10/30/2022

Dr. Syed Kashif Saeed

Internal Audit

Oct 18, 2022 Dr. Syed Kashif Saeed

Internal auditing
• Internal auditing is an appraisal or monitoring activity
established within an entity as a service to the entity.
• It functions by, among other things, examining,
evaluating and reporting to management and the
directors on the adequacy and effectiveness of
components of the accounting and internal control
systems.

Internal Audit 2
2

1
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Internal auditing
• Internal audit is generally a feature of large companies.
• It is a function, provided either by employees of the
entity or sourced from an external organization, to
assist management in achieving corporate objectives.
• In Pakistan, only listed companies are required to
constitute an Internal Audit department, under Code of
Corporate Governance.

Internal Audit 3
3

Oct 18, 2022 Dr. Syed Kashif Saeed

Internal auditing
The internal audit function can assist the board in other
ways as well:
• By, in effect, acting as auditors for board reports not
audited by the external auditors
• By being the experts in fields such as auditing and
accounting standards in the company and assisting in
implementation of new standards
• By liaising with external auditors, particularly where
external auditors can use internal audit work and reduce
the time and therefore cost of the external audit

Internal Audit 4
4

2
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Board Responsibility towards Internal Control

The board of directors is responsible for the governance of
risk and establishing risk management policies.
The board shall undertake at least annually, an overall
review of business risks to ensure that the management
maintains a sound system of risk identification, risk
management and related systemic and internal controls to
safeguard assets, resources, reputation and interest of the
Company and shareholders. Board does this through Audit
Committee.

Internal Audit 5
5

Oct 18, 2022 Dr. Syed Kashif Saeed

Assessing the need for internal audit

i. The cost of setting up an internal audit department versus the
predicted benefit.
ii. Predicted savings in external fees where work carried out by
consultants will be carried out by the new internal audit department.
iii. The complexity and scale of the organization's activities and the
systems supporting those activities.
iv. The ability of existing managers and employees to carry out
assignments that internal audit may be asked to carry out.
v. Management's perceived need for assessing risk and internal
control.
vi. Whether it is more cost effective or desirable to outsource the work.
vii. The pressure from external stakeholders to establish an internal
audit department.

Internal Audit 6
6

3
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Assessing the need for internal audit

In the case of small difference between cost vs benefit of
internal audit function, the company will need to consider
whether there are longer-term benefits, such as:
i. Establishing an internal audit department will help
maintain a group of highly skilled people which may help
the business develop faster that it would otherwise have
done.
ii. Working in internal audit can be a route to providing
training for future senior executives because internal
auditors are likely to obtain knowledge of many aspects
of the business and liaise with personnel at all levels.

Internal Audit 7
7

Oct 18, 2022 Dr. Syed Kashif Saeed

Distinction between internal and external audit

Internal audit External audit

Objective Designed to add value to and  An exercise to enable auditors to 

improve an organization's  express an opinion on the financial 
operations. statements
Reporting Reports to the board of directors, or  Reports to the shareholders/members 
other people charged with  of a company on the truth and fairness 
governance, such as the audit  of the accounts. Audit report is publicly 
committee. Reports are private and  available to the shareholders and other 
for the directors and management  interested parties.
of the company.
Scope Work relates to the operations of  Work relates to the financial statements.
the organization.

Internal Audit 8
8

4
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Distinction between internal and external audit

Internal audit External audit

Relationship Often employees of the organization,  Independent of the company and its

although sometimes the function is  management. Usually appointed by the
outsourced. Shareholders.
Planning and 1. Strategic long‐term planning  1. Planning carried out to achieve 
collection of carried out to achieve objective of  objective regarding truth and fairness 
assignments, with no materiality  of financial statements.
evidence level being set. 2. Materiality level set during planning 
2. Some audits may be procedural,  (may be amended during course of 
rather than risk‐based. audit).
3. Evidence mainly from interviewing  3. External audit work is risk‐based.
staff and inspecting documents  4. Evidence collected using a variety of
(i.e., not external). 5. procedures per ISAs to obtain 
sufficient
Internal Audit 6. appropriate audit evidence. 9
9

Oct 18, 2022 Dr. Syed Kashif Saeed

Regulation of internal auditors

Internal auditing is not regulated in the same way as
statutory external auditing.
There are no legal requirements associated with
becoming an internal auditor.
The scope and nature of internal audit's work is more
likely to be set by company policy than by any external
guidelines.

Internal Audit 10
10

5
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Qualification of Internal Auditor (In Pakistan)

No person shall be appointed as or continue to hold
position as the head of internal audit unless:

a) he/she has three years of relevant experience in

audit or finance or compliance function and is a
member of the Institute of Chartered Accountants of
Pakistan or Institute of Cost and Management
Accountants of Pakistan; or

Internal Audit 11
11

Oct 18, 2022 Dr. Syed Kashif Saeed

Qualification of Internal Auditor

b) he/she has five years of relevant experience in audit or
finance or compliance function and:
i. is a Certified Internal Auditor; or
ii. is a Certified Fraud Examiner; or
iii. is a Certified Internal Control Auditor; or
iv. has a post graduate degree in business, finance
from a university or equivalent recognized and
approved by the Higher Education Commission of
Pakistan (HEC) and is a member of a professional body
relevant to such qualification, if applicable; or
Internal Audit 12
12

6
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Qualification of Internal Auditor

c) he has at least seven years of managerial experience
in fields of audit or accounting or in managing
financial or corporate affairs functions of a company
and has a suitable degree from a university in
Pakistan or abroad equivalent to graduate degree,
recognized and approved by the Higher Education
Commission of Pakistan (HEC). The Commission, on
application from the company, shall determine the
suitability of such candidate.

Internal Audit 13
13

Oct 18, 2022 Dr. Syed Kashif Saeed

Scope of the internal audit function

Business risk is a risk resulting from significant

conditions, events, circumstances, actions or
inactions that could adversely affect an entity's
ability to achieve its objectives and execute its
strategies, or from the setting of inappropriate
objectives and strategies.

Internal Audit 14
14

7
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Scope of the internal audit function

Business risk cannot be eliminated, but it must be
managed by the company.

Internal Audit 15
15

Oct 18, 2022 Dr. Syed Kashif Saeed

Scope of the internal audit function

The internal audit department has a twofold role in
relation to risk management.
1. It monitors the company's overall risk management
policy to ensure it operates effectively.
2. It monitors the strategies implemented to ensure that
they continue to operate effectively.
As a significant risk management policy in companies is
to implement internal controls, internal audit has a key
role in assessing systems and testing controls.

Internal Audit 16
16

8
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Scope of the internal audit function

Internal audit may assist in the development of
systems. However, its key role will be in monitoring
the overall process and in providing assurance that
the systems which the departments have designed
meet objectives and operate effectively.
It is important that the internal audit department
retains its objectivity towards these aspects of its role,
which is another reason why internal audit would
generally not be involved in the assessment of risks
and the design of the system.

Internal Audit 17
17

Oct 18, 2022 Dr. Syed Kashif Saeed

Responsibility for fraud and error

Fraud is a key business risk. It is the responsibility of
the directors to prevent and detect fraud. As the internal
auditors have a role in risk management, they are
involved in the process of managing the risk of fraud.
It is not the responsibility of the external auditors to
prevent and detect fraud, although they may unearth
fraud as part of their audit of the financial statements,
and they shall be aware of the risks of fraud while
carrying out the audit

Internal Audit 18
18

9
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Responsibility for fraud and error

Internal auditors can help to prevent fraud by carrying out
work on assessing the adequacy and effectiveness of
control systems.
They can help to detect fraud by being mindful when
carrying out their work and reporting any suspicions.
The very existence of an internal audit department may act
as a deterrent to fraud.
The internal auditors might also be called upon to undertake
special projects to investigate a suspected fraud.

Internal Audit 19
19

Oct 18, 2022 Dr. Syed Kashif Saeed

Internal audit assignements

Internal audit can be involved in many different assignments
as directed by management.
a) Value for money audits
b) Information technology audits
c) Best value audits
d) Financial audits
e) Operational audits
f) Procurement audits
g) Fraud investigations
h) Review of compliance with laws and regulations
i) Customer service reviews

Internal Audit 20
20

10
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Value for money audits

Value for money (VFM) audits examine the economy,
efficiency and effectiveness of activities and processes.
These are known as the three Es of VFM audits. [Esp not-for-
profit organizations].

The internal auditors will evaluate these three factors for

any given business system or operation in the company.
Value for money can often only be judged by comparison. In
searching for value for money, present methods of
operation and uses of resources must be compared with
alternatives.

Internal Audit 21
21

Oct 18, 2022 Dr. Syed Kashif Saeed

Value for money audits: Three Es

(a) Economy: Attaining the appropriate quantity and quality of
physical, human and financial resources (inputs) at lowest cost. An
activity would not be economical if, for example, there was
overstaffing or failure to purchase materials of requisite quality at
the lowest available price.
(b) Efficiency: This is the relationship between goods or services
produced (outputs) and the resources used to produce them. An
efficient operation produces the maximum output for any given set
of resource inputs, or it has minimum inputs for any given quantity
and quality of product or service provided.
(c) Effectiveness: This is concerned with how well an activity is
achieving its policy objectives or other intended effects.

Internal Audit 22
22

11
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Financial Audit
The financial audit is internal audit's traditional role. It
involves reviewing all the available evidence to substantiate
information in management and financial reporting.
The importance of controls in preventing financial reporting
errors means that it is necessary to review certain areas
regularly to ensure the relevant controls continue to be in
place.
Many internal audit functions will therefore adopt a cycle
approach to financial internal audit engagements to ensure
each area is reviewed on a regular basis.

Internal Audit 23
23

Oct 18, 2022 Dr. Syed Kashif Saeed

Operational Audit
Operational audits are audits of the operational
processes of the organization. They are also known as
management or efficiency audits.
Their prime objective is the monitoring of management's
performance, ensuring that company policy is adhered
to.
There are two aspects of an operational assignment:
1. Ensure policies are adequate
2. Ensure policies work effectively
Internal Audit 24
24

12
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Procurement Audit
Procurement is the process of purchasing for the
business.
A procurement audit will therefore concentrate on the
systems of the purchasing department(s).
The internal auditor will be checking that the system
achieves key objectives and that it operates according to
company guidelines.

Internal Audit 25
25

Oct 18, 2022 Dr. Syed Kashif Saeed

Fraud Investigations
Fraud can range from theft of assets to fraudulent
financial reporting.
Internal audit may be asked to investigate specific
instances of suspected fraud or, more generally, to
review and test controls to prevent or detect fraud.

Internal Audit 26
26

13
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Compliance with laws and regulations

There will be a number of regulations a company will
need to comply with.
Some will be specific to the industry the client operates
in and some will apply to all companies operating in a
region or country.
Internal auditors may assist with or review compliance
with these laws and regulations.

Internal Audit 27
27

Oct 18, 2022 Dr. Syed Kashif Saeed

Customer service reviews

Internal auditors may be asked to assess the level of
customer service.
They could do this by phoning in or visiting
stores/outlets and pretending to be customers.
Alternatively, they could review and analyze the results
of customer surveys.

Internal Audit 28
28

14
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

The internal auditors' report

The internal auditors' report may take any form, as there
are no formal reporting requirements for these reports
as there are for the external auditor's report.
The internal audit may be summarized as 'risk-based',
where the internal auditors consider internal and
external risks and discuss company operations and
systems in place in respect of them or 'performance
enhancement' where, internal auditors consider risk and
strategy on a higher level.
Internal Audit 29
29

Oct 18, 2022 Dr. Syed Kashif Saeed

The internal auditors' report

Regardless of the nature of the assignment, however, all
internal audits are likely to result in a formal report.

At the end of the audit engagement, the results have to

be communicated to relevant staff. The results will be
made up of a number of findings and recommendations
and their aim is to get management to implement
measures to solve the problems identified.

Internal Audit 30
30

15
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Exit Meeting
An exit meeting is held at the end of the internal audit
engagement after a draft report has been produced.

The people at this meeting are likely to include both

operational staff who understand the workings of the
operation that has been reviewed, and staff with suitable
levels of authorization to authorize the implementation
of the corrective actions identified.

Internal Audit 31
31

Oct 18, 2022 Dr. Syed Kashif Saeed

The internal auditors' report - Final

Although the content and format of the final internal
audit report will vary, somewhere the report should, as
a minimum, describe the purpose, scope and results of
the engagement.

Internal Audit 32
32

16
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

The internal auditors' report - Final

Purpose The objective of the audit engagement should be clearly stated.
This makes the report easier to read and helps the reader to
interpret it. Findings should be linked back to this objective.

Scope The scope defines what specifically is audited. It identifies which

activities are audited and also highlights any activities that are
excluded from the audit.

Results This should include:

Observations
Conclusions
Opinions
Recommendations
Action plans

Internal Audit 33
33

Oct 18, 2022 Dr. Syed Kashif Saeed

The internal auditors' report - Final

Background This could include such information as details of the organization
information and the activities reviewed, and the outcome of previous audits of
the same areas.
Summaries An executive summary (as described earlier) may be included to
present the main findings of the report for those who do not have
time to read the entire report.
Accomplishments Improvements in relation to the past audit of the area may be
acknowledged.
Opinions The opinions of management or other staff on the findings and
recommendations may be incorporated into either the main body of
the report, an appendix or as a covering letter.
Executives may need to intervene if there is a disagreement
between management and internal audit.

Internal Audit 34
34

17
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Limitations of the internal audit function

Although the presence of an internal audit department
within an organization is indicative of good internal
control, by its very nature, there are some limitations of
the internal audit function.
1. Internal auditors are employed by the organization,
and this can impair their independence and objectivity
and ability to report fraud/error to senior
management because of perceived threats to their
continued employment within the company.

Internal Audit 35
35

Oct 18, 2022 Dr. Syed Kashif Saeed

Limitations of the internal audit function

2. To ensure transparency, best practice indicates that

the internal audit function should have a dual
reporting relationship, i.e. report both to
management and those charged with governance (the
audit committee).

Internal Audit 36
36

18
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Limitations of the internal audit function

3. Internal auditors are not required to be professionally
qualified (in some countries) and so there may be
limitations in their knowledge and technical expertise.
4. Even if they are professionally qualified, due to the
perceived lack of independence compared with
external professionals, internal audit work would not
be accepted on many assignments where the
interested party is an external stakeholder.

Internal Audit 37
37

Oct 18, 2022 Dr. Syed Kashif Saeed

Outsourcing the internal audit function

It can be expensive to maintain an internal audit function
consisting of employees of the company. It is possible
that the monitoring and review required by a certain
company could be done in a small amount of time and
full-time employees cannot be justified.
It is also possible that several internal audit staff are
required, but the cost of recruitment is prohibitive, or
the directors are aware that the need for internal audit
is only short-term.

Internal Audit 38
38

19
 10/30/2022

Oct 18, 2022 Dr. Syed Kashif Saeed

Outsourcing the internal audit function

In such circumstances, it is possible to outsource the
internal audit function; that is, purchase the service from
outside.
Many of the larger accountancy firms offer internal audit
services.
If same firm might offer one client both internal and
external audit services, then the issues related to the
independence and objectivity need to be analyzed.

Internal Audit 39
39

Oct 18, 2022 Dr. Syed Kashif Saeed

Advantages and disadvantages of outsourcing

Internal Audit 40
40

20