What is Internal Control

1
What is Internal Control ?

• Internal control is defined by the Committee of
  Sponsoring Organizations of the Treadway
  Commission (COSO) as
• A process effected by an entitys board of
  directors, management, and other personnel
  designed to provide reasonable assurance
  regarding the achievement of objectives in the
  following categories
• Reliability of financial reporting
• Compliance with applicable laws and regulations.
• Effectiveness and efficiency of operations
• (COSO 1994, 13.)

2
Internal control is a process

• It is a means to an end, not an end in itself, a
  tool to give a reasonable assurance that
• Laws and other regulations are followed in the
  organization.
• Assets of the organization, both physical and
  immaterial, are in safe.
• Reporting of finances and activities is actual,
  useful, sufficient and reliable.
• Operations are efficient and effective.

3
Internal control system

• Physical controls, manuals, safety orders, IT
  security etc.
• Internal control is effected by people. Its not
  merely policy manuals and forms, but people at
  every level of an organization.
• The ultimate responsibility of functioning
  internal control lies on the top management and
  board of the organization

4
What is Internal Auditing ?

• "Most people have the wrong perception of
  internal auditing - that it's boring - when in
  reality it's one of the hottest professions in
  the world right now," said IIA Chief Advocacy
  Officer Dominique Vincenti.

5
Internal auditing

• Types
• Operational auditing
• Financial reporting auditing
• Compliance auditing
• Targets the main elements in the internal control
  system

• Differences to external auditing
• Not obligatory
• Internal audiotors principal (mandator) top
  management
• Reports to the organization (not to the general
  meeting/wide public)
• Wider functions - not focused on financial
  auditing
• More skills needed !

6
The official definition (IIA)

• Internal auditing is an
• independent, objective assurance
• and consulting activity designed
• to add value and improve an
• organization's operations. It helps
• an organization accomplish its
• objectives by bringing a
• systematic, disciplined approach
• to evaluate and improve the
• effectiveness of risk management,
• control, and governance
• processes.

• The important elements in the definition
• independent and objective
• assurance and consulting activity
• designed to add value and improve an
  organization's operations
• a systematic, disciplined approach
• to evaluate and improve the effectiveness of
• risk management,
• control,
• and governance processes.

7
What are they doing in practice ?

• Evaluating whether policies and procedures are
  being followed.
• Educating management and the board on critical
  issues.
• Monitoring compliance with laws and regulations.
• Assessing operations and making best-practice
  recommendations.
• Providing counsel for improving controls,
  processes and procedures, performance, and risk
  management.
• Suggesting ways to reduce costs, enhance
  revenues, and improve profits.
• Delivering in-house consulting, assurance, and
  facilitation services.

8
Assurance and consulting

• Performed by professionals with an in-depth
  understanding of the business culture, systems,
  and processes, the internal audit activity
  provides assurance that internal controls in
  place are adequate to mitigate the risks, and
  organizational goals and objectives are met.
• When there is room for improvement, internal
  auditors make recommendations for enhancing
  processes, policies, and procedures.

9
Internal auditors

• Ensure accuracy of records.
• Provide cost analysis of historical trends.
• Evaluate internal controls.
• Coordinate their work with the external auditors.
• Perform due diligence of pending subsidiary
  purchases.
• Document and analyze processes and costs.
• Analyze task performance in functional areas.
• Survey customers to determine satisfaction.
• Evaluate costs and benefits.
• Benchmark performance and best practices.
• Confirm internal and external compliance with
  laws, regulations,
• policies, and procedures.
• Ensure compliance with contract terms and
  conditions.
• Compare records with physical assets.
• Reconcile independent and corporate records.
• Review new system development projects.
• Evaluate computer and software application
  controls.
• Investigate alleged fraud situations.

10
WHY SHOULD AN ORGANIZATION HAVE INTERNAL
AUDITING?

• A cornerstone of strong governance, internal
  auditing bridges the gap between management and
  the board,
• assesses the ethical climate and the
  effectiveness and efficiency of operations, and
  serves as an organizations
• safety net for compliance with rules,
  regulations, and overall best business
  practices. (IIA www.theiia.org)

11
(No Transcript)
12
Internal auditors as a profession

• A younger profession than external auditors
• Auditing developed during the industrial
  revolution
• separation of management and ownership
• checking the financial records kept by
  management (agents) for owners ( principals)
• Modern internal auditing begun in 1940s
• a semi-profession established its association
  (IIA) and begun its road to become a recognized
  profession world wide
• Needs for better internal control
• Frauds in financial reporting
• Enron, WorldCom, Parmalat, Skandia etc.
• Sarbanes-Oxley Act in USA in 2002
• Investors interests to enhance internal control
  in listed companies
• In Europe EUs interests to enhance internal
  control of EU money usage in member states

13
What is a profession ?

• Oxford Dictionary a paid occupation, especially
  one involving training and a formal
  qualification. ?treated as sing. or pl. a body
  of people engaged in a profession.

14
Features of a profession

• An own professional association
• Special requirements for entry
• High expertise achieved with special education
• Certification from the association
• Formal licensing from government officials
• Codes of ethics
• Standards for practices

15
Critical view of a prosession

• Professional egoism
• Striving to become a monopoly in labour market
• Clients are incapacitated to solve their own
  problems
• Clients problems are split to parts according to
  boundaries of different professions

16
Historical development

• IIA established in 1941 in USA
• in Finland 1956 over 500 members
• Ethical code and description of internal
  auditors functions in 1947.
• IIAn professional standards in 1978.
• New standards in 2002. Checked in 2004.
• professional exam, CIA exam in 1972
• Also special exams (CCSA - Certification in
  Control Self-Assessment, CGAP - Certified
  Government Auditing Professional, CFSA -
  Certified Financial Services Auditor etc.)
• Now about 130 000 members world wide with global
  headquarters in Altamonte Springs, Fla., United
  States.
• IIA is recognized as the internal audit
  profession's leader in certification, education,
  research, and technological guidance

17
INTERNATIONAL STANDARDS FOR THE PROFESSIONAL
PRACTICE OF INTERNAL AUDITING

• Professional guidance and quality assurance/check
  of the professional work
• Attribute Standards
• Performance Standards
• Implementation Standards