A third line that actually works

Internal Audit

Internal audit assesses governance, risk management and internal control throughout the year, for the board and management. A financial statement audit assesses one year of figures, for outside parties. Both are called audit, which is precisely how they get confused.

Article 3(3) of Law No. 5 of 2011 on Public Accountants permits a public accountant to provide services other than assurance where they relate to accounting, finance and management. Article 28(2)(c) of the same law identifies providing assurance and other services to the same client for the same financial year as a form of conflict of interest. This line is therefore offered to entities whose financial statements we do not audit for that year.

• Establishing the functionstructure, reporting line to the board, competency requirements, and a realistic first year.
• Charter and risk-based plana charter that sets the mandate and authority, then an annual plan built from a risk assessment.
• External review of internal audit performancethe independent assessment required of commercial banks, covering an opinion on the work, conformance with standards, and improvement proposals.
• Outsourced engagementsperforming specific engagements for entities whose function is not yet complete, with responsibility remaining with management.
• Methodology and working papersaudit universe, risk assessment, work programmes, findings, and follow-up tracked to closure.