6 Reasons Why You Need An Internal Audit Manual
Every internal audit function has its own internal audit framework which is Internal Audit Charter (the “Charter”). The Charter outlines the organizational status and role of the internal audit function, independence and governance, etc.
However the Charter usually provides high level guidance, and therefore, it is also essential to have a robust Internal Audit Manual (IAM) which provides further granular guidance for its day-to-day operations.
In other words, the Charter states what internal audit function does, and the IAM describes how and why it is going to be executed. IAM is inseparable from and consistent part of the Charter.
Hence, its highly recommended to develop and maintain by every internal audit function. The benefits of IAM are as follows:
1. Assists in following the Standards
Pursuant to Policies and Procedures Standard 2040:
The chief audit executive (CAE) must establish policies and procedures to guide the internal audit activity.
The chief audit executive (CAE) must establish policies and procedures to guide the internal audit activity.
The CAE’s implementation of Standard 2040 will depend on the structure, maturity, and complexity of the organization and the internal audit function. Hence, more complex is the business, the more comprehensive and sophisticated IAM should be.
The main point is that an IAM generally incorporates all the mandatory guidance of the International Professional Practices Framework (IPPF). Well-communicated and developed IAM assists internal audit team to conform with the Standards in all their activities.
2. Outlines internal policies
As it was mentioned before, an IAM provides details how exactly the operating principles (outlined in the Charter) are to be executed and followed.
For example, any Charter states the principle of internal audit activity’s independence and objectivity, but it does not provide further details.
A well-documented policy on independence and objectivity could be of great help to the CAE who confirms organizational independence and discloses any impairment to its independence and objectivity.
- An IAM should include the policy on individual objectivity that describes the expectations and requirements for an unbiased mindset for every internal auditor. To be more effective such a policy would describe:
- The critical importance of objectivity to the internal audit profession;
- Various situations/ scenarios/ factors that could undermine objectivity, such as auditing a family member or a close friend, etc.;
- Exact actions the internal auditor should take if he or she becomes aware of a current or potential objectivity concern;
- Reporting requirements, where each internal auditor periodically considers and discloses conflicts of interest.
At a minimum, an IAM should include the following internal policies: - Independence and objectivity;
- Ethics;
- Reliance on other assurance providers;
- Protecting confidential information;
- Audit records retention.
Well-documented and well-communicated policies help to ensure that the key principles, rules and expectations related to the internal audit’s mission, goals, responsibilities are followed under various circumstances and situations that may arise.
Furthermore, by following established policies, internal auditors would minimize their stress/pressure in unfamiliar situations, take right actions, and subsequently, preserve the reputation of internal audit.
3. Outlines procedures that provide a systematic and disciplined approach to the audit procedures
Procedures give directions and step-by-step instructions for the audits and outline sequences of activities for interpreting those policies. An IAM describes various procedures with regard to the operation of internal audit function and the planning, completion, and reporting of internal audit engagements.
IAM ensure that Standards are followed, and effectiveness and efficiency of auditing process is enhanced.
An IAM should include procedures for annual planning (including annual risk assessment, development of audit universe, used methodologies and tools), as well as procedures at the engagement level: for planning, fieldwork, reporting, and follow-up phases. Documentation requirements for working papers should also be clearly stated.
An IAM should include procedures for annual planning (including annual risk assessment, development of audit universe, used methodologies and tools), as well as procedures at the engagement level: for planning, fieldwork, reporting, and follow-up phases. Documentation requirements for working papers should also be clearly stated.
By providing a standard approach to auditing, a well-communicated IAM assists internal auditors in auditing by establishing expectations and guiding them in all engagement phases.
At the same time, the CAE should ensure that the IAM is not a rigid instruction, it should be designed to allow for some flexibility necessary to respond to constantly changing conditions and to raise critical thinking of the auditor team.
4. Represents a benchmark by which internal audit could be measured
A robust IAM should also include a formal Quality Assessment and Improvement Program (QAIP) that contains both internal and external assessments of internal audit. The QAIP assures that quality is maintained at the entire spectrum of assurance and consulting work, and it promotes continuous improvement.
Depending on the expectations prescribed in internal policies and procedures, the team can also develop certain KPIs to monitor the performance of the team (i.e. number of days for project wrap-up after completion, number of significant findings, $ of cost recoveries, etc).
In case if you are running the independent quality assessment of internal audit function, than your consultants first would be asking you to review the Charter and IAM to understand the internal audit function of the company.
5. Serves as an educating tool for newly recruits
By reading and understanding the IAM, new hires can get familiar with the rules and instructions much faster. It’s also beneficial for the employees who moved from other departments within the organization and who are not familiar with detail auditing practices.
In addition, by reading the IAM, new staff could also get familiar with the requirements (or expectations) and opportunities in continuous education, professional training, and personal career.
6. Preserves and enhances value of internal audit
Internal audit functions that do not have an IAM are taking risk by relying on expertise of key staff with requisite knowledge and experience. In case of high staff turnover, the team could suffer significantly and consistency and continuity of the high quality audit could be jeopardized. In this situations, an IAM is a powerful tool for a sustainable, well-operating audit function and consistency of project qualities.
In many organizations, the content of IAM already exists in the form of different spreadsheets/ templates/ samples and so on, and it will require some effort to bring it all together into one manual. By developing an IAM, the CAE ensures standardization and centralization of policies and procedures, that aids in building reputation of a well-managed audit function.
Once developed, the IAM needs to be reviewed periodically. The CAE ensures that the manual is updated by assigning someone to keep track of changes within the organization (e.g., corporate policies), industry (e.g., regulatory changes), and profession (e.g., IPPF). Furthermore, the CAE should observe and use best practices in internal audit by customizing them for his/her department. Regular review and update of the IAM will ensure that internal auditors are using the latest technology, audit methodology and tools, standards, and risk information when performing audit engagements. This in turn, will enhance employee morale and productivity.
Do not miss out the valuable benefits of having a robust internal IAM. Our PFC team could help you with its development or update. For further discussion on this subject please contact PFC representative by e-mail: info@www.intelfolio.com or call us: +1(403) 375 9955.
