Internal audit is key to strengthening the risk and control framework. Management owns the risks and controls, but internal audit is the mechanism for checking whether controls are well designed and operating as intended. It is an essential element of good governance and accountability. A typical example of internal audit's value is that audit findings often identify process gaps, which can lead to improvements such as more stringent approval requirements, better segregation of duties, and new controls to reduce the risk of error and fraud. The net effect is less loss and a stronger control environment.
For risk, compliance, and audit folks, internal audit is much more than a check-the-box exercise. It provides useful findings that help the organisation see which controls are working, which are not, and where there are opportunities for improvement. It can go beyond identifying control gaps and actively identify emerging risks by analysing trends, data, and the business environment. It can also drive process improvements by recommending better ways of doing things and establishing good practice for organisations. These value-added activities help the organisation better manage emerging risks and build a framework for continuous improvement.
The three lines model
The three-line model is the usual way to set out responsibilities in risk management.
- First line: business and operational managers are responsible for the risks and implement the controls.
- Second line: risk, compliance and control teams provide the oversight, challenge and guidance.
- Third line: Internal audit provides independent assurance to management and the board.
This model removes ambiguity about responsibility. It makes clear that internal audit does not own the controls it audits and that management cannot simply pass responsibility for risk on.
Audit versus control functions
Audit and control are linked but possess distinct roles. Control functions (risk and compliance) are part of the day-to-day running of the business and are responsible for setting up controls, monitoring them, and ensuring policies are adhered to. Audit is a separate function; its role is to assess whether the control framework is working and whether key risks are being managed as expected. Audit's independence from the control functions is critical because it enables objective assurance without being part of the operational ownership of the controls. To summarise, the control functions design and monitor controls as part of day-to-day business. At the same time, internal audit provides independent assurance on the effectiveness of those controls.
How internal audit evaluates frameworks
Internal audit normally evaluates the risk and control framework by planning, conducting walkthroughs, testing, interviewing, and reviewing evidence. It might look at:
- whether risks are identified accurately.
- Whether the controls are intended to reduce those risks.
- whether the controls are operating consistently.
- whether issues are actually resolved promptly.
- Whether governance and reporting are effective.
Audit may also look at higher-risk areas such as financial reporting, regulatory compliance, cyber controls, third-party risk, and business continuity. The organisation's risk profile and the audit plan determine what it covers. For instance, after a risk assessment, internal audit may identify that the number of incidents relating to third-party vendors has recently increased. In that case, the audit plan may prioritise a review of third-party risk management controls, focusing on areas with the greatest potential impact.
A walkthrough is a useful audit technique where you walk through the process from start to finish to see how transactions move, where the controls are, and where potential problems lie. It's an effective way to identify the gap between the policy and what actually happens.
Testing then looks at whether the controls actually worked. That could involve reviewing approvals, system logs, reconciliations, and so on. The point is not just to see that a control exists; it's to see if it works well enough to assure you.
Case example
For example, in a payment process where invoices are approved before payment and monthly reconciliations are performed, internal audit would assess whether approval limits are being adhered to, whether reconciliation differences are being investigated, and whether one person can both initiate and approve payments. If any issues are found, they would be reported, and recommendations for remedial action would be made.
This kind of review enables the organisation to see whether the process is well controlled or at risk of error and fraud.
Value of internal audit
A strong internal audit function is key to building trust throughout the organisation. It enables management to prioritise what needs to be done, assists the board in its oversight role and underpins the strength of the risk and control framework. The internal audit team can also drive continuous improvement by conducting regular follow-up reviews to ensure issues are resolved and by sharing best practice and lessons learned with the business. This provides an independent voice of feedback to the organisation, enabling it to keep improving.
When internal audit works well, it does more than find problems. It helps the organisation improve its management.
Closing perspective
Internal audit is a vital element of the control environment as it provides objective assurance and a useful challenge. It does this through the three lines model, using tests and control testing to check that risk management is actually working.
In the next article, we look at regulatory criteria and compliance, and how frameworks are driven by regulator and industry requirements.