Internal Audit & Risk

An organization's success is largely dependent on its ability to manage and control the business risks it must address in the ordinary course of business. Enterprise risk directly impacts an organization's ability to compete, to maintain the quality of its products and services, and to sustain its financial strength.

In the case of the private sector, shareholders and investors put their assets at the disposal of a company's management with the goal of achieving a satisfactory return on investment through the activities of that enterprise. On the other side of the spectrum, private citizens place their assets or secure their interests, 'in trust' with custodial organizations, whose first purpose is to safeguard the broader and collective community interest.

Private sector companies, especially those whose shares are exchanged publicly have been subjected to increasing regulations with regard to their control and reporting environments. Organizations whose activities are in the realm of the public trust, are generally subject to supervisory oversight by regulatory bodies. Supervision may be exercised by the country's Central Bank, by a National Insurance Supervisor, an Environmental Control board and the like.

Banks, Insurance companies, financial services companies and trusts, and companies operating in environmentally sensitive industries or health service organizations, are just a few examples of such organizations that must adhere to robust Enterprise Risk Management, or face disciplinary measures.

The Role of Internal Audit

The institution of an effective internal audit function plays a critical role in testing, assessing and reporting on Enterprise Risk. The Institute of Internal Auditors (IIA) has come a long way in setting standards and guidelines for the internal audit function within an enterprise. Today's Internal Audit function is not what it was even 5 years ago. A now internationally accepted IIA framework gives legitimacy to the internal audit function of any enterprise that adheres to it.

Based on the IIA framework, internal audit is now expected to be an independent and objective assurance and consulting activity within an enterprise. Though the function resides within the enterprise, its "independence" is enshrined within its Board-of- Directors-approved charter. Furthermore, the Internal Audit Charter gives the department its mandate and sets out the strategic objectives and value-added propositions commensurate with its role.

With the right tone set at the top, Internal Audit brings a systematic, disciplined and professional approach to evaluating and improving the effectiveness of an organization's risk management systems, internal controls, compliance and governance processes.

The Chief Internal Audit Executive provides leadership to the Internal Audit team. According to IIA, this person is preferably a certified professional with years of audit experience. The department conducts its work following an approved annual audit plan, which includes routine as well as random testing. The department follows IIA, the generally accepted audit approach. Internal Audit also engages in special projects, such as business unit efficiency assessments or investigations of suspected fraudulent activity or compliance audits.