Please note that this pertains to South African Legislation, the King Requirements, and Best Practice.
Today we are having a look at the Roles and Responsibility of Directors in terms of Internal Audit.
Now I understand that most of the SME arena does not have the financial capacity to have an Internal Audit Division as such, but that said there should still be someone looking after the risk aspect of things.
Some of the questions that should be asked by Directors are (but not limited to):-
– Is there an Internal Audit Strategy in place and if so does the plan focus on areas that are most likely to impact the business and therefore the stakeholders? This question should also appear on the Board meeting agenda, at least twice a year.
– Are the Internal Audits effective and frequent enough and is there sufficient frequent communication with the audit committee and the Board of Directors. It stands to reason that if the Board doesn’t know what is going on in the business, they are unable to measure it or even take the necessary step to ensure that potential fraud problems are dealt with timeously.
– Does the Internal Audit Department have the appropriate level of technical and analytical skills required to address all the different types of industry risks that pertain to the business and how often are they measured and assess to ensure that their abilities remain current and are adequate? The members of the Internal Audit Department, in the case of corporations and tasked individuals in the case of SMEs, should be keeping themselves up to date with current fraud techniques, in order for them to be able to set effective checking procedures.
– Is technology adequately utilized in the Internal Audit processes (where applicable) and does it use the existing systems and data effectively in the performance of its work? Here again, the Internal Audit team should keep themselves up to date with the latest audit systems in order for them to remain effective.
– Does the Internal Audit function compare favorably against its peers in benchmark studies and if not how will it be brought up to speed? Clearly, members of the Internal audit team need to also keep abreast of benchmark studies as and when they are made available.
– What is the true absorbed cost of Internal Audit. Are these costs evaluated on an annual basis? This involves a huge amount of discussion between the division head of Internal Audit and the Finance Department Head (or whoever is responsible for the budgets) and never mind annually, this should be discussed quarterly at the very least. This is where the actual cost of the Audit team gets set off against the results of what errors, frauds, thefts, etc., have taken place. Remember ‘prevention’ of these also counts as it too carries a cost.
– Does the Internal Audit function have all the necessary skills as well as diverse skills that are required to give confidence to the audit committee on internal financial control. As with any other employee in the group, the Internal Audit staff should also be attending regular courses to update their skillset.
– Is an annual assessment conducted on the chief audit executives in order to ascertain if the key attributes that are relevant to the business are being upheld on an ongoing basis? Just as the Sales Department is measured on what sales they have successfully made during the year, so too should the Internal Audit Department be measured to ensure that they have not only thwarted potential theft and/or fraud but that they have ensured that the correct procedures have been implemented in order to decrease future attempts of this type of behaviour.
– Is there enough assurance of the Ethics and Risk Management programs?
– In terms of the most recent losses – did Internal Audit provide any form of comfort that these would not re-occur in the future?
– Finally, does the Internal Audit function have all the necessary skills that they require in order to give the Audit Committee assurance on the internal financial controls as well as the operational, administrative, and HR Controls in the Company?
Next time we will have a look at specifically what those financial controls are and what is required.