Financial Auditing

What Is An Internal Financial Audit

What’s an Internal Financial Audit? Everything You Need To Know (and More)

Every company’s operations are unique, and from an outsider’s perspective, this can look pretty simplistic. 

For example, it may look like Apple merely makes phones, computers, and other electronics. However, when the curtain is peeled back, you’ll see that there are numerous levels of operation and organization that must work seamlessly in unison. When even the most minor and seemingly insignificant process is not working correctly, the effect can be detrimental. 

This is where internal audits come in. Internal audits take a look at a company from the inside to make sure everything is working properly. They are completed on all aspects of a business, including logistics, supply-chain, cyber-security, finance, and accounting. 

Internal audits can look very different across a company, and we’ll outline their importance and intricacy, with an emphasis on internal financial audits.

What Are the 3 Types of Audits?

1. Compliance audits

The general definition of compliance is adherence to rules and regulations. 

Compliance looks different depending on the country, region, or industry your business operates in. For example, businesses in the United States may have to comply with laws and regulations set forth by the federal government, state, local, and municipal authorities.

A compliance audit will examine your business to ensure it complies with laws and regulations. Some types of compliance audits include cybersecurity, workplace safety, or environmental.

2. Operational audits

Operational audits are very similar to compliance audits. The difference is that these audits examine operational aspects of a business. 

For example, a retail company may complete an operational audit of how a product moves through the sales cycle. It might look at how products arrive from suppliers, how long they sit in inventory, and how they are sold. The audit would examine how effectively products move through this process and turn into profit.

With technology at the center of most businesses today, operational audits can include information technology and information systems as well. Audits performed on these areas are in-depth and must be completed by knowledgeable auditors to ensure the business runs properly. 

3. Financial audits

Any company’s financial information can paint a powerful picture. Ensuring the image is accurate requires financial audits. 

Internal financial audits took center stage in 2002 thanks to the Sarbanes-Oxley Act (SOX), which came on the heels of massive financial fraud by major companies like Enron and WorldCom. 

SOX is aimed to prevent fraudulent financial statement reporting by placing the responsibility on the senior management of businesses. Company leaders must take an active role in overseeing financial operations and resulting company financial statements or risk penalties, up to and including criminal prosecution in the most egregious cases.

Financial audits review accounting records and the internal audit function to gather audit evidence to ensure that the financial statements are accurate. Financial audits are typically completed by certified public accountants (CPA) and apply uniform auditing standards and procedures. 

Audit committees are becoming the norm and are required at public companies. These groups oversee financial accounting and reporting, internal auditing procedures, and the external audit process. The auditor’s work, as well as, the audit procedures will be explained in detail to the committee. And the final audit report issued by the independent auditor will be presented to the audit committee.

What Are the 5 Internal Controls Components?

1. Control environment

These are a set of ideas and guidelines implemented by the highest level of senior management that reflects the company’s values and sets the tone for how the company will operate. This includes examining corporate governance to identify who has the power and the ability to make decisions. 

Another way to think of the control environment is the overall attitude and awareness of directors and leaders regarding the importance of the company’s internal controls. If management has a lax attitude towards internal controls, you have a weak control environment and there may be a higher risk of fraud or error.

2. Risk assessment

Once the control environment has been established, next a risk assessment is completed. Identify areas of financial reporting that are at the highest risk of fraud or error. Ask questions like, “Which assets are most likely to be stolen, misappropriated, or wasted?” 

Plan to complete assessments on all business processes where there is a considerable risk of the company being unsuccessful. Risk management of business activities should be everyone’s responsibility.

 3. Control activities

Once the risk assessment is complete, design, and implement policies and procedures that mitigate the identified risks. A system of internal control procedures must be designed to specifically address the risk areas identified.

Control activities over financial reporting might include segregation of duties, safeguarding of assets, or authorization limits.

 4. Information and communication

The control activities and internal controls must be communicated to all employees so they have the information they need to do their job properly and adhere to the rules. 

Communication should be clear and regularly shared, even when nothing changes. Reinforcing the message and keeping internal control importance front of mind for employees can prevent control failures. 

5. Monitoring 

The final stage is to monitor the processes and procedures that are implemented. Monitoring is critical to determine the internal controls’ effectiveness and determine if further analysis and action need to be taken.

What Are the 7 Principles of Internal Control?

1. Separation of duties 

This idea is that there is not one single person who has control over an entire process. This creates accountability and natural checks and balances within a company.

2. Responsibility 

Be sure to establish specific duties to specific persons. This includes the fundamental mapping out of who is responsible for what.

3. Skepticism

Though perhaps not an ideal outlook on life, in terms of internal control, corporate officers and responsible parties should always operate with an attitude of skepticism. 

A general attitude of questioning should be maintained, even if evidence or history doesn’t support the need for doubt. 

 4. Rotation 

Similar to the separation of duties, rotation of duties is a key piece of internal control. Responsibility must be rotated amongst team members to ensure the proper execution of procedures. 

One person should not have ultimate control over one activity for an extended period. 

5. Regular independent review 

Regular independent reviews must be completed at a specified interval depending on the need. These reviews can be surprise audits of particular systems, transaction matching verifications, and inventory checks, all completed to check compliance with all company standards and rules.

6. Clarification 

Communication and information should be clear and should be repetitively clarified. Risk assessment and internal control can be akin to a game of telephone, and it can get more watered down when relayed through large companies with several layers of leadership.

7. Documentation

Processes and ongoing systems checks and reconciliations must be thoroughly documented. 

How Do You Perform an Internal Financial Audit?

Internal audits will mitigate the risk of major financial deficiency before external auditors are required to enter the scene. Developing the appropriate accounting policies and controls can be enormously time-consuming but are entirely worth it. 

Start by drafting a plan and calendar for the audit and communicate it to everyone involved. Then review the results of any previous internal audits to learn about any prior deficiencies or areas of concern. Pay special attention to any previous failures in following accounting principles and accounting standards.

Next, you’ll want to prepare the initial document request list so you can gather the financial records and information you’ll need to test whether internal controls are operating as designed. Don’t forget to include interviews with key stakeholders and management to validate processes.

When you’re ready to start auditing, you can draft your own audit programs and tests, or you can use resources provided by the Institute of Internal Auditors (IIA). They are the professional association that advocates and promotes the importance of internal audits.

After you’ve completed your test of the internal controls, be sure you’ve thoroughly documented the results. You’ll want to discuss the results with management. 

Completing internal audits should be a regular part of your company’s operations. It’s the only way you’ll receive reasonable assurance that your internal controls are operating correctly. This helps to reduce the change of a material misstatement of the balance sheet and income statement.

Brandon Malekie

Brandon Malekie, CPA, is an Account Executive at FloQast. Following time at CohnReznick and EY, Brandon joined FloQast as a Business Development Representative, rising to a Senior BDR before making the jump to Account Executive. A graduate of Loyola Marymount University, Brandon enjoys bodysurfing, traveling, and trying new foods in his free time. Connect with Brandon on LinkedIn at https://www.linkedin.com/in/brandonmalekie/.