Internal audit: what it is, its importance and how to do it

Internal auditing is an independent, systematic and objective analysis and consultancy process that contributes to improving operations and activities, generating value for the company by providing insights into advances in risk management, governance and operational control .

This definition comes from the Institute of Internal Auditors (IIA), which provides guidance on compliance with international standards in this area.

Internal audits work like a fine-tooth comb through company processes, identifying conduct and activities that are not aligned with management premises.

Identifying mismatches is essential for risk management , acting to prevent problems from escalating and causing damage, both financially and to the business’s image.

The audit carried out by the company’s own team also helps to ensure that any damage to the business remains secure and is resolved internally, reducing negative effects.

The more efficient and reliable the work of the company’s audit team, the greater the chances of keeping the operation away from the risks inherent to the business, creating transparent corporate governance standards.

Difference between internal and external audit

The difference between the two types of audit is that the internal audit is carried out by a team within the company, made up of professionals specialized in audit guidelines, whose function is to identify improvements in internal processes.

External auditing is carried out by an outsourced team, that is, without an employment relationship with the target company and linked to consultancies that provide services in the area.

Its function is to ensure the level of credibility and trust in the data that organizations pass on to their directors and shareholders.

How important is internal auditing?

Internal auditing is important because, through the assessments carried out, the company’s sectors receive guidance on what and how to improve control processes to be more efficient and not bring risks that could harm the planned objectives and goals .

Among the companies surveyed by the KPMG consultancy, those at an advanced level (34%) have an internal team of specialists who understand all the technical aspects of Internal Auditing.

In companies in the initial stages (35%), the team responsible for auditing processes only masters points related to Traditional Internal Auditing.

Another interesting piece of data from the research that highlights the importance of auditing is that companies invest up to R$150,000 per year in hiring external advisors/consultants to help evaluate different processes, such as LGPD, compliance and other strategies.

In this way, companies create efficient management standards aligned with the requirements identified by the audit, improving communication, coordination and collaboration between all sectors.

How does the Three Lines model work?

The Institute of Internal Auditors’ (IIA) Three Lines model helps to understand and use internal auditing in the best possible way, integrating governance with management.

The corporate governance area defines the means and guidelines for business strategies and evaluation, in addition to monitoring the work of management sectors.

Those responsible for conducting management, in turn, plan strategies, guided by the governance area, carrying out actions and implementing internal control measures.

Each department still corrects and improves processes that are not in line with the organization’s objectives.

For the exchange between governance and management to be productive, it is essential that the areas communicate to define responsibilities, functions and internal structures. This means:

• organize the flow of data so that information reaches everyone, maintaining access control to ensure security;
• consolidate well-structured processes for each area of ​​the company;
• have a well-defined administrative structure;
• assign skills to employees to keep transfers active.

Thus, governance, management and audit maintain an ongoing collaboration , which is the basis of the Three Lines model.

Managers’ trust in the auditors’ work contributes to the objectivity and autonomy of analyses, generating insights that lead to innovation, growth and a reduction in occurrences highlighted in the risk matrix .

The model described above is illustrated in the image below which highlights the main points of the relationship between the three corporate structures:

Who can perform an internal audit?

Internal auditing can be carried out by professionals who have the appropriate qualifications to audit the processes related to the area analyzed. In other words, a legal audit is carried out by the company’s lawyer, while the finances must be audited by an accountant qualified for the role .

Another option is to maintain an Audit department in the company with employees who have undergone training to become auditors. These are generally professionals with degrees in administration, economics and accounting.

Qualification and preparation to correctly perform the audit are essential to ensure the quality of the assessments. If you outsource the work, ask for recommendations from reliable people and check the professional’s training before hiring them.

How to do internal auditing?

The work of the audit team must be conducted by the responsible team, which may be divided or work together to analyze a specific sector of the business. To ensure that an accurate analysis is carried out, take the following steps:

1. Mapping processes

The first step of internal auditing is to map the processes of the area being analyzed or a set of tasks related to a part of the company.

For example, it is possible to carry out an internal audit on the business’s operational industrial processes , that is, on the activities that guarantee the production or qualified provision of services.

Support areas, the governance sector and the internal communication process are other examples of points that auditors may go through.

Once you have defined the sector that will be the focus of the analysis, list the current processes to have a database to begin the assessment.

2. Identify the risks

With the process map in hand, auditors will identify potential risks existing in the work model being carried out in the area being assessed.

The points of concern are then presented to the manager/director responsible for the sector to check whether the concerns raised and the risks identified match what employees already perceived or whether they are new.

3. Define control activities

The audit process continues with the definition of control activities . The objective of these tasks is to reduce the risks identified during the mapping stage.

Thus, the team of auditors joins forces with employees in the audited area to find solutions that really work to avoid unexpected problems and losses in the delivery of production or the final service to the client.

4. Create a checklist

Monitoring activities is done by creating a checklist that will record whether the desired results are appearing, as well as difficulties in implementing control actions.

The advantage of the checklist is that the document can be prepared and completed online, being saved in the internal system, making it easier for auditors to verify.

5. Record evidence about the processes

Every sector has its own performance indicators. While the audit is monitoring the control mechanisms and proposed improvements, record evidence of the evolution of the processes .

If the company uses management software, generating reports that show the evolution of the indicators’ results is easier. This way, auditors have reliable information about the effectiveness of the proposed changes.

6. Report non-compliance

Another measure to ensure that internal auditing is effective is to report non-conformities in other processes that arise with the initial changes.

It is essential that auditors inform the team about this possibility, informing them of the correct conduct when identifying new opportunities for improvement.

7. Receive action plans

With the improvement flow structured and underway, the next step of the audit is to receive action plans .

The audited sector must prepare an action plan and send it to the Audit area, informing the new target to be achieved with the proposed adjustments to the work model.

Documenting the plan makes it much easier for auditors to monitor, as several control measures can be executed at the same time, in different management sectors.

8. Monitoring by action plan

The internal audit team must be divided so that each group can monitor the progress of the action plans, helping employees achieve the desired improvements.

Thus, new, optimized and safer standards are consolidated in the company, maintaining a cycle of continuous improvement in the company.