Audit Fundamentals and Governance
The purpose and structure of an audit
An audit provides independent, objective assurance that an organisation's controls, records, or compliance arrangements meet defined criteria. Candidates should distinguish assurance engagements (auditor expresses a conclusion) from consulting/advisory work (auditor advises, does not opine), and understand the three-party relationship: auditor, responsible party, intended users. Know the difference between reasonable assurance and limited assurance, and between an audit opinion and a management review.
Governance concepts
Understand the audit charter or mandate, the audit committee's role (independence, oversight, approving the plan, receiving reports), and the reporting line of the head of audit. Classic governance questions test whether the auditor reports to management or to the governing body, and why independence from management matters. Also know the concepts of three lines of defence (operational management, risk/compliance oversight, internal audit) and where an auditor sits within it.
Traps to watch
- Confusing independence (freedom from influence) with objectivity (a state of mind). Both matter, but they are not synonyms.
- Assuming internal audit can take operational decisions - it cannot, or it loses independence.
- Treating an audit finding as automatically a fraud finding.
Rule of thumb
If a question asks who should approve the internal audit plan, the safest answer is the governing body or audit committee, not the CEO. If it asks who owns the risk being audited, the answer is management, not the auditor.
Worked example
An organisation's head of audit reports to the finance director, who also owns the processes being audited. This is a governance weakness: independence is impaired. The correct remedy is a functional reporting line to the audit committee.