What is an internal audit?

An internal audit is a key pillar of good governance. Governance refers to the processes and structures implemented by organisations to inform, direct, manage and monitor activities.

The Institute of Internal Auditors (IIA) lists the four pillars of governance as:

1. Audit Committee (Board)

2. Executive Management

3. Internal Audit

4. External Audit

An internal audit provides the board of directors, audit committee, chief executive officer, senior executives and stakeholders with an independent view on whether an organisation has an appropriate risk and control environment, while acting as a catalyst for a strong risk and compliance culture. Internal audit work is risk-based and encompasses both financial and non-financial operations. It is not limited to money. For example, in a healthcare organisation, there may an important role to review clinical governance.

Internal auditing is an important element in the governance and assurance environment, and a valuable tool to manage risk effectively. This applies to all organisations, including associations.

What does an internal audit do?

Internal auditing works to support the board of directors, audit committee, chief executive officer, senior executives and stakeholders.

The following questions are part of an effective internal audit:

• Are we achieving our objectives?
• Are we complying with laws, regulations, policies and contracts?
• Are we limiting opportunities for fraud and corruption?
• Are our decisions properly authorised?
• Are we making sure improvements are implemented?
• Are our assets safeguarded?
• Are we efficient, effective, economic and ethical?
• Are we constantly looking for better ways of doing things?

How can an internal audit be implemented?

Internal auditing need not be costly or even full-time. Organisations should establish internal audit according to their size and requirements. This could be by determining what should be audited, the resources required to do this, and how much budget may be available. Depending on the size of the organisation, it could simply be a few days each month.

Resources may be obtained in a variety of ways:

• Getting an experienced resource to perform internal audit work – this could be in-house or contracted-in. For Associations an option could perhaps be a retired internal audit practitioner.
• Under supervision, business students can be an option.
• Some accounting and auditing professional service firms offer pro bono services to not-for-profit organisations.
• Experienced internal audit practitioners from overseas may be seeking local experience on a volunteer basis.
• The Australian Government may have programs for experienced immigrants from overseas to get local experience.

Benefits

There are a number of potential benefits if an internal audit is implemented in an association:

• It will provide the governing body, usually the board, with assurance that things are in order.
• It will highlight areas where controls may be weak and in need of tightening. Many Associations rely on a small number of people, whether they be paid or volunteer, and it can be difficult to get enough separation of duties which can potentially lead to breakdown in controls and risk to the organisation.
• It will encourage people to have trust in an association. Potential members and donors will generally avoid a poorly controlled association.

Conclusion

Internal auditing is a service function that provides key stakeholders with a range of risk-based activities to assess whether an organisation is operating satisfactorily. Internal stakeholders include the board of directors, audit committee, chief executive officer and senior executives, while external stakeholders are shareholders and regulators.

An internal audit activity in an association can be cost-effectively implemented and provide significant benefits.