staff only

Ϯϵй ϱϳй Internal Staff and External Staff: Co-

sourced
Completely outsourced

Fig 2.Internal audit department organization, mining sector

No clear connection between the internal audit department
d and the Audit Committee can be found at one of
the companies, but at all of them the internal audit reports
r are being presented to the Audit Committee. Alas, in
only 6 companies the internal audit chief is appoinnted by the Audit Committee, and the committee supervises
the efficiency of the departments operations. The otther company is the company that has outsourced its internal
audit function.
Last but not least, in all companies the internal audit results and findings are directed to both the executive
management and, of course, the Audit Committeee. Despite the fact that at one company the internal audit
department position is not recorded, and at the otherrs the audit department is either subordinated to the CEO (1
case), to the Audit Committee (4 cases) or to both (1 case), we can observe that all companies report to both
functions.
1270 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272

• Oil & Gas Producers sector particularities

The internal audit department position is stated in all Annual Reports: in 1 company the department is
placed under the Audit Committee and under the exxecutive management, while in the others the department is
only subordinated to the Audit Committee.
Regarding internal audit roles and responsib bilities, in 3 out of 4 businesses the internal audit offers an
assurance that the company respects the law, the innternal procedures and the corporate governance guidelines.
In 50% of the companies from this sector the interrnal audit also verifies the financial reporting process, and
also in 50% of the companies the risk management system is being evaluated by the internal audit department.
In none of the cases, ad hoc missions have been unddertaken.
Another aspect is the departments’ organizattion. 3 companies have chosen to staff the department by
using internal specialists, while the other company has
h chosen a co-sourced method.

The audit
Ϯϱй
й department is staffed
using internal
specialists
Co-sourced method
of organising the
ϳϱй internal audit
department

Fig3. Internal audit department organization, oil & gas producerss sector

• Pharmaceuticals & Biotechnology sector

The internal audit has the following roles and responnsibilities in these companies:
• Giving assistance to the management in improving the control and risk management process, and
giving assurance that the internal procedurees and the law is respected – all companies;
• In 2 out of 3 companies, the internal audit a department also accomplishes an evaluation of the
company’s’ efficiency in its operations andd the department also monitors the risk management system;
• Again in 2 out of 3 companies, internal audit a examines the financial reporting process and also the
compliance with corporate governance;
• Last but not least, none of the companies have
h had ad-hoc internal audit missions.

The internal audit department is organized in the folllowing manner: at two companies via a co-sourced method,
and at the remaining case with specialists from withhin the company

Organised using staff

from within the
company
ϯ
ϯϯй
ϲϳй Co-sourced method
for organising the
department

Fig 4. Internal audit department organization, pharmaceutical & biotechnology

b sector

To summarise the sectorial analysis we can coonclude that the tendency of positive findings is maintained
high, as it was for the entire sample of companies. Although at first sight significant differences seem to arise
 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272 1271

from sector to sector in certain key aspects, we have to keep in mind the limitative character of this particular
analysis (sectorial one) due to the small number of studied companies in each sector. Thus, if this
investigationhad contained more companies, the differences might have been slightly lower.

4. Conclusions

Despite not being thorough investigation, the conclusion of our analysis reveals the fact that most of the
evaluated companies have implemented a viable internal audit solution. Given the fact that we have chosen the
first 40 companies listed on the FTSE100 index, by market capitalization, most of these companies are
publically known, and it’s not surprising to see most of them rely on an internal audit function.In brief, the
assertions in favour of a high-quality internal audit at the analysed companies are verified, but certain aspects
are confirmed only in some cases. Other assertions, for instance the publishing of the internal audit report, are
not present in none of the cases.
Firstly, evidence of a quality internal audit can be found from the very existence (at the majority of
companies) of an internal audit department, with its specific roles and responsibilities, which include:
assistance it gives the management in improving its control over procedures and operations and in the risk
management process; the assurance of conformity with the law, with the internal manual of procedures and of
course, with the applicable (in each sector) corporate governance guidelines; the evaluation and monitoring of
operation efficiency but also the monitoring of the risk management system, therefore offering guidance and
ways of improvement.
Apart from that, regarding the subordination of the internal audit department, our findings present mostly
subordination to the Audit Committee, but in some companies the department is subordinated to the chief
executive officer (or chief financial officer) as well. In addition, the department is organised mainly using
internal auditor specialists from inside the company or a combination of both from inside and from outside.
Few companies have externalised their internal audit function, which could be understandable and maybe cost-
efficient for them, given their size, organisational culture and objectives. Our opinion is that the best solution in
this aspect would be the co-sourced method, because a better level of assurance can be achieved when using
both external, objective specialists and internal analysts, who could provide better insight on the company’s
operations. Moreover, our findings conclude that the internal audit report is addressed to the Audit Committee,
which evaluates the efficiency of internal audit.
Furthermore, the results and conclusions of the internal audit process are being reported on a regular basis
to both the executive management and to the Audit Committee, which is not surprising given the fact that the
audit department is subordinated to the Committee and the Committee has the responsibility to verify the
activity of the internal audit department.
To summarise the sectorial analysis, the general tendency is the same as found in the entire sample,
nonetheless the differences we have found can provide valuable insight over practices in a particular sector.
However, if we had picked different or more companies, our results might have been a tad changed, thus
generating a more favourable tendency, or not.
Last but not least, we would like to add that this examination is solely based on identified aspects by using
our professional judgement, which includes a process of induction and analysis. Consequently, this study could
have been completed in a different manner because of different perceptions over what the internal audit
function accomplishes; however, we believe that our findings should still apply. One of the limitations of this
analysis is the fact that it relies solely on data provided from the Annual Reports. If the Internal Audit Reports
would have been made available, our results might have been different.
To conclude, this paper, thorough its analysis, tries to prove the role and importance of the internal audit
function, as deducted from how companies implement and organize the internal audit function. This approach
and its results prove that the internal audit is a significant and strategicfactor for any company that means to be
successful.
1272 Cordoş George-Silviu / Procedia Economics and Finance 15 (2014) 1265 – 1272

References
Bo‫܊‬a-Avram C,2009,Auditul intern al societăаilorcomerciale, edituraRisoprint,Cluj-Napoca
Cadbury, A. 1992.The Financial Aspects of Corporate Governancehttp://www.ecgi.org
Chi‫܊‬u G.A., Ioana‫ ܈‬C, 2005, Auditulîninstituаiilepublice, editura CECCAR, Bucure‫܈‬ti
Ghi‫܊‬ă, M., Popescu, M., Bunget, O., Pere‫܈‬, I., Croitoru, I., 2005, Auditul public intern, concepteЮimetodologie,edituraMirton, Timi‫܈‬oara
Popa I.E., Oprean, I., Lenghel, R.D.,2007,ProcedurileaudituluiЮi ale controluluifinanciar, edituraRisoprint, Cluj-Napoca
Preda, S. 1999. Report Code of Conduct http://www.ecgi.org
Tiron-Tudor, A., 2007, Evaluareacontroluluifinanciar intern, editura Accent, Cluj-Napoca
‫܉‬ingău, G., Rolulaudituluiînmediulîntreprinderii, edituraMirton, 2007, Timi‫܈‬oara
Vlad, M., 2012 ContabilitateaЮiauditulfinanciar la instituаiile de credit, edituraSedcomLibris, Ia‫܈‬i
Chartered Instutute of Internal Auditors, http://www.iia.org.uk
Organisation for Economic Co-operation and Development, www.oecd.org
www.londonstockexchange.com
Annual reports downloaded from company websites