what is an internal audit 
internal audits evaluate a company s internal controls including its corporate governance and accounting processes these types of audits ensure compliance with laws and regulations and help to maintain accurate and timely financial reporting and data collection internal auditors are hired by companies who work on behalf of their management teams these audits also provide management with the tools necessary to attain operational efficiency by identifying problems and correcting lapses before they are discovered in an external audit understanding internal auditsinternal audits play a critical role in a company s operations and corporate governance especially now that the sarbanes oxley act of 2002 holds managers legally responsible for the accuracy of their company s financial statements sox also required that a company s internal controls be documented and reviewed as part of its external audit in addition to ensuring that a company complies with laws and regulations internal audits also provide a degree of risk management and safeguard against potential fraud waste or abuse the results of internal audits provide management with suggestions for improvements to current processes not functioning as intended which may include information technology systems as well as supply chain management internal audits may take place on a daily weekly monthly or annual basis some departments may be audited more frequently than others for example a manufacturing process may be audited on a daily basis for quality control while the human resources department might only be audited once a year audits may be scheduled to give managers time to gather and prepare the required documents and information or they may be a surprise especially if unethical or illegal activity is suspected types of internal auditsa company may be required to adhere to local laws compliance needs government regulations external policies or other restrictions to demonstrate compliance with these rules a company may task an internal audit committee to review compile appropriate information and provide an overall opinion on the status of the compliance requirement public companies are required to perform certain levels of external financial auditing where a completely independent third party provides an opinion on the company s financial records companies may want to dive further into audit findings or perform an internal financial audit in preparation for an external audit many of the tests between an internal or external auditor may be similar the nature of independence separates the two types of audits for financial audits as companies become continually more environmentally conscious some take the steps of reviewing the business impact on the planet this results in an internal audit covering how a company safely sources raw materials minimizes greenhouse gases during production utilizes eco friendly distribution methods and reduces energy consumption companies leveraging triple bottom line reporting may perform internal environmental audits as part of annual reporting an it audit may have different objectives the internal audit may be the result of an external lawsuit a company complaint or a target to become more efficient an internal audit focused on technology reviews the controls hardware software security documentation and backup recovery of systems the goal is likely to assess general it accuracy and processing capabilities an internal audit focused on performance pays less attention to the processes and more on the final result the company will have likely have set performance objectives or metrics that may be tied to performance bonuses or other incentives as a result an internal auditor assesses the outcome of an objective that may not be easily quantifiable for example a company may wish to have expanded its use of diverse suppliers the internal auditor independent of any purchasing process will be tasked with analyzing how the company s spending patterns have changed since this goal was set an operational audit is most likely to occur when key personnel leaves or when new management takes over an entity the company may want to assess how things are done and whether resources are being used more efficiently during an operational internal audit the auditor will review whether current staff and processes fulfil the mission statement value and objectives of a company development operating real estate or construction companies may perform construction audits to ensure not only appropriate physical development of a building but appropriate project billing along the life of the project this mostly includes adherence to contract terms with the general contractor sub contractors or standalone vendors as necessary this may also include ensuring the company has remit the appropriate payments collected the appropriate payments and internal project reports regarding project completion are correct many of the audits above may be recurring and performed each year in some cases it might make sense for an internal audit committee to evaluate a special circumstance that will occur only once this may entail gathering a report on the efficiency on a recent merger the hiring of a key employee or a complaint from staff when selecting the individuals for the special investigation audit a company must be especially mindful to select members with appropriate expertise and independence depending on the structure of the organization the internal audit may be prepared by the board of directors of by upper management internal audit vs external auditinternal and external audits have the same objective both types of audits analyze an aspect of a company to determine a specific opinion however there are many differences between the two types of audits in an internal audit the company is often able to select its own audit team as such the team represents the interests of the company s management team this may be advantageous to specifically place certain employees with very niche experience on the team in an external audit the company can often select the external audit firm however the company often does not have a say in the specific employees put on their external audit there may be some requirements regarding the external audit staff depending on the audit for example in an external financial audit a certified public accountant cpa must certify the financial statements in an internal audit there is no requirement that any member of the audit team must be a cpa the end goal of either audit is an audit report however audit reports are used for very different reasons an internal audit report is usually used by internal management to improve the operations processes or policies of the company an external audit report is often required for an outside reason and is more often used by members outside of the company finally the nature of the engagement will be very different during an internal audit the employees of a company may often freely give advice discuss unrelated matters with the company or may have a very fluid consulting agreement during an external audit a very defined scope is often set and the external auditor will often take great care to ensure they do not exceed their audit boundaries a company is usually able to select its own internal audit lead and team membersmembers of the audit team often do not need to have specific titles or licensesaudit reports are primarily used by internal management to improve company operationsinternal audits may be less formal with blurred structure as the auditor provides casual guidancea company or board can usually pick the audit firm but not audit team membersmembers of the audit team may be required to hold specific titles or license as part of the audit agreementaudit reports are primarily used by external parties to satisfy a reporting requirementexternal audits are often more formal with defined boundaries and disallowed servicesinternal audit processinternal auditors generally identify a department gather an understanding of the current internal control process conduct fieldwork testing follow up with department staff about identified issues prepare an official audit report review the audit report with management and follow up with management and the board of directors as needed to ensure recommendations have been implemented before any audit procedures are performed the internal auditors often start by developing the audit plan this sets the audit requirements objectives timeline schedule and responsibilities across audit team members the audits may review prior audits to understand management expectations for presentation and data collection the audit plan often has a checklist to ensure members of the team adhere to broad expectations the internal audit team may also preemptively plan to meet with management throughout the audit to communicate the status and any struggles of the audit the planning stage often ends with a kick off meeting that launches the audit and communicates the initial information needed many of the auditing procedures used by internal audits are the same as external auditors some companies might use continuous audits to ensure ongoing oversight of company practices assessment techniques ensure an internal auditor gathers a full understanding of the internal control procedures and whether employees are complying with internal control directives to avoid disrupting the daily workflow auditors begin with indirect assessment techniques such as reviewing flowcharts manuals departmental control policies or other existing documentation auditing fieldwork procedures can include transaction matching physical inventory count audit trail calculations and account reconciliation as is required by law analysis techniques may test random data or target specific data if an auditor believes an internal control process needs to be improved the internal audit may have started with a defined scope but as the internal audit team gathers and analyzes information it may become necessary to redefine the purpose and extent of the audit this includes re evaluating the original timeline or resources allocated to the audit internal audit reporting includes a formal report and may include a preliminary or memo style interim report an interim report typically includes sensitive or significant results the auditor thinks the board of directors needs to know right away similar to an interim financial statement an interim audit communicates a partial set of information useful for laying the road for the remaining portion often a company may deliver a draft copy of the final audit report and host a pre close internal audit meeting with management this may allow management to provide rebuttals additional information that may change findings or provide commentary on their feedback regarding the audit findings the final report includes a summary of the procedures and techniques used for completing the audit a description of audit findings and suggestions for improvements to internal controls and control procedures the final report may also communicate next steps in terms of changes to be implemented future monitoring processes and what future reviews will entail after a designated amount of time an internal audit may call for follow up steps to make sure the appropriate post close audit changes were implemented the details and process for these monitoring and review steps is often agreed to at the delivery of the final audit for example an internal financial audit may find severe internal control deficiencies that an internal auditor believes will not pass an external financial audit management agreed to implement changes within the next six weeks after six weeks the internal auditor may be tasked with implementing a small scope or limited review of the deficiency to see if the issue still persists the monitoring step of an internal audit is technically not required management or the board may decide to disregard internal audit findings and not implement the changes the audit report suggests internal audit reports the 5 c sinternal audit reports are often known for adhering to the 5 c s reporting requirement a complete sufficient internal audit often ends with a summary report that communicates answers to the following questions importance of internal auditssome may think internal audits are not as valuable as external audits after all a company may hand pick its own internal audits who do not have full independence from the company however there are many ways internal audits provide value to the company and external parties 