Continuous Audits Done by Internal or External Auditors

While there are some similarities between an internal audit and an external audit, there are differences that need to be understood. This blog will explain what an internal audit and an external audit are to the reader. It will dissect the similarities and the differences between an internal audit and an external audit for greater understanding.

What is an Internal Audit?

An internal audit is an independent appraisal of a certain activity or department within an organization. It brings a systematic approach to evaluate and improve the functioning of an organization's internal controls, management of risk, and governance processes. Internal auditors are employees of the organization. The internal audit function maintains its independence within the organization by reporting to the audit committee of the board of directors. They should have access to data and resources across the organization to carry out their audit plan.

The audit plan is approved by the audit committee and carried out by the internal audit function. The audit plan should be based upon risk. Internal audit reports are for management and the board of directors of the organization and are generally not shared outside of the organization. An exception to this may include vendor audits and joint venture audits, for example. Internal audits seek to continuously improve the organization's operations and mitigate risk. In some cases, an organization may outsource its internal audit function and, when this occurs, it should function no differently than if carried out by employees.

What Do Internal Auditors Focus On?

In accordance with the International Standards for the Professional Practice of Internal Auditing, an internal audit evaluates the adequacy and effectiveness of the internal controls over the governance, operations, and information systems that are in place by the organization to meet the following:

• Achievement of the organization's strategic objectives;
• Reliability and integrity of financial and operational information;
• Effectiveness and efficiency of operations and programs;
• Safeguarding of assets; and
• Compliance with laws, regulations, policies, procedures, and contracts.

What is an External Audit?

An easy way to think of an external audit is that an external audit is performed by auditors external to the organization for independence. This is done so as to be shared with interested parties external to the organization. An external audit is an examination performed under specific regulations or guidelines that includes an opinion on the results of the examination. The opinion given is either an unqualified opinion, meaning that there were no material exceptions, or a qualified opinion, meaning that an exception was noted.

An external audit is conducted primarily for users outside of the organization. A financial statement audit is what immediately comes to mind as an example of an external audit as it is widely performed for public entities. This type of external audit report is provided to investors, lenders, and other interested parties.

Other types of external audits include system and organization control (SOC) audits. This type of audit report is provided to current and prospective customers of the organization. There are also Health Insurance Portability and Accountability Act (HIPAA), HITRUST, FedRAMP, PCI DSS, and ISO 27001 audits, etc., that are performed by external auditors and for which reports are generated that are shared with users outside of the organization.

An organization executes a contract with an external audit firm for the purpose of conducting an external audit. The external auditors are required to be independent of the organization for which they are conducting the audit. They should have access to data and resources across the organization to achieve the requirements of the audit, otherwise, any scope limitation may result in qualifying the opinion. In some cases, the external audit may rely upon the work of the internal audit rather than performing all of the work themselves. In so doing, the external audit performs steps to determine the independence and quality of work performed by the internal audit function to substantiate their reliance upon the work performed.

What Are the Audit Similarities?

An internal audit and an external audit are similar in that they both follow a similar audit process including 1) the planning phase; 2) the fieldwork phase, and 3) the reporting phase. An auditor, regardless if they are an internal auditor or an external auditor, must have independence of the process or company, respectively, that they are auditing. Below are some examples of similarities between an internal audit and an external audit.

Audit Similarities

• Independence

• • • Internal Audit:
      • Internal auditors must be independent of the process, area, or department that they are auditing in order to produce unbiased results.
    • External Audit:
      • External auditors must be independent of the organization that they are auditing.

• Process

• • • Internal Audit:
      • An internal audit will include: 1) planning phase; 2) fieldwork phase, and 3) reporting phase.
    • External Audit:
      • An external audit will include: 1) planning phase; 2) fieldwork phase, and 3) reporting phase.

• Report

• • • Internal Audit:
      • A report will be issued based upon the results of the internal audit.
    • External Audit:
      • A report will be issued based upon the results of the external audit.

• Access

• • • Internal Audit:
      • Access to the data and resources needed to conduct the internal audit procedures should be unconstrained.
    • External Audit:
      • Access to the data and resources needed to conduct the external audit procedures should be unconstrained.

• Purpose

• • Internal audit:
    • Internal audits provide assurance on the design and operational effectiveness related to the functioning of the organization's internal controls.
  • External Audit:
    • External audits provide assurance on the design and operational effectiveness related to the functioning of the organization's internal controls.

What Are the Audit Differences?

Differences between an internal audit and an external audit include who the audience is for the resulting audit report. The audience for internal audits is the organization's management providing assurance over internal controls and adding value to improve operations. The audience for external audits is not only for the organization's management, but also primarily for external parties such as investors, lenders, customers, prospective customers, and regulators, etc.

Audit Differences

• Frequency

• • • Internal Audit:
      • An internal audit plan is determined annually, however, the area being audited may be performed every 3-5 years depending upon the risk. Internal audits of the organization are conducted continuously throughout the year.
    • External Audit:
      • Generally, an external audit is performed annually.

• Objective

• • • Internal Audit:
      • Provide feedback to management on the functioning of internal controls and areas with room for improvement and added value.
    • External Audit:
      • Examine the organization's compliance with guidelines or regulations (e.g., GAAP, SOC, HIPAA, etc.), to satisfy the requirements and meet the objectives or criteria.

• Who

• • • Internal Audit:
      • Employees of the company (internal audit department) conduct internal audits or the function may be outsourced. Either way, the internal auditors must be independent of the function being audited in order to produce unbiased results.
    • External Audit:
      • A third-party audit team, notably a CPA firm, will conduct an external audit. The CPA firm and individual auditors are external from the organization and must be independent.

• Scope

• • • Internal Audit:
      • The board of directors or management of the company determines the internal audit plan which cuts across the entire enterprise.
    • External Audit:
      • The relevant authority, regulations, or guidelines determines the scope of the external audit which is specific to the regulation or guideline being measured against for compliance.

• Reporting

• • • Internal Audit:
      • Internal audit must be independent of the area being audited and generally reports to the audit committee of the board of directors.
    • External Audit:
      • External auditors are responsible to the public and external users of the report generated. They must be independent of the organization being audited.

• Users

• • • Internal Audit:
      • Users of internal audit reports are primarily internal to the organization such as management of the subject being audited. Some audit reports may be shared outside of the organization such as for vendor audits and joint venture audits.
    • External Audit:
      • Users of external audit reports are primarily external to the organization such as the public at large, investors, lenders, customers, prospective customers, regulators, etc., and are also used internally by management to provide assurance over the functioning of internal controls.

• Requirement

• • • Internal Audit:
      • Having an internal audit function within an organization is not mandatory but is considered a good business practice.
    • External Audit:
      • Having an external audit is dependent upon whether the organization is a publicly-traded entity and whether lenders, customers, etc. are requesting the external audit to be performed to enter into or continue the relationship. External audits may not be discretionary if required for the entity to stay in business or be competitive.

• Purpose

• • • Internal Audit:
      • Improvement oriented
    • External Audit:
      • Compliance oriented

• Skills

• • Internal Audit:
    • Certifications are not required for internal audits, but interdisciplinary experience and certification designations are helpful, such as CPA, CIA, CISA, CFE, etc.
  • External Audit:
    • Certified Public Accountants (CPA) firms are required when issuing opinions on financial statement audits, SOC audits, etc. CPA, CISA, and CISSP designations are beneficial for individual auditors performing the work.

Summary

Internal audits and external audits complement each other and both require auditor independence and provide assurance over the functioning of internal control. You may be wondering, how does an internal audit help an external audit? In some cases, the external auditor may rely upon the work of the internal auditor rather than performing all the work themselves. Both types of audits provide assurance regarding the design and operational effectiveness around the functioning of internal controls and provide feedback to management and the board of directors.

On the other hand, internal audits focus their efforts internally to add value and improve operations at the organization. The users of internal audit reports are the management of the entity. External audits focus their efforts on the regulations or guidelines prescribed by the authority under which the audit is being conducted to determine compliance by the entity. The users of external audit reports are primarily external to the entity.

Is an Internal Audit Better Than an External Audit, or Vice Versa?

This helps to answer what you need to know about the many differences and some of the similarities between an internal audit and an external audit. At the end of the day, audits, whether they be internal or external, are good for an organization. In the discharge of their responsibility, the results of the audit provide management assurance on the design and operational effectiveness of their internal controls and an understanding of where improvement opportunities exist. Linford and Company assists organizations with audit compliance services such as SOC 1, SOC 2, HIPAA audits, HITRUST, and FedRAMP compliance audit services. If you would like to learn more about Linford and Company and our services, please don't hesitate to contact us.

Becky McCarty has over 20 years of experience in internal controls, audit, and advisory services. She specializes in SOC 1 and SOC 2 examinations for Linford & Co., LLP. Becky completed a Bachelor's degree in Business Administration (Accounting) and a Master of Science degree in Management Information Systems. She worked 6 years with KPMG LLP commencing in 1999, worked several years in the energy industry, and joined Linford & Co., LLP in 2018. Becky also served 9 years on the Board of Directors for a home healthcare nonprofit. She works closely with clients so that the examinations are performed efficiently and with minimal disruption while ensuring performance in accordance with professional guidance. She enjoys helping clients successfully achieve the requirements for their SOC compliance efforts based on their objectives and/or applicable trust services criteria.

maynardmoseas.blogspot.com

Source: https://linfordco.com/blog/internal-vs-external-audits-explained/

Share this post