Role of internal audit in ensuring effective internal controls

Internal audit underpins the effectiveness of internal controls by performing several key tasks.

1. Internal audit reviews and reports upon the controls put in place for the key risks that the company faces in its operations. This will involve ensuring that the control (i.e. mitigation measure) is capable of controlling the risk should it materialise. This is the traditional view of internal audit. A key part of this role is to review the design and effectiveness of internal controls. Many organisations also require internal audit staff to conduct follow-up visits to ensure that any weaknesses or failures have been addressed since their report was first submitted. This ensures that staff take the visit seriously and must implement the findings.

2. Internal audit may also involve an examination of financial and operating information to ensure its accuracy, timeliness and adequacy. In the production of internal management reports, for example, internal audit may be involved in ensuring that the information in the report is correctly measured and accurate. Internal audit needs to be aware of the implications of providing incomplete or partial information for decision-making.

3. It will typically undertake reviews of operations for compliance against standards. Standard performance measures will have an allowed variance or tolerance and internal audit will measure actual performance against this standard. Internal compliance is essential in all internal control systems. Examples might include safety performance, cost performance or the measurement of a key environmental emission against a target amount (which would then be used as part of a key internal environmental control).

4. Internal audit is used to review internal systems and controls for compliance with relevant regulations and externally-imposed targets. Often assumed to be of more importance in rules-based jurisdictions such as the United States, many industries have upper and lower limits on key indicators and it is the role of internal audit to measure against these and report as necessary.

In financial services, banking, oil and gas, etc, legal compliance targets are often placed on companies and compliance data is required periodically by governments.