Internal audit: a helpful tool for improvement

Within the risk management framework, the internal audit is considered the third line of defense that provides independent assurance and advice on matters related to the achievement of the company’s objectives (the first two lines of defense being operational management and risk management & compliance functions).

An internal audit can be performed as an assurance engagement to verify compliance with external or internal requirements, or as a consulting engagement to examine in more detail how a process or system works and identify potential risk elements, redundant activities, and opportunities for improvement and efficiency.

A core objective for internal auditors to add value to their organizations. This is primarily achieved by uncovering unexpected information, identifying opportunities for improvement, and recommending ways to make processes better, faster, or cheaper, i.e. more effective. The work is typically performed as a cyclical process consisting of risk assessment, planning, fieldwork, reporting, and follow-up. Internal audit credibility and value are enhanced when auditors are proactive, offer new insights, and consider the future impact of their evaluations.

Who needs it and why?

Internal audit is valuable for companies that want to better manage their operations and identify potential process deficiencies, as well as opportunities for improvement and optimization at an early stage. As a result, management gains a better understanding of what works well, where risks may arise, and what should be improved. Internal audit is an important component of corporate governance, which also strengthens the confidence of investors and regulators.

For public sector institutions, credit institutions, insurance companies, and licensed payment and electronic money institutions, the establishment of an internal audit function is mandatory.

Payment and electronic money institutions may delegate this function to their parent company or outsource it to a sworn auditor with the necessary qualifications to perform such duties.

The internal audit approach and related services are developed in line with the company’s size, industry, business model, and needs.

What types of internal audit are there?

Internal audits are often categorized into four types: compliance, financial, information technology (IT), and operational.

• Compliance audits assess how a company meets or exceeds the requirements and expectations set out in laws, regulations, internal policies, procedures, and contracts. In case of positive evaluation, such audits provide assurance that the company is following both internally and externally imposed requirements.

• Financial audits focus on how an organization spends, accounts for, and reports the flow of financial resources. These audits are historically focused, capturing a specific point in time (typically a month or a year) to understand past financial transactions and the safeguarding of assets.

• IT audits evaluate the security, safety, and integrity of information processing systems. They examine how people interact with technology, the reliability of input and output data, and critical IT areas like system redundancy, backup, and recovery plans.

• Operational audits focus on how the company uses its resources (human, financial, and expertise) to solve business problems. Unlike financial audits, they are future-oriented and can include elements of the other three audit types. When evaluating how the company utilizes its resources to achieve its goals, operational audits often focus on the so-called 6 E-s: economy, efficiency, effectiveness, equity, ecology, and ethics. The first three key areas are related to performance metrics: cost of operations, methods of operations and results of operations. The last three are related to sustainability and good governance and address fair and equal treatment of all stakeholders, environmentally responsible and sustainable operations, and high professional and governance ethics.

How is internal financial audit different from the external audit?

The most significant difference is that external auditors have the primary responsibility for financial statement regulatory attestation. While internal auditors may review financial statement preparation and supporting documentation, their focus is often broader, encompassing the safeguarding of resources and use of financial resources. Because they are embedded in the organization, internal auditors typically have a broader and deeper knowledge of the company's specific accounting and financial systems than external auditors, which may give a better understanding of the internal logic and performance of these systems.

Internal auditors can perform their work throughout the year, rather than waiting for a year-end review which is typical for external financial audits. This allows the company to identify and fix issues internally before external parties arrive and without the pressing deadlines often present during external year-end audits.

What are the benefits of internal operational audits?

Operational auditing helps organizations look beyond financial results and compliance requirements by giving management a clearer view of how processes actually work, where goals may be unclear, and where hidden risks, inefficiencies or improvement opportunities exist.

By reviewing how resources, people, systems and processes are used in practice, operational audits can identify ways to make work better, faster or more cost-effective. The focus of internal operational audits is practical: contributing to solutions of business problems, strengthening controls and recommending improvements that support better performance. It is also important to keep in mind that operational auditing is typically future-oriented.

Thus, instead of only looking at what happened in the past, it helps to understand what should be improved going forward.

To discuss our services, please contact us at info@orients.lv.