Improve Internal Audit Methodology in the Case Company

Abstract

The purpose of this study was to identify improvement areas in the internal audit methodology used by the Internal Audit team at the case company which is the local subsidiary of a global financial group. The Internal Audit activity of the case company has been recently evaluated by the Institute of Internal Auditors. The overall quality assessment concludes that the Internal Audit activity has a charter, policies and processes that are in conformance with the Mandatory Guidance of the International Professional Practices Framework on Internal Auditing. However, the quality auditors have identified an issue related to traceability among audit documents. This study is aimed to identify root causes for the problem identified by the quality auditors and then suggest improvements to solve the problem.

The qualitative research methodology was utilized in this study. The study started with a thorough analysis of the current internal audit methodology and practice. Next, best practices on the areas of problem were gathered and analyzed based on a literature review and on the author’s previous experience as a consultant of a global leading auditing and consulting company. Based on the results of the best practices review and considering also the objectives of the Internal Audit function and the International Professional Practices Frame-work, solutions to the problem were constructed.

The author recommends the Internal Audit management apply a risk-based approach in planning the internal audit jobs through performing a process risk analysis. The process risk analysis helps refine the audit objectives set in the Internal Audit activity plan and identify other significant areas of concern which need more internal auditors’ efforts. In other words, it helps drive the internal audit engagement execution in a more effective and efficient way.

It is recommended that the Internal Audit methodology manual express and emphasize more clearly on the risk-based internal auditing approach and that the strategic objectives, associated risks and risk responses act as a central point connecting documents created through-out an audit cycle.

It is also recommended that the Internal Audit methodology manual underline requirements and/or criteria on traceability among audit documents as well as provide specific instructions on how audit documents should be documented to ensure a positive link among them.