Internal Auditing

INTERNAL AUDITING:

AN INTERNATIONAL PERSPECTIVE

(Including a review of trends in Ethiopia, Morocco, Argentina, Taiwan, Finland, Israel, France, and South Africa)

Elizabeth Folsom

March 18, 1999

WHAT IS INTERNAL AUDITING?

Internal Auditing is one of the world’s fastest growing but most misunderstood professions. There are many definitions of the profession. For the Institute of Internal Auditors (IIA) "Internal Auditing is an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization. The objective of Internal Auditing is to assist members of the organization in the effective discharge of their responsibilities. To this end, Internal Auditing furnishes them with analyses, appraisals, recommendations, counsel, and information concerning the activities reviewed. The audit objective includes promoting effective control at reasonable cost."[1] In order to fulfil these obligations, internal auditors review the reliability and integrity of financial and operating information; the systems established to ensure compliance with these policies, plans, procedures, laws and regulations; the means of safeguarding assets; the economy and efficiency with which resources are employed; and ascertain whether results of operations or programs are carried out as planned.

Internal Auditing is a rapidly developing function, which is becoming increasingly professionalized in many countries, both in the public and private sectors. Parallel to this development has been the recognition, at various levels of government, of the need to establish this function. In terms of institutionalization, the professional is still young and its rate of development has not been uniform. Internal audit began in the United States in the early 40’s. The initial period was characterized by rapid and multi-faceted growth in both the public and private sectors, accompanied by failures, difficulties, and problems in many areas of management, particularly supervision and control. Today the International Institute of Internal Auditors (IIA) governs the profession and provides a framework, standards, and guidelines for its activities. The IIA has 58,000 members in over 120 countries around the world. The largest representation in the IIA is in the U.S. (29,500), UK (3,700), Canada (2,500), Australia (2,000), and India (1,900).[2]

PURPOSE OF PAPER

In a general sense, auditing is done for the same reasons in all countries. External audits are done to ascertain the validity and reliability of the financial statements prepared by companies based on specific auditing standards. In the same broad vein, internal audits are done to see whether management’s operating and financial controls are being followed and whether or not they are effective. Yet despite these general similarities, actual auditing practices vary considerably from country to country. In some countries, an audit is seldom performed, or it is performed in a manner that is unacceptable to the auditors of other countries. Such difference in auditing practices pose problems for international investors and creditors, and or course, for multinational firms. This paper will examine some of the major similarities and differences in internal auditing throughout the world, the problems encountered, and some of the steps being taken to mitigate those problems. In addition, we will examine the effectiveness of the internal audit profession in various countries.

In order to identify the role and characteristics of internal audit in the management framework and assess its effectiveness, experts have suggested a number of criteria such as: source of authority, degree of independence, line of command, and practical application[3]. Source of authority refers to the level from which the internal audit mandate arises as well as the level of respect the internal audit function has in the organization. Degree of independence is self-explanatory – to what degree is internal auditing allowed to examine any activity, system, process, or transaction and. Line of command refers to the level in the organization that internal auditing reports to (the higher the better) and the level of authority that internal auditing has in getting recommended changes implemented. Practical application encompasses the relevance and modern tools used by internal auditing. To round out the analysis, details are also given on each countries type of government, population, literacy rate, gross domestic product (GDP), Corruption Perception Index (CPI) by Transparency International[4], and Economic Freedom Ranking (EFR) by The Heritage Foundation.[5]

THE INTERNATIONAL SCENE

A recent study on the profession shows some interesting international trends. Conducted by the French Institute of Internal Auditors and Consultants, IFACI (Institute Francais des Auditeirs Consultants Internes), in conjunction with Arthur Andersen, some 600 companies covering all fields, were consulted in ten countries; the United States, United Kingdom, Canada, France, Japan, Germany, Spain, Argentina, Belgium and Morocco.

The findings revealed that the internal audit function was performed in 98% of the companies surveyed and the companies surveyed together employed 22,900 auditors.[6] The reasons which bring about its creation vary from sector to sector but the strong influence of regulations is a dominant factor. In addition, although areas of focus for internal auditing are still close to the initial objectives, they are tending to expand to include diverse functions and the company’s operational problems. The function is based on established methodology and computer tools, but the profile of internal auditors depends on the company’s recruiting and career development policies. Although well represented by women (26%), the function remains dominated by men. All ages are evenly represented but the average auditor is about 40 years old. Fifty-seven percent (57%) have received a general or accounting university education (74% higher education), while only 8% are self-taught.[7]

ETHIOPIA

Government Type:Federal Republic

Population:58,390,351

Literacy:35.5%

GDP:$29B

CPI2.90 (very poor)

EFR:2.90 (mostly free)

Scope of Authority:Low

Degree of Independence:Low

Lines of Command:Low

Practical Application:Low

BACKGROUND

Internal Auditing's importance in Ethiopiawas formally recognized in the early 1930s by the country's first Constitution. This document referred to the proper collection of state revenue and the necessity for procedures to control expenditures. In 1944, another milestone occurred when a proclamation established the Commission for Audit, charged with auditing the Ministry of Finance accounts. The development of state budget practices, an emphasis on fraud deterrence, and growth in trade and industry subsequently added impetus to the growth of the profession. More recently, the "Government Internal Audit Manual," published by the Council of Ministers in 1985, motivated many state authorities to strengthen internal auditing. The Manual suggests that "Although it is the responsibility of the management of each enterprise to set up and run an effective audit department, the situation at present is unsatisfactory and those units that do exist are virtually defunct.” [8]

CURRENT PRACTICE
The reality is that internal auditing today still focuses on traditional activities, such as financial and compliance auditing. Less attention is given to operational audits or the application of modern techniques like flowcharting, statistical sampling, and computer auditing. They spend most of their time ensuring that accounting records are properly maintained and reliable; that company assets are adequately safeguarded and properly maintained; and that the organization is in compliance with established policies and procedures. The majority of internal audit departments do not have a written audit charter. Therefore, the objectives, authority, scope, and responsibilities of internal auditing are not spelled out in most organizations, and no measures exist to ensure that the internal audit department is recognized as acting with the authority and support of senior management. Internal auditing also is handicapped by a critical shortage of appropriately trained and skilled work force, inadequate organizational status, and a lack of professional independence. The essential qualification is still accountancy-based, which constrains the role and scope of internal auditors. A 1991 study found that approximately 71% of surveyed internal audit staff held diplomas and degrees in accounting; none had the requisite professional qualification in internal auditing[9].

THE FUTURE

If we focus only on the increase in the number of internal audit units and in the number of auditors employed, we can certainly say that internal auditing in Ethiopiahas come a long way. However, in terms of skilled and qualified labor; properly delineated authority and responsibilities; and a reporting status that permits the maintenance of integrity, objectivity, and professional independence, internal auditing has far to go. The inadequacies in professional education and the lack of a coordinated comprehensive training program are critical obstacles to strengthening internal auditing in Ethiopia. The government, public enterprises, and private organizations must attend to these areas to realize the full value of effective internal auditing.

MOROCCO

Gov. Type:Constitutional Monarchy

Population:29,114,4997

Literacy:43.7%

GDP:$107B

CPI3.70 (poor)

EFR2.95 (mostly free)

Scope of Authority:High

Degree of Independence:Moderate

Lines of Command:Moderate Practical Application:Moderate

BACKGROUND

A relatively new profession in Morocco,internal auditingwas introduced in the early 1980s by multinational companies. As these organizations began to set up shop in Morocco, they brought with them traditional business practices that included internal auditing. At first, few Moroccan organizations followed suit. Local companies that did employ internal auditors charged them simply with financial and accounting responsibilities. Internal Auditing’s status changed in 1993 when a letter from King Hassan II of Morocco asked that all of Morocco's ministries and public enterprises be audited. The announcement specifically requests external, managerial, and internal audits. According to the letter, internal audits are vital for verifying that the organization's central policies and procedures conform to the applicable laws and politics of the country.[10] In 1996 a law was passed that requires all companies classified as "limited" to establish an internal audit department

CURRENT PRACTICE

Today, Morocco'sinternal auditing practitioners must be university graduates with four-year degrees in some related field, such as accounting, management, or audit. Internal auditors provide assurance in numerous areas, primarily through operational and data processing audits. Management generally regards internal auditdepartments with respect and provides them with appropriate support. The internal auditfunction is often positioned at the highest levels of the organization, which ensures smooth work processes and auditor independence. As a direct result of the King's letter, internal auditinghas become mandatory in all government offices. Public sector companies that have dealings with the various governmental ministries must also conduct internal audits.

THE FUTURE

In spite of their strong position, Morocco'sinternalauditors still face three major obstacles: maintaining their independence, competing in the business community, and educating others about internal auditresponsibilities. The country' s internal auditors are sometimes perceived as an extension of the external auditorganizations rather than as a separate, internalfunction. Many professionals believe that internalauditors should maintain their independence and distinction from the external auditors, and that the survival of internal auditingin Moroccomay be at stake if internalauditors are subsumed by these external auditingorganizations.[11] Moreover, the increase in competition from European firms is a real concern, Moroccan businesses may be eliminated, and many Moroccan internalauditors may find themselves out of work. Finally, many Moroccan professionals are confused about the duties and differences between the internalaudit, total quality, and management control functions. Further efforts to educate the public about internalauditing's distinct qualities are imperative.

ARGENTINA

Government Type:Republic

Population:36,265,463

Literacy:92.6%

GDP:$348 B

CPI3.00(very poor)

EFR2.50 (mostly free)

Scope of Authority:Moderate

Degree of Independence:High

Lines of Command:Moderate

Practical Application:Moderate

BACKGROUND

The concept of internalauditingwas first introduced to Argentinain the early 1950s, when multinational companies with internalauditfunctions established bases in the country. Argentina's first internalauditors generally were employed by these companies, mainly from the U.K. and the U.S. In the early stages, auditors were almost like "policemen" with responsibility for controls over inventories and cash. Later, a second generation of auditors, mostly external auditors who became internalauditors, was primarily involved in the accounting area.

CURRENT PRACTICE

Today's Argentine auditors, typically university graduates with CPA designations, are much more involved in operational auditsand in the overall system of internalcontrol. About 4,300 internalauditors currently practice in Argentina, including 1,000 in the private sector; 1,600 in the public sector; and 1,700 others who perform various control activities.[12] Within the private sector, a high percentage of internalauditors are employed in banking, manufacturing, and utilities.

Legislation requires internalauditors in the public sector. The national government first established the function of internalauditin Argentina's public sector in 1993. Consequently, internalauditunits for each national government organization and a centralized internalauditunit were created. Law in the banking services sector also requires internal auditing. A new regulation enacted in May 1997 requires each bank to have an AuditCommittee with a specific structure, a person responsible for the internalaudit function, and an internalauditor in each bank.

THE FUTURE

Looking ahead, the challenges for Argentina's internal auditors revolve around maintaining their position in companies that emphasize meeting competitive challenges over internal controls, helping management understand that internal control is inherent to an organization’s quality, and change their techniques to become more “business oriented” with an increased understanding of how businesses are managed.[13] Since the privatization of most state-owned companies and significant external investments in the last five to ten years, internalauditors are faced with following - and sometimes leading - the organization' s change process.

Taiwan

Government Type:Democracy

Population:21,908,135

Literacy:92.6%

GDP:$308 B

CPI5.30 (avgcorruption)

EFR1.95 (free)

Scope of Authority:High

Degree of Independence:High

Lines of CommandHigh

Practical Application:High

BACKGROUND

Internalauditing in Taiwanbegan in 1947 as a government function. At that time, both accounting and auditinglaws required all government areas to develop and enhance their internalauditfunctions. In the early 1960s, internalauditingbecame prevalent across the nation. All government-owned enterprises, which included banks and utilities, established internalauditdepartments to improve operational efficiencies. At this stage, internalauditors still focused most of their efforts on the assessment of financial controls. Most private industries did not recognize the importance of internalauditingand internalcontrols until the late 1980s. In 1986, the TaiwanSEC issued the nation's first internalcontrol regulation. The law required companies registered on Taiwan's stock market to establish an internalcontrol system and an internalauditfunction.

CURRENT PRACTICE

These regulations accelerated the development of internalauditingin Taiwan. Today, there are approximately 1,800 government auditors and 4,500 private-sector auditors practicing in the country.[14] However, those numbers promise to grow as companies registered on the stock market continue to add internalauditingpersonnel to their ranks. The internalauditingregulation of 1992 also prohibited registered companies from hiring internalauditors who have not completed at least an undergraduate degree or who are not certified in the practice of internalauditing.[15]

THE FUTURE

As the country strives to promote all of its international developments, auditors will face more business challenges and will have to contend with the following developments withinTaiwan'sever-changing infrastructure. To comply with new regulations, and to boost marketing capabilities in the increasingly competitive global environment, organizations are becoming ISO 9000 and ISO 14000 registered. Taiwanese law requires auditors in most organizations to perform environmental and quality compliance audits, and internalauditors must be familiar with these systems. In addition, to increase international competitiveness, Taiwan's ultimate goal is to transform itself into a "science and technology island.” Therefore, internalauditors who want to increase their value will learn how to continually evaluate the effective use of science and technology resources.

FINLAND

Government Type:Republic

Population:5,149,242

Literacy:100%

GDP:$102 B

CPI9.6 (negligible corruption)

EFR2.25 (mostly free)

Source of Authority:Moderate

Degree of Independence:Moderate

Lines of Command:High

Practical Application:High

BACKGROUND

The origin of internalauditingin Finlanddates back to around 1951. Finland's internalauditingefforts focused on controls over administration, funds, and bookkeeping. Challenges early internalauditors faced included profitability, controls of sales and administration, internalcontrols, insurance and loan process, organizational politics, centralized or decentralized accounting, and profitability of information systems[16]. By 1970, the internalauditingprofession had added analysis and auditof various functions, systems, and methods to its role. Internalauditors ensured that the mission statement and business ideas were followed. They implemented operational controls; auditedinformation; made suggestions; educated personnel; and aided the company' s external auditors.

CURRENT PRACTICE

Today, practitioners in Finlandperform operational, compliance, or financial-based audits, with an emphasis on assessing the organization' s control system and control environment as a whole. In this area of control and risk-assessment, internalauditors typically act more as consultants or partners with management. For example, while management is responsible for organizing appropriate and sufficient control over a company's use of funds and its bookkeeping, they often rely on internalauditing's expertise and experience to accomplish their goals.

Conservative estimates indicate that 700 to 800 internalauditors practice in Finland, most with master's degrees and a major in accounting or finance.[17] When those who may conduct traditional internalauditduties under different job titles - such as directors, controllers, engineers, lawyers, accountants, and auditors in particular industries like government, forestry, and insurance are included, the number grows even larger. Most of Finland's internalauditors work in banking and insurance (22.5 percent); industry, including manufacturing (20.8 percent); state and community government (19.6 percent), and commerce (8 percent)[18]. While no law mandates internalauditingin any business in Finland, banks are indirectly required to have an internalauditfunction.