Best Business Practices on How to Set Up an Internal Audit System

I.     The Cornerstones of Good Corporate Governance
        Governance is defined as the “system by which organizations are directed & controlled”.
        The cornerstones of good governance are the following:
        • Board of directors or Audit Committee
        • Executive Management
        • Internal Auditors
        • External Auditors

II.    Why establish an internal audit function
        • Regulatory requirement
        • Support to the Audit Committee’s oversight role
        • Greater assurance for financial reporting
        • Added value to the organization by helping improve operations, governance,
           risk management and control processes
        • Increasing fraud incidents

III.   What is internal auditing
        • Mandatory Guidance
        • Definition of Internal auditing
             - Purpose
             - Scope of work
             - Objectives of internal audits
             - Authority
             - Responsibility
             - Accountability
        • Independence and objectivity
             - Organizational position
             - Reporting relationships – functional and administrative roles of the
               Audit Committee and the President/CEO
             - Direct access to the audit committee and board
             - Restrictions in performing operational responsibilities

IV.   Role in governance, risk management and control processes
        • Governance processes
        • Risk management processes
        • Internal Control processes

V.     Roles in Supporting the Audit Committee’s Oversight Function
        • Provide assurance and overall opinion on the adequacy and effectiveness of
           governance, risk management and control processes
        • Provide the results of reviews and actions taken by management on financial
           reporting, compliance with laws, regulations, policies, procedures, safeguarding
           of assets and operational effectiveness and efficiency
        • Perform projects, special studies, investigations, or other services in matters of
           interest or concern to the Audit Committee or Board that are outside the scope
           of the annual Audit Plan
        • Report on significant risk exposures, control issues, including fraud risks,
           governance issues and other matters needed by the Audit Committee
        • Select external auditors and evaluate their performance
        • Educate the audit committee on best practices in governance, risk management,
           control and compliance
        • Assist in the self-assessment of the audit committee
        • Act as the secretary of the Audit Committee

VI.   Establishing the Internal Audit Function
        • Audit Committee and CEO to give their expectations or requirements from
           internal audit (the balancing act)
        • Develop the Internal Audit Charter
             - Ensure it contains the “mandatory” contents
             - Ensure alignment with Audit Committee Charter
             - Secure written approval
        • Determine the “staffing requirement” of the internal audit activity
             - Determine bases for staffing internal audit function
             - Develop CAE job description and specifications first
             - Roles and responsibilities
             - Qualifications: knowledge, skills and experience
             - Hire the Chief Audit Executive first
             - Develop job descriptions and specifications of other positions
                   • Deciding whether to build the internal audit function in-house,
                      fully outsource or partially outsource, advantages & disadvantages
                      of each option
                   • Hire or outsource based on decision
        • Develop a risk-based audit planning process or methodology:
             - Risk assessment model/ framework
             - Consider inputs from senior management and the audit committee/ board
               on risks that may prevent the organization from achieving its strategic objectives
             - Coordinate with other assurance providers
             - Staffing plan and financial budgeting process
             - Review and approval process of the Audit Committee or board
             - Monitoring and reporting process on achievement of the audit plan to the
               Audit Committee or Board

VII.  Ensuring the Internal Audit Function Continues to be Effective
        • Managing internal audit
        • Concept of adding value
        • Developing a competency framework and staff development plan
        • Developing a Quality Assurance & Improvement Program
             - Identify key performance metrics of internal audit
             - Track, monitor and report results of QAIP to the Audit Committee or Board
        • Develop internal audit manual or policies & procedures based on the IIA
           Standards & Code of Ethics
        • Advocate or communicate the existence of internal audit function to the
           rest of the organization
        • Reviewing performance of internal audit function

VIII. Summary and Conclusion