Why is it important for internal auditors to consider it controls in assessing a firms control environment?

You are here:

This information sheet (INFO 221) provides guidance to assist organisations that are considering whether to have an internal audit function, and to ensure the quality of this function. It may be relevant to directors and audit committees of entities subject to the ASX principles.

This information sheet explains:

What is internal audit?

An internal audit function can contribute to corporate governance by providing an organisation's directors and audit committee with independent reviews of, and suggestions for, improving the design and operation of the organisation’s:

• financial and non-financial control environment
• processes for identifying and monitoring risks
• governance processes.

Internal audit can be an important element in the control environment of organisations and can contribute to more effective risk management.

What do the ASX Corporate Governance Principles say about having an internal audit function?

The ASX Corporate Governance Principles and Recommendations (PDF 2.2MB) state that if a listed entity does not have an internal audit function, they need to explain the reason for this. Additionally, they should explain how risk management and internal control processes are managed, evaluated and continually improved in the absence of an internal audit function.

How can internal audit be independent?

In order to ensure the independence of the internal audit function from management:

• the internal audit function should report directly to the audit committee, rather than the management of the organisation
• the internal audit charter and plan should be reviewed and approved by the audit committee, who should also receive and review reports on internal audit engagements, and monitor the performance and independence of the internal audit function
• while the internal audit budget may be set with the chief executive officer, the appropriateness of the budget should be reviewed by the audit committee.

Internal audit services may be provided by employees, external service providers or a combination of the two. However, the external auditor should generally not also provide internal audit services to the same organisation.

How is the quality of internal audit work assured?

Internal audit should maintain a quality assurance and improvement program, including workpaper reviews and performance evaluations. Periodic external reviews of internal audit may also be appropriate.

Where can I get more information?

Important notice

Please note that this information sheet is a summary giving you basic information about a particular topic. It does not cover the whole of the relevant law regarding that topic, and it is not a substitute for professional advice. You should also note that because this information sheet avoids legal language wherever possible, it might include some generalisations about the application of the law. Some provisions of the law referred to have exceptions or important qualifications. In most cases your particular circumstances must be taken into account when determining how the law applies to you.

This is Information Sheet 221 (INFO 221), issued on 20 June 2017. Information sheets provide concise guidance on a specific process or compliance issue or an overview of detailed guidance.

Internal controls are accounting and auditing processes used in a company's finance department that ensures the integrity of financial reporting and regulatory compliance. Besides complying with laws and regulations and preventing fraud, internal controls can help improve operational efficiency by ensuring budgets are adhered to, policies are followed, capital shortages are identified, and accurate reports are generated for leadership.

• Internal controls are the mechanisms, rules, and procedures implemented by a company to ensure the integrity of financial and accounting information, promote accountability and prevent fraud.
• Besides complying with laws and regulations, and preventing employees from stealing assets or committing fraud, internal controls can help improve operational efficiency by improving the accuracy and timeliness of financial reporting.
• Internal audits play a critical role in a company’s internal controls and corporate governance, now that the Sarbanes-Oxley Act of 2002 has made managers legally responsible for the accuracy of its financial statements.

Internal controls have become a key business function for every U.S. company since the accounting scandals in the early 2000s. In their wake, the Sarbanes-Oxley Act of 2002 was enacted to protect investors from fraudulent accounting activities and improve the accuracy and reliability of corporate disclosures. This has had a profound effect on corporate governance, by making managers responsible for financial reporting and creating an audit trail. Managers found guilty of not properly establishing and managing internal controls face serious criminal penalties.

The auditor’s opinion that accompanies financial statements is based on an audit of the procedures and records used to produce them. As part of an audit, external auditors will test a company’s accounting processes and internal controls and provide an opinion as to their effectiveness.

Internal audits evaluate a company’s internal controls, including its corporate governance and accounting processes. They ensure compliance with laws and regulations and accurate and timely financial reporting and data collection, as well as helping to maintain operational efficiency by identifying problems and correcting lapses before they are discovered in an external audit. Internal audits play a critical role in a company’s operations and corporate governance, now that the Sarbanes-Oxley Act of 2002 has made managers legally responsible for the accuracy of its financial statements.

No two systems of internal controls are identical, but many core philosophies regarding financial integrity and accounting practices have become standard management practices. While internal controls can be expensive, properly implemented internal controls can help streamline operations and increase operational efficiency, in addition to preventing fraud.

Regardless of the policies and procedures established by an organization, only reasonable assurance may be provided that internal controls are effective and financial information is correct. The effectiveness of internal controls is limited by human judgment. A business will often give high-level personnel the ability to override internal controls for operational efficiency reasons, and internal controls can be circumvented through collusion.

The U.S. Congress passed the Sarbanes-Oxley Act of 2002 to protect investors from the possibility of fraudulent accounting activities by corporations, which mandated strict reforms to improve financial disclosures from corporations and prevent accounting fraud.

Internal controls are typically comprised of control activities such as authorization, documentation, reconciliation, security, and the separation of duties. And they are broadly divided into preventative and detective activities.

Preventive control activities aim to deter errors or fraud from happening in the first place and include thorough documentation and authorization practices. Separation of duties, a key part of this process, ensures that no single individual is in a position to authorize, record, and be in the custody of a financial transaction and the resulting asset. Authorization of invoices and verification of expenses are internal controls.

In addition, preventative internal controls include limiting physical access to equipment, inventory, cash, and other assets.

Detective controls are backup procedures that are designed to catch items or events that have been missed by the first line of defense. Here, the most important activity is reconciliation, used to compare data sets, and corrective action is taken upon material differences. Other detective controls include external audits from accounting firms and internal audits of assets such as inventory.

Auditing techniques and control methods from England migrated to the United States during the Industrial Revolution. In the 20th century, auditors' reporting practices and testing methods were standardized.

Internal controls are the mechanisms, rules, and procedures implemented by a company to ensure the integrity of financial and accounting information, promote accountability, and prevent fraud. Besides complying with laws and regulations and preventing employees from stealing assets or committing fraud, internal controls can help improve operational efficiency by improving the accuracy and timeliness of financial reporting.

The Sarbanes-Oxley Act of 2002, enacted in the wake of the accounting scandals in the early 2000s, seeks to protect investors from fraudulent accounting activities and improve the accuracy and reliability of corporate disclosures.

Internal controls are broadly divided into preventative and detective activities. Preventive control activities aim to deter errors or fraud from happening in the first place and include thorough documentation and authorization practices. Detective controls are backup procedures that are designed to catch items or events that have been missed by the first line of defense. 

Separation of duties, a key part of the preventive internal control process, ensures that no single individual is in a position to authorize, record, and be in the custody of a financial transaction and the resulting asset. Authorization of invoices, verification of expenses, limiting physical access to equipment, inventory, cash, and other assets are examples of preventative internal controls.

Detective internal controls attempt to find problems within a company's processes once they have occurred. They may be employed in accordance with many different goals, such as quality control, fraud prevention, and legal compliance. Here, the most important activity is reconciliation, used to compare data sets, and corrective action is taken if there are material differences. Other detective controls include external audits from accounting firms and internal audits of assets such as inventory.