Internal Audit, Risk Management and Governance
Domain 10 tests internal audit’s role, independence, risk-based planning and the external auditor’s use of internal audit work.
Core rules
- Section 138 and Rule 13 require internal audit for prescribed companies; the internal auditor reports to the audit committee and should be independent of management functions.
- Risk-based internal audit (RBIA) links the audit plan to the organisation’s risk profile and focuses on high-risk processes and controls.
- Internal audit evaluates governance, risk management and controls; it is not a substitute for statutory audit.
- SA 610 allows the external auditor to use internal audit work after evaluating objectivity, competence and a systematic approach, and after re-performing some work.
Worked example
In a procurement internal audit, the auditor maps purchase-to-pay risks, selects high-value and split POs, tests three-way matching, and checks vendor master changes. A finding that purchases were split to avoid approval limits is reported to the audit committee with root cause and recommendation. The external auditor may use the work but still tests the controls that matter to the financial statements.
Traps
Placing internal audit under the CFO; treating internal audit as an assurance opinion on the financial statements; relying on internal audit without evaluating competence; and using internal audit staff to perform management functions.