4.4. The Audit Committee and internal audit

The relationship between the Audit Committee and internal auditors is central to enabling the committee to meet its responsibilities. As such, the relationship between the Head of Internal Audit and the Committee is an important one.  Internal audit is functionally responsible to the Audit Committee and works to the committee through its Head.

Reports by internal audit provide the Audit Committee with a key source of information on the entity’s performance. Maximising the value of internal audit requires that open lines of communication are established and maintained between internal audit and the committee.

Strategic and Annual Internal Audit Work Plans

The Audit Committee should review and provide advice to the Chief Executive/Board on the adequacy of Strategic and Annual Internal Audit Work Plans.[35]

The nature of the Internal Audit Strategic Audit Plan will be commensurate with the size and complexity of each entity, as well as the entity’s risk profile, and the extent of the entity’s investment in the internal audit function. In developing this plan consideration should be given to the entity’s goals and objectives, internal and external risks, the work of other review activities or functions, stakeholder expectations and internal audit business objectives and management strategies. There should be sufficient flexibility in the Internal Audit Strategic Audit Plan to accommodate additional audits that the Chief Executive/Board may commission from time to time. [36] The Annual Internal Audit Work Plan should be reviewed periodically by the Audit Committee to re-confirm the relevance and priority of audit topics.

Better practice tip: Audit Committee and Annual Internal Audit

Audit Committees should be alert to the need to vary, at short notice, the internal audit work plan to enable internal audit to review programs or activities of emerging high risk to the entity.

Where the internal audit function is outsourced, particular attention should be given to potential conflicts of interest when considering the appointment of a service provider or the proposed Internal Audit Strategic Audit Plan. It is important to fully consider any restrictions placed on the scope of audit coverage, and to help the committee gauge the level of coverage of particular areas over time the committee would consider previous audit activity in the areas identified for audit.

Once approved, the Audit Committee should consider the mechanisms for communicating the approved plan to relevant stakeholders, including the Chief Executive/Board and senior management. Entities might consider placing the approved Internal Audit Strategic Audit Plan on their intranet to make it available to all stakeholders and staff.

On an ongoing basis during the year, the Audit Committee would review internal audit’s progress in carrying out the approved work program. This review would take into consideration:

• reasons for any adjustments to the scope of the review, particularly when requested by the Chief Executive/Board; and
• changes to the timing of assignments and reasons for any delays against the approved timetable.

Internal audit resourcing

An important responsibility of the Audit Committee is to be satisfied that there are sufficiently skilled internal audit resources available to undertake the approved internal audit work program, including providing support for, and input to, the committee. Consideration of internal audit resources would include a periodic review of the model of internal audit the entity uses, that is, in-house, outsourced or co-sourced, and the range of resources required, to assess whether they are appropriate for the entity. Considerations would include the Internal Audit Strategic Audit Plan and the audits required to be conducted.

If the committee decides that internal audit resources are not adequate, the Chair of the Audit Committee should formally raise the committee’s concerns with the Chief Executive/Board.

Where the internal audit function is outsourced, it would be expected that the committee would provide input to the statement of requirements developed as part of a tender process and provide advice on the appointment of the service provider. In particular, the committee should be alert to any potential conflicts of interest involving possible service providers. Where internal audit is provided in-house, the committee would be expected to contribute to the selection process of the Head of Internal Audit, particularly in determining the qualities expected of the appointee.

Internal audit reports

In addition to regular, informal communication between internal audit and the Audit Committee, the committee should receive regular reports, in an agreed format, from internal audit on the results of their work. This should include management’s response to internal audit recommendations and other suggestions for improvement. Responses from management should be clear and concise and should include:

• whether management agrees or disagrees with the finding and recommendation. If there is disagreement, identify the reasons; and
• identifying the specific position or work area responsible for implementing the recommendation; a brief outline of the action to be taken; and the timeframe for implementation.

Audit Committee members-only session with internal audit

It is better practice to have a private session with internal audit, at a scheduled meeting(s) during the year that provides an opportunity for the committee to raise issues, ask questions and seek feedback from the internal auditor without management present. This supports the recognition of the independent role of internal audit.

Part 3 includes a checklist of matters the Audit Committee may wish to discuss with internal audit at this session (pages 105 to 107).

Review the performance of internal audit

Each year the Audit Committee should review the performance of internal audit. The Audit Committee should also commission a periodic external review of internal audit. [37]

 

---

Previous: The Audit Committee and other committees

Next: The Audit Committee and external audit