Documenti di Didattica
Documenti di Professioni
Documenti di Cultura
good practice
guide
May 1996
AUDIT
COMMISSION
It Takes Two
Contents
Appendices
10
21
Problem solving
26
Finally
30
33
Acknowledgements
This guide is based on research into
professional standards for internal
and external auditors, publications
concerning co-operation between
internal and external auditors, and
field visits. The Audit Commission
gratefully acknowledges assistance
from the internal and external
auditors of the following local
government and NHS bodies:
Royal Mail
Factor
Management and the
Audit Committee
Probable failure to
achieve best practice
Probable success
are supportive
take little or no
interest
Internal audit
External audit
is willing to make
changes to achieve
best practice in cooperation
makes demands on
internal audit and
gives little or no
feedback
I
Readers who are not familiar with the
Managed Audit will find a definition in
Appendix A to this guide. Further
information can be found in the Good
Practice Guide to the Managed Audit,
available on request from the Audit
Commission.
It Takes Two
Exhibit 2
Benefits
Management
Internal audit
External audit
Exhibit 3
Answers to some common questions from management
Is this something new? Why havent my auditors been doing it for years?
Most internal and external auditors
are already co-operating but many could go further or do better. This guide
may help improve the benefits being derived from co-operation.
Internal and external auditors carry out different functions, both of them
useful to management and the audited body. See Appendix B for the details.
The law says you have to have external auditors, and good sense generally
compels you to have internal auditors too, although there may also be certain
rules or regulations (eg, NHS requirements).
5
It Takes Two
Visits to establishments
In cases where there are many entities
within the audited body requiring
audit visits (eg, schools, GP
fundholders, cash offices, social
services units) it will often be sensible
for internal audit to take the lions
share of the necessary audit visits,
since their greater familiarity with the
business being conducted and their
year-round presence provide potential
efficiencies for the audited body.
It Takes Two
VFM follow up
External audit is required to
investigate the audited bodys
progress in implementing agreed VFM
recommendations from past years
and in achieving agreed savings. This
is an area where internal audits
greater degree of presence on site
and closer knowledge of the audited
body could mean they can deal with
VFM follow up effectively. Both
auditors will be aware that it is
managements responsibility to own
and to deliver the follow-up action.
Management arrangements
External audit is required to assess
managements arrangements for the
economic, efficient and effective use
of resources. Internal auditors will
often be required to appraise the
economy and efficiency with which
resources are employed (Institute of
Internal Auditors Standard 340).
There is good potential for cooperation here too.
waste, extravagance,
inefficient administration;
Grant claims
The external auditor relying on
internal audit work on local authority
grant claims will be expected to reperform some of the internal audit
work concerned. This requirement
stems from the risk inherent in grant
claims that management may have a
8
Performance indicators
External auditors appointed by the
Audit Commission are required to
satisfy themselves that arrangements
put in place by management for the
collection, recording and publication
of certain performance indicators are
adequate. This is another area where
co-operation with internal audit can
be considered.
Joint reporting
Joint reporting may also be difficult to
arrange, for practical reasons. Internal
audit are often required to report
promptly to their Audit Committee (or
equivalent governing body eg, an
alternative committee or the Chief
Executive or Director of Finance) as
soon as each project is complete.
Internal audit will probably be
working to terms of reference for the
project that go beyond the
requirements of external audit.
Conversely, external audit will
normally be working to a different
audit reporting timetable, focused on
memoranda to management to deal
with any matters arising from their
early review work and the annual
management letter issued towards
the end of the year. Where some form
of joint reporting is arranged, often
on systems evaluation, for instance,
care should be taken not to blur the
different accountabilities of the
internal and external auditors.
Auditors should consider joint
reporting where it adds value for the
audited body.
Staff transfers
The short-term transfer or
secondment of staff can be useful in
achieving a better understanding of
the other auditors processes and
priorities. This is more often done by
transfer of an internal auditor to work
with the external auditors for a time,
although transfers in the other
direction, or swaps, can also take
place.
It Takes Two
10
Exhibit 4
Procedures
EVALUATION
Every
few
CONSULTATION
years
TRAINING
RISK
ASSESSMENT
REPORTING
Annual
cycle
MONITORING
AND REVIEW
11
PLANNING
COMMUNICATION
It Takes Two
Case Study 1
Effective communication
The internal and external audit at one entity have a written agreement to meet
on a quarterly basis with set agendas for each meeting. These formal meetings
are accompanied by access to the other auditor, if needed, on an ongoing
basis throughout the year. The agendas for the quarterly meetings include:
February
May
Communication
Communication is fundamental in
developing and maintaining good cooperation between auditors. It runs
through the co-operation process
from start to finish, and may be
formal, informal or a combination of
both. Good communication is
genuinely two-way so that issues are
discussed at the appropriate stages of
both audit cycles, with formal notes
Evaluation
Under Statement of Auditing
Standard (SAS) 500.3 issued by the
I
APB, external auditors should
perform an evaluation of the internal
audit function if they consider that it
may be possible and desirable to
place reliance on internal audits
work. SAS 500 applies to Audit
Commission audits. A full evaluation
should be carried out from time to
time, and should be updated every
year. Some audited bodies prefer a
full evaluation at least every two
years.
II
12
Case Study 2
Communicating the results of an
evaluation
An auditing consortium that has
often been evaluated by different
external auditors always asks the
external auditors not to say in their
reports we cannot rely on internal
audit when what they mean is the
coverage achieved by internal audit
in any year is insufficient to allow
us to do less systems work
ourselves, or words to that effect.
It is important to be clear when
wording the results of an
evaluation, so as not to give any
false impressions.
Case Study 3
Evaluation of internal audit
One NHS body visited had appointed new internal auditors for the 1994/95
financial year. External audit undertook an evaluation of the new internal
audit service to ensure that it complied with the mandatory standards of the
NHS Internal Audit Manual, in respect of:
Objectives and scope
Independence
Relationships
Evidence
13
It Takes Two
Consultation
Consultation aims to determine the
mechanism through which internal
and external audit will co-operate,
and to set it up to run for a number
of years. Auditors should consult on
the standards and procedures for cooperation in the broad sequence
shown in Exhibit 5 which is discussed,
stage by stage, in the rest of this
chapter.
Exhibit 5
Consultation
ACTION PLAN
Systems
approach
Documentation
STANDARDS
Sharing
files
Reporting
Communication
Timing of
cycles
Review
mechanism
PROCEDURES
Systems
work
Fraud
work
VFM work
AGREEMENT
14
Action plan
Systems approach
15
Case Study 4
A shared audit approach
The external and internal audit
services at a health authority came
together to discuss and draw up
joint testing plans and audit
schedules for GP fundholder
audits. This has enabled external
audit to achieve the Audit
Commissions recommended threeyear cycle, with reliance on internal
audit in the interim years.
It Takes Two
Documentation
Another area of consultation may be
the standards of documentation to be
maintained on internal and external
audit files in order for reliance to be
maximised. Both sets of auditors are
required by professional standards to
record their work adequately, but may
find it useful to discuss at a more
detailed level certain minimum
standards of documentation for both
sets of auditors to adopt; for example,
whether source documentation is to
be copied to the audit file when
errors are noted during detailed
testing. There are advantages and
disadvantages to adopting one
auditors methods of testing and
Exhibit 6
Audit documentation
Advantages
Disadvantages
16
Sharing files
Auditors should also agree practical
arrangements for sharing relevant
files and working papers. These
consultations may include
arrangements for access to the files,
photocopying the files where
necessary, file storage and the
retention policy to be used, and may
have regard to ensuring that no
inappropriate liabilities might arise.
Communication
Both auditors should consider and
agree how communication between
them will work in practice. One
example of a good mechanism for
communication was noted in Case
Study 1 (page 12). Auditors may also
wish to set up other practical
communication arrangements such as
arrangements for sharing
accommodation when the external
auditors are on site.
Timing of cycles
In order for co-operation between
auditors to work most effectively,
there should be consultation and
agreement as to the timing of their
audit cycles during the year. Prior to
consultation and discussion between
internal and external audit, the timing
of the external regularity audit cycle
during the year may look like
Exhibit 7.
The internal audit cycle normally runs
on a financial year basis. By April,
Exhibit 7
External audit cycle before discussions (excluding VFM audit)
Level of activity
Case Study 5
Systems audit work documentation
Final
accounts
audit
Systems
audit
Planning
Reporting
Auditors may wish to agree a
standard reporting format. The main
advantage of a standard format is
that audit findings will be reported to
management in a consistent way by
Time
17
It Takes Two
Case Study 6
Planning
As soon as new internal auditors
were appointed in April 1994, the
external auditors met with the
internal auditors to discuss internal
audit plans and how to maximise
co-operation between the two sets
of auditors. This meant that the
external auditors began to think
about the planning for their
1994/95 audit before they had
completed their 1993/94 financial
statements audit. The external
auditors were able to implement a
Managed Audit for 1994/95.
18
Case Study 7
The consultation process
As a result of consultation on
internal audit plans at one audited
body, the internal audit service
agreed to reschedule their audit of
creditor payments from April 1994
to December 1994. This gave
external audit the opportunity to
place greater reliance on the work
of internal audit with only three
months of the financial year not
covered by the internal audit work.
The external and internal auditors
at another audited body have
agreed that internal audit work on
systems should take place later in
the financial year in future, and
that their selection of samples
should be spread over the period
to date. This will give external audit
greater comfort in expressing an
opinion on the financial statements
for the year. External audit have
agreed that their interim audit can
be moved from January/February to
after March.
In another case, internal audit
schedule their work in consultation
with external audit, to mutual
benefit. At least one audit is
undertaken for the external
auditors each year. Internal audit
suggest the topic, and draw up an
assignment brief which is signed
off by both auditors. The report
goes to external audit and to the
County Treasurer.
Level of activity
Exhibit 8
External audit cycle after discussions (excluding VFM audit)
Case Study 8
Consultations on fraud and
corruption work
The auditors at an audited body
have shared the Audit Commission
Fraud Manual. This manual was
used by both sets of auditors when
they sat down to agree a joint
three year plan for audit work on
the prevention of fraud and
corruption.
Systems work
The final matter that internal audit,
external audit and management may
wish to consider is the extent of
systems work external audit believes
they should undertake. For example,
the agreement in Case Study 1 (page
12) clearly specifies the work that
external audit will undertake on
systems, assuming that internal audit
have completed their agreed work.
Training
Final
accounts
audit
Planning
Systems
audit
Time
19
Getting started
Auditors starting from square one, or
close to it, may find the summary
implementation plan in Exhibit 9
useful.
It Takes Two
Exhibit 9
An implementation plan
The internal and external auditors at a local authority agreed this action plan:
December
1994
February
1995
March
1995
September
1995
January
1996
March
1996
March
1996
Conclusion
Best practice co-operation depends
on sound set-up work which is
updated from time to time. It requires
continuing attention to training and
effective communication. This chapter
has described the steps to be taken in
order to prepare for and maintain
co-operation at its optimum level.
20
Risk assessment
One of the earliest steps in the annual
audit cycles of each set of auditors is
to review and update their risk
assessment in accordance with their
own policies and procedures. The
internal auditor considers whether an
event or action will adversely affect
the audited body. The external auditor
considers the risk of giving an
inappropriate audit opinion on the
financial statements, and the risk
associated with each of the other
external audit objectives (see
Appendix B). In good practice
examples, risk assessment is the
driving force behind both auditors
approaches to their work.
For internal auditors, the result of the
risk assessment process is usually the
production of an Internal Audit Needs
Assessment. This is an appraisal of the
systems operated by the audited
body, their relative risk, and the
frequency with which an internal
audit appraisal of them should be
made. This assessment encompasses
the compliance, operational and
financial activities of the audited
body. The external auditors risk
assessment is generally restricted to
the financial systems, in accordance
I
with the Code of Audit Practice.
Internal and external auditors should
share the information contained in
their risk assessments in order to
inform each others assessments.
Differences may arise. For instance,
external auditors may need to
recognise that internal audit may rate
21
Planning
Next, each set of auditors will draw
up their initial audit plans for the year.
External auditors may be some nine or
ten months, or in extreme cases up to
a year, behind internal audit in
drawing up their plans for the same
financial year. This disparity in the
timing of internal and external audit
cycles needs to be actively managed.
Internal and external audit need to
discuss each others plans to
understand the proposed scope,
timing and extent of audit work with
a view to eliminating duplication of
effort.
External auditors need to start
thinking further ahead. By the time
external audit start planning, internal
audit are generally already over half
way into their audit year, with a good
view of progress and findings to date
and the likely outturn of internal audit
activity against the original plan. Both
these pieces of information will be of
use to external audit planning in
order to determine the amount of
reliance on internal audit that they
can build into their plan and the likely
systems and substantive testing to be
carried out. Exhibits 10 and 11
(overleaf) give examples of the
considerations auditors may have
when reviewing each others plans.
It Takes Two
Exhibit 10
Reviewing INTERNAL audit plans
Timing could any adjustments be
made to the timing of internal or
external audit proposed work to
maximise the potential for
reliance?
Scope could any adjustments be
made to the areas of work selected
by internal audit to enable
maximum reliance to be placed on
their work?
Extent could any adjustments be
made to the extent of internal
audit work; for example, from
review to detailed testing, in order
for reliance to be maximised?
Exhibit 11
Reviewing EXTERNAL audit plans
Duplication is there any
potential duplication in the work
proposed by external audit with
work we have already undertaken
or are due to undertake?
Assistance are there any areas in
which external audit are planning
work where we could assist within
our agreed resources and plan?
Omissions are there any areas
external audit have overlooked
which, due to my knowledge of
the entity, one of us should be
doing some audit work on?
22
Performing work
The next stage is for both auditors to
perform their agreed audit plan using
the agreed approach and
documentation methods. Internal
audit work for the year will start first
and internal auditors should continue
to liaise and communicate with
external auditors on the progress of
their audits during the year. This will
enable external audit to update their
plans to take account of internal audit
progress, findings and
recommendations.
Exhibit 12
External audit systems testing
Following a detailed review of the
work performed by internal audit,
the external audit work
programme for systems and
controls testing was limited to:
23
It Takes Two
Review
As noted above, external audit need
to take reasonable steps to ensure
internal audit work is performed in
accordance with the requirements of
the Code of Audit Practice. Their
review of specific internal audit work
will consider whether the work has
been performed properly and has met
the standards agreed at the
consultation stage. The results of the
review will help external audit to
determine whether the overall
evaluation of the internal audit service
remains appropriate. The issues
external auditors take account of in
their review include the matters
shown in Exhibit 13.
A good practice example of
documentation of the external audit
review of internal audit work is
Reporting
The final stage in each audit cycle is
reporting. Internal auditors generally
produce reports for each audit they
undertake, together with summary
reports on at least an annual basis.
Internal auditors should keep external
audit informed by sending them a
copy of each final audit report
produced. This good practice was
noted at most of the sites visited. In
order for internal audit to be
Exhibit 13
Review considerations
Is the internal audit report consistent with the results of the work
performed?
What is the impact of internal audit findings on the external audit plan?
24
Conclusion
Exhibit 14
Review of internal audit
The external auditors of one audited body complete a standard record of
assessment of internal audit work on each significant system. This
assessment asks the following questions:
Have correct conclusions been drawn from the work and, if appropriate,
reported and action secured?
25
Exhibit 15
External audit reporting
The Chief Internal Auditor at an
audited body co-ordinates
responses to the external auditors
Report to Officers, and takes the
opportunity to add value to the
report (but without assuming an
operational responsibility) by, for
instance, identifying any errors and
suggesting updates for action
already taken by management. This
ensures that the internal audit
function at the council are aware
of the results and
recommendations arising from the
work of external audit, and is
helpful to external audit since it
adds to the quality of their
outputs.
It Takes Two
Problem solving
Suggested response
External audit
26
Problem solving
Suggested response
External audit
External audit try to direct internal audit work to
concentrate only on the areas in which external audit wish
to rely?
27
It Takes Two
Suggested response
Internal audit
28
Problem solving
Suggested response
Management
For audit findings and recommendations to have maximum
impact they should be reported as soon as possible after
the completion of fieldwork.
Management ask why they get two reports on their
financial systems if internal and external audit are
co-operating effectively?
29
It Takes Two
Finally...
Co-operation between internal and
external audit is something that most
auditors could do better, given more
support from top management or the
Audit Committee and a little more
understanding of the obligations
placed upon the other auditor.
Improved co-operation can mean
better progress with the Managed
30
Appendix A
Definition of the Managed Audit
The Managed Audit is the opinion
audit service that results from
applying the principles of auditing
and proper professional standards in
conditions where the audited body
has:
effective controls;
Exhibit A1
Spectrum of possible conditions at the audited body
Managed audit not
possible
poor control
environment
poor monitoring
controls exercised by
management
reliance on internal
audit not possible
production of
accounts schedules
inaccurate or late
Partial use of
managed audit
Managed audit
achievable
strong control
environment
reliance on internal
audit
good co-operation
from the audited
body
(An audited body can move to the right or to the left on this spectrum from year to year.)
31
It Takes Two
Appendix B
Understanding each other: the different obligations placed on internal and external
auditors
In establishing co-operation, internal
audit and external audit will be
concerned to fulfil their own
obligations properly and to maximise
their contribution to the audited
body. The outcome will be better all
round if both parties take steps to
understand the others position.
32
independence, an objective
attitude and due professional care;
an approach that is risk based,
carefully planned, and carried out
to plan with no undue overruns or
delays; and
Appendix B
Exhibit B1
Terms of reference for internal audit
For example: to assist the Chief Executive (or s151 Officer) and members to
meet their objectives and to discharge their responsibilities by providing an
independent appraisal of the adequacy and effectiveness of the controls
operated by management and of the arrangements made by management
for the conduct of business and the use of resources.
The organisational status of internal audit in the audited body and their
reporting lines
33
It Takes Two
Exhibit B2
Audit objectives
The external auditors objectives are to give an independent assessment of:
1.
2.
3.
4.
5.
6.
7.
34
Appendix B
A requirement to co-operate
The Code includes the following
comments relating to other auditors:
In framing a methodology that will
meet the requirements of this Code,
auditors should:
(f) establish effective co-ordination
arrangements between internal
and external audit and seek to
place reliance on the work of
internal audit wherever possible;
35
It Takes Two
Exhibit B3
Understanding each other
Planning of the detailed audit work needs to be carried out much earlier
than would normally be the case for external audit, which should be
looking two or more years ahead when discussing co-operation with
internal audit and should be familiar with internal audits planning cycle
(which may be five years or more).
36
Appendix B
37
It Takes Two
Appendix C
Control self assessment
Taken from a professional
briefing issued by the Institute of
Internal Auditors
Control self assessment is a process
which allows individual line managers
and staff to participate in reviewing
existing controls for adequacy (both
now and in the predicted future) and
in recommending, agreeing and
implementing improvements to
existing controls.
38
It Takes Two
A good practice guide
May 1996
It Takes Two
Questions
Practicalities
1 Is there two-way communication between internal and
external audit on matters of mutual interest and concern?
2 Do external audit report the results of their evaluation of
internal audit to us, and to internal audit, and make
constructive suggestions for improvement?
3 Have all areas for potential co-operation between auditors
been explored imaginatively by both sets of auditors?
4 Have we considered, in conjunction with our auditors,
whether joint reporting would be of value?
5 Have we looked objectively at how we use our internal audit
resource and whether it could be better deployed? For
instance, are ad hoc projects always examined to confirm
that they should take priority over internal audit work
already approved?
6 What current internal audit work would we be prepared to
drop, modify or postpone in order to improve the potential
for co-operation between internal and external audit?
Yes/no
Priority
Lead person
Questions
Preparation
1 Do our internal and external auditors meet on at least a
quarterly basis to give feedback, discuss progress and
resolve problems?
2 Is it time we had another in-depth evaluation of internal
audit?
3 Was the last evaluation constructive and helpful?
Yes/no
Priority
Lead person
Questions
Annual procedures
1 Do we discuss all audit plans with both sets
of auditors?
2 Have the results of the external audit review
of internal audit work been reported to us
and to the internal auditors?
Problem solving
1 Have we identified any potential problems
acting as a barrier to effective co-operation
between internal and external audit?
Yes/no
Priority
Lead person
It Takes Two
A good practice guide
May 1996
Questions
Concept and impact of good co-operation
1 Are we being active in promoting cooperation?
2 Are we willing to make changes to help
achieve the best value from co-operation?
3 Are we working with the other auditors to
determine how audit resource may best be
used to provide a service that meets
everyones requirements?
Practicalities
1 Could we be better at two way
communication with the other auditors on
matters of mutual interest and concern?
2 Do the members of our team understand
enough about how the other auditors
operate and the requirements placed upon
them?
3 Have the following areas for potential cooperation between auditors been explored
imaginatively by both of us?
Internal control
Computer audit work
VFM auditing
VFM follow up
Management arrangements
Fraud and corruption
Grant claims
Performance indicators
Other PLEASE STATE........................................
4 Are we sharing files as productively as
possible?
5 For areas of co-operation, would joint
reporting be of value?
6 Could we derive benefit for the audited body
by arranging any staff transfers, joint
training or other short-term working
arrangements?
yes/no
If no,
action by
Questions
Preparation
1 Is the evalution of internal audit up to date?
2 Was the latest evaluation:
Insightful?
Constructive?
Helpful?
3 Have we both agreed an action plan to
implement any external audit evaluation
recommendations?
4 Have we consulted the other auditors and
agreed our approaches to each of the
following:
Action planning
Systems approach
Documentation
Sharing files
Communication
Reporting
Timing of work cycles
Training
5 Have we agreed, in writing, our plans for cooperation and reliance arrangements with
the other auditors?
Annual procedures
1 Do we understand each others approach to
risk assessment?
2 Are we fully informed on the other auditors
latest plans and current progress?
3 Are there sensible and timely arrangements
in hand for the review of work to be carried
out by one auditor and relied upon by the
other?
yes/no
If no,
action by
Questions
yes/no
If no,
action by
Prepared by:
Date:
Date: