On this page
The Board (with the support of the audit committee) is responsible for the proper oversight of the company’s control system. In this regard, the best friends of the Board and the audit committee are a well-functioning internal audit function and an independent, professional external auditor.
Responsibility for the development and operation of sound risk management and internal control systems lies with management. The Board (with the support of the audit committee) is responsible for the oversight of these processes.
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation to accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control and governance processes. The internal auditor is appointed by the Board, not by the CEO or Management Board, is not part of the management team and, unlike other employees, does not hold an operational role.
External (statutory or financial) auditing is the obligatory annual examination of a company’s financial statements and records by an independent external auditor. The external auditor is approved by the shareholders on the recommendation of the Board.
Differences between the internal and external audit functions
| Aspect | Internal audit | External audit |
|---|---|---|
| Who performs it? | Employees of the company or outsourced internal auditors | Independent third-party firm |
| Purpose | Improve internal operations, risk management, and controls; help the company achieve its goals | Provide an independent opinion on the fairness and accuracy of financial statements |
| Audience | Management and the Board and audit committee | Shareholders and other stakeholders (investors, creditors, regulators, public) |
| Scope | Broad; covers various aspects of the business (operations, compliance, IT, HR, cyber and other areas) | Primarily focused on financial statements and internal controls over financial reporting |
| Reporting | Internal reports for the audit committee and the Board, with recommendations for improvement | Formal audit report, expressing an opinion on financial statements and presented to the audit committee, Board and shareholders |
| Independence | Organisational independence; not subordinate to the company’s CEO or Management Board | Strict independence from the company being audited (no material ties, no provision of other services) |
| Mandatory? | Generally, not, but highly recommended for good governance | Usually legally mandatory |
| Frequency | Ongoing throughout the year | Typically, annual |
Internal audit
Internal audit is a function within a company that is tasked with providing unbiased, independent reviews of systems and processes. That is why the internal auditor is the only non-operational function in the company. The role of internal audit is to provide the Board and top management with an objective source of information regarding the company’s risks, control environment, operational effectiveness and compliance with applicable laws and regulations.
The reviews performed by Internal Audit are called internal audits. The aim of internal audits is to identify weaknesses within the organisation’s processes and control environment internally so that they can be fixed as quickly as possible to prevent harm to the company or its stakeholders.1
Internal audit reports to the Board (and its audit committee), providing recommendations for the necessary improvements in systems and processes as well as reports on the implementation of those recommendations. It is important to emphasise that, where the Board has an audit committee, the Board should still maintain a regular relationship with the internal auditor and not delegate this important duty entirely to its audit committee, which supports the Board by examining internal audit activities in greater depth and providing opinions and suggestions for Board decisions.
It is important to emphasise that internal audit not only performs internal audits, but also advises the responsible company employees to help them achieve the set goals. Internal audit is the eyes and ears of the Board.
Internal audit should comply with the Global Internal Audit Standards of the IIA.2
The audit committee proposes, and the Board approves:
- the internal audit regulations;
- the strategic internal audit plan;
- the risk-based internal audit plan (three-year and annual);
- the internal audit budget (annually);
- the appointment, dismissal, evaluation and remuneration of the head of internal audit.
The head of internal audit must have functional accountability to the audit committee and the Board, and only administrative accountability to the CEO. It is the Board, not the CEO, that appoints the internal auditor, sets their remuneration and assesses their performance.
External audit
The responsibilities of the Board and its audit committee in relation to the external audit include:
- Recommending the external auditor. The audit committee assesses potential audit firms (and the particular auditor) for independence, objectivity and expertise, and then recommends a firm (and the particular auditor) to the Board for appointment or reappointment by the shareholders.
- Negotiating fees. The audit committee negotiates the auditor’s fees to ensure that they are reasonable and will not compromise audit quality.
- Reviewing the audit plan. The audit committee reviews and approves the external auditor’s audit plan, including the scope of the work, the key risks identified and the planned resources.
- The entire Board (including the audit committee) should meet the auditor twice during the annual audit cycle: before the audit, to share its insights into the situation in the company that could be relevant to the auditor and to learn about the audit plan, and after the audit, to discuss the findings and the auditor’s report. In addition, the audit committee should meet the auditor during the audit to discuss emerging findings.
- The audit committee should assess the quality of the external auditor’s work.
- Ensure that the external auditor is invited to the annual general meeting of shareholders.
- The Board, with the help of its audit committee, should follow up on the external auditor’s recommendations.
- The Board should ensure the disclosure of the audit report (in the annual report and on the website).
- Ensure that the auditor is rotated in line with the applicable rules: for public-interest entities, EU law requires rotation of the audit firm after no more than ten years and of the key audit partner after no more than seven years, unless national legislation sets other limits.
- Pay close attention to the smoothness of the collaboration between the executives and the auditor.
Chapter
