Welcome to One Internal Auditor

Internal auditing is the service to the governing body (board of directors) of an organisation that provides consulting (advice) on adequate internal control and assurance (independent assessment) on the implementation of that adequate internal control.

The governing body (board of directors) of an organisation is who the buck stops with and who establishes internal control in an organisation.

It is an insult to say internal auditing is auditing because that refers to only part of the mandate of internal auditing. It also opens the way to a situation where one is assessed without knowing what one is assessed on.

Independent assessments follow this pattern:

• 1. Criterion (What is supposed to happen or be done?)
• 2. Condition (What has happened or was done?)
• 3. Finding (Comparison between criterion and condition.)

Competent internal auditing understands that if the subject has no idea what the criterion is, then it is meaningless to continue with the assessment and claim credit for how many wrong things one discovered.

That is why the consulting mandate is important, to ensure that what is assessed is what is expected rather than what is hoped for.

It is also an insult to say internal auditors are jacks of all trades and masters of none. Such remark betrays a lack of uderstanding of what the area of expertise of internal auditing is and what one should expect from internal auditing.

The area of expertise of internal auditing, its scope, is internal control and only internal control.

The governing body (board of directors) of an organisation is expected to exercise even more care to the affairs of its organisation than to the respective affairs of its respective members.

That means the governing body (board of directors) of an organisation must anticipate and address all opportunities and threats to the mission of the organisation.

Those opportunities and threats constitute the risk universe of the organisation, also known as the environment the organisation operates in.

For completeness, internal control consists of:

• 1. The organisation's risk universe;
• 2. The processes through which the care is exercised;
• 3. The obligations of every employee of the organisation, regardless of hierarchy or position in the organisation.

It is the governing body (board of directors) of an organisation that establishes the internal control applicable in the organisation.

An inadequate system of internal control amounts to the governing body (board of directors) of an organisation and internal auditing expecting employees to implement the wrong practices.

For this reason, the first focus of internal auditing is to provide advice on adequate internal control.

Only when there is adequate internal control may internal auditing provide independent assessment on the implementation of internal control.

The 'independent' in independent assessment implies that employees have already conducted self (internal) assessments.

The implementation and assessment are continuous, not continual, activities.

The implementation and assessment must cover the whole organisation, all the time. In other words, anything other than continuous full coverage is meaningless.

One Internal Auditor provides a default risk universe. Nevertheless the governing body (board of directors) of an organisation may and must modify it for its own purposes because it is what separates one organisation from the next.

The aim of adequate internal control is to ensure that risks (the opportunities and threats) facing the organisation are identified and addressed at the level at which they arise, with appropriate supervision and oversight.

Internal audit stakeholders consist of two groups:

• 1. Oversight body members;
• 2. Employees.

Oversight body members consist of:

• 1. The governing body (board of directors);
• 2. The executive head;
• 1. The audit committee;
• 1. The external auditors;
• 1. The public representatives, where applicable.

Regarding oversight body members:

• 1. It is for the governing body to decide whether external auditors and public representatives should have direct access to this platform or get the information they need from an oversight body it designates.
• 2. It is important is that all members of an oversight body should receive the same information as other members of the same group.
• 3. The governing body needs to be aware that direct access to this platform gives oversight body members access to everything regarding internal control, throughout the organisation.
• 4. The executive head has mandatory access to everything in the platform.
• 5. The finance head has access to everything in the platform through the audit committee membership.

Employees consist of:

• 1. A particular employee;
• 2. The direct manager of the above employee;
• 3. The direct manager of the above direct manager;
• 3. The direct manager of the above direct manager.

What this means is that an employee has access to internal control information of:

• 1. The particular employee;
• 2. All direct subordinates of the above employee;
• 3. All direct subordinates of the subordinates immediately above;
• 4. All direct subordinates of the subordinates immediately above.

What a particular employee has access to constitutes the area of responsibility of that employee.