Internal and External Audit

• Documenting Systems: Procedures used to document systems include speaking to relevant client staff, observing application of controls, walk through test - tracing a transaction through the system, inspecting documents, prior year files
• Methods for documenting systems

  • Narrative notes (written description of the system)
  • Flow Charts (A diagrammatical description of the system)
  • Internal Control Questionnaire (A client is asked if they use common controls from a list)
  • Internal Control Evaluation (Client is given a list of risks and asked what controls they use to mitigate these risks)
• Narrative notes


  • Simple, Easy to understand by audit staff, Time consuming if complex system, Hard to identify missing controls
• Flow Charts


  • Easy to view the entire system, Easier to spot missing controls, Difficult to change, Still need narrative notes
• Internal Control Questionnaire


  • Quick to prepare, Can ensure all controls are present, Controls may be overstated, Less common controls unlikely to be captured
• Internal Control Evaluation


  • Controls less likely to be overstated, Checklist may not be relevant to every client, Less common risks unlikely to be captured
• A test of control involves the auditor obtaining evidence that the client has implemented controls and they are working effectively
• Typical tests would include observation, inspection of documents recording performance of the control, using test data (CAATs)
• ISA265 Communicating Deficiencies in internal control to those charged with governance and management - requires auditors to report deficiencies to management
• Deficiency


  Credit checks are not performed for new customers
• Consequence


  This could result in irrecoverable debts and a reduction in profit and cash flow
• Recommendation


  Credit checks should be made for all new customers
• Sales System Key Controls

  • Credit checks are performed
  • Customers sign the goods received note as proof of delivery and confirmation the goods were in good condition
  • Invoices raised match the goods received notes
  • Sales invoices are prepared using company price lists
  • Discounts must be authorised
  • Monthly customer statements are sent
  • Sales ledger receipts are checked to invoice before processing
• Sales System Tests of Control


  • Inspect a sample of customer files to ensure a credit check has been performed
  • Inspect a customer account to ensure a credit limit is in place
  • Inspect goods received notes for a sample of sales
  • Agree a sample of invoices to the goods received notes
  • Agree a sample of invoices to the company authorised price list
  • Inspect a sample of sales with discounts and ensure the discount has been authorised
  • For a sample of customers ensure monthly statements have been sent
  • Check a sample of receipts ensure they match to invoice
• Purchases System Key Controls

  • Centralised purchasing team ensures only goods needed for business purposes are bought and for a cost effective price
  • Sequential pre numbered purchase orders are made by the purchasing department
  • Inventory checks are made before ordering
  • Approved supplier list
  • Goods received are inspected for condition and quantity and checked to the purchase order
  • The invoice received matches the GRN before processing
  • Batch control, the number of invoices processed in the batch is checked to the number physical invoices
  • Supplier statement reconciliations have been performed
• Purchases System Tests of Control


  • Inspect a sample of purchases to ensure they have been authorised and generated by the central purchasing team
  • Inspect the log and ensure it has been signed to confirm a weekly sequence check
  • Inspect a sample of requisitions for signature to confirm inventory has been checked
  • Agree a sample of purchases have been made from suppliers on the authorised list
  • Inspect a sample of delivery notes for signature to confirm the condition and quantity of the goods
  • Inspect a sample of invoices and ensure they match to the GRN
  • Inspect the batch control sheets to ensure this check has been made
  • For a sample of suppliers ensure the monthly statements have been performed
• Payroll System Key Controls

  • Supervision of clock card use ensures only genuine hours worked are paid
  • Wages are calculated by the system, payroll manager checks a sample of calculations by the system
  • The company accountant reviews the payroll to ensure the total figure looks reasonable and for any anomolies
  • Payroll payments are signed by 2 directors
  • Bank statements are checked for wages that have not cleared
  • Completion and authorisation of standing data forms
• Payroll System Tests of Control


  • Observe the use and supervision of clockcards
  • For a sample of weeks ensure the payroll manager checks have been made
  • For a sample of weeks check to see if the accountant has signed the payroll as evidence of review
  • For a sample of weeks check to see if 2 directors have signed as evidence of review
  • Check bank statements for anomolies
  • For a sample of new employees ensure standing data forms have been authorised by an appropriate manager
• Primrose Co has recently upgraded its computer system to enable greater automation of transaction processing. The new system has integrated the sales, inventory and purchasing systems.
• Sales orders are entered into the system manually. The inventory system is automatically updated to reflect that inventory has been allocated to an order. The system will flag if there is insufficient inventory to fulfil the order.
• The inventory system is linked to the purchasing system so that when inventory falls to a minimum level a purchase order is automatically created and sent to the purchasing manager for authorisation. Once the manager clicks 'authorised' the order is automatically sent electronically to the approved supplier for that item.
• The system is backed up daily to ensure minimal loss of data in the event of a system failure.
• Primrose Co's internal auditors were present during the implementation of the new system and performed tests during the process to ensure the information transferred into the new system was free from error. The internal audit plan of work has been updated to include regular tests of the system throughout the year to ensure it is working effectively.
• The external auditor of Primrose Co is planning to use automated tools and techniques during the audit for the first time this year as a result of the new system and is also planning to use the work of Primrose Co's internal audit department if possible.
• An internal audit is an independent, objective assurance activity designed to evaluate a company's control and ensure they are working effectively.
• An internal control team is expensive to set up and run, the need for one will depend on the scale and diversity of activities, the desire of management to have assurance and advice on risk and controls and the current control environment
• Difference between external and internal auditors

  • External Audit: Objective - Express an opinion on the truth and fairness of the financial statements, Reporting - To shareholders and available publically, Appointment - By the shareholders and must be independent, Scope of work - Verifying the truth and fairness of the financial statements
• Role of internal audit

  • Risk identification
  • Corporate governance
  • Effectiveness of controls
  • Prevention and detection of fraud
  • Value for money
  • Compliance with laws and regulations
  • Reliability of financial information
• A well functioning internal audit department

  • Well resourced eg qualified and experienced staff
  • Independent and objective ie no operational responsibility
  • Chief internal auditor appointed by the audit committee
  • Work plan agreed by the audit committee
  • No limitation on scope ie full access to all parts of the organisation
• Limitations of Internal audit


  • Internal auditors work for the company so may not want to report issues that could lose them their job
  • In smaller organisations they may be managed by the finance function so again may not want to report issues
  • If internal auditors have worked there a long time there may be familiarity threats
• Advantages of Outsourcing Internal audit

  • Professional firms will be independent
  • Professional firms might have a broader range of expertise
  • Professional firms can be employed on a flexible basis
  • Professional firms are responsible for their activities and hold insurance
  • Greater focus on cost and efficiency of internal audit work
  • Access to new market software
• Disadvantages of Outsourcing Internal Audit

  • Professional forms lack intimate knowledge and understanding of organisations and their systems
  • Loss of flexibility
  • High fees
  • Conflict of interest eg should an external auditor provide internal audit services
  • Lack of control over quality of the work
  • Pressure on independence of the outsourced function eg if management threaten not to renew the contract
• An audit procedure should be a clear instruction of how audit evidence is to be gathered. It should contain an ACTION applied to a SOURCE to achieve an OBJECTIVE
• Financial Statement Assertions - Items in the Statement of Profit and Loss

  • Occurrence - Have transactions occurred and relate to the entity
  • Completeness - Have all transactions been recorded
  • Accuracy - Have amounts been recorded appropriately
  • Cut off - Have transactions been recorded in the correct period
  • Classification - Have transactions been recorded in the correct a/c
  • Presentation - Are transactions and disclosures adequate
• Financial Statement Assertions - Items in the Statement of Financial Position

  • Completeness - as before
  • Classification - as before
  • Presentation - as before
  • Existence (rather than occurrence) - do assets, liabilities and equity exist
  • Rights & Obligations - Does entity own assets / have rights to obligations
  • Accuracy & Valuation - Assets, liabilities and equity are recorded at appropriate values
• For every debit entry there will be a credit entry, so for any misstatement of a debit entry there will also be a misstatement of a credit entry
• Auditors primarily test: Assets and income for overstatement, Liabilities and expenses for understatement
• Testing for understatement tests completeness, Testing for overstatement tests valuation, rights and obligations and occurrence
• Understatement occurs if a transaction occurs or an asset is acquired and is not recorded in the financial statements
• To test for understatement an auditor must select a sample from outside the financial statements/accounting records and traces them to the financial statements/accounting records