You are on page 1of 21


PAST YEAR QUESTION (OCT 2010 ,Q3 & OCT 2008, Q2)


(a) i) explain outsourcing and why a company needs to outsource its internal audit function.

Outsourcing is an arrangement in which one company provides services for another company that could also be or usually have been provided inhouse. Company needs to outsource its internal audit function because: Comprehensive Internal Audit Function Internal Audit provides a comprehensive approach to establishing, directing and managing the entire internal audit function of the company.


and Reliable Internal audit group will respond to the company needs when we need assistance throughout the year.


outsourced internal auditors are favored by Audit Committees and external auditors because they maintain the highest level of independence and competency.

(a) ii) Suggest the advantages and limitations that Encik Abu would face if he decides to outsource the internal audit function Advantages of outsourcing:

Focus on core competencies Outsourcing allows management to focus on core competencies instead of the day to day low payback activities that are time consuming. The resulting improvement in staff allocation allows the business to afford the luxury of having access to global expertise and cutting edge technology. It will increase the business return and effective management of the existing resources

Cost Internal audit outsourcing helps the business to reduce its costs by converting the fixed costs of an internal audit function to variable costs. The costs of overlapping positions and audit effort can also be reduced thus creating more flexibility in increasing and decreasing workload demands. Credibility The external provider with a good reputation carries greater credibility compared to the work done by the internal audit staff

Limitations of outsourcing:

Allegiance of in house staff versus external service provider, where the elements of motivation and loyalty are questionable. Outsourcing the internal activities will result in the business incurring a large amount of resources in the form of fees and time assisting the external provider. Eventually, these costs will become a fixed costs to the organization in the long term. Culture of the organization towards the external provider might limit or hinder the outsource providers from performing their assignments. They may find it difficult to access information, whether verbal or documentary. Hence, to overcome this, the board will have to ensure that the external providers given the required authority and assistance.

(b) i) Differentiate the internal and external reporting channel of inappropriate company activities by an employee. Internal reporting channel - The wrongdoing is reported to parties within the organisation - gives an organisation the opportunity to deal quickly with a concern without the pressure of external publicity External reporting channel - The wrongdoing is reported to parties outside of the organisation - can cause serious damage to the organisations

(b) ii) suggest how internal auditors should response to a report on inappropriate company activities provided by whistleblower

whistleblower in good faith & not motivated by a grudge or other doubtful motive.
that whistleblower not make the disclosure for purposes of personal gain.



clearly communicate the finding or recommendation to the appropriate level of management

care must be taken when investigating a suspicion of fraud to avoid false accusations or alerting the suspect that an investigation is taking place. Audit shall be responsible for receiving the reports and investigating the facts.



The Head of Internal Audit shall treat any information received as confidential.
The results of the investigation shall not be disclosed or discussed with anyone other than those who are required to know them. This is essential to avoid injuring the reputation of persons that may have been found innocent during the investigation


(a) Explain the related amended provisions on internal auditing and audit committee and its significance to the internal audit profession. The amended provisions to the Listing Requirements of Bursa Malaysia Securities Bhd. On 31 January 2008 are:

Essentially, the amendments will enhance the CG framework by: enhancing the effectiveness and independence of audit committee and mandating the internal audit function by listed issuers and listed companies.

The key amendments are in the following respects:

requiring all audit committee members to be nonexecutive directors mandating the internal audit function by listed issuers and listed companies and requiring the internal audit function of listed issuers and listed companies to report directly to the audit committee enhancing the disclosure in the annual reports of listed issuers and listed companies to include information pertaining to the internal audit function

expanding the functions of the audit committee to include the review of the adequacy of the competency of the internal audit function setting out the rights of audit committee to convene meetings with external auditors, internal auditors or both, excluding the attendance of other directors and employees of the listed issuers and listed companies

clarifying that Bursa Securities may "approve" such other requirements relating to the financial-related qualifications or experience that must be fulfilled by at least one audit committee member and the signatory to the statutory declaration in relation to the accounts; and

requiring listed issuers and listed companies to submit a copy of written representation or submission of external auditors' resignation to Bursa Securities as provided under section 172A of the Companies Act 1965.2.

Significance impact to the internal audit function

The internal audit function of a listed company must be independent from the management and operations and the listed company must not allow inter-management audits.

The internal audit function can either be performed in-house or outsourced. If outsourced, the key issue that must be taken into consideration is the independence and the objectivity of the firm/person to whom the internal audit function is outsourced.

The internal audit function can be outsourced to the firm performing the statutory audit for the listed company if the firm fulfils the requirements of independence and objectivity pursuant to the International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors and the Internal Auditing Guidelines issued by the Malaysian Institute of Accountants

(b) i) Identify & explain the various arrangements that an organization can outsource its internal audit functions

Full Outsourcing Execution of a full scope and risk-focused internal audit plan contracted to the accounting firms. An in-house contract with reporting responsibility to the board of directors and audit committee will be appointed as a liaison with the accounting firm.
Partial Outsourcing Execution of the internal audit plan is partly done by an external provider on an ongoing basis.

Co-sourcing Execution of internal audit plan is shared between the accounting firm and the organization. Basically, outsourced partly handle specialized areas (eg: financial or operational audit) or those that are more cost effective to outsource. Sub-contracting It involves the engagement of an external party for a limited period to undertake a specific engagement or a portion of some engagement. Basically in-house internal audit department will normally provide the management and oversight functions

(b) ii) Circumstances that an internal audit can be outsourced


or "fly-in" internal audit function is expensive. The company is not complex or big enough to recruit a permanent internal audit team. Not enough manpower to carry out internal audit work due to temporary increase of workload. Reduce fixed costs through reducing head count to maintain flexibility of internal audit cost. In-house internal audit team is lacking specialist resources e.g. treasury, information technology, e-commerce, etc., to carry out internal audit work.