Sei sulla pagina 1di 8

Managerial Auditing Journal

Corporate governance: communications from internal and external auditors


Janet L. Colbert
Article information:
To cite this document:
Janet L. Colbert, (2002),"Corporate governance: communications from internal and external auditors", Managerial Auditing
Journal, Vol. 17 Iss 3 pp. 147 - 152
Permanent link to this document:
http://dx.doi.org/10.1108/02686900210419930
Downloaded on: 30 January 2016, At: 09:05 (PT)
References: this document contains references to 7 other documents.
To copy this document: permissions@emeraldinsight.com
The fulltext of this document has been downloaded 3793 times since 2006*
Users who downloaded this article also downloaded:
Lois Munro, Jenny Stewart, (2011),"External auditors' reliance on internal auditing: further evidence", Managerial Auditing
Journal, Vol. 26 Iss 6 pp. 464-481 http://dx.doi.org/10.1108/02686901111142530
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

Hasnah Haron, Andrew Chambers, Rozaldy Ramsi, Ishak Ismail, (2004),"The reliance of external auditors on internal
auditors", Managerial Auditing Journal, Vol. 19 Iss 9 pp. 1148-1159 http://dx.doi.org/10.1108/02686900410562795
Dominic S.B. Soh, Nonna Martinov-Bennie, (2011),"The internal audit function: Perceptions of internal
audit roles, effectiveness and evaluation", Managerial Auditing Journal, Vol. 26 Iss 7 pp. 605-622 http://
dx.doi.org/10.1108/02686901111151332

Access to this document was granted through an Emerald subscription provided by emerald-srm:191455 []
For Authors
If you would like to write for this, or any other Emerald publication, then please use our Emerald for Authors service
information about how to choose which publication to write for and submission guidelines are available for all. Please
visit www.emeraldinsight.com/authors for more information.
About Emerald www.emeraldinsight.com
Emerald is a global publisher linking research and practice to the benefit of society. The company manages a portfolio of
more than 290 journals and over 2,350 books and book series volumes, as well as providing an extensive range of online
products and additional customer resources and services.
Emerald is both COUNTER 4 and TRANSFER compliant. The organization is a partner of the Committee on Publication
Ethics (COPE) and also works with Portico and the LOCKSS initiative for digital archive preservation.

*Related content and download information correct at time of download.


Corporate governance: communications from internal
and external auditors

Janet L. Colbert
Department of Accounting, Gordon Ford College of Business, Bowling Green,
Kentucky, USA

Keywords COSO (1992) published reports related to


Corporate governance, Auditors, Introduction controls and corporate governance in 1992.
Communication, Finance
Under International Standards on Auditing Still earlier, the Treadway Commission
Abstract (ISAs), external auditors have a (National Commission on Fraudulent
International Standards on responsibility to communicate certain Financial Reporting, 1987) and the Cohen
Auditing (ISAs) require external Commission (AICPA, 1978) addressed
matters discovered during the financial
auditors to communicate with the
client's governance body regarding statement audit with those persons charged governance issues. Also, various Web sites
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

significant matters which came to with governance of the entity. Similarly, the deal with such topics; some which are of
the auditors' attention during the authoritative Practice Advisories (PA), interest are shown in Table I.
engagement. Similarly, the While these reports and others address, in
issued by the Institute of Internal Auditors
authoritative Practice Advisories
(PAs), issued by the Institute of (IIA), require internal auditors to share varying degrees, corporate governance and
Internal Auditors (IIA), mandate observations and recommendations with internal and external audit issues, very little,
that internal auditors discuss those charged with oversight if anything, has been written which
certain items with the board. Thus, specifically focuses on requirements for both
responsibilities, typically, the board of
the governance body/board should
be receiving information from two directors. Thus, the governance body/board internal and external auditors to
groups of auditors. Compares and should be receiving information from two communicate with the governance body/
contrasts the requirements of the sets of auditors. Does the communication board and what the governance body/board
ISAs and PAs with regard to can expect. This article helps to fill that gap.
from one set of auditors complement or
communications with the
governance body/board. The supplement the insights gleaned from the
differences in the communications other? Or, is this reporting by the two groups
to the governance body/board by a duplication of effort and information? International auditing standards
the external and internal auditors
After briefly reviewing significant
derive mainly from the focus of International Standards Auditing section 260
each group. The external auditors publications regarding corporate governance
(ISA 260), ``Communications of audit matters
serve those users external to the and the supporting roles of internal and
with those charged with governance''
organization; in contrast, internal external auditors, this article summarizes
auditors serve the board, which is (International Federation of Accountants,
the requirements of the international
responsible for the internal aspects 2000)[1], provides guidance in
of the entity. Besides external auditing standards and the internal
communicating matters which may be of
communication on financial issues, auditing standards related to auditor
interest to the governance body of an entity.
the board also desires information communications with the governance body/
on operational and compliance The Standard applies to external auditors.
board. The article then goes on to compare The persons and body which should receive
matters. The comparison of the
international external auditing and and contrast the standards. the communication as well as the matters to
the internal auditing standards
be included are addressed in the Standard.
shows that some information
received by the governance body/ Also, the timing and form of the
board is similar. However, much is
Significant publications communication is covered. Finally, the
unique. Both groups of auditors aid
In recent years, corporate governance has Standard's discussion encompasses
the governance body/board in
received increased attention in the confidentiality issues as well as matters
achieving its objective of guiding
the entity to carry out its mission accounting and auditing literature. See, for related to applicable laws and regulations.
effectively and efficiently example, the Panel on Audit Effectiveness
Report and Recommendations (Panel on Audit Relevant persons and governance body
Effectiveness of the Public Oversight Board, The external auditor must determine the
2000) and the Report and Recommendations of persons or body entrusted with the
the Blue Ribbon Committee on Improving the governance of the entity. The relevant
Effectiveness of Corporate Audit Committees persons, and the body they make up, should
(Blue Ribbon Committee on Improving the be those responsible for supervising,
Effectiveness of Corporate Audit controlling, and directing the entity, as well
Managerial Auditing Journal Committees, 1999). Both Cadbury (1992) and as for achieving its objectives. The
17/3 [2002] 147±152 governance body is also accountable for
# MCB UP Limited appropriate financial reporting and for
The current issue and full text archive of this journal is available at
[ISSN 0268-6902] reporting other matters to interested parties.
[DOI 10.1108/02686900210419930] http://www.emeraldinsight.com/0268-6902.htm
The title and structure of the governance
[ 147 ]
Janet L. Colbert Table I
Corporate governance: Relevant Web sites
communications from internal
and external auditors URL Organization Brief description
Managerial Auditing Journal
17/3 [2002] 147±152 www.cbc.to/ CBC (Commonwealth Business Encourages best practices in
Council) corporate governance
www.ecgn.ulb.ac.be/ecgn/ ECGN (European Corporate Research into corporate governance
Governance Network) issues
www.theiia.org/ecm/newsletters. IIA (Institution of Internal Auditors) ``Tone at the Top'' newsletter for
cfm?doc_id=739 audit committees, boards and
executive management
www.oecd.org/daf/governance/ OECD (Organization for Economic Principles of corporate governance
principles.htm Co-operation and Development)

body may vary across countries, according to documentation should be included in the
legal and cultural norms. Regardless of the working papers. The documentation might
composition and name of the governance consist of minutes of the governance body's
body, the external auditors should identify it meeting or a confirmation sent to that group
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

and establish a working relationship with the by the external auditor.


members.
Confidentiality, laws and regulations
Matters to be communicated ISA 260 notes that the confidentiality rules of
The matters which the external auditor must accounting licensing bodies or legal
communicate to the governance body are requirements may restrict the external
those which are discovered during the auditor's communication with the
financial statement audit and which the governance body. Thus, the external
external auditor believe are significant and auditor's ethical responsibilities to
relevant to that group. The external auditor communicate with the group may differ from
is under no obligation to specifically search its legal ones. Conversely, the Standard
for matters of governance interest, but may observes that accounting licensing bodies or
locate such items in the normal course of the legal requirements may mandate specific
engagement. communication with governance bodies. To
ISA 260 notes some of the matters which sort out these differing perspectives, the
might come to the attention of the external external auditor may wish to consult with an
auditor and which may be of interest to the attorney. The ISA does not address the
governance body in fulfilling its oversight requirements of these licensing bodies or
role. These are: legal authorities.
. the scope of the audit;
. management's selection of, or changes in,
significant accounting policies; Internal auditing standards
. significant risks and exposures with a
potential financial statement effect; Like ISA 260, guidance in the IIA's Practice
. proposed and booked audit adjustments; Advisories[2], discusses the auditor's
. material uncertainties which may impact responsibilities in communicating with the
the going concern assumption; governing body of an organization. However,
. disagreements with management; the PAs apply to internal auditors rather
. expected modifications to the standard than their external colleagues. The guidance
audit report; in the PAs addresses the appropriate body
. material weaknesses in internal control; which internal auditors are to communicate
. management integrity; with and the communications to be made to
. fraud. that group. Also, a charter, internal audit
plans, and activity reports are discussed in
Timing and form of communication the advisories. Finally, the PAs cover
The communication of matters to the coordination of the work of the internal
governance body should be done in a timely auditors with that of their external
fashion. Prompt reporting enables the body colleagues.
to take appropriate action.
The form of the communication to the Governing body and direct communication
governance body is not regulated by the ISA; The PAs note that the chief audit executive
either oral or written communication is (CAE) should report to the audit committee,
allowed. If the external auditor chooses to the board of directors, or other governing
relay matters orally, appropriate authority. Regardless of its name, the
[ 148 ]
Janet L. Colbert appropriate body for internal auditors to course management chooses, the internal
Corporate governance: report to is the one with oversight auditor is then responsible for informing the
communications from internal responsibility for auditing, financial board as to management's actions or
and external auditors
reporting, organizational governance, and decisions.
Managerial Auditing Journal
17/3 [2002] 147±152 control.
The CAE should have direct and regular External auditors
contact with the board. Such contact helps to The PAs note that, to ensure appropriate
ensure that the board and the CAE audit coverage and to minimize duplication
communicate regarding matters which are of work, internal and external audit coverage
relevant to both. should be coordinated. The CAE should
periodically evaluate the coordination of the
Charter, plans and activity reports work of the two sets of auditors and
The PAs specify that every internal audit communicate the results of the evaluation to
department should have a charter. The the board.
document validates the unit's position in the The PAs recognize that external auditors
entity, authorizes internal audit access to are required to communicate directly with
records, and defines the scope of its work. the board regarding certain issues. The CAE
The charter should be approved by senior should be prepared for questions from the
management and accepted by the board. board and have an understanding of those
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

Periodically, the CAE should assess whether matters which the external professionals will
the charter is still adequate and discuss. Thus, in advance of the external
communicate the assessment to senior auditors' meeting with the board, the
management and the board. internal group should request information
The CAE should also submit to senior from their external colleagues regarding the
management and the board a summary of issues to be presented.
plans for work for the upcoming year. The
summary should be approved by senior
management and tendered to the board for Compare and contrast
informational purposes. Such information
Some of the information provided to the
helps the board ascertain if the work of
governance body/board by the international
internal auditing supports the objectives and
external and the internal auditors will be
plans of the entity.
similar, while much may be unique to one or
After completing the work, the internal
the other sets of auditors. The comparison of
audit department should present reports of
the international external and internal audit
its activities to senior management and the
guidance regarding communications with
board. Significant engagement observations
the governance body/board is summarized in
and recommendations are included in the
Table II.
report. The reporting should be undertaken
To comprehend the similarities and
at least annually. Below are those items
differences in the information the two groups
which the PAs suggest might constitute
proffer, it is helpful to begin by
significant engagement observations and
understanding the sources of both the
therefore, should be communicated to the
demand for the external audit and the
board:
authority for the internal audit function.
. irregularities;
. illegal acts;
Authority/demand
. errors;
The demand for the external audit derives
. waste;
from the users of financial statements and
. inefficiency;
their representatives and advisors. These
. ineffectiveness;
parties are aided in their decision making
. conflicts of interest;
regarding financial matters by the added
. control weaknesses.
credibility which an independent audit
While it is the internal auditor's provides.
responsibility to report significant Another factor which impacts on the
engagement observations, it is management's demand for external audits is the legal and
duty to resolve those issues. Management regulatory climate. Specific laws or
may decide to act by implementing regulations in various countries may require
recommendations made by the internal entities to submit audited financial
auditors or by making other changes. statements.
Alternatively, management may decide not Whether the demand for an engagement
to take action, thereby accepting whatever emanates from added credibility and/or laws
risk the internal auditors have identified in and regulations, the external auditor's focus
the current situation. Regardless of which is to protect third party or public interests.
[ 149 ]
Janet L. Colbert Table II
Corporate governance: Comparison of ISAs and PAs regarding communication with governance body/board
communications from internal
and external auditors Topic ISAs PAs
Managerial Auditing Journal
17/3 [2002] 147±152 Authority/demand External focus Internal focus
Aid users by adding credibility Derived from definition/charter
Mandated by laws/regulations Serves the board
Protect the public interest
Planning, scope Gather evidence to support opinion Plans approved by senior management,
on financial statements summary presented to board
Not required to plan procedures to Restrictions on scope reported to board
locate matters to communicate
Reporting responsibilities Report matters which may have Submit plans for coming period
come to attention of external Present activity report of work
auditor; no requirement to search performed
for matters Matters may be operational, compliance,
Matters are generally limited to or financial in nature
those financial in nature Mandate to follow up on significant
No obligation to follow up on engagement observations and
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

findings recommendations
Generally report at or near end of
engagement
Coordination with other Allows coordination with internal Allows coordination with external
auditors auditors auditors
Requires external auditors to Requires communication to the board
consider work of internal auditor; regarding coordination of the two
does not require communication sets of auditors
regarding that consideration

Because of this perspective, that auditor's Planning and scope


communication with the governance body In planning the engagement and determining
centers on information garnered during the its scope, the external auditor's main
work performed in this role. objective is to gather evidence to support
In contrast to that of the external auditor, giving an opinion on the financial
the internal auditor's focus derives from the statements. Secondarily, and as a product of
definition of internal auditing and from the audit, the composition of the governance
language in the department's charter. The body and what matters are to be
definition of internal auditing is: communicated to it are considered.
Internal auditing is an independent, objective ISA 260 notes that the form of the
assurance and consulting activity designed to governance body may vary across
add value and improve an organization's jurisdictions. In some countries, two boards
operations. It helps an organization exist; one is typically a supervisory,
accomplish its objectives by bringing a
nonexecutive body and the other is a
systematic, disciplined approach to evaluate
management, or executive, board. Other
and improve the effectiveness of
management, control, and governance countries may embrace the single board
processes[3]. model. Regardless of which structure the
country and entity utilize, the external
This definition emphasizes internal audit's auditor should plan to report to the body
role in aiding the entity to achieve its which supervises, controls, and directs the
objectives. The internal audit function's entity. This group is accountable for ensuring
charter should reinforce this view. Because that the entity's objectives are achieved and
the board is ultimately responsible for the that financial results and other information
entity's accomplishment of its objectives, the are reported to interested parties.
internal auditor's focus is on providing When planning the engagement, the
information to that group. external auditor is not required to design
Both external and internal auditors procedures specifically to gather information
communicate with the governance body/ to report to the governance body. Rather,
board. However, the external auditors are matters to be communicated are those which
ultimately attempting to protect the public come to the auditor's attention in the course
interest ± an external focus ± while the of the engagement and which the auditor
internal auditors serve the board ± an deems to be significant and relevant to the
internal focus. governance body. To make clear the scope of
[ 150 ]
Janet L. Colbert the work and their responsibilities regarding auditors are likely to communicate more
Corporate governance: communication, the external auditors may frequently than their external colleagues.
communications from internal elect to include this information in an Besides submitting plans for the coming
and external auditors
engagement letter. year's work, internal auditors also prepare
Managerial Auditing Journal
17/3 [2002] 147±152 Because the demand for, and objectives of, activity reports covering those items already
internal audit are distinct from those of listed. The activity reports, emphasizing
external audit, the planning and scope of the significant observations and
two types of engagements also vary. Internal recommendations, may be prepared as the
auditors typically plan engagements which are work is being performed or after it has been
different in nature and much broader in scope completed. The CAE presents these activity
than those of their external colleagues. While reports to senior management and the board
external engagements focus on the financial at least annually. However, the CAE is likely
statement audit, internal audit work typically
to communicate with the board much more
encompasses compliance and operational
often, perhaps several times a year.
engagements, as well as financial work.
In studying the list of matters to be
The PAs indicate that the CAE should
communicated, it is apparent that the
annually prepare a summary of the planned
external auditor relays matters with either a
work and staffing requirements, as well as a
direct financial statement impact or which
budget. Senior management should give
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

approval to this overall plan. For were unearthed during the financial
informational purposes, the board should be statement audit. In contrast, the list of
presented with a summary of the plan. The engagement observations shows that the
summary should be detailed enough to allow significant audit observations found by the
the board to ascertain if the work of internal internal auditor are much broader in scope
audit bolsters the objectives of the entity and than the external audit findings. The internal
the board. audit observations follow from the activity's
As the internal auditors perform coverage of operational and compliance, as
engagements during the year, they may well as financial statement, issues.
encounter scope limitations. Such Besides the breadth of the observations,
restrictions arise when the internal audit recommendations, and findings, the auditor's
activity is prevented from carrying out its treatment of the entity's responses to them
plans and meeting its objectives. For differs between the external and internal
example, a scope limitation may arise when groups. The external auditors have no
access to locations, records, or employees is obligation to follow up with the governing
limited, the internal auditors are not able to body or management to ascertain if action has
perform necessary procedures, or the been taken. (Of course, during the next year's
planned work is restricted. The board should audit, the issues may surface again.) In
be informed, preferably in writing, of these contrast to their external colleagues, internal
challenges and their possible impact. auditors are under a mandate to follow up on
significant engagement observations and
Reporting responsibilities recommendations. The internal group is to
In communicating with the governance body, ascertain if appropriate action has been
the external auditor covers those matters taken, or if not, if management has accepted
already listed. When discussing the items the related risks. Management is not required
noted, the external auditors should make
to implement the recommendations of the
clear that the financial statement audit is not
internal audit activity or to make any changes
designed to locate all matters which may be
at all. However, the changes implemented, or
relevant to the governing body. Rather, only
management's acceptance of the risks, should
those which came to the external auditor's
be reported back to the board.
attention when performing the engagement
are included. Unless requested by the
governing body, no special work is Coordination with other auditors
performed to search for such matters. Because members of the governance body/
The external audit's communication with board will be hearing from both the external
the governing body should be completed in a and internal auditors, they may naturally
timely fashion. Generally, at or near the have queries regarding the two groups
completion of the audit is sufficient. working together. The internal audit
However, if critical items are found, meeting literature addresses the coordination of work
with the governing body before the end of the with the external auditors in PA 2050-1,
engagement may be warranted. ``Coordination.'' ISA 610, ``Considering the
In comparison to that of the external Work of Internal Auditing,'' focuses on this
auditors, the internal auditor's issue in the international external audit
communications with the board are standards (International Federation of
generally more detailed. Also, internal Accountants, 2000)
[ 151 ]
Janet L. Colbert Both the ISA 610 and PA 2050-1 allow that some information received by the body
Corporate governance: coordination of the work of the external and from the two sets of auditors is similar.
communications from internal internal audit groups. However, neither However, the objectives of an external audit
and external auditors
standard goes so far as to require coordination. and an internal audit differ. Therefore, the
Managerial Auditing Journal
17/3 [2002] 147±152 The international external audit standard information and perspective the two sets of
directs the auditor to consider the activities auditors offer to the governance body/board
of the internal audit function and to are distinct. Both groups of auditors aid the
determine if that function's activities might governance body/board in its role of guiding
impact on the external engagement. the entity in effectively and efficiently
However, the ISA does not require the carrying out its mission.
external auditor to communicate the results
of the consideration with the governance Notes
body. 1 Effective for audits of financial statements for
In contrast, the PA mandates that the periods ending on or after 31 December 2000.
director of internal audit evaluate the 2 The IIA Practice Advisories referenced in this
coordination of the two sets of auditors and article are:
then communicate the assessment to senior . 1000-1: Internal audit charter;

management and the board. Also, the . 1110-1: Organizational independence;

. 1130-1: Impairments to independence or


director of internal audit may choose to
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

communicate regarding the performance of objectivity;


. 2020-1: Communication and approval;
the external auditor.
. 2050-1: Coordination;
The internal audit standard goes on to
. 2060-1: Reporting to board and senior
indicate that the internal auditor should
anticipate that the external auditor will management;
. 2410-1: Communication criteria.
communicate with the board regarding
3 www.theiia.org, Professional Practices
various issues. The internal auditor is
Framework, approved June 1999, effective
advised to be prepared by having an
1 January 2002.
understanding of the topics. Similar advice is
not present in the international external
auditing standard. References
AICPA (1978), The Commission on Auditors'
Responsibilities: Report, Conclusions, and
Recommendation, The Cohen Commission
Conclusion Report, AICPA, New York, NY.
Blue Ribbon Committee on Improving the
Both the ISAs and the PAs address the
Effectiveness of Corporate Audit Committees
communication of the respective auditors
(1999), Report and Recommendations of the
with the governance body/board.
Blue Ribbon Committee on Improving the
Significantly, both sets of standards require Effectiveness of Corporate Audit Committees,
such communication. Also, both the ISAs and National Association of Securities Dealers
the PAs allow, but do not require, (NASB) and New York Stock Exchange
coordination with the other group of auditors. (NYSE), February.
The differences in the communications of Cadbury, Sir A. (1992), Financial Report of the
the external and internal auditors with the Committee on the Financial Aspects of
governance body/board derive from the Corporate Governance, Financial Reporting
focus of each group. While the demand for the Council, London Stock Exchange, London
external audit arises from external users' (Cadbury Report), December.
desire for credible financial statements, the Committee on Sponsoring Organizations (COSO)
need for the internal audit function arises of the Treadway Commission (1992), Internal
from the board's wish for information useful Control ± Integrated Framework, AICPA, New
in fulfilling its duty to aid in achieving the York, NY.
entity's objectives. Thus, the scope of the International Federation of Accountants (IFAC)
external audit is limited to matters related to (2000), IFAC 2000 Technical Pronouncements,
IFAC, New York, NY.
the financial statements while the work of
National Commission on Fraudulent Financial
internal audit encompasses operational and
Reporting (Treadway Commission) (1987),
compliance, as well as financial issues. Other
Report of the National Commission on
differences between the external and internal
Fraudulent Financial Reporting, National
audit communications relate to follow-up on Commission on Fraudulent Financial
the auditor's observations, recommendations, Reporting.
and findings and notification regarding Panel on Audit Effectiveness of the Public
coordination with the other set of auditors. Oversight Board (2000), The Panel on
From the comparison of the international Audit Effectiveness Report and
external auditing and the internal auditing Recommendations August 31, 2000, Public
standards regarding communications with Oversight Board, Stamford, CT, available at
the governance body/board, it can be seen www.pobauditpanel.org

[ 152 ]
This article has been cited by:

1. Mélanie Roussy. 2015. Welcome to the Day-to-Day of Internal Auditors: How Do They Cope with Conflicts?. AUDITING:
A Journal of Practice & Theory 34, 237-264. [CrossRef]
2. Mélanie Roussy. 2013. Internal auditors’ roles: From watchdogs to helpers and protectors of the top manager. Critical
Perspectives on Accounting 24, 550-571. [CrossRef]
3. Fernando Belfo, António Trigo. 2013. Accounting Information Systems: Tradition and Future Directions. Procedia Technology
9, 536-546. [CrossRef]
4. Philomena Leung, Barry J. Cooper, Luckmika Perera. 2011. Accountability structures and management relationships of
internal audit. Managerial Auditing Journal 26:9, 794-816. [Abstract] [Full Text] [PDF]
5. De la Rey van der Waldt, Gerbie van Heerden. 2007. Financial communication to retirement fund members: a survey among
trustees and member stakeholders. Communicatio 33, 152-168. [CrossRef]
Downloaded by McMaster University At 09:05 30 January 2016 (PT)

Potrebbero piacerti anche