Internal Audit
VEZIN INTERNAL AUDIT SERVICES
What is Internal Audit?
Internal auditing is an independent and objective assurance and consultancy activity that aims to improve and add value to your business's operations.
What does internal audit do?
Internal audit helps your organization achieve its goals by evaluating the effectiveness of your organization's risk management, internal control, and corporate governance processes. The scope of duty of internal audit is risk management, internal control and governance processes. We can define risk management as identifying potential events that may negatively affect institutions' achievement of their goals and determining the measures to be taken against them. Internal control is all the measures taken to increase the possibility of institutions achieving their goals. Governance, or corporate governance, can be defined as all the structures and processes created to achieve the goals of institutions.
Internal audit is an independent and objective activity. Independence is the ability of internal audit to carry out its duties freely, free from interference. Internal audit reporting to the board of directors or audit committee ensures that it carries out its duties independently of senior management. Objectivity means that internal auditors perform their duties without taking sides and without prejudice, and internal auditors must be objective.
The sole goal of internal audit is to help the organization achieve its goals. Internal auditing detects risks that may prevent businesses from achieving their goals in advance and ensures the development of controls, that is, measures, that will eliminate or minimize the negative effects of these risks. Internal audit identifies the root causes of problems and makes suggestions to eliminate them.
Why Do Companies Need Internal Audit?
Internal audit is the eyes and ears of the board/audit committee and senior management. It is the only unit that will answer management and board questions independently and objectively. The questions like; Are our risks managed effectively? Are our internal controls effective? Are our measures against abuse sufficient? Are our assets adequately protected? Is our managerial and financial reporting accurate? Can we comply with the regulations? Can we carry out our operations efficiently and effectively? etc.
Internal audit examines all the priority processes of your organization, as if performing a health scan, detects weaknesses that pose risks and makes recommendations to prevent your risks from occurring again.
It strengthens your control environment by helping to comply with ethical rules, creates audit awareness and culture among personnel, and prevents abuse, etc. prevents vulnerabilities.
By strengthening the internal controls in your business processes; It ensures that your operations are carried out effectively and efficiently, the accuracy of your financial and managerial reports, your top management takes quick and effective decisions, the protection of all your assets, the effective use of your resources, your losses, your compliance with regulations, and thus prevents penalties, errors, and abuses, and provides an early warning function.
Regarding corporate governance, it provides confidence to investors and increases the reputation of your organization by increasing responsibility, accountability, and transparency in your institution. It also helps the institutionalization and sustainability of your business by ensuring that transactions are carried out in accordance with established procedures, rather than depending on individuals.
Internal audit helps your senior management by providing consultancy services in many areas. For example; reducing your costs by making benefit and cost analyses, preparing your business continuity and disaster recovery plans, selecting and installing your enterprise resource planning systems, establishing your corporate risk management systems, creating your quality systems, conducting your benchmarking studies, coordinating your process evaluation and organizational structuring studies, establishing your ethics line, Identification of risks and controls in your business processes and establishment of your internal controls, security/internal control/compliance with regulations, etc. It provides consultancy services in areas such as providing awareness training to your institution staff, researching new technologies/innovative ideas and project follow-ups. Internal audit provides you with consultancy services at much more affordable costs than consultancy services received from external institutions.
Internal audit is the only unit in your organization that can see the big picture. Since internal audit examines all processes of your organization while other units carry out studies on their areas of duty, it better sees the process weaknesses, coordination and communication deficiencies between departments and makes the most appropriate suggestions to eliminate the problems.
What are the Critical Elements in the Success of Internal Audit?
The ability of your internal audit department to provide the expected benefits depends on some critical elements: First of all, internal auditing must be positioned correctly within the organization, that is, it must report to the board of directors in a way that ensures its independence. Your internal audit staff must be sufficient and competent. The board of directors and senior management must provide full support to internal audit in its work. Technological opportunities and data analysis tools should be used effectively in audit processes. There must be effective communication between internal audit, senior management and the audit committee. Internal audit processes should be structured in accordance with international standards and in an agile manner.
What is Internal Audit Not?
Internal auditing is often confused with other types of audits and studies:
Internal audit is not “internal control”. We can briefly describe internal control as "measure". Internal auditing is an activity that checks the effectiveness of these measures, that is, internal controls, and provides assurance in this regard. In essence, internal auditing is also an element of the internal control system, and having internal auditing in an institution strengthens the internal control system. The owners and implementers of internal controls are the relevant process owner units, senior management, and employees. The board of directors is responsible for overseeing the effectiveness of internal controls.
Internal audit is not just about financial auditing. Internal audit, in accordance with the needs of the institution; In addition to financial auditing, it carries out various audits such as operational, compliance, information systems and performance audits.
The work done by certified public accountants and independent accountants and financial advisors (which ensures that tax calculations, accounting records and financial reporting are done correctly) is not internal audit.
Studies such as quality and lean management are not internal auditing. These activities aim to improve processes and increase quality.
Internal auditing is different from inspection. Inspection is mostly retrospective and compliance audit oriented. However, rather than compliance auditing, internal auditing works proactively to prevent errors from occurring, is future-oriented and risk and control focused.
Internal auditing is different from external auditing. External audit is carried out by independent auditors from outside the company regarding the accuracy of financial reporting processes. The main purpose of external audit is to provide assurance to stakeholders outside the company.
The main task of internal audit is not to conduct investigations. Internal auditing is an assurance and consultancy activity. However, since internal audit is independent and objective, it carries out examination and investigation activities upon the request of the senior management and the board of directors or due to irregular transactions detected during the audits. Investigative activities are aimed at determining personal responsibility and are different from internal auditing.
As Vezin, we offer the following services to establish your internal audit department and increase its effectiveness.
ESTABLISHMENT OF MODERN INTERNAL AUDIT FUNCTION
As Vezin, we help you establish your internal audit function and initiate audits. We ensure the establishment of the internal audit department and the start of audits in three stages:
First Stage: Establishing the Internal Audit Department and Audit Processes
• Understanding business processes in order to determine the staff size of internal audit
• Understanding the expectations of the business board of directors and senior management
• Determining the internal audit organization and its place in the corporate organization
• Finding and supporting the selection of internal audit personnel
• Creation of internal audit charter
• Creation of internal audit manuel
• Informing the board of directors/audit committee, senior management and staff about internal audit processes
• Training of auditors on internal audit standards and audit methodologies
Second Stage: Conducting Pilot Audits
• Conducting risk assessment in determined processes and creating an audit plan
• Creating the audit program
• Carrying out pilot audits together with the audit team
• Creation of audit working papers
• Creating an audit reporting system and reporting
• Establishing a follow-up system of management action plans
• Determination of internal audit performance criteria
Phase Three: Oversight and Development of the Audit Team
• Supervision of audit processes and providing guidance to the audit team
• Monitoring the performance of the audit unit
• Providing support by identifying areas that need improvement for the internal audit team.
STRATEGIC INTERNAL AUDIT CONSULTANCY
It is sometimes stated by company top managers and company owners that they cannot obtain the expected benefit from internal auditing. Internal audit departments cannot engage in activities that create sufficient added value in their institutions for various reasons such as; organizational structuring problems, lack of competent and sufficient personnel, inadequate use of technological tools and data analysis tools, wrong audit methodologies, inadequate understanding of what internal auditing etc. We provide support to companies that have established an internal department but need support regarding internal audit processes, in order to maximize the value that the internal audit function adds to the business.
We offer this service in two stages:
First Stage: Understanding the Current Situation of the Internal Audit Function and Identifying Improvement Areas
• Understanding the expectations of senior management and the board of directors from internal auditing
• Evaluation of business activities and audit universe in terms of understanding internal audit needs and unit size
• The current audit unit's organizational structure, personnel status, systems and tools used, audit methodologies, reporting, action follow-ups, etc. evaluation in all its aspects
• Evaluation of the audit committee charter
Second stage: Evaluating the actions taken for the identified improvement areas and providing strategic support to the audit team.
• Writing/revising the internal audit charter and guide, revising the action follow up systematic and supporting the actions to be taken
• Reviewing the audit works carried out and making recommendations on the issues identified.
• Evaluating the adequacy of the actions taken regarding the improvement areas identified in the first phase.
• Providing strategic consultancy to the internal audit team in areas where it is needed
INTERNAL AUDIT CO-SOURCING SERVICE
One of the most critical elements for internal audit departments to add maximum value to their institutions is to have competent and sufficient personnel resources. Internal audit departments have difficulty finding audit personnel in areas that require expertise such as IT, finance-accounting, and fraud, or cannot retain their existing personnel. We provide expert audit staff support to internal audit departments that have established an internal audit department but do not have sufficient qualified and number of expert audit staff.
INTERNAL AUDIT OUTSOURCING SERVICE
Some businesses; Instead of establishing an internal audit department for various reasons (cost advantage, receiving service from expert auditors, etc.), they ensure that audit work is carried out entirely by using external resources. We provide internal audit services to businesses that prefer to outsource their internal audit services, by our expert auditors.
INTERNAL AUDIT QUALITY ASSURANCE ASSESSMENT SERVICE
According to International Internal Audit Standards, internal audit managers must prepare and maintain a Quality Assurance and Improvement Program (QAIP) that covers all aspects of the internal audit activity they manage. These programs are evaluations made by qualified and independent people outside the institution in order to evaluate whether the internal audit activity complies with the standards and whether the internal auditors comply with the ethical rules. External evaluations are mandatory at least every five years.
As Vezin, we provide a full range of external evaluation services.
Full-scale external evaluation service is carried out within the following scope:
First of all, the level of compliance with standards and ethical rules is evaluated. In this scope; we evaluate compliance with internal audit regulations, plans, policies, procedures, practices and other relevant regulations.
In the second scope, the effectiveness and efficiency of the internal audit activity is evaluated. In this context, the processes and infrastructure of the internal audit activity, including the quality assurance and improvement program, and the knowledge, experience and expertise of the internal audit staff are evaluated.
Thirdly, the value added by the internal audit activity is evaluated. In this context, the value that internal audit adds to the institution is evaluated.
Within the scope of the evaluation study, we evaluate the works carried out by the internal audit activity such as; benchmarking, review, consultancy, investigation etc. In addition, interviews are held with senior management, operational managers and board of directors/audit committee members to evaluate the level of meeting the expectations of the internal audit activity.
As a result of the QAIP service, a conclusion is reached regarding the compliance status as generally complying, partially complying or not complying at all.
REVIEW SERVICE FOR INTERNAL AUDIT QUALITY ASSURANCE ASSESSMENT
We aim to identify the deficiencies or inadequacies of your internal audit departments, which are not yet ready to implement a fully comprehensive quality assurance and evaluation program, and to improve them. For these departments, we review whether they are ready for the Quality Assurance and Development Program.
This review is carried out in the following scope and stages:
First, the level of compliance with standards and ethical rules is evaluated. In this scope; we evaluate compliance with internal audit regulations, plans, policies, procedures, practices and other relevant regulations.
In the second scope, the effectiveness and efficiency of the internal audit activity is evaluated. In this context, the processes and infrastructure of the internal audit activity, including the quality assurance and improvement program, and the knowledge, experience and expertise of the internal audit staff are evaluated.
Thirdly, the value added by the internal audit activity is evaluated. In this context, the value that internal audit adds to the institution is evaluated.
Improvement suggestions are made by our external evaluation expert regarding the improvement areas identified as a result of the studies. The actions to be taken by the institution regarding these suggestions and their maturity are determined. At the end of the specified period, the suitability of the improvements made is reviewed.
RISK ASSESSMENT AND RISK-FOCUSED AUDIT PLANNING SERVICE
One of the most important issues in internal auditing is the allocation of internal audit resources to areas that meet the needs of the business and can create added value. In order to achieve this goal, an effective risk assessment and audit planning must be carried out. In risk assessment, it is critical to determine the audit universe of the institution correctly, understand the expectations of the senior management and the board of directors/audit committee, and analyze the strategic priorities of the institution well. In addition, internal audit resource competencies must be analyzed accurately and resource needs, if any, must be determined.
Within the scope of this service, the audit universe is created by first reviewing the processes of the institution. Interviews are held to understand the expectations of the relevant process managers, senior managers and the board of directors/audit committee and to determine the areas they consider priority. The strategic plans of the institution are examined. Some business processes can be observed on-site to better understand the required processes. Determined business processes are subjected to numerical risk scoring using a risk assessment methodology designed specifically for your institution. Risk maps are prepared.
A short-term audit plan and internal audit strategic plan are prepared within the framework of the risk assessment results and the institution's strategic priorities.
INTERNAL AUDIT TRAININGS
One of the critical elements in the success of internal audit departments is that the competency level of the personnel is at the desired level. We design training activities according to the needs of your audit personnel. Some of these trainings are listed below:
• Critical success elements in internal auditing
• Communication skills for internal auditors
• Effective reporting in internal audit
• Internal auditing techniques for auditors
• Preparation for CIA certification exams
• COSO Internal Control Framework