The Outsourced Internal Auditor and the Side Letters
Ruhuna Agri PLC is a CSE-listed agribusiness with revenue of LKR 7.2 billion and four subsidiaries. Its internal audit function is outsourced to the same firm that earns LKR 18 million a year from tax advisory and system implementation work for the group. The internal audit plan is approved by the CFO; the outsourced internal audit partner reports functionally to the CFO and administratively to the group finance director. The audit committee has three members: a retired actuary (chair), a non-executive director who is a supplier to the company, and the MD. It met twice in the year; the external auditor's management letter was tabled at the second meeting. In March, a whistleblower emailed the CFO alleging that sales staff booked LKR 340 million of sales in the last week of the year with side letters allowing returns. The CFO asked the internal audit partner to 'look into it informally' and not to involve the audit committee. The partner did not document the review. The annual report states that the audit committee 'reviewed the effectiveness of internal controls'.
1. Evaluate the independence and objectivity of internal audit and the effectiveness of the audit committee's composition.
Read the worked answer
Internal audit must be independent of the activities it audits. Reporting functionally to the CFO is a serious conflict because the CFO owns many of the controls and financial reporting judgements under review. The outsourced firm also earns LKR 18 million from tax advisory and systems implementation, which creates a self-review and economic dependence threat. The internal audit partner should report functionally to the audit committee, with unrestricted access and private sessions, while administrative reporting can sit with the CEO.
The audit committee is not effective. The MD is an executive and should not be a member; the supplier is not independent; only the retired actuary is independent. SEC rules require an audit committee of at least three non-executive directors, majority independent, chaired by an independent director. Two meetings a year is too few for a group of this size, and there is no evidence of private meetings with internal or external audit. The committee cannot claim to have reviewed internal controls if it never saw the whistleblower allegation.
2. What should the internal audit partner do now, and what governance changes should the board make?
Read the worked answer
The partner should not conduct an informal, undocumented review. The allegation is a fraud risk indicator: LKR 340 million of last-week sales with side letters may be improper revenue recognition. The partner should document the allegation, preserve emails and side letters, escalate immediately to the audit committee chair, and recommend an independent forensic review. The partner should not accept instructions from the CFO to withhold information. Professional standards and the internal audit charter require objectivity and access to the committee. If the firm cannot act independently because of the advisory relationship, it should decline the forensic work and the company should appoint another firm.
The board should separate internal audit from the tax adviser, appoint a chief audit executive or co-source with safeguards, revise the charter, and strengthen the whistleblowing channel so concerns go directly to the audit committee. The committee should meet privately with the whistleblower and the forensic team, and minute its actions.
3. Is the annual report statement about internal controls defensible? Explain.
Read the worked answer
The statement that the committee 'reviewed the effectiveness of internal controls' is not defensible. A review requires a documented process, scope, findings and follow-up. On these facts the committee met twice, did not receive the whistleblower complaint, and relied on an internal audit function reporting to the CFO. The statement may be misleading and could expose directors to liability for false or misleading disclosure.
The board should correct the annual report if not yet issued, or make a corrective announcement, and disclose the investigation's outcome. The audit committee should minute its actual work and avoid boilerplate claims. It should also review whether the external auditor was told about the side letters, because withholding the allegation could impair the audit.