The Hindu Business Line : Developing an internal audit plan

THE function of Internal Audit (IA) has assumed greater importance after the twin disasters of Enron and WorldCom and the subsequent passing of the Sarbanes Oxley Act.

The idea that IA should function as the eyes and ears of an organisation appears to be more relevant and needed nowadays. Against this background, the Institute of Chartered Accountants of India has proposed a Standard on Planning an Internal Audit.

The draft starts off by getting into what planning an Internal Audit is all about. While emphasising the need for planning the audit, which is a continuous process, the Draft talks about getting the approval of the Audit Committee for any changes in the Internal Audit Plan.

This would put too much of pressure on an already-burdened Audit Committee, thanks to SOX and Clause 49 of the Listing Agreement. This could be amended to state that only major changes in the Internal Audit programme would need to be informed to the Audit Committee. The internal audit plan should be based on the knowledge of the entity's business.

While developing the internal audit plan, the internal auditor should have regard for the objectives of the internal audit engagement as well as the time and resources available for conducting the engagement. Planning an internal audit involves establishing the overall strategy for the engagement so as to keep the risks associated with the assignment at the acceptable level.

The internal auditor should obtain a level of knowledge of the entity sufficient to enable him to identify events, transactions, policies and practices that may have a significant effect on the financial information.

Following are some of the sources wherefrom the internal auditor can obtain such knowledge:

Entity's policy and procedures manual

Minutes of the meetings of the shareholders, board of directors, and important committees of the board such as the audit committee, remuneration committee, shareholders' grievances committee

Management reports/internal audit reports of prior periods

Newspapers/ industry journals

Discussion with client management and staff

Visits to entity's plant facilities etc., to obtain first hand information regarding the production processes of the entity

Other documents produced by the entity, for example, material sent to the shareholders and the regulatory authorities, management policy manuals, manuals relating to accounting and internal controls, organisational charts, job description charts, and so on.

The next step in audit planning is establishment of the audit universe or the audit territory. The audit universe is designed to reflect the overall business objectives and therefore includes components from the strategic plan of the entity.

The next stage in planning is establishing the specific objectives of the internal audit engagement required to make the audit plan responsive to those changes. Once the scope of the internal audit procedures is established, the next phase is that of deciding upon the resource allocation. Efficient resource allocation is essential to achieve the desired objective, within the constraints of time and cost as well as optimum utilisation of resources.

It should be stated that most of the above points have already been covered in different pronouncements of the ICAI. "Knowledge of the Business" finds a place in most of these pronouncements. The above draft seems to be a reminder to auditors to plan and document an internal audit properly.

(The author is a Hyderabad-based chartered accountant.)