TABLE OF CONTENT

CONTENTS PAGES

CHAPTER ONE: INTERNAL CONTROL SYSTEM

1.1 Definition, Objectives, Features and Importance
1.1.1 Definition of Internal Control
1.1.2 Objectives of Internal Control
1.1.3 The Essential Features of Internal Control
1.1.4 Importance of Internal Control to Auditors
1.2 Types of Internal Control
1.3 Scope and Components of Internal Control System
1.4 Internal Controls and their Inherent Limitations
1.5 Understanding the Internal Control System
1.6 Ascertaining the System of Controls
1.7 Recording the Systems of Control
1.8 Evaluating the Internal Control.
1.9 Reporting on Internal Control to Management.

CHAPTER TWO: INTERNAL AUDIT

2.1 Introduction
2.2 History of Internal Auditing
2.3 Internal Audit as a Control Factor
2.4 Organizational Independence
2.5 The role of internal audit
2.6 Safeguarding of Assets
2.7 Role in risk management
2.8 Role in Corporate Governance
2.9 Audit Project Selection or "Annual Audit Plan"
2.10 Internal Audit Execution

CHAPTER THREE: INTERNATIONAL AUDITING AND ASSURANCE STANDARDS

BOARD
3.1 Introduction
3.2 Information technology audit
3.3 Purpose
3.4 Types of IT Audits
3.5 IT Audit Process
3.6 Information Security Audit
3.7 History of IT Auditing
3.8.1 Principles of an IT Audit
3.8.2 Emerging Issues
3.8.3 Web Presence audits
3.8.4 Enterprise Communications Audits

CHAPTER FOUR: COMPUTER-AIDED AUDIT TOOLS

4.1 Introduction
4.2.1 Traditional Auditing vs CAATs
4.2.2 CAATTs Alternative
4.2.3 Traditional audit vs CAATTs on specific risks

1
4.3.1 Specialized Software
4.3.2 Benefits of Audit Software include
4.4 CAATs Education and Professional Development
4.5 Creation of Electronic Work Papers
4.6 Fraud Detection
4.7 Acronyms CAATTs vs CAAT

CHAPTER FIVE: CHANGE MANAGEMENT AUDITING

5.1 Introduction
5,2 Operational Auditing
5.2.1 Objectives
5.22 Preliminary preparation
5.2.3 Advantages
5.2.4 Disadvantages
5.3 Risk-Based Internal Audit
5.4 Risk Capacity
5.5 Risk Appetite
5.5.1 Risk
5.5.2 Inherent Risk
5.5.3 Residual Risk
5.5.4 Risk Register
5.5.5 Risk Assessment

CHAPTER SIX: MAINTAINING A SOUND SYSTEM OF INTERNAL CONTROL

6.1 Responsibility for the system of internal control
6.2 The system of internal control
6.3 Understanding the nature and context of control
6.4 The importance of internal control and risk management

CHAPTER SEVEN: REVIEWING THE EFFECTIVENESS OF INTERNAL CONTROL

7.1 Responsibility for reviewing the effectiveness of internal control
7.2 The process for reviewing effectiveness
7.3 Business objectives
7.4 Risk identification and assessment
7.5 Identification of appropriate controls
7.6 Monitoring of controls

CHAPTER EIGHT: CHIEF AUDIT EXECUTIVE

8.1 Introduction
8.2 Independent Attitude
8.3.1 Organizational Independence
8.3.2 Independent Function: No Conflict of Interest Allowed
8.3.3 Hierarchical Independence
8.3.4 Independent Status
8.3.5 Independent Communication Right
8.3.6 Independent Budgeting
8.3.7 Access to Information
8.4 Typical Duties
8.5 Quality Management
8.6 Reporting of Critical Findings
2
8.7 Survey Results

CHAPTER NINE: LEAD AUDITOR AND QUALITY STANDARD

9.1 Certified lead auditor
9.2 Certification Programs
9.3 ISO 9000
9.4 Reasons for Use
9.5 ISO 9000 series Quality Management Principles
9.6 Contents of ISO 9001:2015
9.7 Certification
9.8 Evolution of ISO 9000 Standards
9.8.1 1987 version
9.8.2 1994 version
9.8.3 2000 version
9.8.4 ISO 9000 Requirements include
9.8.5 2008 version
9.8.6 2015 version
9.9 Auditing
9.10 Industry-Specific Interpretations
9.11 Effectiveness
9.12 Advantages
9.13 Criticisms of ISO 9001 Certification

CHAPTER TEN: CORPORATE GOVERNANCE

10.1 Introduction
10.2 Background
10.3 Principal–Agent Conflict
10.4 Principal–Principal: Conflict (the Multiple Principal Problem)
10.5 Principles
10.6 Models
10.7.1 Continental Europe (Two-Tier Board System)
10.7.2 United States, United Kingdom
10.8 Founder Centrism
10.9.1 Regulations
10.9.2 Sarbanes–Oxley Act
10.9.3 Codes and Guidelines
10.9.4 Stock Exchange Listing Standards
10.9.5 Other Guidelines

CHAPTER ELEVEN: AUDIT RISK

11.1 Introduction
11.2 Enterprise Risk Management
11.3 ERM Frameworks ‗Defined
11.4 Casualty Actuarial Society framework
11.5.1 The Risk Management Process Involves
11.5.2 COSO ERM framework
11.5.3 ISO 31000: The new International Risk Management Standard
11.6 RIMS Risk Maturity Model
11.7 Implementing an ERM program
11.8 Common Challenges in ERM Implementation
3
CHAPTER TWELVE: COMPLIANCE
12.1 Introduction
12.2 By Nation
12.3.1 Business Motivation Model
12.3.2 Elements
12.4 Governance, Risk Management, and Compliance
12.5 Overview
12.6 Basic Concepts
12.7 GRC Market Segmentation
12.8 GRC Product Vendors
12.9 GRC Data Warehousing and Business Intelligence
12.10 GRC Research

CHAPTER THIRTEEN: RECORDS MANAGEMENT

13.1 Introduction
13.2 Concepts of Record
13.3 Records Management Theory
13.3.1 Records Life-Cycle
13.3.2 Records Continuum Theory
13.4.1 Records Management Practices and Concepts
13.4.2 Practice of Records Management may involve
13.5 Defensible Solutions
13.6 Classification
13.7 Enterprise Records
13.8 Industry Records
13.9 Legal Hold Records
13.10 Records Retention Schedule
13.11 Managing Physical Records
13.12 Identifying Records
13.13 Storing Records
13.14 Retrieval of Records
13.15 Circulating Records
13.16 Disposal of Records
13.16 Managing Digital Records
13.17 Electronic Tax Records
13.18 Current Issues
13.18.1 Compliance and Legal Issues
13.18.2 Security
13.18.3 Transparency
13.18.4 Adoption and Implementation
13.18.5 Impact of Internet and Social Media
13.18.6 Records Life Cycle Management
13.18.7 Conversion of Paper Records to Electronic Form
13.19 Electronic Records Management Systems
13.20 Commercial Records Centers

REFERENCES

4
 CHAPTER ONE
INTERNAL CONTROL SYSTEM

1.1 Definition, Objectives, Features and Importance

For systems-based auditing to work effectively, the auditor will like to rely on internal
controls to reduce the volume of substantive testing. It is therefore important for the
auditor to examine the internal control practice and procedures that are in place in
the client‘s business. Where weaknesses are revealed, the auditor recommends
ways of improving the systems.

1.1.1 Definition of Internal Control

The operational standard (guideline) defines internal control as ―The whole system
of controls, financial and otherwise, established by the management in order to carry
on the business of the enterprise, in an orderly and efficient manner, ensure
adherence to management policies, safeguard the assets and secure as far as
possible the completeness and accuracy of the records.

1.1.2 Objectives of Internal Control

The striking thing about the definition is its all-embracing nature and it is clear that
internal control is concerned with the controls operational in every area of corporate
activity as well as with the way in which individual controls inter-relate. The individual
components of an internal control system are known as ―controls‖ or ―internal
controls‖. The above definition establishes four objectives of internal controls as:

a) To carry on the business of the company in an orderly and efficient manner;

b) To ensure adherence to management policies;
c) To safeguard the asset of the organization; and
d) To secure completeness and accuracy of the records.

1.1.3 The Essential Features of Internal Control

The detailed nature of the controls operative within any commercial organization will
depend upon:

a) The nature and size of the business conducted;

b) The number of administrative staff employed;
c) The volume of transactions;
d) The materiality of transactions concerned;
e) The importance placed upon internal controls by the organizations own
management;
f) The management style of the entity particularly the trust placed in the integrity and
honesty of the key personnel and the latter‘s ability to supervise and control their
own subordinate staff;
g) The geographical distribution of the enterprise; and
h) Many other factors.

1.1.4 Importance of Internal Control to Auditors

a. They prevent errors and frauds or material misstatement

b. They detect errors and frauds or material misstatement.

5
c. They ensure complete and adequate recording of transactions.
d. They ensure that all recorded transactions are real, properly valued, related to the
correct period, properly classified, correctly authorized and posted.
e. They help to ensure reliable financial reporting and compliance with relevant laws,
regulations and standards.
f. They provide management with reasonable assurance that goals and objectives it
believes are important to the company, which are equally important to the auditor,
will be met.

1.2 Types of Internal Control

Internal controls can be categorized as:
a) Organizational –An enterprise should have a plan of organization which
should:
i) Define and allocate responsibilities
ii) Identify lines of reporting
In all cases, the delegation of authority and responsibility should be clearly
specified. An employee should also know the precise powers delegated to him, the
extent of his authority and to whom he should report.

b) Segregation of duties
i) No one person should be responsible for the recording and processing of a complete
transaction.

ii) The involvement of several people reduces the risk of intentional manipulation or
accidental error and increases the element of checking of work.

iii) Functions which for a given transaction should be separated include initiation,
authorization, execution, custody and recording.

c) Physical
i) This concerns physical custody of assets and invoices and procedures designed to
limit access to authorized personnel only.

ii) Access can be direct, e.g. by being able to enter the warehouse or indirect, that is by
documentation e.g. personnel knowing the correct procedures, may be able to
extract goods by doing the right paper work.

iii) These controls are especially important in the case of valuable, portable,
exchangeable or desirable assets e.g. locking of securities (share certificates) in a
safe with procedures for the custody of the use of the keys, use of passes to restrict
access to sensitive places, use of password to restrict access to computer files.

d) Authorization and approval

All transactions should require authorization or approval by an appropriate person.

6
 ii) Access can be direct, e.g. by being able to enter the warehouse or indirect, that is by
documentation e.g. personnel knowing the correct procedures, may be able to
extract goods by doing the right paper work.

iii) These controls are especially important in the case of valuable, portable,
exchangeable or desirable assets e.g. locking of securities (share certificates) in a
safe with procedures for the custody of the use of the keys, use of passes to restrict
access to sensitive places, use of password to restrict access to computer files.

d) Authorization and approval

All transactions should require authorization or approval by an appropriate person.

The limits to these authorizations should be specified e.g.

i) All credit sales must be approved by the credit control department
ii) All individual office stationery purchases to a certain limit

e) Arithmetical and Accounting

i) These are controls in the recording function which check that the transactions have
been properly checked and coded, that they are all included and that they are
correctly recorded and accurately processed.
ii) Procedures include checking the arithmetical accuracy of the records, the
maintenance and checking of totals, reconciliation, control accounts, trial balances,
accounting for documents and previews.

f) Personnel
i) Procedures should be designed to ensure that personnel operating a system are
competent and motivated to carry out the tasks assigned to them, as the proper
functioning of a system depends upon the competence and integrity of the operating
personnel.

ii) Measures include selection of people with appropriate personnel characteristics and
training; assignment to tasks of the right level of staff; appropriate remuneration and
promotion and career development prospects.

g) Supervision
All actions by all level of staff should be supervised. The responsibility for
supervision should be clearly laid down and communicated to the person being
supervised.

h) Management
i) These are controls, exercised by management which are outside and over and
above the day to day routine of the system.

ii) They include overall supervisory control, review of management accounts,

comparison with budgets, internal audit and any other special review procedures.

i) Acknowledgement of performance
Persons performing data processing operations and other sensitive activities should
acknowledge their activities by means of signatures, initials, rubber stamps, etc., for
7
 example, if invoice calculations have to be checked, the checker should initial each
invoice. This mitigates against the following:

i) Inherent limitations of internal controls

ii) Fraud perpetuated within and/or outside the system

iii) Hacking of computer code through human cleverness

1.3 Scope and Components of Internal Control System

The scope of internal control systems extends beyond control of accounting
procedures; it further encompasses the control environment, the entity‘s work
assessment process, control procedures, information and communication system
and monitoring.

a) The Control Environment

This is the foundation of all other components of internal control. This refers to all the
overall attitude, awareness and actions of directors and management regarding the
internal control systems and its importance in the entity i.e. a strong control
environment can complement specific control procedures but does not in itself
ensure the effectiveness of the internal control system.

b) Risk Assessment
Managers need to assess business risk as part of designing and operating the
internal control system to minimize errors and irregularities. Business risk represents
factors, events and condition that can prevent an organization from achieving its
business objectives. If management effectively assesses and respond to risk, the
auditor will need to accumulate less evidence than when management fails to,
because control risk is lower. Conditions that may increase business risk include
new personnel, new technology, corporate restructuring and foreign operations.

c) Control procedures
Control procedures sometimes called control activities represents policies and
procedures and specific actions taken by a client‘s management and employees that
help ensure management‘s directives are carried out. Control procedures involve
establishing a policy of control and defining procedures to effect the policy. All
control procedures should be analyzed for risk.

d) Information and Communication system

The information and communication component of internal control is a necessary
prerequisite for achieving management objective. Communication includes report
production and distribution, every organization is expected to capture pertinent
information relating to both internal and external events and both financial and non-
financial activities of the organization. For an audit, the auditor should obtain an
understanding of the information system and the related business process relevant
to financial reporting.

e) Monitoring
Internal controls need to be monitored. Management should assess the quality of
control performance on a timely basis. Monitoring involves the process of assessing
8
 the design of controls and their operation on a timely basis and taking necessary
corrective actions. Example of monitoring controls include: Company Operating
Manager‘s Report and Published Financial Statement, analysis of customers‘
complaints, periodic comparison of recorded amounts to actual assets, and
examining internal auditors reports on control performance.

1.4 Internal Controls and their Inherent Limitations

Directors of corporate bodies set up internal controls in the accounting system to
ensure that:

a. transactions are executed in accordance with proper authorization,

b. all transactions are promptly recorded at the correct values in the appropriate
accounts and in accordance with relevant regulatory frameworks,
c. access to assets is permitted in accordance with authorized procedures, and
d. recorded assets are compared with physically existing assets at reasonable intervals
and differences reconciled.

However, any instituted internal control system provides management with only
reasonable but not absolute assurance that their objectives are accomplished
because of inherent limitations such as the following:
i) The requirement that the cost of an internal control does not outweigh the potential
loss which may result from its absence.
ii) Most systematic internal controls tend to be directed at routine transactions rather
than non-routine transactions.
iii) The potential for human error in the operation of internal controls due to
carelessness, distraction, mistakes of judgment and the understanding of
instructions.
iv) The possibility that a person responsible for exercising an internal control could
abuse that responsibility by overriding an internal control.
v) The possibility of controls being by-passed because two or more people colluded.
Collusion maybe between people inside the organization, but may involve outsiders
as well.
vi) The possibility that procedures may become inadequate due to changes in
conditions or that compliance with procedures may deteriorate over time. This may
particularly apply if a business is expanding.

Factors that determine the success of an Internal Control System include:

a. The nature, size and volume of transactions
b. The geographical distribution of the enterprise
c. The controls exercised personally by individual members of management
d. The cost of setting up controls and the benefit obtained there from e. Management‘s
attitude to controls

1.5 Understanding the Internal Control System

In planning the audit, auditors should obtain and document an understanding of the
accounting system and control environment sufficient to determine their audit
approach.

i. Major classes of transactions in the entity‘s operations;

9
ii. how such transactions are initiated;
iii. significant accounting records, supporting documents and accounts in the financial
statements; and
iv. iv. the accounting and financial reporting process, from the initiation of significant
transactions and other events to the inclusion in the financial statements.

b. The factors affecting the nature, timing and extent of the procedures performed in
order to understand the systems include:
i. Materiality considerations;
ii. The size and complexity of the entity
iii. Their assessment of inherent risk
iv. The complexity of the entity‘s computer systems
v. The type of internal controls involved, and vi. the nature of the entity‘s
documentation of specific transactions

c. The auditor updates previous knowledge of the accounting systems in the following
ways:
i. Enquiries of appropriate supervisory and other personnel at various organizational
levels within the entity, together with references to documentation such as procedure
manuals, job descriptions and systems descriptions.

ii. Inspection of relevant documents and records produced by the systems.

iii. Observation of the entity‘s activities and operations, including the information
technology functions, organization, personnel performing control procedures and the
nature of transactions processing.

1.6 Ascertaining the System of Controls

Methods of ascertaining the control system are summarized as follows:
 Examining previous audit work o Client‘s own documentation of the system
 Interviews with client‘s staff.
 Tracing transactions o Examining client‘s documents
 Observation of procedures

a. Examining previous audit work

Apart from first audit, the audit files should provide a record of the system as it
operated at the last date. Unless there has been no major change, this requires
updating.

b. Client‘s own documentation of the system

Some entities have manuals of procedures. These provide source of information to
the existing control systems. It is important to check whether the system as
described in the manual is what is actually practiced.

c. Interviews with client‘s staff

During various stages of the audit, the auditor will need to sit down with some
members of the staff of the client and find out how they carry out the functions.
These reveal existing control and give indication of potential problems.

10
d. Tracing transactions
Walk through tests allow auditors to identify any examples of actual procedures that
vary from intended procedures. It also helps the understanding of the entire process
as well as identification of risks.

e. Examining client‘s documents

The auditor can also ascertain the client‘s control systems by examining some
available documents provided by the client. For example, minutes of management
meeting may reveal control issues that require further investigations. Implementation
or steering group meetings should be held for significant systems changes and
documentations of these will be useful sources of information.

f. Observation of procedure
It is sometimes useful to watch staff carrying out procedures (such as wages pay-
out, receiving materials into stores, etc.) to be able to ascertain the existing and
practiced control procedures.

1.7 Recording the Systems of Control

Methods of recording the system may include
 Narrative Notes Organization Chart
 Internal Control Questionnaire
 Flow Charts and other Diagrammatic Presentation

a. Narrative Notes
This method is where words are used to describe the systems. Narrative notes are
normally appropriate for simple systems where all paper work are handled by only
one or few people. For each system, narrative notes need to describe the following:
i. Functions to be performed and those responsible for performing them
ii. Documents used
iii. Source and destination of documents
iv. Sequence of filing documents v. Types of accounting books kept

It has the advantages of being simple to record and easy to understand.

However, it has several practical application difficulties which include the following:

 It is difficult to make a note of change in the system

 Preparation of narrative notes for a complex system may take up a disproportionate
amount of space.
 It may be difficult to see if part of the system has been missed out altogether.

b. Organization Chart
This provides a convenient way of describing the authority, responsibility, approval
and reporting relationships that exist in the organization. It outlines the formal
relationships that exist in the organization. It however does not specify the precise
duties of the individuals concerned.

c. Internal Control Questionnaire (ICQ) ICQ remains the longest used internal control
assessment and recording technique. Its function is to highlight precisely the areas
of strength and weakness in internal control.
11
 The questionnaire is a standardized pre-printed document designed by the audit firm
using it, and comprises a series of questions designed to determine whether
desirable controls are present. They are formulated so that there is one to cover
each of the major transaction cycles. The following points are worth-noting about the
use of ICQ.

i) An ICQ will normally be used if the size and complexity of the client organization
justifies it.
ii) A complete ICQ should have an effective life of approximately three years during
which only updating would be necessary. The completion of new ICQ would be
necessary if a major change in the system had taken place (e.g. a change over from
manual to computerized system).
iii) The ICQ should be completed by a senior member of the audit staff after putting the
questions to the responsible officers of the client company.
iv) Observation and selected tests will ensure that the ICQ accurately reflects the
strengths and weaknesses within the procedures that operate from day to day.
v) The auditor should not place reliance on controls on the basis of this preliminary
evaluation. He should conduct further compliance tests designated to give a
reasonable assurance that the controls are functioning properly.
vi) The questions should be formulated in such a way that the relevant internal control
criteria are implicit, so that no more than a yes/no answer is required to indicate
compliance or non-compliance. This degree of simplicity is not possible for every
question, for example cases where it is necessary to know the names of executive
officer authorized to sign cheques, or the limit on the authority of a particular officer
to authorize expenditure.

Advantages and disadvantages of ICQ

Advantages include the following:
 If drafted thoroughly, they can ensure that all controls are considered
 They are quick to prepare.
 They are easy to use and control. A manager or partner reviewing the work can
easily see what has been done.

Disadvantages include the following:

 The client may overstate controls. - ICQ may contain a large number of irrelevant
controls.
 They can give the impression that all controls are of equal weight.
 They may not include unusual controls, which are nevertheless effective in particular
circumstances.

d. Flowcharts
The auditor, in establishing the nature of the system in operation, may include flow
charts of the system, supplemented by narrative notes in the permanent audit files.
These are updated on the basis of regular periodic reviews.

The auditor‘s flow charts may be adapted from those already prepared by the client,
or produced from scratch by the auditor himself.

12
 The preparation of the charts, will of itself teach the auditor a good deal more about
the detailed functioning of the system at work in each department.

The auditor should not commit the chart to his files until he has, as a result of
questioning and observation, reasonably ascertained that it represents what actually
takes place. This precaution is important because the nature of the audit tests
subsequently carried out will, to a large degree, follow the pattern reflected in the
chart and much time will be wasted if the charts are incomplete or inaccurate.

Generally, there are two methods of flowcharting, namely: Document Flowcharts and
Information Flowcharts.

Document Flowcharts are more commonly used because they are relatively easy to
prepare. They show that:

 All documents are followed through from beginning to the end

 All operations and controls are shown.

Information Flowcharts are prepared in the reverse direction from the flow. They
start with the entry into the accounting records and work back to the actual
transaction. They concentrate on significant information flows and ignore any
unimportant or copies of document. They are easy to understand but require skill
and experience to compile them.
Rules of Flowcharting
The following rules are generally observed in flowcharting:

I) A flowchart should only be used when the system being reviewed cannot be readily
understood in words

ii) Flowcharts should be kept simple so that the overall structure or flow is clear at first
sight. This means that:
 There must be conformity of symbols, with each symbol representing one and only
one thing
 The direction of the flowchart should be from top to bottom and from left to right
 There must be no loose ends  The main flow should finish at the bottom right and
corner, not in the middle of the page
 Connecting lines should cross only where absolutely necessary to preserve the
chart‘s simplicity

iii) Unless BSI symbols are used, a key should always be provided.

iv) A specially designed template should always be used; freehand flowcharting is

rarely acceptable.

v) The chart must reflect the system, weaknesses included.

vi) Marginal comments should be included in the chart where appropriate, using a
dotted flow line and marginal bracket.

13
 Advantages of Flowcharts
i) The system or any part of it may be presented as a totality without any loss of detail.
ii) The relationship between procedures in different areas can be depicted simply.
iii) Control features (or their absence in cases where they might be expected) may be
highlighted by the use of designated symbols.
iv) References to the other related audit documents may be easily incorporated.
v) Diagrammatic representation facilitates subsequent references to particular features
in the system more readily than pure narrative.
vi) New members of the audit team are able to participate in the audit work after a short
induction period and as a result, it results in considerable saving of time.
vii) As the information is presented in a standard form, they are fairly easy to follow and
to review.
viii) They generally ensure that the system is recorded in its entirety, as all document
flows have to be traced from beginning to end. Any‖ loose end‖ will be apparent from
a quick examination.
ix) They eliminate the need for extensive narrative notes and can be of considerable
help in highlighting the salient points of control and any weakness in the system.

Disadvantages of Flowcharts
i) They are only suitable for describing standard systems. Procedures for dealing with
unusual transactions will normally have to be recorded using narrative notes.

ii) They are useful for recording the flow of documents, but once the records or the
assets to which they relate have become static, they can no longer be used for
describing the control (for example over noncurrent assets).

iii) Major amendment is difficult without redrawing.

iv) Time can be wasted by charting areas that are of no audit significance.

1.8 Evaluating the Internal Control.

After ascertaining and recording the system, the auditor has to conduct some
preliminary evaluation of the control system in order to form opinion as to whether he
can rely on the system to reduce substantive testing or he should disregard the
control system (because they are inefficient) and to conduct in-depth testing. This is
generally done through the use of Internal Control Evaluation Questionnaire.

a. Internal Control Evaluation Questionnaire (ICEQs)

These are designed to determine whether appropriate control systems exist to
prevent specific errors or omissions. They are answered using knowledge of the
system obtained from the flow chart or the internal control questions. The
characteristic of these questions is that they concentrate on criteria that the controls
present should fulfil.

b. The nature of an ICEQ can be illustrated with the examples below:

 The sales (revenue) cycle Is there reasonable assurance: that sales are properly
authorized?  that sales are made to reliable payers?
 That all goods dispatched are invoiced?
 That all invoices are properly prepared?
 That all invoices are recorded?
14
 That invoices are properly supported?
 That all credits to customers‟ accounts are valid?
 That cash and cheques received are properly recorded and deposited?
 That slow payers will be chased and that bad and doubtful debts will be provided
against?  that all transactions are properly accounted for?
 That cash sales are properly dealt with?
 That sundry sales are controlled?
 That at the period end the system will neither overstate nor understate debtors?
ii. The purchases (expenditure) cycle
 Is there reasonable assurance: that goods or services could not be received without
a liability being recorded?
 That receipt of goods or services is required in order to establish a liability?
 That a liability will be recorded:

 only for authorized items; and

 At the proper amount?

 That all payments are properly authorized?  that all credits due from suppliers are
received?
 That all transactions are properly accounted for?  that at the period end liabilities
are neither overstated nor understated by the system?
 That the balance at the bank is properly recorded at all times?  that unauthorized
cash payments could not be made and that the balance of petty cash is correctly
stated at all times?

iii. Wages and Salaries

Is there reasonable assurance:
 That employees are only paid for work done?
 That employees are paid the correct amount (gross and net)?
 That the right employees actually receive the right amount?
 That accounting for payroll costs and deductions is accurate?

iv. Stocks
Is there reasonable assurance:
 That stock is safeguarded from physical loss (e.g. fire, theft, deterioration)?
 That stock records are accurate and up to date?  that the recorded stock exists?
 That the recorded stock is owned by the company?
 That the cut off is reliable?  that the costing system is reliable?
 That the stock sheets are accurately complied?
 That the stock valuation is fair?

v. Non-current assets
Is there reasonable assurance:
 That recorded assets actually exist and belong to the company?
 That capital expenditure is authorized and reported?
 That disposals of non-current assets are authorized and reported?
 That depreciation is realistic?  that non-current assets are correctly accounted for?
 That income derived from non-current assets is accounted for?

15
vi. Investments
Is there reasonable assurance:
 That recorded investments belong to the company and are safeguarded from loss?
 That all income, rights or bonus issues are properly received and accounted for?
 That investment transaction is made only in accordance with company policy and
are appropriately authorized and documented?
 That the carrying values of investments are reasonably settled?

vii Management information and general controls

 Is the nominal ledger satisfactorily controlled?
 Are journal entries adequately controlled?
 Does the organization structure provide a clear definition of the extent and limitation
of authority?
 Are the systems operated by competent employees, who are adequately supported?
 If there is an internal audit function, is it adequate?
 Are financial planning procedures adequate?
 Are periodic internal reporting procedures adequate?

c. Advantages of ICEQs
i. ICEQs highlight areas of weakness where extensive substantive testing will be
required.
ii. Answering ICEQs enables auditors to identify the important controls which they are
most likely to test during control testing.

d. Disadvantages of ICEQs The main disadvantage of ICEQs is that they can be

drafted vaguely, hence misunderstood and important controls not identified.

1.9 Reporting on Internal Control to Management.

a. Introduction
This section outlines the need for auditors to communicate weaknesses identified in
the accounting and internal control systems to management and describe the nature
and contents of such reports.

At the conclusion of the internal control assessment stage of the audit, there is the
need for the auditors to communicate any weaknesses discovered in the internal
control systems to the management of the client company.

This report usually takes the form of a Management Letter, Letter of Weakness, or
Internal Control Letter. However other forms of reports are acceptable.

The precise stage of the audit at which the letter should be sent, how far the content
of the report should extend and the action the auditor should take if his observations
on major weaknesses are ignored by the client are matters of professional judgment
and based on the type of audit and the client company.

Where the audit work is performed on more than one visit, the auditors normally
report to management after the interim audit work has been completed as well as

16
 after the final visit, particularly if there are procedures that need to be improved
before the financial year end.
b. Principal purposes of reports to management

The principal purposes of reports to management are as follows:

i. To enable the auditors to comment on the design and operation of the accounting
and internal control systems examined during the course of the audit and to make
suggestion for their improvement;

ii. To provide other constructive advice, for example, comments on potential

economies or improvements in efficiency identified during the audit; and
iii. To communicate other matters that have come to the auditors‘ attention during the
audit, for example comments on adjusted and unadjusted errors in the financial
statements or on particular accounting policies and practices.

c. Material weaknesses in accounting and internal control systems

When material weaknesses in the accounting and internal control systems are
identified during the audit, the auditors should report them in writing to the directors,
the audit committee or to an appropriate level of management on a timely basis.

A material weakness (within this context), is a condition which may result in a material
misstatement in the financial statements. If the directors or management have
detected a material weakness, and in the view of the auditors, have taken the
appropriate corrective actions, the auditors do not need to report to directors or
management on the matter.

In this circumstance, the auditors normally document the considerations which

resulted in their conclusion that no report to directors or management in respect of
this matter is needed.

Ordinarily, material weaknesses in the accounting and internal control systems are
communicated to directors or management in a written report issued by the auditors.
However, in some circumstances it may be sufficient for the relevant matters to be
raised orally with directors or management, followed by a file note circulated to those
attending the meeting to provide a record of the auditors‘ observations and the
responses of the directors or management.

When no material weaknesses are identified during the audit, the auditors may
choose not to issue a report to directors or management. They may however need to
inform them that no report is to be issued.

d. Addressee of report to management

When submitting a management report, the auditors need to consider which
directors or members of management have the power to act on their findings.
Ordinarily, it is appropriate to address the report to the board of directors, audit
committee or similar body. The report may contain matters of varying levels of
significance which may make it appropriate for a tiered report to be issued so that
the board can consider any major points and receipt of a report less important
matters can be delegated to other levels of management.

17
 Ordinarily, the auditors request a reply to the points raised in a report to
management, indicating the actions that the directors or management intend to take
as a result of the comments made in the report.

In any report to directors or management, the auditors need to explain that the report
is not a comprehensive statement of all weaknesses which exist or of all
improvements which may be made, but that it documents only those matters which
have come to their attention as a result of the audit procedures performed. The
auditors may wish to refer to their audit approach in the report to directors or
management, particularly in the work undertaken on the accounting and internal
control system, to help directors or management appreciate the nature, time and
extent of the audit procedures which have resulted in the identification of the matters
included in the report.

e. Other matters regarding reports to management

If the auditors identify weakness (other than material weakness) and other matters
which they consider appropriate to bring to the attention of directors, they may
include them in the report (together with the material weaknesses), although they
may be issued in a separate report.

The auditors may consider it appropriate to raise these matters orally with
management and under these circumstances; the auditors normally prepare a file
note to provide a record of their observations.

To be effective, a report to directors or management is issued immediately after

completion of the audit procedures giving rise to comment. Where the audit work is
performed in more than one visit, it is appropriate to report to directors or
management after the interim visit as well as after the final audit visit. However, an
interim audit report needs to make it clear that the overall audit work is only partially
complete and further matters may still arise.

Matters raised in previous reports to directors or management need to be

considered by the auditors. Where they have not been dealt with effectively, the
auditors need to enquire why appropriate action has not been taken. If the auditors
consider that a point is still significant, consideration needs to be given to repeating
the point in the current report, otherwise there is a risk that the auditors may give an
impression that they are satisfied that the weakness has been corrected.

f. Third parties interested in reports to directors or management

Any report to directors or management is a confidential communication. Thus the
auditors need to obtain the prior consent of the directors or management if they are
to provide a copy of report to directors or management to a third party.

In practice, the auditors have little control over what happens to the report once it
has been dispatched. Occasionally, management may provide third parties with
copies of the report, e.g. their banks or certain regulatory authorities.

It is therefore appropriate to ensure that third parties who see the report understand
that it was not prepared for their benefit. Accordingly, care needs to be taken to
18
 protect the auditor‘s position from exposure to liability to any third parties who may
seek to rely on a report which was not intended for their use.

Thus, auditors ordinarily state in their report to management that:

i. the report has been prepared for the sole use of the entity;
ii. it must not be disclosed to a third party without the written consent of the auditors;
and
iii. no responsibility is assumed by the auditors to any other person.

As a general rule, a liability in negligence to a third party may only arise in

circumstances where the auditors carry out work for an entity knowing that their work
is to be relied upon by a third party and that the third party may suffer financial loss
as a result. An expressed disclaimer of liability normally provides a high degree of
protection against an unforeseen liability to a third party.
Specimen management letter

6th February 2017

The Board of Directors
Seekfirst Plc
290 Abeka Rd Ext
Lagos

Members of the Board,

Financial Statements for the year ended 31 December 2016

Following the conduct of our interim audit, we set out below certain points which
arose as a result of our review of the accounting systems and procedures operated
by your company.

We wish to point out, however, that our audit testing was undertaken in accordance
with the scope of our audit engagement, and therefore, will not necessarily identify
all weaknesses that may exist. As you are aware, it is the responsibility of the
directors to ensure that satisfactory internal controls are maintained at all times.

1. Purchase order
Procedure Present system
During the audit we found out that some departments order some goods from
suppliers orally without support of purchase requisition or purchase order.

Recommendation
We recommend that the Logistic department be made responsible for all
procurements and when orders are made orally, they should be subsequently
confirmed by raising official purchase order.

2. Purchase Ledger Reconciliation

Present System:
Although it is the practice of your company to reconcile the purchase ledger with
statements received from various suppliers at the end of every month, this was not
done in August and September.

19
 Implication
Unexplained differences exist between suppliers‟ statements balance and purchase
ledger balances. This implies a breakdown of purchases invoice and or cheque
payment batching and posting procedures.

Recommendation
It is important that this reconciliation is performed regularly by a responsible official
independent of day to day purchase ledger, cashier and nominal ledger functions.

3 Credit Control
Present System
As at 30October 2016, total debtors figure approximates 3 month sales although the
company‘s trade terms allow 4 weeks credit to customers.

Implication
This has resulted in high overdraft level with the resultant high interest charges and
difficulty in settling the accounts of some key suppliers on time.

Recommendations
We recommend that a more structured system of debt collection be considered
using standard letters and that statement should be sent out a week earlier than it is
now.

Yours faithfully,

ABC & Co.

Chartered Accountants

20
 CHAPTER TWO
INTERNAL AUDIT
2.1 Introduction
Internal auditing is an independent, objective assurance and consulting activity
designed to add value to and improve an organization's operations. It helps an
organization accomplish its objectives by bringing a systematic, disciplined approach
to evaluate and improve the effectiveness of risk management, control and
governance processes. Internal auditing achieves this by providing insight and
recommendations based on analyses and assessments of data and business
processes. With commitment to integrity and accountability, internal auditing
provides value to governing bodies and senior management as an objective source
of independent advice. Professionals called internal auditors are employed by
organizations to perform the internal auditing activity.

The scope of internal auditing within an organization is broad and may involve topics
such as an organization's governance, risk management and management controls
over: efficiency/effectiveness of operations (including safeguarding of assets), the
reliability of financial and management reporting, and compliance with laws and
regulations. Internal auditing may also involve conducting proactive fraud audits to
identify potentially fraudulent acts; participating in fraud investigations under the
direction of fraud investigation professionals, and conducting post investigation fraud
audits to identify control breakdowns and establish financial loss.

Internal auditors are not responsible for the execution of company activities; they
advise management and the board of directors (or similar oversight body) regarding
how to better execute their responsibilities. As a result of their broad scope of
involvement, internal auditors may have a variety of higher educational and
professional backgrounds.

Internal auditors work for government agencies (federal, state and local); for publicly
traded companies; and for non-profit companies across all industries. Internal
auditing departments are led by a chief audit executive ("CAE") who generally
reports to the audit committee of the board of directors, with administrative reporting
to the chief executive officer (In the United States this reporting relationship is
required by law for publicly traded companies).

2.2 History of Internal Auditing

The internal auditing profession evolved steadily with the progress of management
science after World War II. It is conceptually similar in many ways to financial
auditing by public accounting firms, quality assurance and banking compliance
activities. While

some of the audit technique underlying internal auditing is derived from management
consulting and public accounting professions, the theory of internal auditing was
conceived primarily by Lawrence Sawyer (1911–2002), often referred to as "the
father of modern internal auditing"; and the current philosophy, theory and practice
of modern internal auditing as defined by the International Professional Practices
Framework (IPPF) of the Institute of Internal Auditors owes much to Sawyer's vision.

21
 With the implementation in the United States of the Sarbanes–Oxley Act of 2002, the
profession's exposure and value was enhanced, as many internal auditors
possessed the skills required to help companies meet the requirements of the law.
However, the focus by internal audit departments of publicly traded companies on
SOX related financial policy and procedures derailed progress made by the
profession in the late 20th century toward Larry Sawyer's vision for internal audit.
Beginning in about 2010, the IIA once again began advocating for the broader role
internal auditing should play in the corporate arena, in keeping with the IPPF's
philosophy.

2.3 Internal Audit as a Control Factor

The external auditor should consider the activities of internal auditing and their
effect, if any, on external audit procedures.

―Internal auditing‖ means an appraisal activity established within an entity as a

service to the entity. Its functions include, amongst other things, monitoring the
internal control system.

While the external auditor has sole responsibility for the audit opinion expressed and
for determining the nature, timing and extent of external audit procedures, certain
parts of internal auditing work may be useful to the external auditor.

A Scope and Objectives of Internal Auditing

The scope and objectives of internal auditing vary widely and depend on the size
and structure of the entity and the requirements of its management. Ordinarily,
internal auditing activities include one or more of the following.

i. Monitoring of internal control:

The establishment of adequate internal control is the responsibility of management
which demands proper attention on a continuous basis. Internal auditing is ordinarily
assigned specific responsibility by management for reviewing controls, monitoring
their operation and recommending improvements thereto.
ii. Examination of financial and operating information:
This may include review of the means used to identify measure, classify and report
such information and specific inquiry into individual items including detailed testing of
transactions, balances and procedures.
iii. Review of the economy:
Efficiency and effectiveness of operations including non-financial controls of an
entity: Review of compliance with laws, regulations and other external requirements
and with management policies and directives and other internal requirements.

B Relationship Between Internal Auditing and The External Auditor

The role of internal auditing is determined by management, and its objectives differ
from those of the external auditor who is appointed to report independently on the
financial statements. The internal audit function‘s objectives vary according to
management‘s requirements. The external auditor‘s primary concern is whether the
financial statements are free of material misstatements.

22
 Nevertheless some of the means of achieving their respective objectives are often
similar and thus certain aspects of internal auditing may be useful in determining the
nature, timing and extent of external audit procedures.
Internal auditing is part of the entity. Irrespective of the degree of autonomy and
objectives of internal auditing, it cannot achieve the same degree of independence
as required of the external auditor when expressing an opinion on the financial
statements. The external auditor has sole responsibility for the audit opinion
expressed, and that responsibility is not reduced by any use made of internal
auditing. All judgments relating to the audit of the financial statements are those of
the external auditor.

c. Understanding and Preliminary Assessment of Internal Auditing

The external auditor should obtain a sufficient understanding of internal audit
activities to identify and assess the risks of material misstatement of the financial
statements and to design and perform further audit procedures.

Effective internal auditing will often allow a modification in the nature and timing, and
a reduction in the extent of audit procedures performed by the external auditor but
cannot eliminate them entirely. In some cases, however, having considered the
activities of internal auditing, the external auditor may decide that internal auditing
will have no effect on external audit procedures.

The external auditor should perform an assessment of the internal audit function
when internal auditing is relevant to the external auditor‘s risk assessment.

The external auditor‘s assessment of the internal auditor‘s function will influence the
external auditor‘s judgment about the use which may be made of internal auditing in
making risk assessments and thereby modifying the nature, timing and extent of
further external audit procedures.

When obtaining an understanding and performing an assessment of the internal

audit function, the important criteria are the following:

i) Organizational status: Specific status of internal auditing in the entity and the effect
this has on its ability to be objective. In the ideal situation, internal auditing will report
to the highest level of management and be free of any other operating responsibility.
Any constraints or restrictions placed on internal auditing by management would
need to be carefully considered. In particular, the internal auditors will need to be
free to communicate fully with the external auditor.
ii) Scope of function: The nature and extent of internal auditing assignments
performed. The external auditor would also need to consider whether management
acts on internal audit recommendations and how this is evidenced.
iii) Technical Competence: Whether internal auditing is performed by persons having
adequate technical training and proficiency as internal auditors. The external auditor
may, for example, review the policies for hiring and training the internal auditing staff
and their experience and professional qualifications.
iv) Due professional care: Whether internal auditing is properly planned, supervised,
reviewed and documented. The existence of adequate audit manuals, work
programs and working papers would be considered.
d. Timing for Liaison and Coordination
23
 When planning to use the work of internal auditing, the external auditor will need to
consider internal auditor‘s tentative plan for the period and discuss it as early as
possible. Where the work of internal auditing is to be a factor in determining the
nature, timing and extent of the external auditor‘s procedures, it is desirable to agree
in advance the timing of such work, the extent of audit coverage, materiality levels
and proposed methods of sample selection, documentation of the work performed
and review and reporting procedures.

Liaison with internal auditing is more effective when meetings are held at appropriate
intervals during the period. The external auditor would need to be advised of and
have access to relevant internal reports and be kept informed of any significant
matter that comes to the internal auditor. Similarly, the external auditor would
ordinarily inform the internal auditor of any significant matters which may affect
internal auditing.

e. Evaluating the Work Of Internal Auditing

When the external auditor intends to use specific work of internal auditing, the
external auditor should evaluate and perform audit procedures on that work to
confirm its adequacy for the external auditor‘s purposes.

The evaluation of specific work of internal auditing involves consideration of the

adequacy of the scope of work and related programs and whether the assessment
of the internal auditing remains appropriate. This evaluation may include
consideration of whether:

i) The work is performed by persons having adequate technical training and

proficiency as internal auditors and the work of assistants is properly supervised,
reviewed and documented;
ii) Sufficient appropriate audit evidence is obtained to be able to draw reasonable
conclusions;
iii) Conclusions reached are appropriate in the circumstances and any reports prepared
are consistent with the results of the work performed; and
iv) Any exceptions or unusual matters disclosed by internal auditing are properly
resolved.

The nature, timing and extent of the audit procedures performed on the specific work
of internal auditing will depend on the external auditor‘s judgment as to the risk of
material misstatement of the area concerned, the assessment of internal auditing
and the evaluation of the specific work by internal auditing. Such audit procedures
may include examination of items already examined by internal auditing,
examination of other similar items and observation of internal auditing procedures.

The external auditor would record conclusions regarding the specific internal
auditing work that has been evaluated and the audit procedures performed on the
internal auditor‘s work.

2.4 Organizational Independence

While internal auditors are hired directly by their company, they can achieve
independence through their reporting relationships. Independence and objectivity
are a cornerstone of the IIA professional standards; and are discussed at length in
24
 the standards and the supporting practice guides and practice advisories.
Professional internal auditors are mandated by the IIA standards to be independent
of the business activities they audit. This independence and objectivity are achieved
through the organizational placement and reporting lines of the internal audit
department. Internal auditors of publicly traded companies in the United States are
required to report functionally to the board of directors directly, or a sub-committee of
the board of directors (typically the audit committee), and not to management except
for administrative purposes.

The required organizational independence from management enables unrestricted

evaluation of management activities and personnel and allows internal auditors to
perform their role effectively. Although internal auditors are part of company
management and paid by the company, the primary customer of internal audit
activity is the entity charged with oversight of management's activities. This is
typically the audit committee, a sub-committee of the board of directors.
Organizational independence is effectively achieved when the chief audit executive
reports functionally to the board. Examples of functional reporting to the board
involve the board: Approving the internal audit charter; Approving the risk based
internal audit plan; Approving the internal audit budget and resource plan; Receiving
communications from the chief audit executive on the internal audit activity's
performance relative to its plan and other matters; Approving decisions regarding the
appointment and removal of the chief audit executive; Approving the remuneration of
the chief audit executive; and Making appropriate inquiries of management and the
chief audit executive to determine whether there are inappropriate scope or resource
limitations.

2.5 The role of internal audit

Internal auditing activity is primarily directed at evaluating internal control. Under the
COSO Framework, internal control is broadly defined as a process, effected by an
entity's board of directors, management, and other personnel, designed to provide
reasonable assurance regarding the achievement of the following core objectives for
which all businesses strive:

1. Effectiveness and efficiency of operations.

2. 2. Reliability of financial and management reporting.
3. 3. Compliance with laws and regulations.

2.6 Safeguarding of Assets

Management is responsible for internal control, which comprises five critical
components: the control environment; risk assessment; risk focused control
activities; information and communication; and monitoring activities. Managers
establish policies, processes, and practices in these five components of
management control to help the organization achieve the four specific objectives
listed above. Internal auditors perform audits to evaluate whether the five
components of management control are present and operating effectively, and if not,
provide recommendations for improvement.

In the United States, the internal audit function independently tests managements
control assertions and reports to the company's audit committee of the board of
directors.
25
2.7 Role in risk management
Internal auditing professional standards require the function to evaluate the
effectiveness of the organization's Risk management activities. Risk management is
the process by which an organization identifies, analyzes, responds, gathers
information about, and monitors strategic risks that could actually or potentially
impact the organization's ability to achieve its mission and objectives.

Under the COSO enterprise risk management (ERM) Framework, an organization's

strategy, operations, reporting, and compliance objectives all have associated
strategic business risks – the negative outcomes resulting from internal and external
events that inhibit the organization's ability to achieve its objectives. Management
assesses risk as part of the ordinary course of business activities such as strategic
planning, marketing planning, capital planning, budgeting, hedging, incentive payout
structure, credit/lending practices, mergers and acquisitions, strategic partnerships,
legislative changes, conducting business abroad, etc. Sarbanes–Oxley regulations
require extensive risk assessment of financial reporting processes. Corporate legal
counsel often prepares comprehensive assessments of the current and potential
litigation a company faces. Internal auditors may evaluate each of these activities, or
focus on the overarching process used to manage risks entity-wide. For example,
internal auditors can advise management regarding the reporting of forward-looking
operating measures to the board, to help identify emerging risks; or internal auditors
can evaluate and report on whether the board and other stakeholders can have
reasonable assurance the organization's management team has implemented an
effective enterprise risk management program.

In larger organizations, major strategic initiatives are implemented to achieve

objectives and drive changes. As a member of senior management, the chief audit
executive (CAE) may participate in status updates on these major initiatives. This
places the CAE in the position to report on many of the major risks the organization
faces to the audit committee, or ensure management's reporting is effective for that
purpose.

The internal audit function may help the organization address its risk of fraud via a
fraud risk assessment, using principles of fraud deterrence. Internal auditors may
help companies establish and maintain Enterprise Risk Management processes.
This process is highly valued by many businesses for establishing and implementing
effective management systems and ensuring quality is maintained & professional
standards are met Internal auditors also play an important role in helping companies
execute a SOX 404 top-down risk assessment. In these latter two areas, internal
auditors typically are part of the risk assessment team in an advisory role.

2.8 Role in Corporate Governance

Internal auditing activity as it relates to corporate governance has in the past been
generally informal, accomplished primarily through participation in meetings and
discussions with members of the board of directors. According to COSO's ERM
framework, governance is the policies, processes and structures used by the
organization's leadership to direct activities, achieve objectives, and protect the
interests of diverse stakeholder groups in a manner consistent with ethical
standards. The internal auditor is often considered one of the "four pillars" of
26
 corporate governance, the other pillars being the board of directors, management,
and the external auditor.

A primary focus area of internal auditing as it relates to corporate governance is

helping the audit committee of the board of directors (or equivalent) perform its
responsibilities effectively. This may include reporting critical management control
issues, suggesting questions or topics for the audit committee's meeting agendas,
and coordinating with the external auditor and management to ensure the committee
receives effective information. In recent years, the IIA has advocated more formal
evaluation of corporate governance, particularly in the areas of board oversight of
enterprise risk, corporate ethics, and fraud.

2.9 Audit Project Selection or "Annual Audit Plan"

Based on the risk assessment of the organization, internal auditors, management
and oversight boards determine where to focus internal auditing efforts. This focus
or prioritization is part of the annual/ multi-year annual audit plan. The audit plan is
typically proposed by the CAE (sometimes with several options or alternatives) for
the review and approval of the audit committee or the board of directors. Internal
auditing activity is generally conducted as one or more discrete assignments.

It should be adapted to the specific purpose of audit, and the selection of audit
method must be adapted to its specific purpose. Otherwise, it will deviate from the
purpose of the audit.

2.10 Internal Audit Execution

A typical internal audit assignment involves the following steps:
1. Establishing and communicating the scope and objectives of the audit to appropriate
members of management.
2. Developing an understanding of the business area under review – this includes
objectives, measurements & key transaction types and involves interviews and a
review of documents – flowcharts and narratives may be created, if necessary.
3. Describing the key risks facing the business activities within the scope of the audit.
4. Identifying management practices in the five components of control used to ensure
that each key risk is properly controlled and monitored. An internal audit checklist
can be a helpful tool to identify common risks and desired controls in the specific
process or specific industry being audited.
5. Developing and executing a risk-based sampling and testing approach to determine
whether the most important management controls are operating as intended.
6. Reporting issues and challenges identified and negotiating action plans with the
management to address these problems.
7. Following-up on reported findings at appropriate intervals. Internal audit departments
maintain a follow-up database for this purpose.
8. Audit assignment length varies based on the complexity of the activity being audited
and internal audit resources available. Many of the above steps are iterative and
may not all occur in the sequence indicated.
9. In addition to assessing business processes, specialists called information
technology (IT) auditors review information technology controls.

27
 CHAPTER THREE
INTERNATIONAL AUDITING AND ASSURANCE STANDARDS BOARD

3.1 Introduction
The International Auditing and Assurance Standards Board (IAASB) is an
independent standards body that issues standards, like the International Standards
on Auditing, quality control guidelines, and other services, to support the
international auditing of financial statements. It is a body supported by the
International Federation of Accountants (IFAC). The Public Interest Oversight Board
provides oversight of the IAASB, ensuring that the standards are in the public
interest.

To further ensure proposed standards are in the public interest the IAASB consults
its Consultative Advisory Group, which is composed of standard setters, various
international organizations from the private and public sectors, and regulators.
Representatives include a balance of users and prepares of financial statements,
and should to the extent practicable be balanced geographically.

Founded in March 1978 as the International Auditing Practices Committee (IAPC),

the IAASB's current strategic themes include:

1. Supporting global financial stability

2. Enhancing the role, relevancy and quality of assurance in an evolving world
3. Facilitating adoption and implementation of the standards it sets

3.2 Information technology audit

An information technology audit, or information systems audit, is an examination of
the management controls within an Information technology (IT) infrastructure and
business applications. The evaluation of evidence obtained determines if the
information systems are safeguarding assets, maintaining data integrity, and
operating effectively to achieve the organization's goals or objectives. These reviews
may be performed in conjunction with a financial statement audit, internal audit, or
other form of attestation engagement.

IT audits are also known as automated data processing audits (ADP audits) and
computer audits.

They were formerly called electronic data processing audits (EDP audits).

3.3 Purpose
An IT audit is different from a financial statement audit. While a financial audit's
purpose is to evaluate whether the financial statements present fairly, in all material
respects, an entity's financial position, results of operations, and cash flows in
conformity to standard accounting practices, the purposes of an IT audit is to
evaluate the system's internal control design and effectiveness. This includes, but is
not limited to, efficiency and security protocols, development processes, and IT
governance or oversight. Installing controls are necessary but not sufficient to
provide adequate security. People responsible for security must consider if the
controls are installed as intended, if they are effective, or if any breach in security
has occurred and if so, what actions can be done to prevent future breaches. These
28
 inquiries must be answered by independent and unbiased observers. These
observers are performing the task of information systems auditing. In an Information
Systems (IS) environment, an audit is an examination of information systems, their
inputs, outputs, and processing.

The primary functions of an IT audit are to evaluate the systems that are in place to
guard an organization's information. Specifically, information technology audits are
used to evaluate the organization's ability to protect its information assets and to
properly dispense information to authorized parties. The IT audit aims to evaluate
the following:

Will the organization's computer systems be available for the business at all times
when required? (Known as availability) Will the information in the systems be
disclosed only to authorized users? (Known as security and confidentiality) Will the
information provided by the system always be accurate, reliable, and timely?
(Measures the integrity) In this way, the audit hopes to assess the risk to the
company's valuable asset (its information) and establish methods of minimizing
those risks.

3.4 Types of IT Audits

Various authorities have created differing taxonomies to distinguish the various
types of IT audits. Goodman & Lawless state that there are three specific systematic
approaches to carry out an IT audit:

1. Technological innovation process audit: This audit constructs a risk profile for
existing and new projects. The audit will assess the length and depth of the
company's experience in its chosen technologies, as well as its presence in relevant
markets, the organization of each project, and the structure of the portion of the
industry that deals with this project or product, organization and industry structure.
2. Innovative comparison audit: This audit is an analysis of the innovative abilities of
the company being audited, in comparison to its competitors. This requires
examination of company's research and development facilities, as well as its track
record in actually producing new products.
3. Technological position audit: This audit reviews the technologies that the business
currently has and that it needs to add. Technologies are characterized as being
either "base", "key", "pacing" or "emerging".

Others describe the spectrum of IT audits with five categories of audits:

1. Systems and Applications: An audit to verify that systems and applications are
appropriate, are efficient, and are adequately controlled to ensure valid, reliable,
timely, and secure input, processing, and output at all levels of a system's activity.
System and process assurance audits form a subtype, focusing on business process
centric business IT systems. Such audits have the objective to assist financial
auditors.
2. Information Processing Facilities: An audit to verify that the processing facility is
controlled to ensure timely, accurate, and efficient processing of applications under
normal and potentially disruptive conditions.

29
3. Systems Development: An audit to verify that the systems under development meet
the objectives of the organization, and to ensure that the systems are developed in
accordance with generally accepted standards for systems development.
4. Management of IT and Enterprise Architecture: An audit to verify that IT
management has developed an organizational structure and procedures to ensure a
controlled and efficient environment for information processing.
5. Client/Server, Telecommunications, Intranets, and Extranets: An audit to verify that
telecommunications controls are in place on the client (computer receiving services),
server, and on the network connecting the clients and servers.
And some lump all IT audits as being one of only two type: "general control review"
audits or "application control review" audits.

A number of IT audit professionals from the Information Assurance realm consider

there to be three fundamental types of controls regardless of the type of audit to be
performed, especially in the IT realm. Many frameworks and standards try to break
controls into different disciplines or arenas, terming them ―Security Controls―,
‖Access Controls―, ―IA Controls‖ in an effort to define the types of controls
involved. At a more fundamental level, these controls can be shown to consist of
three types of fundamental controls: Protective/Preventative Controls, Detective
Controls and Reactive/Corrective Controls.

In an IS, there are two types of auditors and audits: internal and external. IS auditing
is usually a part of accounting internal auditing, and is frequently performed by
corporate internal auditors. An external auditor reviews the findings of the internal
audit as well as the inputs, processing and outputs of information systems. The
external audit of information systems is primarily conducted by certified Information
System auditors, such as CISA, certified by ISACA, Information System Audit and
Control Association, USA, Information System Auditor (ISA) certified by ICAI
(Institute of Chartered Accountants of India), and other certified by reputed
organization for IS audit.
Frequently a part of the overall external auditing performed by a Certified Public
Accountant (CPA) firm. IS auditing considering all the potential hazards and controls
in information systems. It focuses on issues like operations, data, integrity, software
applications, security, privacy, budgets and expenditures, cost control, and
productivity. Guidelines are available to assist auditors in their jobs, such as those
from Information Systems Audit and Control Association.

3.5 IT Audit Process

The following are basic steps in performing the Information Technology Audit
Process:
1. Planning
2. Studying and Evaluating Controls
3. Testing and Evaluating Controls
4. Reporting 5. Follow-up
6. Information security

3.6 Information Security Audit

Auditing information security is a vital part of any IT audit and is often understood to
be the primary purpose of an IT Audit. The broad scope of auditing information
security includes such topics as data centers (the physical security of data centers
30
 and the logical security of databases, servers and network infrastructure
components), networks and application security. Like most technical realms, these
topics are always evolving; IT auditors must constantly continue to expand their
knowledge and understanding of the systems and environment& pursuit in System
Company.

3.7 History of IT Auditing

The concept of IT auditing was formed in the mid-1960s. Since that time, IT auditing
has gone through numerous changes, largely due to advances in technology and the
incorporation of technology into business.

Currently, there are many IT-dependent companies that rely on information

technology in order to operate their business e.g. Telecommunication or Banking
company. For the other types of business, IT plays the big part of company including
the applying of workflow instead of using the paper request form, using the
application control instead of manual control which is more reliable or implementing
the ERP application to facilitate the organization by using only 1 application.
According to these, the importance of IT Audit is constantly increased. One of the
most important roles of the IT audit is to audit over the critical system in order to
support the financial audit or to support the specific regulations announced e.g.
SOX.

3.8.1 Principles of an IT Audit

The following principles of an audit should find a reflection:
1. Timeliness: Only when the processes and programming is continuously inspected in
regard to their potential susceptibility to faults and weaknesses, but as well with
regard to the continuation of the analysis of the found strengths, or by comparative
functional analysis with similar applications an updated frame can be continued.

2. Source openness: It requires an explicit reference in the audit of encrypted

programs, how the handling of open source has to be understood. E.g. programs,
offering an open source application, but not considering the IM server as open
source, have to be regarded as critical. An auditor should take an own position to the
paradigm of the need of the open source nature within cryptologic applications.

3. Elaborateness: Audit processes should be oriented to certain minimum standard.

The recent audit processes of encrypting software often vary greatly in quality, in the
scope and effectiveness and also experience in the media reception often differing
perceptions. Because of the need of special knowledge on the one hand and to be
able to read programming code and then on the other hand to also have knowledge
of encryption procedures, many users even trust the shortest statements of formal
confirmation. Individual commitment as an auditor, e.g. for quality, scale and
effectiveness, is thus to be assessed reflexively for yourself and to be documented
within the audit.

Five Principles of a Crypto-IT-Audit

1. The financial context: Further transparency is needed to clarify whether the software
has been developed commercially and whether the audit was funded commercially
(paid Audit). It makes a difference whether it is a private hobby / community project
or whether a commercial company is behind it.
31
2. Scientific referencing of learning perspectives: Each audit should describe the
findings in detail within the context and also highlight progress and development
needs constructively. An auditor is not the parent of the program, but at least he or
she is in a role of a mentor, if the auditor is regarded as part of a PDCA learning
circle (PDCA = Plan-Do-Check-Act). There should be next to the description of the
detected vulnerabilities also a description of the innovative opportunities and the
development of the potentials.

3. Literature-inclusion: A reader should not rely solely on the results of one review, but
also judge according to a loop of a management system (e.g. PDCA, see above), to
ensure, that the development team or the reviewer was and is prepared to carry out
further analysis, and also in the development and review process is open to
learning‗s and to consider notes of others. A list of references should be
accompanied in each case of an audit.

4. Inclusion of user manuals & documentation: Further a check should be done,

whether there are manuals and technical documentations, and, if these are
expanded.

5. Identify references to innovations: Applications that allow both, messaging to offline

and online contacts, so considering chat and e-mail in one application - as it is also
the case with Gold Bug - should be tested with high priority (criterion of presence
chats in addition to the e-mail function). The auditor should also highlight the
references to innovations and underpin further research and development needs.

This list of audit principles for crypto applications describes - beyond the methods of
technical analysis - particularly core values, that should be taken into account.

3.8.2 Emerging Issues

There are also new audits being imposed by various standard boards which are
required to be performed, depending upon the audited organization, which will affect
IT and ensure that IT departments are performing certain functions and controls
appropriately to be considered compliant. Examples of such audits are SSAE 16,
ISAE 3402, and ISO27001:2013.

3.8.3 Web Presence audits

The extension of the corporate IT presence beyond the corporate firewall (e.g. the
adoption of social media by the enterprise along with the proliferation of cloud-based
tools like social media management systems) has elevated the importance of
incorporating web presence audits into the IT/IS audit. The purposes of these audits
include ensuring the company is taking the necessary steps to:

1. Rein in use of unauthorized tools (e.g. "shadow IT")

2. Minimize damage to reputation
3. Maintain regulatory compliance
4. Prevent information leakage
5. Mitigate third-party risk
6. Minimize governance risk

32
 The use of departmental or user developed tools has been a controversial topic in
the past. However, with the widespread availability of data analytics tools,
dashboards, and statistical packages users no longer need to stand in line waiting
for IT resources to fulfill seemingly endless requests for reports. The task of IT is to
work with business groups to make authorized access and reporting as
straightforward as possible. To use a simple example, users should not have to do
their own data matching so that pure relational tables are linked in a meaningful way.

IT needs to make nonnormalized, data warehouse type files available to users so

that their analysis work is simplified. For example, some organizations will refresh a
warehouse periodically and create easy to use "flat' tables which can be easily
uploaded by a package such as Tableau and used to create dashboards.

3.8.4 Enterprise Communications Audits

The rise of VOIP networks and issues like BYOD and the increasing capabilities of
modern enterprise telephony systems causes increased risk of critical telephony
infrastructure being misconfigured, leaving the enterprise open to the possibility of
communications fraud or reduced system stability. Banks, financial institutions, and
contact centers typically set up policies to be enforced across their communications
systems. The task of auditing that the communications systems are in compliance
with the policy falls on specialized telecom auditors. These audits ensure that the
company's communication systems:
1. Adhere to stated policy
2. Follow policies designed to minimize the risk of hacking or phreaking
3. Maintain regulatory compliance
4. Prevent or minimize toll fraud
5. Mitigate third-party risk
6. Minimize governance risk

Enterprise communications audits are also called voice audits, but the term is
increasingly deprecated as communications infrastructure increasingly becomes
data oriented and data-dependent. The term "telephony audit" is also deprecated
because modern communications infrastructure, especially when dealing with
customers, is omni-channel, where interaction takes place across multiple channels,
not just over the telephone. One of the key issues that plagues enterprise
communication audits is the lack of industry-defined or government-approved
standards.

IT audits are built on the basis of adherence to standards and policies published by
organizations such as NIST and PCI, but the absence of such standards for
enterprise communications audits means that these audits have to be based an
organization's internal standards and policies, rather than industry standards. As a
result, enterprise communications audits are still manually done, with random
sampling checks. Policy Audit Automation tools for enterprise communications have
only recently become available.

33
 CHAPTER FOUR
COMPUTER-AIDED AUDIT TOOLS
4.1 Introduction
Computer-assisted audit tool (CAATs) or computer-assisted audit tools and
techniques (CAATs) is a growing field within the IT audit profession. CAATs is the
practice of using computers to automate the IT audit processes. CAATs normally
includes using basic office productivity software such as spreadsheet, word
processors and text editing programs and more advanced software packages
involving use statistical analysis and business intelligence tools. But also more
dedicated specialized software are available.
CAATs have become synonymous with data analytics in the audit process.
4.2.1 Traditional Auditing vs CAATs
Traditional audit example
The traditional method of auditing allows auditors to build conclusions based upon a
limited sample of a population, rather than an examination of all available or a large
sample of data.
4.2.2 CAATTs Alternative
CAATTs, not CAATs, addresses these problems. CAATTs, as it is commonly used,
is the practice of analyzing large volumes of data looking for anomalies. A well
designed CAATTs audit will not be a sample, but rather a complete review of all
transactions. Using CAATTs the auditor will extract every transaction the business
unit performed during the period reviewed. The auditor will then test that data to
determine if there are any problems in the data.

4.2.3 Traditional audit vs CAATTs on specific risks

Another advantage of CAATTs is that it allows auditors to test for specific risks. For
example, an insurance company may want to ensure that it doesn't pay any claims
after a policy is terminated. Using traditional audit techniques this risk would be very
difficult to test. The auditor would "randomly select" a "statistically valid" sample of
claims (usually e if any of those claims were processed after a policy was
terminated. Since the insurance company might process millions of claims the odds
that any of those 30–50 "randomly selected" claims occurred after the policy was
terminated is extremely unlikely.
Using CAATTs the auditor can select every claim that had a date of service after the
policy termination date. The auditor then can determine if any claims were
inappropriately paid. If they were, the auditor can then figure out why the controls to
prevent this failed. In a real life audit, the CAATTs auditor noted that a number of
claims had been paid after policies were terminated. Using CAATTs the auditor was
able to identify every claim that was paid and the exact dollar amount incorrectly
paid by the insurance company. Furthermore, the auditor was able to identify the
reason why these claims were paid. The reason why they were paid was because
the participant paid their premium. The insurance company, having received a
payment, paid the claims. Then after paying the claim the participant's check
bounced. When the check bounced, the participant's policy was retrospectively
terminated, but the claim was still paid costing the company hundreds of thousands
of dollars per year.

34
 However, the CAATTs driven review is limited only to the data saved on files in
accordance with a systematic pattern. Much data is never documented this way. In
addition saved data often contains deficiencies, is poorly classified, is not easy to
get, and it might be hard to become convinced about its integrity. So, for the present
CAATTs is complement to an auditor's tools and techniques. In certain audits
CAATTs can't be used at all. But there are also audits which simply can't be made
with due care and efficiently without CAATTs.

4.3.1 Specialized Software

In the most general terms, CAATTs can refer to any computer program utilized to
improve the audit process. Generally, however, it is used to refer to any data
extraction and analysis software. This would include programs such as data analysis
and extraction tools, spreadsheets (e.g. Excel), databases (e.g. Access), statistical
analysis (e.g. SAS), generalized audit software (e.g. ACL, Arbutus, EAS), business
intelligence (e.g. Crystal Reports and Business Objects), etc.

4.3.2 Benefits of Audit Software include

They are independent of the system being audited and will use a read-only copy of
the file to avoid any corruption of an organization‗s data.
Many audit-specific routines are used such as sampling.
Provides documentation of each test performed in the software that can be used as
documentation in the auditor‗s work papers.
Audit specialized software may perform the following functions:
1. Data queries
2. Data stratification
3. Sample extractions
4. Missing sequence identification
5. Statistical analysis
6. Calculations
7. Duplicate transaction identification
8. Pivot table creation
9. Cross tabulation.

4.4 CAATs Education and Professional Development

CAATs is the fundamental tool which is used by the auditors. This tool facilitates
them to make search from the irregularities from the given data. With the help of this
tool, the auditors and accountant of any firm will be able to provide more analytical
results. These tools are used throughout every business environment and also in the
industry sectors too. With the help of computer-assisted audit techniques, more
forensic accounting with more analysis can be done. It‗s really a helpful tool that
helps the firm auditor to work in an efficient and productive manner. Working with the
CAATs, it is essential for the accountant or the auditor to select the right data, the
selection process is very much tricky, and you need to be professional for it. After
selecting the right data, import that to the CAATs, now the tool will automatically
generate the analytical data. This tool really contributes to the efficiency of the
auditors. The fundamental course outline includes:
1. Computer Auditing Overview
2. Legal and Ethical Issues for Computer Auditors
3. Understanding CAATs
4. Computer Auditing Project Planning
35
5. Data Access Skill and Knowledge
6. Data Verify Skill and Knowledge
7. Data Analysis Skill and Knowledge
8. Audit Finding Report Skill and Knowledge

4.5 Creation of Electronic Work Papers

Keeping electronic work papers on a centralized audit file or database will allow the
auditor to navigate through current and archived working papers with ease. The
database will make it easier for auditors to coordinate current audits and ensure they
consider findings from prior or related projects. Additionally, the auditor will be able
to electronically standardize audit forms and formats, which can improve both the
quality and consistency of the audit working papers.

4.6 Fraud Detection

CAATs provides auditors with tools that can identify unexpected or unexplained
patterns in data that may indicate fraud. Whether the CAATs is simple or complex,
data analysis provides many benefits in the prevention and detection of fraud.

CAATs can assist the auditor in detecting fraud by performing and creating the
following:
1. Analytical Tests
Evaluations of financial information made by studying plausible relationships among
both financial and non-financial data to assess whether account balances appear
reasonable (AU 329). Examples include ratio, trend, and Benford's Law tests.
2. Data Analysis Reports
Reports produced using specific audit commands such as filtering records and
joining data files.
3. Continuous monitoring
Continuous monitoring is an ongoing process for acquiring, analyzing, and reporting
on business data to identify and respond to operational business risks. For auditors
to ensure a comprehensive approach to acquire, analyze, and report on business
data, they must make certain the organization continuously monitors user activity on
all computer systems, business transactions and processes, and application
controls.
4. Curb Stoning in Surveys
Curb stoning is the term for instances where a surveyor completes a survey form by
making up data. Because some of the data should conform with Benford's law, this
practice can be detected using CAATTs which provide the capability of performing
such tests
4.7 Acronyms CAATTs vs CAAT
CAATTs and CAATs are used interchangeably. While CAATs has emerged as the
more common spelling, CAATTs is the more precise acronym. The acronym
CAATTs solves one of the two problems with defining the acronym. CAATs means:
Computer Aided (or Assisted) Audit Techniques (or Tools and Techniques)
The first "A" and the "T" can have two different meanings depending on who uses
the term. By using the term CAATTs, one is clearly incorporating both "Tools" and
"Techniques."

36
 CHAPTER FIVE
CHANGE MANAGEMENT AUDITING
5.1 Introduction
Proper change control auditing can lower the following risks:
1. Security features of the network turn off.
2. Harmful code is distributed to users.
3. Sensitive data is lost or becomes insecure.
4. Financial report errors occur.
5. Control procedure.

The following features are commonly part of a change management auditing

procedure:
1. Change management procedures are formally documented and controlled.
2. Changes are requested in a formal process.
3. Requests are recorded and stored for reference.
4. The effect of the requested change is assessed.
5. Each change is assessed based on its projected effect to the computer system and
business operations. The assessment is documented with the request.
6. Priority is based on urgency, potential benefits, and the ease with which changes
can be corrected.
7. Controls are imposed on changes.
8. Changes are limited by automated or manual controls. In particular, unauthorized
changes are periodically searched for.
9. An emergency change process is in place.
10. Policies clearly define emergency changes. Generally, these are errors that
significantly impair system function and business operations, increase the system's
vulnerability, or both. Emergency changes override some, but not all, controls. For
instance, a proposed change might be documented, but not permitted without
authorization.
11. Change documentation is periodically updated.
12. Maintenance tasks and changes are recorded.
13. Controls are applied to new software releases.
14. For security, new software releases often require controls such as backups, version
control, and a secure implementation.
15. Software distribution is assessed for compliance.
16. Software distribution is assessed for compliance with license agreements.
Noncompliance can have disastrous financial and legal results.
17. Changes are submitted for approval.
18. Proposed changes are submitted for approval after auditors have reviewed the
required resources, other changes, the effect, urgency, and the system's stability.
19. Duties are separated
20. Responsibility for creation, approval, and application are assigned to different
personnel to avoid undesired changes.
21. Changes are reviewed.
22. Changes are monitored to assess the efficacy of change management policies.

5.2 Operational Auditing

5.2.1 Objectives
1. To appraise the effectiveness and efficiency of a division, activity, or operation of the
entity in meeting organizational goals.
37
2. To understand the responsibilities and risks faced by an organization.
3. To identify, with management participation, opportunities for improving control.
4. To provide senior management of the organization with a detailed understanding of
the result
5. Steps of operational audit Generally Operational Audit involves following five steps;

5.22 Preliminary preparation

1. Field Survey
2. Audit Programme Development
3. Audit Execution
4. Reporting and Follow-up

5.2.3 Advantages
1. In addition to making the business more efficient and profitable in the long run.
2. An operational audit almost always provides a company with some new, fresh
perspectives.
3. It makes executives aware of problems that might not have been found otherwise
and lets them evaluate risks for the future.
4. Managers also can use results to motivate employees, as the company always has
something to work toward at the end of the process.

5.2.4 Disadvantages
1. Reviewing operational processes can be very time consuming and costly.
2. When employees and managers are working with the auditor, they can't do other
activities that might benefit the business, so projects or production might slow
temporarily.
3. Sometimes, the changes that a business makes are hard for workers to get used to,
which can increase conflicts or confusion.
4. Operational audit is a systematic review of effectiveness, efficiency and economy of
operation. Operational audit is a future-oriented, systematic, and independent
evaluation of organizational activities.

In Operational audit financial data may be used, but the primary sources of evidence
are the operational policies and achievements related to organizational objectives.
Operational audit is a more comprehensive form of an internal audit.

5.3 Risk-Based Internal Audit

Risk-based internal audit (RBIA) is an internal methodology which is primarily
focused on the inherent risk involved in the activities or system and provides
assurance that risk is being managed by the management within the defined risk
appetite level. It is the risk management framework of the management and seeks at
every stage to reinforce the responsibility of management and BOD (Board of
Directors) for managing risk.
Risk based internal audit is conducted by internal audit department to help the risk
management function of the company by providing assurance about the risk
mitigation. RBIA allows internal audit to provide assurance to the board that risk
management processes are managing risks effectively, in relation to the risk
appetite.

38
5.4 Risk Capacity
Is the maximum amount of risk that an entity can bear which is linked to capital,
liquid assets, borrowing capacity etc. and maximum amount of bearable risk by an
entity.

5.5 Risk Appetite

It is the amount of risk that an entity (on broad level) willing to accept within its
overall Capacity. It provides the threshold of acceptable risk and determining the risk
appetite is continuous process, it can't be set once and leave. Risk appetite is
developed on the basis of risk level of company like risk Hunger Company may
develop high risk appetite while risk averse company may develop low risk appetite
level.

5.5.1 Risk
Risk is the potential of losing something of value, weighed against the potential to
gain something of value. Risk hinders the achievement of objective and it has two
attributes. Likelihood: Probability of Risk Event (P)

Consequences: Impact of Risk Event (I) In Risk based internal auditing two types of
risks are considered.

5.5.2 Inherent Risk

Risk that existed in the absence of any action or control or modification of an event

5.5.3 Residual Risk

Risk that remains after controls are implemented or we can say residual of inherent
risk

5.5.4 Risk Register

It is a log that contains all of the information related to the risk management
activities. It includes following details related to risk management activities.
It contains:
1. Risks
2. Potential response
3. Root cause of risks
4. Risk categories and ranking

5.5.5 Risk Assessment

Allows an entity to understand the possibility and impact of risk event. Use two
prospective:

1. Likelihood: Probability of risk event (P)

2. Consequences: Impact of risk event (I)

39
 CHAPTER SIX
MAINTAINING A SOUND SYSTEM OF INTERNAL CONTROL
6.1 Responsibility for the system of internal control
The Board is ultimately responsible for the system of internal control. Boards will
normally delegate to management the task of establishing, operating and monitoring
the system, but they cannot delegate their responsibility for it.

The Board should set appropriate policies on internal control and regularly assure
itself that appropriate processes are functioning effectively to monitor the risks to
which the company is exposed and that the system of internal control is effective in
reducing those risks to an acceptable level. It is essential that the right tone is set at
the top of the company - the Board should send out a clear message that control
responsibilities must be taken seriously.

In determining its policies with regard to internal control, and thereby assessing what
constitutes a sound system of internal control in the particular circumstances of the
company, the Board‘s deliberations should include consideration of the following
factors:
■ The nature and extent of the risks facing the company;
■ The extent and categories of risk which it regards as acceptable for the company to
bear;
■ The likelihood of the risks concerned materializing;
■ The company‘s ability to reduce the incidence and impact on the business of risks
that do materialize; and
■ The costs of operating particular controls relative to the benefit thereby obtained in
managing the related risks

The Board, however, does not have sole responsibility for a company‘s system of
internal control. Ultimately responsibility for the internal control system rests with the
Board, but all employees have some accountability towards implementing the
Board‘s policies on risk and control. This reflects the ‗topdown, bottom-up‘ nature of
a sound system of internal control.

While the ‗tone at the top‘ is set by the Board, it is the role of management to
implement the policies adopted by the Board. In fulfilling its responsibilities,
management should identify and evaluate the risks faced by the group - for
consideration by the Board - and design, operate and monitor an appropriate system
of internal control.

The operation and monitoring of the system of internal control should be undertaken
by individuals who collectively possess the necessary skills, technical knowledge,
objectivity, and understanding of the company and the industries and markets in
which it operates.

6.2 The system of internal control

An internal control system encompasses the policies, processes, tasks, behaviours
and other aspects of a company that, taken together:
■ Facilitate its effective and efficient operation by enabling it to respond appropriately
to significant business, operational, financial, compliance and other risks to

40
 achieving the company‘s objectives This includes the safeguarding of assets from
inappropriate use or from loss and fraud, and ensuring that liabilities are identified
and managed;
■ Help ensure the quality of internal and external reporting. This requires the
maintenance of proper records and processes that generate a flow of timely,
relevant and reliable information from within and outside the organization;
■ Help ensure compliance with applicable laws and regulations, and also internal
policies with respect to the conduct of business.

A company‘s system of internal control commonly comprises:

■ Control environment; The control environment sets the tone of an organisation,
influencing the control consciousness of its people. It is the foundation for all other
components of internal control, providing discipline and structure. Control
environment factors include the integrity, ethical values and competence of the
entity‘s people; management‘s philosophy and operating style; the way management
assigns authority and responsibility, and organises and develops its people; and the
attention and direction provided by the Board of directors.

■ Identification and evaluation of risks and control objectives; Every entity faces a
variety of risks from external and internal sources that must be assessed. A
precondition to risk assessment is establishment of objectives, linked at different
levels and internally consistent. Risk assessment is the identification and analysis of
relevant risks to achievement of objectives, forming a basis for determining how the
risks should be managed.

Because economic, industry, regulatory and operating conditions will continue to

change, mechanisms are needed to identify and deal with the special risks
associated with change

■ Control activities; Control activities are the policies and procedures that help ensure
that management directives are carried out. They help ensure that necessary
actions are taken to address risks to achievement of the entity‘s objectives. Control
activities occur throughout the organisation, at all levels and in all functions. They
include a range of activities as diverse as approvals, authorisations, verifications,
reconciliations, reviews of operating performance, security of assets and segregation
of duties
■ Information and communication processes; and Pertinent information must be
identified, captured and communicated in a form and timeframe that enables people
to carry out their responsibilities. Information systems produce reports, containing
operational, financial and compliance-related information, that make it possible to
run and control the business. They deal not only with internally generated data, but
also information about external events, activities and conditions necessary to
informed business decision-making and external reporting Effective communication
must also occur in a broader sense, flowing down, across and up the organisation.
All personnel must receive a clear message from top management that control
responsibilities must be taken seriously. They must understand their own role in the
internal control system, as well as how individual activities relate to the work of
others. They must have a means of communicating significant information upstream.

41
 There also needs to be effective communication with external parties, such as
customers, suppliers, regulators and shareholders
■ Processes for monitoring the effectiveness of the system of internal control. Internal
control systems need to be monitored - a process that assesses the quality of the
system‘s performance over time. This is accomplished through ongoing monitoring
activities, separate evaluations or a combination of the two. On going monitoring
occurs in the course of operations. It includes regular management and supervisory
activities, and other actions personnel take in performing their duties. The scope and
frequency of separate evaluations will depend primarily on an assessment of risks
and the effectiveness of ongoing monitoring procedures. Internal control deficiencies
should be reported upstream, with serious matters reported to top management and
the Board

6.3 Understanding the nature and context of control

The following concepts are important in understanding the nature and context of
control.
■ Control should be capable of responding quickly to evolving risks to the business
arising from factors within the company and to changes in the business environment.
Risks include not only those related to the achievement of a specific objective but
also those fundamental to the viability and success of the company such as failure to
maintain the company‘s resilience or capacity to identify and exploit opportunities.
Resilience refers to the company‘s capacity to respond and adapt to unexpected
risks and opportunities, and to make decisions on the basis of telltale indicators in
the absence of definitive information. Control needs to be ‗close‘ to the associated
risks - the shorter the chain, the quicker the reaction

Illustration 1
Getting the control as close to the risk as possible
A ship‘s captain is given absolute responsibility for their vessel whilst it is at sea, so
they can take appropriate and timely action to remedy any problems that may arise
during the course of the voyage.
■ The costs of control must be balanced against the benefits, including the risks it is
designed to manage.
Design decisions involve the acceptance of some degree of risk. The cost of control
must always be balanced against the benefit of controlling the risk. It is possible to
reach a position where the incremental cost of additional control is greater than the
benefit derived from controlling the risk.

Illustration 2 –
Improving performance can mean greater tolerance of risk
When Sony were designing the Walkman which required a significant advance in
manufacturing technology, the CEO stated that in order to achieve the 50%
reduction in the size of cassette player components, he would be willing to accept a
higher level of failure in research and development projects and he had to visibly
demonstrate this acceptance.
■ The system of control must include procedures for reporting immediately to
appropriate levels of management any significant control failings or weaknesses that
are identified together with details of corrective action being undertaken,
42
 It should not be assumed, without making appropriate enquiries, that breakdowns in
internal control are isolated occurrences. The key is continual learning rather than
attribution of blame. This philosophy should come down from the top of the
company. A blame culture encourages the concealment of breakdowns in control

Often major disasters are the result of the accumulation of a number of smaller,
seemingly insignificant events, which if analysed collectively would provide the
necessary warnings to enable preventative action.
■ Control can help minimize the occurrence of errors and breakdowns but cannot
provide absolute assurance that they will not occur.
Human fallibility and the risk of unforeseeable occurrences are inherent limitations in
any system of internal control. A control system cannot be designed to provide
protection with certainty against: a company failing to meet its business objectives;
or all material errors, losses, frauds or breaches of laws or regulations.

■ The system of control should be embedded in the operations of the company and
form part of its culture.
Control is effected by people throughout the company, including the Board of
directors, management and all other staff. People who are accountable, as
individuals or teams, for achieving objectives should also be accountable for the
effectiveness of control that supports the achievement of those objectives. It is
important that criteria are in place by which the effectiveness of the system of control
can be judged. By making individuals accountable, the likelihood that controls are
operated properly is increased.
Illustration 3 –
Getting the right management behaviour at the coal face
A photocopy salesman was offered a significant bonus for achieving demanding
annual sales targets. The copiers were normally sold on a standard three-year hire
purchase contract. The salesman could not influence the contract but he was in a
position to provide the purchaser with extended warranty cover beyond the contract
term. This gave him an advantage over and above his competitors and enabled him
to consistently meet his sales targets. The company was unaware that anything was
wrong until year four when significant warranty claims began to be received on
machinery which was no longer generating an income. In this case the individual
had replaced the corporate risk profile with his own individual risk profile - a
behaviour which should have been known to be unacceptable,

6.4 The importance of internal control and risk management

It is important that risk management and control are not seen as a burden on
business, rather the means by which business opportunities are maximised and
potential losses associated with unwanted events reduced.

Risk, derived from the early Italian risicare or to dare, is an ever present aspect of
the business world. Companies set themselves strategic and business objectives,
then manage risks that threaten the achievement of those objectives. Internal control
and risk management should supplement entrepreneurship, but not replace it.
Increased shareholder value is the reward for successful risk taking and the role of
internal control is to manage risk appropriately rather than to eliminate it.

43
 Risks manifest themselves in a range of ways and the effect of risks crystallizing
may have a positive as well as a negative outcome for the company. It is vital that
those responsible for the stewardship and management of a company be aware of
the best methods for identifying, and subsequently managing such risks.

Risk can be defined as real or potential events which reduce the likelihood of
achieving business objectives. Or, put another way, uncertainty as to the benefits.
The term includes both the potential for gain and exposure to loss.
Internal control is one of the principal means by which risk is managed. Other
devices used to manage risk include the transfer of risk to third parties, sharing risks,
contingency planning and the withdrawal from unacceptably risky activities. Of
course, as discussed above, companies can accept risk too. Getting the balance
right is the essence of successful business - to knowingly take risk, rather than be
unwittingly exposed to it.

The business objective of a nineteenth century coal miner was to maximise coal
output. More tonnage meant more money. Unfortunately, there was always the
danger that the mine workings would collapse, delaying output and injuring, if not
killing, the collier. This is the risk which threatened the achievement of the miner‘s
objective. Fortunately, the miner could use pit props to control or manage the risk of
collapse.

For our miner, the secret of successful risk management was to maximise his time at
the coal face by utilizing the right number of controls. Too many props (over-
controlled) would leave little time to dig coal. Too few props (under controlled) would
result in disaster

In the modern business world, corporate objectives and the environment in which
companies operate are constantly evolving. As a result, the risks facing companies
are continually changing too. A successful system of internal control must therefore
be responsive to such changes - enabling adaptation quicker than its competitors.
Effective risk management and internal control is therefore reliant on a regular
evaluation of the nature and extent of risks. Compliance with the spirit of the Turnbull
guidance, rather than treating it as an additional layer of bureaucracy, will go a long
way to realising the benefits of effective risk management and internal control.

The advantages of embracing Turnbull may include:

■ Exploitation of business opportunities earlier
■ Increased likelihood of achieving business objectives
■ Increased market capitalization
■ More effective use of management time
■ Lower cost of capital
■ Fewer unforecast threats to the business
■ More effective management of change
■ Clearer strategy setting

In summary, successful risk management - as envisaged in Turnbull‘s guidance - is the

process that achieves the most efficient combination of controls necessary to
provide reasonable assurance that business objectives can be achieved reliably.

44
 CHAPTER SEVEN
REVIEWING THE EFFECTIVENESS OF INTERNAL CONTROL
7.1 Responsibility for reviewing the effectiveness of internal control
The responsibilities of both directors and management are well defined in the
guidance. Reviewing the effectiveness of internal control is an essential part of the
Board‘s responsibilities while management is accountable to the Board for
developing, operating and monitoring the system of internal control and for providing
assurance to the Board that it has done so.

Aspects of the review work may be delegated to the Audit Committee, and other
appropriate committees such as a Risk Committee or Health and Safety Committee.
These committees may be sub-committees of the Board, alternatively they may
include representatives from throughout the company eg, a Risk Committee may
include representatives from management, internal audit and other assurance
functions. The Board as a whole, however, should form its own view on the
adequacy of the review after due and careful enquiry

In order to properly assess the adequacy of the review with a view to approving the
directors‘ statement on the company‘s system of internal control, the Board will need
to establish:
■ The terms of reference of the Audit Committee, or other relevant committees, and
their ability to contribute to such a review;
■ How key business risks are identified, evaluated and managed;
■ The rigor and comprehensiveness of the review process;
■ What evidence the Board has gathered to support the statement; and
■ Whether the entire Board can satisfy itself that the proposed statement is factually
correct.
The Board‘s knowledge must be detailed enough to allow it to concur with what is
said in the proposed statement on internal control in the annual report and accounts
The role of the Audit Committee, or other relevant committees, in the review process
is for the Board to decide and will depend upon factors such as the size, style and
composition of the Board and the nature of the company‘s principal risks.
The Audit Committee will normally consider financial controls; however, the Board
may also request that the committee be used to provide a single focal point for some
or all of the wider review of internal control and the proposed statement for inclusion
in the annual report prior to approval by the Board. In this event, it may be necessary
for the Audit Committee to draw together the results of the work of the Risk
Committee and/or other Board committees in reviewing specific risks (e.g. safety
and environmental issues).

The Audit Committee‘s role is, however, a non-executive one. In enquiring into these
matters it is not seeking to take on an executive function that properly belongs to
management. Instead, its aim is to satisfy itself that management has properly
fulfilled its responsibilities.

45
7.2 The process for reviewing effectiveness
Put simply, a company‘s system of internal control has as its principal aim the
management of risks that threaten the achievement of its business objectives.
Therefore, in order to have effective internal control a company needs to:

■ Identify its business objectives;

■ Identify and assess the risks which threaten the achievement of those objectives;

■ Design internal controls to manage those risks;

■ Operate the internal controls in accordance with their design specification; and

■ Monitor the controls to ensure they are operating correctly. Turnbull and the
Combined Code add the final two links in the chain:

■ Directors‘ should review the effectiveness of the system of internal control; and

■ Report to shareholders that they have done so.

This suggests a defined process for the Board‘s review of the effectiveness of
internal control - a process starting with the identification of the business objectives
and the identification and assessment of the related risks that would prevent the
company achieving those objectives. By expressly identifying business objectives,
the likelihood of overlooking key business risks will be reduced. It should be
remembered that key risks include not only those that threaten the survival of the
group, or could seriously weaken it, but also the risk of failing to identify significant
opportunities.

7.3 Business objectives

The Board should identify all of the strategic business objectives which are key to
the success of the company. By making these explicit the likelihood of overlooking
key business risks which threaten the survival of the company or could lead to a
significant impact on its performance or reputation will be reduced

Linking the identification of key business risks to the company‘s strategic business
objectives may already be part of the normal financial calendar supporting the
strategic planning and budgeting process. It will be important to ensure this process
is sufficiently balanced in its appraisal of the financial and non-financial risks

7.4 Risk identification and assessment

The Board should formally identify the major business risks (or review the process
by which they have been identified and formally endorse the conclusions) and be
able to demonstrate that it is aware of the significant risks facing the business.
Significant risks include those that threaten the survival of the group, or could
seriously weaken it, along with the risk of failing to identify significant opportunities.

There are many techniques available for identifying risk. Some are detailbased and
offer quantification, others are scenario-based or qualitative. The process can either
be facilitated by specialists or carried out by questionnaire or a combination of both.
46
 Techniques for identifying risks include:
PEST analysis
A high-level technique to understand the external environment affecting the industry
and some of the specific external factors that may affect the business. It considers
Political, Economic, Social and Technological factors and the risks to the business
that flow from these.
Five Forces analysis
This technique considers all the forces that influence the company, its industry and
its market place. It helps to analyze why a business is successful or not. The five
forces are the threat of new entrants, threat of substitute products or services, the
bargaining power of suppliers and buyers, the competitors and the intensity of rivalry
in the industry.
SWOT analysis
SWOT is an acronym for Strengths, Weaknesses, Opportunities and Threats to the
business.

Facilitated methods (eg, brain storming) have the advantage of drawing upon those
experienced in risk assessment, whilst maximising the input of management who
should know the business best.

Turning to risk assessment, it is important that management consider the underlying

gross risks, which are the risks faced by the business before any form of control, not
merely the risks which are currently exposed after existing controls. This will enable
the company to evaluate potentially critical controls and any significant under/over
control.

For each identified risk a value judgement must be made on the impact, both
financial and reputational, that its crystallisation would have on the business and the
likelihood of the risk occurring.

It is particularly important to consider the reputational impact as well as financial

impact as the consequence of a risk crystallising may go beyond the initial financial
impact. The effect on a company‘s reputation may over the medium term have a far
greater cost than the perceived initial financial impact.

Regardless of the technique chosen, directors should:

■ use a well defined analysis format;
■ Assess both the probability of the risk occurring and its likely impact;
■ apply causation analysis to identify the root cause of risk; and
■ be aware that risks can have single or multiple causes and single or multiple
impacts. These interdependencies can be critical in identifying the real impact of
risks, and hence the cost benefit analysis applied to their mitigation.

Once these steps have been performed it may be appropriate to apply more
sophisticated measurement techniques to certain risk scenarios to establish the
expected effect.

Armed with this prioritisation of the risks facing the business, informed choices as to
the most appropriate means to mitigate loss to an acceptable level can be made.
47
 An effective risk assessment process addresses both financial risks (such as credit,
market and liquidity risk) and non-financial risks (such as operational, legal and
environmental risk). Furthermore, the process should include an evaluation of the
risks to determine which are controllable by the company and which are not.

For those risks that are controllable, the company must decide whether to accept
those risks or whether to mitigate the risk through control procedures. For those
risks that cannot be controlled, the Board must decide whether to accept the risks or
to withdraw from, or reduce the level of business activity concerned. Contingency
plans should be considered where the Board elects to accept uncontrollable
significant risks.

7.5 Identification of appropriate controls

The Board should identify controls appropriate to maintain the key business risks
within the defined risk tolerance levels set by the Board, bearing cost/benefit
considerations in mind - or review the process by which this is done and endorse the
conclusions. The Board should also be satisfied that suitable individuals have a clear
responsibility for maintaining a dynamic risk identification and assessment process
and related internal controls.

The Board may not know the fine detail of how all risks that could lead to a material
loss are controlled but should be satisfied that proper control policies, procedures
and activities have been established to support their control objectives. The design
of controls should be based on generally accepted control criteria which have been
approved by the Board for this purpose and include both preventative and detective
controls.

7.6 Monitoring of controls

The Board should establish procedures to ensure that monitoring the
appropriateness and effectiveness of the identified controls is embedded within the
normal operations of the company. This may require cultural changes.

Although monitoring controls is part of the overall system it is largely independent of

the elements it is checking. Examples of monitoring procedures include:

■ Control self-assessment reviewed and tested (at least to a limited extent) by head
office/internal audit; Control and risk self-assessment by local operational
management is a popular option but needs to be carefully managed. Management
already have an implicit responsibility for the design and operation of the system of
internal controls within their businesses and self-certification is a means of
formalising this responsibility. The approach can range from the use of detailed
questionnaires (which may be subsequently validated by internal or external audit)
through to a broader workshop based approach at which both business risks and
related controls are investigated and assessed by the unit responsible for achieving
the business objective - a bottom-up approach

Self-certification may not be sufficient on its own as the right amount of independent
challenge may not be built into the process. The results should be independently

48
 reviewed (for example, by internal or external auditors) on behalf of the Board or
Audit Committee. This independent review should independently challenge the:

- Completeness of the business objectives covered;

- Process for the identification and assessment of the associated business risks;
- Design and operation of the key mitigants;
- Process for reporting any excess of residual risk beyond defined risk tolerance
levels; and
- Process for reporting any significant over/under control.

■ Internal audit visits on a cyclical basis; and Although internal audit should maintain
independence from management, they can perform more than just a monitoring role.
In many companies they also act as facilitators and internal advisors to management
on effective means of controlling business risks. Internal audit arrangements
naturally vary, but they have the potential to play a central role within the monitoring
process

■ Special reviews by external auditors or specialists on a cyclical basis. Responsibility

for reviewing and concluding on the effectiveness of internal control rests with the
Board. However, the external auditors are likely to have helpful knowledge and
access to specialist consultants with expertise in specific aspects of risk
management and control evaluation. Such procedures are out with the scope of the
statutory audit, but could be provided as part of a separate engagement.

Within a large organisation a balance must be struck between direct involvement by

the directors and a high level review in which some areas of responsibility are
delegated. Multi-site or multi-national organisations require involvement from both
group and operating company management

In order to make an objective assessment of the effectiveness of internal control, a

set of criteria is required as a basis for making judgements.

Several models exist which provide a basis for the design and objective assessment
of the effectiveness of control. By their nature, such models also provide criteria by
which the effectiveness of the system of internal control can be judged. Two models
that are currently accepted internationally are the COSO and CoCo systems. The
COSO criteria being substantially similar to those set out in the ICAEW earlier
guidance on internal financial control (the Rutteman report).

The effectiveness of control cannot be judged solely on the degree to which each
criterion, taken separately, is met. The criteria are interrelated, as are the control
elements in an organisation. Control elements cannot be designed or evaluated in
isolation from the business objectives and associated threats to the achievement of
those objectives.

The Board‘s review of effectiveness

While effective monitoring throughout the group is an essential component of a
sound system of internal control, the Board cannot rely solely on the embedded
monitoring process to discharge its responsibilities. Turnbull requires that the Board
should regularly receive and review reports on internal control. The Board should be
49
 informed about how the reviews giving rise to the reports have been undertaken.
Unless the Board are aware of how such reviews have been undertaken, they will
not be in a position to opine on the appropriateness of the output. Clearly a
perfunctory report will not offer the same degree of comfort as one produced through
a thoughtful process.

In addition, the Board should undertake an annual assessment exercise for the
purposes of making its statement in the annual report to ensure that it has
considered all significant aspects of internal control for the accounting period and the
period up to the date of approval of the annual report and accounts.

The Board should define the process to be adopted for its review of the
effectiveness of internal control and should ensure that it is provided with
appropriately documented support for its statement on internal controls in the annual
report and accounts. The Board need to consider both the scope and frequency of
the reports it receives during the year, together with the process for its annual
assessment.

‗Regular‘ review process

The reports from management and/or others qualified to prepare them in
accordance with agreed procedures, should provide a balanced assessment of the
significant risks and the effectiveness of the system of internal control in the areas
covered. Any significant control failings or weaknesses identified should be
discussed in the reports, including the impact that they have had, could have had, or
may have, on the group and the actions being taken to rectify them.
It is essential that there is a frank open dialogue between management and the
Board on matters of risk and control.

When reviewing reports during the year, the Board should:

■ Consider what are the significant risks and assess how they have been identified,
evaluated and managed; The Board must satisfy itself that all the significant risks
threatening the achievement of its business objectives have been identified,
assessed and controlled within its defined risk tolerances.

■ Assess the effectiveness of the related system of internal control in managing the
significant risks, having regard, in particular, to any significant failings or
weaknesses that have been reported;

When considering the effectiveness of the related system of internal control, the
directors should have regard to the principal characteristics of a sound system of
internal control

■ Consider whether necessary actions are being taken promptly to remedy any
significant failings or weaknesses; and It is not sufficient for the Board to satisfy itself
that weaknesses are being identified. It must also consider what remedial action is
being taken and whether such steps are appropriate.
■ Consider whether the findings indicate a need for more extensive monitoring of the
system of internal control.

50
 Where a weakness identified in one area of the business may be duplicated in other
areas, it may be appropriate for the Board to commission a more comprehensive
review. Alternatively, the Board may consider that either the degree of risk involved
or the potential for control breakdown warrant further investigation.

The annual review exercise

The guidance requires that the Board‘s annual assessment should consider issues
dealt with in the reports it has reviewed during the year together with additional
information necessary to ensure the Board has taken account of all significant
aspects of internal control for the company‘s accounting period and the period up to
the date of approval of the annual report and accounts. This suggests that the Board
must, at least, update its annual assessment directly before the annual report and
accounts are approved

Compliance with Turnbull requires that the Board‘s annual assessment should, in
particular, consider:
■ Changes since the last review in the nature and extent of significant risks and the
company‘s ability to respond effectively to changes in its business and external
environment

The Board should review the company‘s business and operational structure to
identify changes which might alter the risk profile, a typical example might be either
entry to, or withdrawal from, a volatile market

The ability to respond effectively to changed circumstances is vital. For example, a

company attempting to establish a foothold in a volatile market place might respond
to new competitors by providing heavily discounted products or services to secure its
market position

■ The scope and quality of management‘s ongoing monitoring of risks and the system
of internal control, and, where applicable, the work of its internal audit function and
other providers of assurance;

The Board will wish to consider whether management‘s approach to the ongoing
monitoring of the system of internal control covers the key risks to the business in
what they believe to be an appropriate cycle and with a level of diligence that they
deem satisfactory. All directors, including the non executives directors, will need to
form a view on how well the company is managed.

The internal audit function may provide significant additional comfort providing it has
sufficient resources and authority to be effective.

■ The extent and frequency of the communication of the results of the monitoring to
the Board - or Board committees - which enables it to build up a cumulative
assessment of the state of control in the company and the effectiveness with which
risk is being managed;

The Board should consider whether it receives the output from the monitoring
process regularly enough for it to be able to form a timely opinion of the ongoing
effectiveness of the process. If the Board does not receive, review and act upon the
51
 results of the monitoring on a timely basis, strategic decision making may be
impaired.

■ The incidence of significant control failings or weaknesses that have been identified
at any time during the period and the extent to which they have resulted in
unforeseen outcomes or contingencies that have had, could have had, or may in the
future have, a material impact on the company‘s financial performance or condition;
and

The Board will want to reflect on the incidence of control weaknesses which
occurred during the period and the effect which those weaknesses had, or could
have or still may have on the organisations results,

■ The effectiveness of the company‘s public reporting process. The efficiency of the
year end reporting process from all areas of the organisation will provide an
indication of the level of management control throughout the organisation.

Should the Board become aware at any time of a significant failing or weakness in internal
control, it should determine how the failing or weakness arose and reassess the
effectiveness of management‘s ongoing processes for designing, operating and
monitoring the system of internal control.

52
 CHAPTER EIGHT
CHIEF AUDIT EXECUTIVE

8.1 Introduction
The chief audit executive (CAE), director of audit, director of internal audit, auditor
general, or controller general is a high-level independent corporate executive with
overall responsibility for internal audit.

Publicly traded corporations typically have an internal audit department, led by a

chief audit executive ("CAE") who reports functionally to the audit committee of the
board of directors, with administrative reporting to the chief executive officer.

The profession is unregulated, though there are a number of international standard

setting bodies, an example of which is the Institute of Internal Auditors ("IIA"). The
IIA has established Standards for the Professional Practice of Internal Auditing and
has over 150,000 members representing 165 countries, including approximately
65,000 Certified Internal Auditors.

The CAE is intrinsically an independent function; otherwise it may become

dysfunctional and of low quality (but there are many degrees in the level of
independence and efficiency). The CAE function exists only to constitute a third-level
of control in the organisation, which must be independent from the first-level control
(the first-level layer belongs to the management of an organisation, who is
responsible in the first instance for acting in compliance with the organization‗s rules)
and consecutively second-level (which are the supporting units i.e. legal, HR, risk
function, financial control etc.). An effective independence is the result of both an
attitude of CAE, and of prerogatives/guarantees conceded by the organisation or
given by the organization‗s principals (e.g., the board of directors or audit
committee).

Because the CAE understands risks and controls, company strategy and the
regulatory environment the CAE may assume additional organizational
responsibilities beyond traditional internal auditing.

8.2 Independent Attitude

The CAE should be independent in the performance of his/her duties, so that he/she
can carry out his/her work freely without admitting interference, and as objectively as
possible. Independence permits him/her to render impartial and unbiased
judgments‗, which are essential to the proper evaluation of management and
controls. It also allows him/her to view the financial actions, procedures and
decisions in a detached way. This may become of an importance when providing
objective assurance about the internal control framework.

8.3.1 Organizational Independence

To perform their role effectively, CAEs require organizational independence from
management, to enable unrestricted evaluation of management activities and
personnel. This can be analysed in the different points below:

All the elements below should be granted to the CAE in the basic rules of the
organisation, or stated in the charter of audit approved by the audit committee and
53
 promulgated in the organization (IIA Standard 1110 Organizational Independence,
and standard 1000C1).

8.3.2 Independent Function: No Conflict of Interest Allowed

Even though the CAE may be formally part of the management structure of the
organisation (among the ―chief executives‖), he/she does not participate in any
management decision process or accept any responsibility in the execution of
company activities.

CAEs may advise management (must, when it is about compliance, risk

management, internal controls) and the board of directors (or similar oversight body)
regarding how to better execute their responsibilities. But she/he remains
independent of the activities observes or audits.

8.3.3 Hierarchical Independence

The primary customer of internal audit activity is the entity charged with oversight of
management's activities. This is typically the audit committee, a sub-committee of
the board of directors. To provide hierarchical independence, most chief audit
executives report to the chairperson of the audit committee as to the performance of
his/her duties.

The definition (and regular revision) of the scope of the function should be agreed
between the CAE and the audit committee. The internal audit‗s annual work plan,
which for practical reasons must be discussed with the auditees, is subject to the
approbation of the sole audit committee, board of directors, or other appropriate
governing authority.

The internal rules and practices of the directorate of internal audit (audit manual) are
of the responsibility of the CAE.

8.3.4 Independent Status

The independence of the CAE in the performance of his duties should be
guaranteed in the staff rules. The audit committee should have sole competence for
the final decision on appointment and dismissal of the CAE‖, and for his
remuneration, activity appraisal and career advancement.

The CAE is liable to disciplinary action but only with the concurrence of the audit
committee. This could happen if he/she is negligent in the performance of his duties.

8.3.5 Independent Communication Right

The CAE reports directly to the audit committee and the board. There should be a
report from the CAE to each ordinary audit committee meeting and if deemed
necessary to the board. Such reports should be addressed directly to the chairman
of the audit committee with parallel copy to the director-general.

However, the CAE in the performance of his daily work communicates and liaises
with the director-general and the staff of the organisation.

8.3.6 Independent Budgeting

54
 Although CAEs and internal auditors are paid by the company, the human resource
budget of the directorate of internal audit, in particular, should be protected from
interference from the audited organization. The typical risk is that the audit's budget
subject to the approval of director of HR and of the DG is a source of potential
interference or friendly pressure to self-limit the CAE‗s critic exercise of an
independent viewpoint. An appeal to the board, even expressly foreseen as part of
the communication right of the CAE, is often ineffective on short-term imposed
constraints, given the time constraints of the budget process. The best practice is
that the audit committee's opinion is required on the CAE‗s draft budget, well in
advance of the normal budgeting process of the organisation.

8.3.7 Access to Information

Information is of key importance to organize, prepare and perform internal audits.
Independent auditors are generally granted full access to any and all information
they require to discharge their responsibilities. Reasonable restrictions would be
limited to things such as personal information in personnel records such as health
information. Unduly restricted access to information is a major impediment to an
independent auditor and indicates that an organization is not truly supportive of the
auditor's mandate and its commitment to sound governance should be questioned.

8.4 Typical Duties

Status, strategy and organisation of the internal audit department
1. Ensure that the status (e.g. stipulated in an audit charter), strategy, resources of the
internal audit department are aligned and are consistent with the organization's
objectives and governance policy.
2. Establish appropriate policies and procedures to guide the internal audit function,
and ensure the quality of the assurance services delivered.
3. Management, supervision of the internal audit activity.
4. Obtain (or manage the production of) a risk analysis;
5. Ensure that the risk assessment is done at least annually;
6. Establish risk-based audit plans to set out the priorities of the internal audit function,
consistent with the organizational objectives.
7. Considers the input of senior management, senior departmental management, of the
audit committee;
8. The internal audit plan usually addresses financial reporting and other fundamental
controls, to be coordinated with the audit plan of the statutory auditor
9. Coordinate internal auditing activities and plans with other internal and external
providers of assurance and consulting activities to ensure proper coverage and
minimize duplication of effort.
10. Communicate plan of engagements and resource requirements for the internal audit
function, including significant interim changes to the audit committee. This
communication shall include the impact of resource limitations.
11. Ensure that internal audit resources are appropriate, sufficient and effectively
deployed to achieve the internal audit plan approved by the audit committee or the
board.
12. Ensure that internal auditors have appropriate professional qualifications and skills,
and opportunities for sufficient training and development to maintain and develop
their internal auditing competence and to obtain Certified Internal Auditor
certification.
13. Ensure the timely completion of internal auditing engagements.
55
14. Ensure that reports on internal auditing engagements are provided to the audit
committee with a minimum of delay.
15. Provide an annual holistic opinion on the effectiveness and adequacy of risk
management, control, and governance processes.

8.5 Quality Management

The CAE is responsible for assuring that appropriate engagement supervision is
provided. Supervision is a process begins with planning and continues throughout
the examination, evaluation, communication, and follow-up phases of the
engagement.

Develop and maintain a quality assurance and improvement program that covers all
aspects of the internal audit function, and continuously monitor its effectiveness.

In collaboration with the audit committee, ensure that a practice inspection or other
external review of the internal audit function is conducted at least every 3 years, by a
qualified, independent external review team, and that the results of this external
assessment are communicated to the audit committee.

Ensure that professional internal auditing standards are followed (e.g. IIA standards
or local standards).

NB: Generally accepted auditing standards and International Standards on Auditing

are external audit standards.
Report at least annually to the audit committee on the internal audit function's
conformance with professional internal auditing standards

8.6 Reporting of Critical Findings

Inform the Audit Committee without delay of any issue of risk, control or
management practice that may be of significance. The chief audit executive (CAE)
reports the most critical issues to the audit committee quarterly, along with
management's progress towards resolving them. Critical issues typically have a
reasonable likelihood of causing substantial financial or reputational damage to the
company. For particularly complex issues, the responsible manager may participate
in the discussion. Such reporting is critical to ensure the function is respected, that
the proper "tone at the top" exists in the organization, and to expedite resolution of
such issues. It is a matter of considerable judgment to select appropriate issues for
the audit committee's attention and to describe them in the proper context.

8.7 Survey Results

Various consulting and public accounting firms perform research on audit
committees, to provide benchmarking data. Some results are identified below:
54% of committee members surveyed felt the audit committee was "very effective,"
while 38% indicated "somewhat effective."
Risk management, internal control, and accounting estimates and judgments were
the top priority areas for 2007.
41% were "very satisfied" with the internal audit function, while 52% were
"somewhat satisfied."
Two-thirds felt the chief internal audit position was for a professional internal auditor,
rather than as a "stepping stone" to other roles.
56
 CHAPTER NINE
LEAD AUDITOR AND QUALITY STANDARD
9.1 Certified lead auditor
The certified lead auditor designation is a professional certification for audit team
leaders working for certification bodies or performing supplier audits for large
organizations. Lead auditor certification requires tertiary education plus two years of
work experience as an auditor or lead auditor in training.

9.2 Certification Programs

It is possible to become a certified lead auditor in the following ISO (International
Organization for Standardization) certification programs:

1. Quality (ISO 9000)

2. Aerospace (AS9100)
3. Medical (ISO 13485)
4. Environmental audits (ISO 14001)
5. Information security (ISO/IEC 27001)
6. Occupational health and safety (ISO 45001)
7. Diversity and Inclusion (ISO/CD 30415 Diversity and inclusion) ISO Diversity

9.3 ISO 9000

The ISO 9000 family of quality management systems (QMS) is a set of standards
that helps organizations ensure they meet customer and other stakeholder needs
within statutory and regulatory requirements related to a product or service. ISO
9000 deals with the fundamentals of quality management systems including the
seven quality management principles that underlie the family of standards. ISO 9001
deals with the requirements that organizations wishing to meet the standard must
fulfill.

Third-party certification bodies provide independent confirmation that organizations

meet the requirements of ISO 9001. Over one million organizations worldwide are
independently certified, making ISO 9001 one of the most widely used management
tools in the world today. However, the ISO certification process has been criticized
as being wasteful and not being useful for all organizations.

ISO 9000 was first published in 1987 by ISO (International Organization for
Standardization). It was based on the BS 5750 series of standards from BSI that
were proposed to ISO in 1979.[12] However, its history can be traced back some
twenty years before that, to the publication of government procurement standards,
such as the United States Department of Defense MIL-Q-9858 standard in 1959,
and the UK's Def Stan 05-21 and 05–24. Large organizations that supplied
government procurement agencies often had to comply with a variety of quality
assurance requirements for each contract awarded, which led the defense industry
to adopt mutual recognition of NATO AQAP, MIL-Q, and Def Stan standards.
Eventually, industries adopted ISO 9000 instead of forcing contractors to adopt
multiple—and often similar—requirements.

9.4 Reasons for Use

57
The global adoption of ISO 9001 may be attributable to a number of factors. In the
early days, the ISO 9001 (9002 and 9003) requirements were intended to be used
by procuring organizations, as the basis of contractual arrangements with their
suppliers. This helped reduce the need for "supplier development" by establishing
basic requirements for a supplier to assure product quality. The ISO 9001
requirements could be tailored to meet specific contractual situations, depending on
the complexity of product, business type (design responsibility, manufacture only,
distribution, servicing etc.) and risk to the procurer. If a chosen supplier was weak on
the controls of their measurement equipment (calibration), and hence QC/inspection
results, that specific requirement would be invoked in the contract. The adoption of a
single quality assurance requirement also leads to cost savings throughout the
supply chain by reducing the administrative burden of maintaining multiple sets of
quality manuals and procedures.

A few years later, the UK Government took steps to improve national

competitiveness following publication of cmd 8621, and Third Party Certification of
Quality Management Systems was born, under the auspices of the National
Accreditation Council of Certification Bodies (NACCB), which has become the
United Kingdom Accreditation Service (UKAS).

In addition to many stakeholders' benefits, a number of studies have identified

significant financial benefits for organizations certified to ISO 9001, with an ISO
analysis of 42 studies showing that implementing the standard does enhance
financial performance. Corbett et al. showed that certified organizations achieved
superior return on assets compared to otherwise similar organizations without
certification.

Heras et al. found similarly superior performance and demonstrated that this was
statistically significant and not a function of organization size. Naveha and Marcus
claimed that implementing ISO 9001 led to superior operational performance in the
U.S. automotive industry. Sharma identified similar improvements in operating
performance and linked this to superior financial performance. Chow-Chua et al.
showed better overall financial performance was achieved for companies in
Denmark. Rajan and Tamimi (2003) showed that ISO 9001 certification resulted in
superior stock market performance and suggested that shareholders were richly
rewarded for the investment in an ISO 9001 system.

While the connection between superior financial performance and ISO 9001 may be
seen from the examples cited, there remains no proof of direct causation, though
longitudinal studies, such as those of Corbett et al. (2005), may suggest it. Other
writers, such as Heras et al. (2002),have suggested that while there is some
evidence of this, the improvement is partly driven by the fact that there is a tendency
for better performing companies to seek ISO 9001 certification.

The mechanism for improving results has also been the subject of much research.
Lo et al. (2007) identified operational improvements (e.g., cycle time reduction,
inventory reductions) as following from certification. Internal process improvements
in organizations lead to externally observable improvements. The benefit of
increased international trade and domestic market share, in addition to the internal
benefits such as customer satisfaction, interdepartmental communications, work
58
 processes, and customer/supplier partnerships derived, far exceeds any and all
initial investment.

9.5 ISO 9000 series Quality Management Principles

The ISO 9000 series are based on seven quality management principles (QMP) The
seven quality management principles are:

QMP 1 – Customer focus

QMP 2 – Leadership
QMP 3 – Engagement of people
QMP 4 – Process approach
QMP 5 – Improvement

QMP 6 – Evidence-based decision making

QMP 7 – Relationship management

Principle 1 – Customer focus

Organizations depend on their customers and therefore should understand current
and future customer needs, should meet customer requirements and strive to
exceed customer expectations.

Principle 2 – Leadership
Leaders establish unity of purpose and direction of the organization. They should
create and maintain the internal environment in which people can become fully
involved in achieving the organization's objectives.

Principle 3 – Engagement of people

People at all levels are the essence of an organization and their full involvement
enables their abilities to be used for the organization's benefit.

Principle 4 – Process approach

A desired result is achieved more efficiently when activities and related resources
are managed as a process.

Principle 5 – Improvement
Improvement of the organization's overall performance should be a permanent
objective of the organization.

Principle 6 – Evidence-based decision making Effective decisions are based on the

analysis of data and information.

Principle 7 – Relationship management

An organization and its external providers (suppliers, contractors, service providers)
are interdependent and a mutually beneficial relationship enhances the ability of
both to create value.

9.6 Contents of ISO 9001:2015

A fish wholesaler in Tsukiji, Japan, advertising its ISO 9001 certification

59
 ISO 9001:2015 Quality management systems — Requirements is a document of
approximately 30 pages available from the national standards organization in each
country. Only ISO 9001 is directly audited against for third-party assessment
purposes.

Contents of ISO 9001:2015 are as follows:

Section 1: Scope
Section 2: Normative references
Section 3: Terms and definitions
Section 4: Context of the organization
Section 5: Leadership
Section 6: Planning
Section 7: Support
Section 8: Operation
Section 9: Performance evaluation
Section 10: Continual Improvement

Essentially, the layout of the standard is similar to the previous ISO 9001:2008
standard in that it follows the Plan, Do, Check, Act cycle in a process-based
approach but is now further encouraging this to have risk-based thinking (section
0.3.3 of the introduction). The purpose of the quality objectives is to determine the
conformity of the requirements (customers and organizations), facilitate effective
deployment and improve the quality management system.

Before the certification body can issue or renew a certificate, the auditor must be
satisfied that the company being assessed has implemented the requirements of
sections 4 to 10. Sections 1 to 3 are not directly audited against, but because they
provide context and definitions for the rest of the standard, not that of the
organization, their contents must be taken into account.

The standard no longer specifies that the organization shall issue and maintain
documented procedures, but ISO 9001:2015 requires the organization to document
any other procedures required for its effective operation. The standard also requires
the organization to issue and communicate a documented quality policy, a quality
management system scope, and quality objectives. The standard no longer requires
compliant organizations to issue a formal Quality Manual. The standard does require
retention of numerous records, as specified throughout the standard. New for the
2015 release is a requirement for an organization to assess risks and opportunities
(section 6.1) and to determine internal and external issues relevant to its purpose
and strategic direction (section 4.1).
The organization must demonstrate how the standard's requirements are being met,
while the external auditor's role is to determine the quality management system's
effectiveness. More detailed interpretation and implementation examples are often
sought by organizations seeking more information in what can be a very technical
area.

9.7 Certification
The International Organization for Standardization (ISO) does not certify
organisations itself. Numerous certification bodies exist, which audit organisations
and upon success, issue ISO 9001 compliance certificates. Although commonly
60
 referred to as "ISO 9000" certification, the actual standard to which an organization's
quality management system can be certified is ISO 9001:2015 (ISO 9001:2008
expired around September 2018). Many countries have formed accreditation bodies
to authorize ("accredit") the certification bodies. Both the accreditation bodies and
the certification bodies charge fees for their services. The various accreditation
bodies have mutual agreements with each other to ensure that certificates issued by
one of the accredited certification bodies (CB) are accepted worldwide. Certification
bodies themselves operate under another quality standard, ISO/IEC 17021, while
accreditation bodies operate under ISO/IEC 17011.

An organization applying for ISO 9001 certification is audited based on an extensive

sample of its sites, functions, products, services, and processes. The auditor
presents a list of problems (defined as "nonconformities", "observations", or
"opportunities for improvement") to management. If there are no major
nonconformities, the certification body issues a certificate. Where major
nonconformities are identified, the organization presents an improvement plan to the
certification body (e.g., corrective action reports showing how the problems will be
resolved); once the certification body is satisfied that the organization has carried out
sufficient corrective action, it issues a certificate. The certificate is limited by a
certain scope (e.g., production of golf balls) and displays the addresses to which the
certificate refers.

An ISO 9001 certificate is not a once-and-for-all award but must be renewed, in

accordance with ISO 17021, at regular intervals recommended by the certification
body, usually once every three years. There are no grades of competence within
ISO 9001: either a company is certified (meaning that it is committed to the method
and model of quality management described in the standard) or it is not. In this
respect, ISO 9001 certification contrasts with measurement-based quality systems.

9.8 Evolution of ISO 9000 Standards

The ISO 9000 standard is continually being revised by standing technical
committees and advisory groups, who receive feedback from those professionals
who are implementing the standard.

Year Edition of ISO 9001

1987 1st Edition
1994 2nd Edition
2000 3rd Edition
2008 4th Edition
2015 5th Edition

9.8.1 1987 version

ISO 9000:1987 had the same structure as the UK Standard BS 5750, with three
"models" for quality management systems, the selection of which was based on the
scope of activities of the organization:

ISO 9001:1987 Model for quality assurance in design, development, production,

installation, and servicing was for companies and organizations whose activities
included the creation of new products.

61
 ISO 9002:1987 Model for quality assurance in production, installation, and servicing
had basically the same material as ISO 9001 but without covering the creation of
new products.

ISO 9003:1987 Model for quality assurance in final inspection and test covered only
the final inspection of finished product, with no concern for how the product was
produced.

ISO 9000:1987 was also influenced by existing U.S. and other Defense Standards
("MIL SPECS"), and so was well-suited to manufacturing. The emphasis tended to
be placed on conformance with procedures rather than the overall process of
management, which was likely the actual intent.[citation needed]

9.8.2 1994 version

ISO 9000:1994 emphasized quality assurance via preventive actions, instead of just
checking final product, and continued to require evidence of compliance with
documented procedures. As with the first edition, the down-side was that companies
tended to implement its requirements by creating shelf-loads of procedure manuals,
and becoming burdened with an ISO bureaucracy. In some companies, adapting
and improving processes could actually be impeded by the quality management
system.

9.8.3 2000 version

ISO 9001:2000 replaced all three former standards of 1994 issue, ISO 9001, ISO
9002 and ISO 9003. Design and development procedures were required only if a
company does, in fact, engage in the creation of new products. The 2000 version
sought to make a radical change in thinking by actually placing front and centre the
concept of process management (the monitoring and optimization of a company's
tasks and activities, instead of just inspection of the final product). The 2000 version
also demanded involvement by upper executives in order to integrate quality into the
business system and avoid delegation of quality functions to junior administrators.
Another goal was to improve effectiveness via process performance metrics:
numerical measurement of the effectiveness of tasks and activities. Expectations of
continual process improvement and tracking customer satisfaction were made
explicit

9.8.4 ISO 9000 Requirements include

1. Approve documents before distribution;
2. Provide correct version of documents at points of use;
3. Use your records to prove that requirements have been met; and
4. Develop a procedure to control your records.

9.8.5 2008 version

ISO 9001:2008 in essence re-narrates ISO 9001:2000. The 2008 version only
introduced clarifications to the existing requirements of ISO 9001:2000 and some
changes intended to improve consistency with ISO 14001:2004. There were no new
requirements. For example, in ISO 9001:2008, a quality management system being
upgraded just needs to be checked to see if it is following the clarifications
introduced in the amended version.
62
 ISO 9001 is supplemented directly by two other standards of the family:

1. ISO 9000:2005 "Quality management systems. Fundamentals and vocabulary"

2. ISO 9004:2009 "Managing for the sustained success of an organization. A quality
management approach"

Other standards, like ISO 19011 and the ISO 10000 series, may also be used for
specific parts of the quality system.

9.8.6 2015 version

In 2012, ISO TC 176 - responsible for ISO 9001 development - celebrated 25 years
of implementing ISO 9001[40] and concluded that it was necessary to create a new
QMS model for the next 25 years. They subsequently commenced the official work
on creating a revision of ISO 9001, starting with the new QM principles. This
moment was considered by important specialists in the field as "beginning of a new
era in the development of quality management systems." As a result of the intensive
work from this technical committee, the revised standard ISO 9001:2015 was
published by ISO on 23 September 2015. The scope of the standard has not
changed; however, the structure and core terms were modified to allow the standard
to integrate more easily with other international management systems standards.

The new ISO 9001:2015 management system standard helps ensure that
consumers get reliable, desired quality goods and services. This further increases
benefits for a business.

The 2015 version is also less prescriptive than its predecessors and focuses on
performance. This was achieved by combining the process approach with risk-based
thinking, and employing the Plan-Do-Check-Act cycle at all levels in the
organization.

Some of the key changes include:

1. High-Level Structure of 10 clauses is implemented. Now all new standards released

by ISO will have this high-level structure
2. Greater emphasis on building a management system suited to each organization's
particular needs A requirement that those at the top of an organization be involved
and accountable, aligning quality with wider business strategy
3. Risk-based thinking throughout the standard makes the whole management system
a preventive tool and encourages continuous improvement
4. Less prescriptive requirements for documentation: the organisation can now decide
what documented information it needs and what format it should be in
5. Alignment with other key management system standards through the use of a
common structure and core text
6. Inclusion of Knowledge Management principles
7. Quality Manual & Management representative (MR) are no longer mandatory

9.9 Auditing
Two types of auditing are required to become registered to the standard: auditing by
an external certification body (external audit) and audits by internal staff trained for
63
 this process (internal audits). The aim is a continual process of review and
assessment to verify that the system is working as it is supposed to, to find out
where it can improve, and to correct or prevent identified problems. It is considered
healthier for internal auditors to audit outside their usual management line, so as to
bring a degree of independence to their judgments‗.

9.10 Industry-Specific Interpretations

The ISO 9001 standard is generic; its parts must be carefully interpreted to make
sense within a particular organization. Developing software is not like making
cheese or offering counseling services, yet the ISO 9001 guidelines, because they
are business management guidelines, can be applied to each of these. Diverse
organizations—police departments (United States), professional soccer teams
(Mexico), and city councils (UK)—have successfully implemented ISO 9001:2000
systems.

Over time, various industry sectors have wanted to standardize their interpretations
of the guidelines within their own marketplace. This is partly to ensure that their
versions of ISO 9000 have their specific requirements, but also to try and ensure
that more appropriately trained and experienced auditors are sent to assess them.

The TickIT guidelines are an interpretation of ISO 9000 produced by the UK Board
of Trade to suit the processes of the information technology industry, especially
software development.

AS9000 is the Aerospace Basic Quality System Standard, an interpretation

developed by major aerospace manufacturers. Those major manufacturers include
AlliedSignal, Allison Engine, Boeing, General Electric Aircraft Engines, Lockheed-
Martin, McDonnell Douglas, Northrop Grumman, Pratt & Whitney, Rockwell-Collins,
Sikorsky Aircraft, and Sundstrand. The current version is AS9100D.

PS 9000 * QS 9000 is an interpretation agreed upon by major automotive

manufacturers (GM, Ford, Chrysler). It includes techniques such as FMEA and
APQP. QS 9000 is now replaced by ISO/TS 16949.

ISO/TS 16949:2009 is an interpretation agreed upon by major automotive

manufacturers (American and European manufacturers); the latest version is based
on ISO 9001:2008. The emphasis on a process approach is stronger than in ISO
9001:2008. ISO/TS 16949:2009 contain the full text of ISO 9001:2008 and
automotive industry-specific requirements. After the new edition of ISO 9001:2015
the ISO/TS 16949:2009 was also completely revised and reissued by IATF
(International Automotive Task Force). IATF 16949:2016 is now a stand-alone
standard that doesn't include the ISO 9001:2015 requirements but still refers to them
and works as an additional automotive-specific requirement to ISO 9001.

TL 9000 is the Telecom Quality Management and Measurement System Standard,

an interpretation developed by the telecom consortium, QuEST Forum. In 1998
QuEST Forum developed the TL 9000 Quality Management System to meet the
supply chain quality requirements of the worldwide telecommunications industry.
The TL 9000 standard is made up of two handbooks: the QMS Requirements
Handbook, and the QMS Measurement Handbook. The current versions of the
64
 Requirements and Measurements Handbooks are 6.0. Unlike ISO 9001 or other
sector-specific standards, TL 9000 includes standardized product and process
measurements that must be reported into a central repository, which allows
organizations to benchmark their performance in key process areas against peer
organizations. It is important to note that TL 9000 R6.0 contains the full text of ISO
9001:2015.

ISO 13485:2016 is the medical industry's equivalent of ISO 9001. ISO 13485:2016 is
a stand-alone standard. Because ISO 13485 is relevant to medical device
manufacturers (unlike ISO 9001, which is applicable to any industry), and because
of the differences between the two standards relating to continual improvement,
compliance with ISO 13485 does not necessarily mean compliance with ISO 9001
(and vice versa).

ISO/IEC 90003:2014 provides guidelines for the application of ISO 9001 to computer
software.

ISO/TS 29001 is quality management system requirements for the design,

development, production, installation, and service of products for the petroleum,
petrochemical, and natural gas industries. It is equivalent to API Spec Q1 without the
Monogram annex.

ISO 17025:2017 is the Quality Management System applicable only to Testing and
Calibration Laboratories.

9.11 Effectiveness
This section possibly contains original research. Please improve it by verifying the
claims made and adding inline citations. Statements consisting only of original
research should be removed. (May 2013) (Learn how and when to remove this
template message)

The debate on the effectiveness of ISO 9000 commonly centers on the following
questions:

1. Are the quality principles in ISO 9001 of value?

2. Does it help to implement an ISO 9001-compliant quality management system?
3. Does it help to obtain ISO 9001 certification?

The effectiveness of the ISO system being implemented depends on a number of

factors, the most significant of which are:

1. Commitment of senior management to monitor, controls, and improve quality.

Organizations that implement an ISO system without this desire and commitment
often take the cheapest road to get a certificate on the wall and ignore problem
areas uncovered in the audits.

2. How well the ISO system integrates into current business practices: Many
organizations that implement ISO try to make their system fit into a cookie-cutter
quality manual instead of creating a manual that documents existing practices and
only adds new processes to meet the ISO standard when necessary.
65
3. How well the ISO system focuses on improving the customer experience: The
broadest definition of quality is "Whatever the customer perceives good quality to
be." This means that a company doesn't necessarily have to make a product that
never fails; some customers have a higher tolerance for product failures if they
always receive shipments on-time or have a positive experience in some other
dimension of customer service. An ISO system should take into account all areas of
the customer experience and the industry expectations, and seek to improve them
on a continual basis. This means taking into account all processes that deal with the
three stakeholders (customers, suppliers, and organization). Only then can a
company sustain improvements in the customer's experience.

4. How well the auditor finds and communicates areas of improvement: While ISO
auditors may not provide consulting to the clients they audit, there is the potential for
auditors to point out areas of 5. Improvement: Many auditors simply rely on
submitting reports that indicate compliance or non-compliance with the appropriate
section of the standard; however, to most executives, this is like speaking a foreign
language. Auditors that can clearly identify and communicate areas for improvement
in language and terms executive management understands facilitate action on
improvement initiatives by the companies they audit. When management doesn't
understand why they were non-compliant and the business implications associated
with noncompliance, they simply ignore the reports and focus on what they do
understand.

9.12 Advantages
Proper quality management can improve business, often having a positive effect on
investment, market share, sales growth, sales margins, competitive advantage, and
avoidance of litigation. The quality principles in ISO 9000:2000 are also sound,
according to Wade and Barnes, who says that "ISO 9000 guidelines provide a
comprehensive model for quality management systems that can make any company
competitive". Sroufe and Curkovic, (2008) found benefits ranging from registration
required to remain part of a supply base, better documentation, to cost benefits, and
improved involvement and communication with management. According to ISO the
2015 version of the standard brings the following benefits:

1. By assessing their context, organizations can define who is affected by their work
and what they expect. This enables clearly stated business objectives and the
identification of new business opportunities.

2. Organizations can identify and address the risks associated with their organization.

3. By putting customers first, organizations can make sure they consistently meet
customer needs and enhance customer satisfaction. This can lead to more repeat
customers, new clients and increased business for the organization.

4. Organizations work in a more efficient way as all their processes are aligned and
understood by everyone. This increases productivity and efficiency, bringing internal
costs down.

5. Organizations will meet necessary statutory and regulatory requirements.

66
5. Organizations can expand into new markets, as some sectors and clients require
ISO 9001 before doing business.
9.13 Criticisms of ISO 9001 Certification
A common criticism of ISO 9000 and 9001 is the amount of money, time, and
paperwork required for a complete implementation, and later when needed, ISO
9001 certification. Dalgleish cites the "inordinate and often unnecessary paperwork
burden" of ISO, and says that "quality managers feel that ISO's overhead and
paperwork are excessive and extremely inefficient". The level of minimum
documentation for a minimum scope organization has been greatly reduced, going
from ISO 9001:2000 to ISO 9001:2008 to ISO 9001:2015.

According to Barnes, "Opponents claim that it is only for documentation. Proponents

believe that if a company has documented its quality systems, then most of the
paperwork has already been completed." Wilson suggests that ISO standards
"elevate inspection of the correct procedures over broader aspects of quality", and
therefore, "the workplace becomes oppressive and quality is not improved."

One study showing reasons for not adopting this standard include the risks and
uncertainty of not knowing if there are direct relationships to improved quality, and
what kind and how many resources will be needed. Additional risks include how
much certification will cost, increased bureaucratic processes and risk of poor
company image if the certification process fails.

According to John Seddon, ISO 9001 promotes specification, control, and

procedures rather than understanding and improvement. Wade argues that ISO
9000 is effective as a guideline, but that promoting it as a standard "helps to mislead
companies into thinking that certification means better quality undermining the need
for an organization to set its own quality standards." In short, Wade argues that
reliance on the specifications of ISO 9001 does not guarantee a successful quality
system.

The standard is seen as especially prone to failure when a company is interested in

certification before quality. Certifications are in fact often based on customer
contractual requirements rather than a desire to actually improve quality. "If you just
want the certificate on the wall, chances are you will create a paper system that
doesn't have much to do with the way you actually run your business", said ISO's
Roger Frost. Certification by an independent auditor is often seen as the problem
area, and according to Barnes, "has become a vehicle to increase consulting
services."

Dalgleish argues that while "quality has a positive effect on return on investment,
market share, sales growth, better sales margins and competitive advantage,"
"taking a quality approach is unrelated to ISO 9000 registration." In fact, ISO itself
advises that ISO 9001 can be implemented without certification, simply for the
quality benefits that can be achieved.
67
Abrahamson argues that fashionable management discourse such as Quality Circles
tends to follow a lifecycle in the form of a bell curve, possibly indicating a
management fad.

Dytz argues that ISO 9001 certification is based on 7 management principles and
that companies are free to develop their internal tools and working methods,
however, the model adopted to audit and certify companies does not evaluate the
effectiveness of these methods. Even when there is still a superficial analysis of this
effectiveness, mainly due to the time available to audit these companies, the
certifications do not distinguish two companies with the same business model, with
regard to their internal capacity and quality of management.

Pickrellargues[citation needed] that ISO systems merely gauge whether the

processes are being followed. It does not gauge how good the processes are or
whether the correct parameters are being measured and controlled to ensure
quality. Furthermore, when unique technical solutions are involved in the creation of
a new part, ISO does not validate the robustness of the technical solution—a key
part of advanced quality planning. It is not unheard of for an ISO-certified plant to
display poor quality performance due to poor process selection and/or poor technical
solutions.

Lastly, the standard itself is proprietary, and not open to inspection by the general
public. It may be purchased from the ISO for 178 Swiss Francs.

68
 CHAPTER TEN
CORPORATE GOVERNANCE

10.1 Introduction
Corporate governance is the collection of mechanisms, processes and relations
used by various parties to control and to operate a corporation. Governance
structures and principles identify the distribution of rights and responsibilities among
different participants in the corporation (such as the board of directors, managers,
shareholders, creditors, auditors, regulators, and other stakeholders) and include the
rules and procedures for making decisions in corporate affairs. Corporate
governance is necessary because of the possibility of conflicts of interests between
stakeholders, primarily between shareholders and upper management or among
shareholders.

Corporate governance includes the processes through which corporations'

objectives are set and pursued in the context of the social, regulatory and market
environment. These include monitoring the actions, policies, practices, and decisions
of corporations, their agents, and affected stakeholders. Corporate governance
practices can be seen as attempts to align the interests of stakeholders.

Interest in the corporate governance practices of modern corporations, particularly in

relation to accountability, increased following the high-profile collapses of a number
of large corporations in 2001–2002, many of which involved accounting fraud; and
then again after the financial crisis in 2008.

Corporate scandals of various forms have maintained public and political interest in
the regulation of corporate governance. In the U.S. these have included scandals
surrounding Enron and MCI Inc. (formerly WorldCom). Their demise led to the
enactment of the Sarbanes–Oxley Act in 2002, a U.S. federal law intended to
improve corporate governance in the United States. Comparable failures in Australia
(HIH, One.Tel) are associated with the eventual passage of the CLERP 9 reforms
there (2004) that similarly aimed to improve corporate governance. Similar corporate
failures in other countries stimulated increased regulatory interest (e.g., Parmalat in
Italy).

Corporate governance has also been more narrowly defined as "a system of law and
sound approaches by which corporations are directed and controlled focusing on the
internal and external corporate structures with the intention of monitoring the actions
of management and directors and thereby, mitigating agency risks which may stem
from the misdeeds of corporate officers."

Corporate governance has also been defined as "the act of externally directing,
controlling and evaluating a corporation" and related to the definition of Governance
as "The act of externally directing, controlling and evaluating an entity, process or
resource." In this sense, governance and corporate governance are different from
management because governance must be EXTERNAL to the object being
governed. Governing agents do not have personal control over, and are not part of
the object that they govern. For example, it is not possible for a CIO to govern the IT
function. They are personally accountable for the strategy and management of the
function. As such, they "manage" the IT function; they do not "govern" it. At the same
69
 time, there may be a number of policies, authorized by the board that the CIO
follows. When the CIO is following these policies, they are performing "governance"
activities because the primary intention of the policy is to serve a governance
purpose. The board is ultimately "governing" the IT function because they stand
outside of the function and are only able to externally direct, control and evaluate the
IT function by virtue of established policies, procedures and indicators. Without
these policies, procedures and indicators, the board has no way of governing, let
alone affecting the IT function in any way.

One source defines corporate governance as "the set of conditions that shapes the
ex post bargaining over the quasi-rents generated by a firm.‖ The firm itself is
modeled as a governance structure acting through the mechanisms of contract.
Here corporate governance may include its relation to corporate finance.

10.2 Background
The need for corporate governance follows the need to mitigate conflicts of interests
between stakeholders in corporations. These conflicts of interests appear as a
consequence of diverging wants between both shareholders and upper
management (principal–agent problems) and among shareholders (principal–
principal problems), although also other stakeholder relations are affected and
coordinated through corporate governance.

10.3 Principal–Agent Conflict

I n large firms where there is a separation of ownership and management, the
principal–agent problem can arise between upper-management (the "agent") and
the shareholder(s) (the "principal(s)"). The shareholders and upper management
may have different interests. The shareholders typically desire returns on their
investments through profits and dividends, while upper management may also be
influenced by other motives, such as management remuneration or wealth interests,
working conditions and perquisites, or relationships with other parties within (e.g.,
management-worker relations) or outside the corporation, to the extent that these
are not necessary for profits.

Those pertaining to self-interest are usually emphasized in relation to principal-agent

problems. The effectiveness of corporate governance practices from a shareholder
perspective might be judged by how well those practices align and coordinate the
interests of the upper management with those of the shareholders. However,
corporations sometimes undertake initiatives, such as climate activism and voluntary
emission reduction that seems to contradict the idea that rational self-interest drives
shareholders' governance goals.

An example of a possible conflict between shareholders and upper management

materializes through stock repurchases (treasury stock). Executives may have
incentive to divert cash surpluses to buying treasury stock to support or increase the
share price. However, that reduces the financial resources available to maintain or
enhance profitable operations. As a result, executives can sacrifice long-term profits
for short-term personal gain. Shareholders may have different perspectives in this
regard, depending on their own time preferences, but it can also be viewed as a
conflicting with broader corporate interests (including preferences of other
stakeholders and the long-term health of the corporation).
70
10.4 Principal–Principal: Conflict (the Multiple Principal Problem)
The principal–agent problem can be intensified when upper management acts on
behalf of multiple shareholders—which is often the case in large firms (see Multiple
principal problem). Specifically, when upper management acts on behalf of multiple
shareholders, the multiple shareholders face a collective action problem in corporate
governance, as individual shareholders may lobby upper management or otherwise
have incentives to act in their individual interests rather than in the collective interest
of all shareholders. As a result, there may be free-riding in steering and monitoring
of upper management, or conversely, high costs may arise from duplicate steering
and monitoring of upper management. Conflict may break out between principals
and this all leads to increased autonomy for upper management.

Ways of mitigating or preventing these conflicts of interests include the processes,

customs, policies, laws, and institutions which affect the way a company is
controlled—and this is the challenge of corporate governance. To solve the problem
of governing upper management under multiple shareholders, corporate governance
scholars have figured out that the straightforward solution of appointing one or more
shareholders for governance is likely to lead to problems because of the information
asymmetry it creates. Shareholders' meetings are necessary to arrange governance
under multiple shareholders, and it has been proposed that this is the solution to the
problem of multiple principals due to median voter theorem: shareholders' meetings
lead power to be devolved to an actor that approximately holds the median interest
of all shareholders, thus causing governance to best represent the aggregated
interest of all shareholders

10.5 Principles
Contemporary discussions of corporate governance tend to refer to principles raised
in three documents released since 1990: The Cadbury Report (UK, 1992), the
Principles of Corporate Governance (OECD, 1999, 2004 and 2015), and the
Sarbanes–Oxley Act of 2002 (US, 2002). The Cadbury and Organisation for
Economic Co-operation and Development (OECD) reports present general
principles around which businesses are expected to operate to assure proper
governance. The Sarbanes–Oxley Act, informally referred to as Sarbox or Sox, is an
attempt by the federal government in the United States to legislate several of the
principles recommended in the Cadbury and OECD reports.

1. Rights and equitable treatment of shareholders: Organizations should respect the

rights of shareholders and help shareholders to exercise those rights. They can help
shareholders exercise their rights by openly and effectively communicating
information and by encouraging shareholders to participate in general meetings.

2. Interests of other stakeholders: Organizations should recognize that they have legal,
contractual, social, and market driven obligations to non-shareholder stakeholders,
including employees, investors, creditors, suppliers, local communities, customers,
and policy makers.

71
 4. Role and responsibilities of the board: The board needs sufficient relevant skills and
understanding to review and challenge management performance. It also needs
adequate size and appropriate levels of independence and commitment.

4. Integrity and ethical behavior: Integrity should be a fundamental requirement in

choosing corporate officers and board members. Organizations should develop a
code of conduct for their directors and executives that promotes ethical and
responsible decision making.

5. Disclosure and transparency: Organizations should clarify and make publicly known
the roles and responsibilities of board and management to provide stakeholders with
a level of accountability. They should also implement procedures to independently
verify and safeguard the integrity of the company's financial reporting. Disclosure of
material matters concerning the organization should be timely and balanced to
ensure that all investors have access to clear, factual information.

10.6 Models
Different models of corporate governance differ according to the variety of capitalism
in which they are embedded. The Anglo-American "model" tends to emphasize the
interests of shareholders. The coordinated or multistakeholders model associated
with Continental Europe and Japan also recognizes the interests of workers,
managers, suppliers, customers, and the community. A related distinction is
between market oriented and network-oriented models of corporate governance.

10.7.1 Continental Europe (Two-Tier Board System)

Some continental European countries, including Germany, Austria, and the
Netherlands, require a two-tiered board of directors as a means of improving
corporate governance. In the two-tiered board, the executive board, made up of
company executives, generally runs day-to-day operations while the supervisory
board, made up entirely of non-executive directors who represent shareholders and
employees, hires and fires the members of the executive board, determines their
compensation, and reviews major business decisions.

Germany, in particular, is known for its practice of co-determination, founded on the

German Codetermination Act of 1976, in which workers are granted seats on the
board as stakeholders, separate from the seats accruing to shareholder equity.

10.7.2 United States, United Kingdom

The so-called "Anglo-American model" of corporate governance emphasizes the
interests of shareholders. It relies on a single-tiered board of directors that is
normally dominated by non-executive directors elected by shareholders. Because of
this, it is also known as "the unitary system." Within this system, many boards
include some executives from the company (who are ex officio members of the
board). Nonexecutive directors are expected to outnumber executive directors and
hold key posts, including audit and compensation committees. In the United
Kingdom, the CEO generally does not also serve as Chairman of the Board,
whereas in the US having the dual role has been the norm, despite major misgivings
regarding the effect on corporate governance. The number of US firms combining
both roles is declining, however.

72
 In the United States, corporations are directly governed by state laws, while the
exchange (offering and trading) of securities in corporations (including shares) is
governed by federal legislation. Many US states have adopted the Model Business
Corporation Act, but the dominant state law for publicly traded corporations is
Delaware General Corporation Law, which continues to be the place of incorporation
for the majority of publicly traded corporations. Individual rules for corporations are
based upon the corporate charter and, less authoritatively, the corporate bylaws.
Shareholders cannot initiate changes in the corporate charter although they can
initiate changes to the corporate bylaws.

It is sometimes colloquially stated that in the US and the UK "the shareholders own
the company". This is, however, a misconception as argued by Eccles & Youmans
(2015) and Kay (2015).

10.8 Founder Centrism

Recent scholarship from the University of Oxford outlines a new theory of corporate
governance, founder centrism, which is premised upon a narrowing in the separation
between ownership and control. Through the lens of concentrated equity ownership
theory, a new theory of the firm, the traditional checklist of best practices are
inapplicable, as evidenced by the significant outperformance of technology
companies with dual-class share structures and integrated CEO/Chairman positions:

Founder-run companies, such as Facebook, Netflix and Google are at the forefront
of a new wave of organizational structure better suited to long-term value creation.
Founder centrism, an inclusive concept within CEO theory, integrates the capacity of
founder and non-founder senior leadership to adopt an owner's mindset in
traditionally structured corporations, such as Thomas J. Watson Sr. and Thomas
Watson Jr. with IBM, Steve Jobs and Tim Cook with Apple, Jamie Dimon with
JPMorgan Chase, Lloyd Blankfein with Goldman Sachs, Rick George with Suncor
Energy, and many others. In substance, all fall within the ambit of founder
centrism—leaders with a founder's mindset, an ethical disposition towards the
shareholder collective, and an intense focus on exponential value creation without
enslavement to a quarter-by-quarter upward growth trajectory.

In traditionally structured firms, high performing executives gain deference, become

highly influential, and take on the qualities of concentrated equity owners. To the
extent these leaders embrace founder centrism, their companies will experience
efficiency advantages relative to competitors operating within traditional parameters.

An article published by the Australian Institute of Company Directors called "Do

Boards Need to become more Entrepreneurial?" also considered the need for
founder centrism behaviour at board level to appropriately manage disruption.

10.9.1 Regulations
Corporations are created as legal persons by the laws and regulations of a particular
jurisdiction. These may vary in many respects between countries, but a corporation's
legal person status is fundamental to all jurisdictions and is conferred by statute.
This allows the entity to hold property in its own right without reference to any
particular real person. It also results in the perpetual existence that characterizes the
modern corporation. The statutory granting of corporate existence may arise from
73
 general purpose legislation (which is the general case) or from a statute to create a
specific corporation, which was the only method prior to the 19th century.

In addition to the statutory laws of the relevant jurisdiction, corporations are subject
to common law in some countries, and various laws and regulations affecting
business practices. In most jurisdictions, corporations also have a constitution that
provides individual rules that govern the corporation and authorize or constrain its
decision makers. This constitution is identified by a variety of terms; in English-
speaking jurisdictions, it is usually known as the Corporate Charter or the
Memorandum and Articles of Association. The capacity of shareholders to modify
the constitution of their corporation can vary substantially.

The U.S. passed the Foreign Corrupt Practices Act (FCPA) in 1977, with subsequent
modifications. This law made it illegal to bribe government officials and required
corporations to maintain adequate accounting controls. It is enforced by the U.S.
Department of Justice and the Securities and Exchange Commission (SEC).
Substantial civil and criminal penalties have been levied on corporations and
executives convicted of bribery.

The UK passed the Bribery Act in 2010. This law made it illegal to bribe either
government or private citizens or make facilitating payments (i.e., payment to a
government official to perform their routine duties more quickly). It also required
corporations to establish controls to prevent bribery.

10.9.2 Sarbanes–Oxley Act

The Sarbanes–Oxley Act of 2002 was enacted in the wake of a series of high-profile
corporate scandals. It established a series of requirements that affect corporate
governance in the U.S. and influenced similar laws in many other countries. The law
required, along with many other elements, that:

The Public Company Accounting Oversight Board (PCAOB) be established to

regulate the auditing profession, which had been self-regulated prior to the law.
Auditors are responsible for reviewing the financial statements of corporations and
issuing an opinion as to their reliability.

The chief executive officer (CEO) and chief financial officer (CFO) attest to the
financial statements. Prior to the law, CEOs had claimed in court they hadn't
reviewed the information as part of their defense.

Board audit committees have members that are independent and disclose whether
or not at least one is a financial expert, or reasons why no such expert is on the
audit committee.

External audit firms cannot provide certain types of consulting services and must
rotate their lead partner every 5 years. Further, an audit firm cannot audit a company
if those in specified senior management roles worked for the auditor in the past year.
Prior to the law, there was the real or perceived conflict of interest between providing
an independent opinion on the accuracy and reliability of financial statements when
the same firm was also providing lucrative consulting services.

74
10.9.3 Codes and Guidelines
Corporate governance principles and codes have been developed in different
countries and issued from stock exchanges, corporations, institutional investors, or
associations (institutes) of directors and managers with the support of governments
and international organizations. As a rule, compliance with these governance
recommendations is not mandated by law, although the codes linked to stock
exchange listing requirements may have a coercive effect.

Organisation for Economic Co-operation and Development principles

One of the most influential guidelines on corporate governance are the G20/OECD
Principles of Corporate Governance, first published as the OECD Principles in 1999,
revised in 2004 and revised again and endorsed by the G20 in 2015. The Principles
are often referenced by countries developing local codes or guidelines. Building on
the work of the OECD, other international organizations, private sector associations
and more than 20 national corporate governance codes formed the United Nations
Intergovernmental Working Group of Experts on International Standards of
Accounting and Reporting (ISAR) to produce their Guidance on Good Practices in
Corporate Governance Disclosure. This internationally agreed benchmark consists
of more than fifty distinct disclosure items across five broad categories:

1. Auditing
2. Board and management structure and process
3. Corporate responsibility and compliance in organization
4. Financial transparency and information disclosure
5. Ownership structure and exercise of control rights

The OECD Guidelines on Corporate Governance of State-Owned Enterprises are

complementary to the G20/OECD Principles of Corporate Governance, providing
guidance tailored to the corporate governance challenges unique to state-owned
enterprises.

10.9.4 Stock Exchange Listing Standards

Companies listed on the New York Stock Exchange (NYSE) and other stock
exchanges are required to meet certain governance standards. For example, the
NYSE Listed Company Manual requires, among many other elements:

Independent directors: "Listed companies must have a majority of independent

directors. Effective boards of directors exercise independent judgment in carrying
out their responsibilities. Requiring a majority of independent directors will increase
the quality of board oversight and lessen the possibility of damaging conflicts of
interest." (Section 303A.01) An independent director is not part of management and
has no "material financial relationship" with the company.

Board meetings that exclude management: "To empower non-management directors

to serve as a more effective check on management, the non-management directors
of each listed company must meet at regularly scheduled executive sessions without
management." (Section 303A.03)

75
 Boards organize their members into committees with specific responsibilities per
defined charters. "Listed companies must have a nominating/corporate governance
committee composed entirely of independent directors." This committee is
responsible for nominating new members for the board of directors. Compensation
and Audit Committees are also specified, with the latter subject to a variety of listing
standards as well as outside regulations.

10.9.5 Other Guidelines

The investor-led organisation International Corporate Governance Network (ICGN)
was set up by individuals centered on the ten largest pension funds in the world
1995. The aim is to promote global corporate governance standards. The network is
led by investors that manage 18 trillion dollars, and members are located in fifty
different countries. ICGN has developed a suite of global guidelines ranging from
shareholder rights to business ethics.

The World Business Council for Sustainable Development (WBCSD) has done work
on corporate governance, particularly on accounting and reporting. In 2009, the
International Finance Corporation and the UN Global Compact released a report,
"Corporate Governance: the Foundation for Corporate Citizenship and Sustainable
Business," linking the environmental, social and governance responsibilities of a
company to its financial performance and long-term sustainability.

Most codes are largely voluntary. An issue raised in the U.S. since the 2005 Disney
decision is the degree to which companies manage their governance
responsibilities; in other words, do they merely try to supersede the legal threshold,
or should they create governance guidelines that ascend to the level of best
practice. For example, the guidelines issued by associations of directors, corporate
managers and individual companies tend to be wholly voluntary, but such
documents may have a wider effect by prompting other companies to adopt similar
practices.

76
 CHAPTER ELEVEN
AUDIT RISK

11.1 Introduction
Audit risk (also referred to as residual risk) refers to the risk that an auditor may
issue an unqualified report due to the auditor's failure to detect material
misstatement either due to error or fraud. This risk is composed of:

1. Inherent Risk (IR): The risk involved in the nature of business or transaction.
Example, transactions involving exchange of cash may have higher IR than
transactions involving settlement by cheques. The term inherent risk may have other
definitions in other contexts.;

2. Control Risk (CR): The risk that a misstatement may not be prevented or detected
and corrected due to weakness in the entity's internal control mechanism. Example,
control risk assessment may be higher in an entity where separation of duties is not
well defined; and

3. Detection Risk (DR): The probability that the auditing procedures may fail to detect
existence of a material error or fraud. Detection risk may be due to sampling error or
non-sampling error.

Audit risk can be calculated as:

AR = IR × CR × DR

11.2 Enterprise Risk Management

Enterprise risk management (ERM) in business includes the methods and processes
used by organizations to manage risks and seize opportunities related to the
achievement of their objectives. ERM provides a framework for risk management,
which typically involves identifying particular events or circumstances relevant to the
organization's objectives (threats and opportunities), assessing them in terms of
likelihood and magnitude of impact, determining a response strategy, and monitoring
process. By identifying and proactively addressing risks and opportunities, business
enterprises protect and create value for their stakeholders, including owners,
employees, customers, regulators, and society overall.

ERM can also be described as a risk-based approach to managing an enterprise,

integrating concepts of internal control, the Sarbanes–Oxley Act, data protection and
strategic planning. ERM is evolving to address the needs of various stakeholders,
who want to understand the broad spectrum of risks facing complex organizations to
ensure they are appropriately managed. Regulators and debt rating agencies have
increased their scrutiny on the risk management processes of companies.

According to Thomas Stanton of Johns Hopkins University, the point of enterprise

risk management is not to create more bureaucracy, but to facilitate discussion on
what the really big risks are.

77
11.3 ERM Frameworks ‘Defined
There are various important ERM frameworks, each of which describes an approach
for identifying, analyzing, responding to, and monitoring risks and opportunities,
within the internal and external environment facing the enterprise. Management
selects a risk response strategy for specific risks identified and analyzed, which may
include:
Avoidance: exiting the activities giving rise to risk

Reduction: taking action to reduce the likelihood or impact related to the risk

Alternative Actions: deciding and considering other feasible steps to minimize risks

Share or Insure: transferring or sharing a portion of the risk, to finance it

Accept: no action is taken, due to a cost/benefit decision

Monitoring is typically performed by management as part of its internal control

activities, such as review of analytical reports or management committee meetings
with relevant experts, to understand how the risk response strategy is working and
whether the objectives are being achieved.

11.4 Casualty Actuarial Society framework

In 2003, the Casualty Actuarial Society (CAS) defined ERM as the discipline by
which an organization in any industry assesses, controls, exploits, finances, and
monitors risks from all sources for the purpose of increasing the organization's short-
and longterm value to its stakeholders." The CAS conceptualized ERM as
proceeding across the two dimensions of risk type and risk management processes.
The risk types and examples include:

1. Hazard risk

2. Liability torts, Property damage, Natural catastrophe

3. Financial risk

4. Pricing risk, Asset risk, Currency risk, Liquidity risk

5. Operational risk

6. Customer satisfaction, Product failure, Integrity, Reputational risk; Internal Poaching;

Knowledge drain

7. Strategic risks

8. Competition, Social trend, Capital availability

11.5.1 The Risk Management Process Involves

1. Establishing Context: This includes an understanding of the current conditions in
which the organization operates on an internal, external and risk management
context.
78
2. Identifying Risks: This includes the documentation of the material threats to the
organization‗s achievement of its objectives and the representation of areas that the
organization may exploit for competitive advantage.

3. Analyzing/Quantifying Risks: This includes the calibration and, if possible, creation of

probability distributions of outcomes for each material risk.

4. Integrating Risks: This includes the aggregation of all risk distributions, reflecting
correlations and portfolio effects, and the formulation of the results in terms of impact
on the organization‗s key performance metrics.

5. Assessing/Prioritizing Risks: This includes the determination of the contribution of

each risk to the aggregate risk profile, and appropriate prioritization.

6. Treating/Exploiting Risks: This includes the development of strategies for controlling

and exploiting the various risks.

7. Monitoring and Reviewing: This includes the continual measurement and monitoring
of the risk environment and the performance of the risk management strategies.

11.5.2 COSO ERM framework

The COSO "Enterprise Risk Management-Integrated Framework" published in 2004
(New edition COSO ERM 2017 is not Mentioned and the 2004 version is outdated)
defines ERM as a "…process, effected by an entity's board of directors,
management, and other personnel, applied in strategy setting and across the
enterprise, designed to identify potential events that may affect the entity, and
manage risk to be within its risk appetite, to provide reasonable assurance regarding
the achievement of entity objectives."

The COSO ERM Framework has eight Components and four objectives categories.
It is an expansion of the COSO Internal Control-Integrated Framework published in
1992 and amended in 1994. The eight components - additional components
highlighted - are:

1. Authority and pledge to the ERM

2. RISK Management policy

3. Mixer of ERM in the institution

4. Risk Assessment

5. Risk Response

6. Communication and Reporting

7. Information and Communication

8. Monitoring
79
 The four objectives categories - additional components highlighted - are:
1. Strategy - high-level goals, aligned with and supporting the organization's mission

2. Operations - effective and efficient use of resources

3. Financial Reporting - reliability of operational and financial reporting

4. Compliance - compliance with applicable laws and regulations

11.5.3 ISO 31000: The new International Risk Management Standard

ISO 31000 is an International Standard for Risk Management which was published
on 13 November 2009. An accompanying standard, ISO 31010 - Risk Assessment
Techniques, soon followed publication (December 1, 2009) together with the
updated Risk Management vocabulary ISO Guide 73.

11.6 RIMS Risk Maturity Model

The RIMS Risk Maturity Model (RMM) for Enterprise Risk Management, published in
2006, is an umbrella framework of content and methodology that detail the
requirements for sustainable and effective enterprise risk management. The RMM
model consists of twenty-five competency drivers for seven attributes that create
ERM‗s value and utility in an organization. The 7 attributes are:

1. ERM-based approach

2. ERM process management

3. Risk appetite management

4. Root cause discipline

5. Uncovering risks

6. Performance management

6. Business resiliency and sustainability

The model was developed by Steven Minsky, CEO of Logic Manager, and published
by the Risk and Insurance Management Society in collaboration with the RIMS ERM
Committee. The Risk Maturity Model is based on the Capability Maturity Model,
amethodology founded by the Carnegie Mellon University Software Engineering
Institute (SEI) in the 1980s.

11.7 Implementing an ERM program

Organizations by nature manage risks and have a
variety of existing departments or functions ("risk functions") that identify and
manage particular risks. However, each risk function varies in capability and how it
coordinates with other risk functions. A central goal and challenge of ERM is
improving this capability and coordination, while integrating the output to provide a

80
 unified picture of risk for stakeholders and improving the organization's ability to
manage the risks effectively.

11.8 Common Challenges in ERM Implementation

Various consulting firms offer suggestions for how to implement an ERM program.
Common topics and challenges include:

1. Identifying executive sponsors for ERM.

2. Establishing a common risk language or glossary.
3. Describing the entity's risk appetite (i.e., risks it will and will not take)
4. Identifying and describing the risks in a "risk inventory".
5. Implementing a risk-ranking methodology to prioritize risks within and across
functions.
6. Establishing a risk committee and or Chief Risk Officer (CRO) to coordinate certain
activities of the risk functions.
7. Establishing ownership for particular risks and responses.
8. Demonstrating the cost-benefit of the risk management effort.
9. Developing action plans to ensure the risks are appropriately managed.
10. Developing consolidated reporting for various stakeholders.
11. Monitoring the results of actions taken to mitigate risk.
12. Ensuring efficient risk coverage by internal auditors, consulting teams, and other
evaluating entities.
13. Developing a technical ERM framework that enables secure participation by 3rd
parties and remote employees.

81
 CHAPTER TWELVE
COMPLIANCE

12.1 Introduction
In general, compliance means conforming to a rule, such as a specification, policy,
standard or law. Regulatory compliance describes the goal that organizations aspire
to achieve in their efforts to ensure that they are aware of and take steps to comply
with relevant laws, policies, and regulations. Due to the increasing number of
regulations and need for operational transparency, organizations are increasingly
adopting the use of consolidated and harmonized sets of compliance controls. This
approach is used to ensure that all necessary governance requirements can be met
without the unnecessary duplication of effort and activity from resources.

Regulations and accrediting organizations vary among fields, with examples such as
PCI-DSS and GLBA in the financial industry, FISMA for U.S. federal agencies,
HACCP for the food and beverage industry, and the Joint Commission and HIPAA in
healthcare. In some cases, other compliance frameworks (such as COBIT) or even
standards (NIST) inform on how to comply with regulations.

Some organizations keep compliance data all data belonging or pertaining to the
enterprise or included in the law, which can be used for the purpose of implementing
or validating compliance—in a separate store for meeting reporting requirements.
Compliance software is increasingly being implemented to help companies manage
their compliance data more efficiently. This store may include calculations, data
transfers, and audit trails.

12.2 By Nation
Regulatory compliance varies not only by industry but often by location. The
financial, research, and pharmaceutical regulatory structures in one country, for
example, may be similar but with particularly different nuances in another country.
These similarities and differences are often a product "of reactions to the changing
objectives and requirements in different countries, industries, and policy contexts.

12.3.1 Business Motivation Model

The Business Motivation Model (BMM) in enterprise architecture provides a scheme
and structure for developing, communicating, and managing business plans in an
organized manner. Specifically, the Business Motivation Model does all of the
following:

1. Identifies factors that motivate the establishing of business plans;

2. I Dentifies and defines the elements of business plans; and

3. Indicates how all these factors and elements inter-relate.

Initially developed by the Business Rules Group (BRG), in September 2005, the
Object Management Group (OMG) voted to accept the Business Motivation Model
as the subject of a Request for Comment (RFC). This meant that the OMG was
willing to consider the Business Motivation Model as a specification to be adopted by
the OMG, subject to comment from any interested parties. Adoption as an OMG
82
 specification carries the intention that the Business Motivation Model would, in time,
be submitted to the International Organization for Standardization (ISO) as a
standard.

12.3.2 Elements
"BMM captures business requirements across different dimensions to rigorously
capture and justify why the business wants to do something, what it is aiming to
achieve, how it plans to get there, and how it assesses the result."

The main elements of BMM are

Ends: What (as opposed to how) the business wants to accomplish
Means: How the business intends to accomplish its ends
Directives: The rules and policies that constrain or govern the available
means
Influencers: Can cause changes that affect the organization in its employment of its
means or achievement of its ends. Influencers are neutral by definition.
Assessment: A judgment of an Influencer that affects the organization's ability to
achieve its ends or use its means.

12.4 Governance, Risk Management, and Compliance

Governance, risk management and compliance (GRC) is the term covering an
organization's approach across these three practices: Governance, risk
management, and compliance. The first scholarly research on GRC was published
in 2007 where GRC was formally defined as "the integrated collection of capabilities
that enable an organization to reliably achieve objectives, address uncertainty and
act with integrity." The research referred to common "keep the company on track"
activities conducted in departments such as internal audit, compliance, risk, legal,
finance, IT, HR as well as the lines of business, executive suite and the board itself.

12.5 Overview
Governance, risk management, and compliance are three related facets that aim to
assure an organization reliably achieves objectives, addresses uncertainty and acts
with integrity. Governance is the combination of processes established and executed
by the directors (or the board of directors) that are reflected in the organization's
structure and how it is managed and led toward achieving goals. Risk management
is predicting and managing risks that could hinder the organization from reliably
achieving its objectives under uncertainty. Compliance refers to adhering with the
mandated boundaries (laws and regulations) and voluntary boundaries (company's
policies, procedures, etc.).

GRC is a discipline that aims to synchronize information and activity across

governance, and compliance in order to operate more efficiently, enable effective
information sharing, more effectively report activities and avoid wasteful overlaps.
Although interpreted differently in various organizations, GRC typically encompasses
activities such as corporate governance, enterprise risk management (ERM) and
corporate compliance with applicable laws and regulations.

Organizations reach a size where coordinated control over GRC activities is required
to operate effectively. Each of these three disciplines creates information of value to

83
 the other two, and all three impacts the same technologies, people, processes and
information.

Substantial duplication of tasks evolves when governance, risk management and

compliance are managed independently. Overlapping and duplicated GRC activities
negatively impact both operational costs and GRC matrices. For example, each
internal service might be audited and assessed by multiple groups on an annual
basis, creating enormous cost and disconnected results. A disconnected GRC
approach will also prevent an organization from providing real-time GRC executive
reports. GRC supposes that this approach, like a badly planned transport system,
every individual route will operate, but the network will lack the qualities that allow
them to work together effectively.

If not integrated, if tackled in a traditional "silo" approach, most organizations must

sustain unmanageable numbers of GRC-related requirements due to changes in
technology, increasing data storage, market globalization and increased regulation.

12.6 Basic Concepts

Governance describes the overall management approach through which senior
executives direct and control the entire organization, using a combination of
management information and hierarchical management control structures.

Governance activities ensure that critical management information reaching the

executive team is sufficiently complete, accurate and timely to enable appropriate
management decision making, and provide the control mechanisms to ensure that
strategies, directions and instructions from management are carried out
systematically and effectively.

Risk management is the set of processes through which management identifies,

analyzes, and, where necessary, responds appropriately to risks that might
adversely affect realization of the organization's business objectives. The response
to risks typically depends on their perceived gravity, and involves controlling,
avoiding, accepting or transferring them to a third party, whereas organizations
routinely manage a wide range of risks (e.g. technological risks, commercial/financial
risks, information security risks etc.).

Compliance means conforming to stated requirements. At an organizational level, it

is achieved through management processes which identify the applicable
requirements (defined for example in laws, regulations, contracts, strategies and
policies), assess the state of compliance, assess the risks and potential costs of
non-compliance against the projected expenses to achieve compliance, and hence
prioritize, fund and initiate any corrective actions deemed necessary.

12.7 GRC Market Segmentation

A GRC program can be instituted to focus on any individual area within the
enterprise, or a fully integrated GRC is able to work across all areas of the
enterprise, using a single framework.

84
 A fully integrated GRC uses a single core set of control material, mapped to all of the
primary governance factors being monitored. The use of a single framework also
has the benefit of reducing the possibility of duplicated remedial actions.

When reviewed as individual GRC areas, the three most common individual
headings are considered to be Financial GRC, IT GRC, and Legal GRC.

Financial GRC relates to the activities that are intended to ensure the correct
operation of all financial processes, as well as compliance with any finance-related
mandates.
IT GRC relates to the activities intended to ensure that the IT (Information
Technology) organization supports the current and future needs of the business, and
complies with all IT-related mandates.

Legal GRC focuses on tying together all three components via an organization's
legal department and chief compliance officer.

Analysts disagree on how these aspects of GRC are defined as market categories.
Gartner has stated that the broad GRC market includes the following areas:

1. Finance and audit GRC

2. IT GRC management

3. Enterprise risk management.

They further divide the IT GRC management market into these key capabilities.
Although this list relates to IT GRC, a similar list of capabilities would be suitable for
other areas of GRC.

4. Controls and policy library

5. Policy distribution and response

6. IT Controls self-assessment and measurement

7. IT Asset repository

8. Automated general computer control (GCC) collection

9. Remediation and Exception Management

10. Reporting

11. Advanced IT risk evaluation and compliance dashboards

12.8 GRC Product Vendors

The distinctions between the sub-segments of the broad GRC market are often not
clear. With a large number of vendors entering this market recently, determining the
best product for a given business problem can be challenging. Given that the
85
analysts don‗t fully agree on the market segmentation, vendor positioning can
increase the confusion.

Due to the dynamic nature of this market, any vendor analysis is often out of date
relatively soon after its publication.

Broadly, the vendor market can be considered to exist in 3 segments:

Integrated GRC solutions (multi-governance interest, enterprise wide)

Domain specific GRC solutions (single governance interest, enterprise wide)

Point solutions to GRC (relate to enterprise wide governance or enterprise wide risk
or enterprise wide compliance but not in combination.)

Integrated GRC solutions attempt to unify the management of these areas, rather
than treat them as separate entities. An integrated solution is able to administer one
central library of compliance controls, but manage, monitor and present them
against every governance factor. For example, in a domain specific approach, three
or more findings could be generated against a single broken activity. The integrated
solution recognizes this as one break relating to the mapped governance factors.

Domain specific GRC vendors understand the cyclical connection between

governance, risk and compliance within a particular area of governance. For
example, within financial processing — that a risk will either relate to the absence of
a control (need to update governance) and/or the lack of adherence to (or poor
quality of) an existing control.

An initial goal of splitting out GRC into a separate market has left some vendors
confused about the lack of movement. It is thought that a lack of deep education
within a domain on the audit side, coupled with a mistrust of audit in general causes
a rift in a corporate environment. However, there are vendors in the marketplace
that, while remaining domain-specific, have begun marketing their product to end
users and departments that, while either tangential or overlapping, have expanded
to include the internal corporate internal audit (CIA) and external audit teams (tier 1
big four AND tier two and below), information security and operations/production as
the target audience.
This approach provides a more 'open book' approach into the process. If the
production team will be audited by CIA using an application that production also has
access to, is thought to reduce risk more quickly as the end goal is not to be
'compliant' but to be 'secure,' or as secure as possible.

Point solutions to GRC are marked by their focus on addressing only one of its
areas. In some cases of limited requirements, these solutions can serve a viable
purpose. However, because they tend to have been designed to solve domain
specific problems in great depth, they generally do not take a unified approach and
are not tolerant of integrated governance requirements. Information systems will
address these matters better if the requirements for GRC management are
incorporated at the design stage, as part of a coherent framework.

86
12.9 GRC Data Warehousing and Business Intelligence
GRC vendors with an integrated data framework are now able to offer custom built
GRC data warehouse and business intelligence solutions. This allows high value
data from any number of existing GRC applications to be collated and analysed.

The aggregation of GRC data using this approach adds significant benefit in the
early identification of risk and business process (and business control) improvement.

Further benefits to this approach include (i) it allows existing, specialist and high
value applications to continue without impact (ii) organizations can manage an
easier transition into an integrated GRC approach because the initial change is only
adding to the reporting layer and (iii) it provides a real-time ability to compare and
contrast data value across systems that previously had no common data scheme.

12.10 GRC Research

A publication review carried out in 2009[citation needed] found that there was hardly
any scientific research on GRC. The authors went on to derive the first GRC short
definition from an extensive literature review. Subsequently, the definition was
validated in a survey among GRC professionals. "GRC is an integrated, holistic
approach to organisation-wide GRC ensuring that an organisation acts ethically
correct and in accordance with its risk appetite, internal policies and external
regulations through the alignment of strategy, processes, technology and people,
thereby improving efficiency and effectiveness." The authors then translated the
definition into a frame of reference for GRC research.

Each of the core disciplines – Governance, Risk Management and Compliance –

consists of the four basic components: strategy, processes, technology and people.
The organization‗s risk appetite, its internal policies and external regulations
constitute the rules of GRC. The disciplines, their components and rules are now to
be merged in an integrated, holistic and organisation-wide (the three main
characteristics of GRC) manner – aligned with the (business) operations that are
managed and supported through GRC. In applying this approach, organisations long
to achieve the objectives: ethically correct behaviour, and improved efficiency and
effectiveness of any of the elements involved.

87
 CHAPTER THIRTEEN
RECORDS MANAGEMENT

13.1 Introduction
Records management, also known as records and information management, is an
organizational function devoted to the management of information in an organization
throughout its life cycle, from the time of creation or receipt to its eventual
disposition. This includes identifying, classifying, storing, securing, retrieving,
tracking and destroying or permanently preserving records. The ISO 15489-1: 2001
standard ("ISO 15489-1:2001") defines records management as "[the] field of
management responsible for the efficient and systematic control of the creation,
receipt, maintenance, use and disposition of records, including the processes for
capturing and maintaining evidence of and information about business activities and
transactions in the form of records.

An organization's records preserve aspects of institutional memory. In determining

how long to retain records, their capacity for re-use is important. Many are kept as
evidence of activities, transactions, and decisions. Others document what happened
and why. The purpose of records management is part of an organization's broader
function of Governance, risk management, and compliance and is primarily
concerned with managing the evidence of an organization's activities as well as the
reduction or mitigation of risk associated with it. Recent research shows linkages
between records management and accountability in governance.

13.2 Concepts of Record

The concept of record is variously defined. The ISO 15489-1:2016 defines records
as "information created, received, and maintained as evidence and as an asset by
an organization or person, in pursuit of legal obligations or in the transaction of
business." While there are many purposes of and benefits to records management,
as this definition highlights a key feature of records is their ability to serve as
evidence of an event. Proper records management can help preserve this feature of
records.

Recent and comprehensive studies have defined records as "persistent

representations of activities" as recorded or created by participants or observers.
This transactional view emphasizes the importance of context and process in the
determination and meaning of records. In contrast, previous definitions have
emphasized the evidential and informational properties of records. In organizational
contexts, records are materials created or received by an organization in the
transaction of business, or in pursuit of or in compliance with legal obligations. This
organizational definition of record stems from the early theorization of archives
asorganic aggregations of records that is "the written documents, drawings and
printed matter, officially received or produced by an administrative body or one of its
officials.

A record is a document consciously retained as evidence of an action. Records

management systems generally distinguish between records and non-records
88
(convenience copies, rough drafts, duplicates), which do not need formal
management. Many systems, especially for electronic records, require documents to
be formally declared as a record so they can be managed. Once declared, a record
cannot be changed and can only be disposed of within the rules of the system.

Records may be covered by access controls to regulate who can access them and
under what circumstances. Physical controls may be used to keep confidential
records secure – personnel files, for instance, which hold sensitive personal data,
may be held in a locked cabinet with a control log to track access. Digital records
systems may include role-based access controls, allowing permissions (to view,
change and/or delete) to be allocated to staff depending on their role in the
organisation. An audit trail showing all access and changes can be maintained to
ensure the integrity of the records.

Just as the records of the organization come in a variety of formats, the storage of
records can vary throughout the organization. File maintenance may be carried out
by the owner, designee, a records repository, or clerk. Records may be managed in
a centralized location, such as a records center or repository, or the control of
records may be decentralized across various departments and locations within the
entity. Records may be formally and discretely identified by coding and housed in
folders specifically designed for optimum protection and storage capacity, or they
may be casually identified and filed with no apparent indexing. Organizations that
manage records casually find it difficult to access and retrieve information when
needed. The inefficiency of filing maintenance and storage systems can prove to be
costly in terms of wasted space and resources expended searching for records.

An inactive record is a record that is no longer needed to conduct current business

but is being preserved until it meets the end of its retention period, such as when a
project ends, a product line is retired, or the end of a fiscal reporting period is
reached. These records may hold business, legal, fiscal, or historical value for the
entity in the future and, therefore, are required to be maintained for a short or
permanent duration. Records are managed according to the retention schedule.
Once the life of a record has been satisfied according to its predetermined period
and there are no legal holds pending, it is authorized for final disposition, which may
include destruction, transfer, or permanent preservation.

A disaster recovery plan is a written and approved course of action to take after a
disaster strikes that details how an organization will restore critical business
functions and reclaim damaged or threatened records.

An active record is a record needed to perform current operations, subject to

frequent use, and usually located near the user. In the past, 'records management'
was sometimes used to refer only to the management of records which were no
longer in everyday use but still needed to be kept – "semi-current" or "inactive"
records, often stored in basements or offsite. More modern usage tends to refer to
the entire "lifecycle" of records – from the point of creation right through until their
eventual disposal.

The format and media of records is generally irrelevant for the purposes of records
management from the perspective that records must be identified and managed,
89
 regardless of their form. The ISO considers management of both physical and
electronic records. Also, section DL1.105 of the United States Department of
Defense standard DoD 5015.02-STD (2007) defines Records Management as "the
planning, controlling, directing, organizing, training, promoting, and other managerial
activities involving the life cycle of information, including creation, maintenance (use,
storage, retrieval), and disposal, regardless of media."

13.3 Records Management Theory

13.3.1 Records Life-Cycle
The records life-cycle consists of discrete phases covering the life span of a record
from its creation to its final disposition. In the creation phase, records growth is
expounded by modern electronic systems. Records will continue to be created and
captured by the organization at an explosive rate as it conducts the business of the
organization. Correspondence regarding a product failure is written for internal
leadership, financial statements and reports are generated for public and regulatory
scrutiny, the old corporate logo is retired, and a new one – including color scheme
and approved corporate font – takes its place in the organization's history.

Examples of records phases include those for creation of a record, modification of a

record, movement of a record through its different states while in existence, and
destruction of a record.

Throughout the records life cycle, issues such as security, privacy, disaster
recovery, emerging technologies, and mergers are addressed by the records and
information management professional responsible for organizational programs.
Records and information management professionals are instrumental in controlling
and safeguarding the information assets of the entity. They understand how to
manage the creation, access, distribution, storage, and disposition of records and
information in an efficient and cost-effective manner using records and information
management methodology, principles, and best practices in compliance with records
and information laws and regulations.

13.3.2 Records Continuum Theory

The records continuum theory is an abstract conceptual model that helps to
understand and explore recordkeeping activities in relation to multiple contexts over
space and time.

13.4.1 Records Management Practices and Concepts

A records manager is someone who is responsible for records management in an
organization.

Section 4 of the ISO 15489-1:2001 states that records management includes:

1. Setting policies and standards

2. Assigning responsibilities and authorities

3. Establishing and promulgating procedures and guidelines

4. Providing a range of services relating to the management and use of records

90
5. Designing, implementing and administering specialized systems for managing
records

6. Integrating records management into business systems and processes

13.4.2 Practice of Records Management may involve

1. Planning the information needs of an organization

2. Identifying information requiring capture

3. Creating, approving, and enforcing policies and practices regarding records,

including their organization and disposal

4. Developing a records storage plan, this includes the short and long-term housing of
physical records and digital information

5. Identifying, classifying, and storing records

6. Coordinating access to records internally and outside of the organization, balancing

the requirements of business confidentiality, data privacy, and public access.

7. Identification and maintenance of records per a specified retention period

Executing a retention policy on the disposal of records which are no longer required
for operational reasons; according to organizational policies, statutory requirements,
and other regulations this may involve either their destruction or permanent
preservation in an archive.

Records-management principles and automated records-management systems aid

in the capture, classification, and ongoing management of records throughout their
lifecycle. ARMA International defines records management as "the field of
management responsible for establishing and implementing policies, systems, and
procedures to capture, create, access, distribute, use, store, secure, retrieve, and
ensure disposition of an organization's records and information". Such a system may
be paper-based (such as index cards as used in a library), or may involve a
computer system, such as an electronic records-management application.

13.5 Defensible Solutions

A defensible solution is one that can be supported with clearly documented policies,
processes and procedures that drive how and why work is performed, as well as one
that has clearly documented proof of behavior patterns, proving that an organization
follows such documented constraints to the best of their ability.

While defensibility applies to all aspects of records life cycle, it is considered most
important in the context of records destruction, where it is known as "defensible
disposition" or "defensible destruction," and helps an organization explicitly justify
and prove things like who destroys records, why they destroy them, how they
destroy them, when they destroy them, and where they destroy them.

91
13.6 Classification
Records managers use classification or categorization of record types as a means of
working with records. Such classifications assist in functions such as creation,
organization, storage, retrieval, movement, and destruction of records.

At the highest level of classification are physical versus electronic records. (This is
disputable; records are defined as such regardless of media. ISO 15489 and other
best practices promulgate a functions based, rather than media based classification,
because the law defines records as certain kinds of information regardless of
media.)

Physical records are those records, such as paper, that can be touched and which
takes up physical space.

Electronic records, also often referred to as digital records, are those records that
are generated with and used by information technology devices.

Classification of records is achieved through the design, maintenance, and

application of taxonomies, which allow records managers to perform functions such
as the categorization, tagging, segmenting, or grouping of records according to
various traits.

13.7 Enterprise Records

Enterprise records represent those records that are common to most enterprises,
regardless of their function, purpose, or sector. Such records often revolve around
the day-to-day operations of an enterprise and cover areas such as but not limited
litigation, employee management, consultant or contractor management, customer
engagements, purchases, sales, and contracts.

The types of enterprises that produce and work with such records include but are not
limited to for-profit companies, non-profit companies, and government agencies.

13.8 Industry Records

Industry records represent those records that are common and apply only to a
specific industry or set of industries. Examples include but are not limited to medical
industry records (e.g., the Health Insurance Portability and Accountability Act),
pharmaceutical industry records, and food industry records.

13.9 Legal Hold Records

Legal hold records are those records that are mandated, usually by legal counsel or
compliance personnel, to be held for a period of time, either by a government or by
an enterprise, and for the purposes of addressing potential issues associated with
compliance audits and litigation. Such records are assigned Legal Hold traits that
are in addition to classifications which are as a result of enterprise or industry
classifications.

Legal hold data traits may include but are not limited to things such as legal hold
flags (e.g. Legal Hold = True or False), the organization driving the legal hold,
descriptions of why records must be legally held, what period of time records must
be held for, and the hold location.
92
13.10 Records Retention Schedule
A record retention schedule is a document, often developed using archival appraisal
concepts and analysis of business and legal contexts within the intended
jurisdictions that outlines how long certain types of records need to be retained for
before they can be destroyed.

13.11 Managing Physical Records

Managing physical records involves different disciplines or capabilities and may
draw on a variety of forms of expertise.

13.12 Identifying Records

If an item is presented as a legal record, it needs to be authenticated. Forensic
experts may need to examine a document or artifact to determine that it is not a
forgery, and that any damage, alteration, or missing content is documented. In
extreme cases, items may be subjected to a microscope, x-ray, radiocarbon dating
or chemical analysis. This level of authentication is rare, but requires that special
care be taken in the creation and retention of the records of an organization.

13.13 Storing Records

Records must be stored in such a way that they are accessible and safeguarded
against environmental damage. A typical paper document may be stored in a filing
cabinet in an office. However, some organisations employ file rooms with specialized
environmental controls including temperature and humidity. Vital records may need
to be stored in a disaster-resistant safe or vault to protect against fire, flood,
earthquakes and conflict. In extreme cases, the item may require both disaster-
proofing and public access, such as the original, signed US Constitution. Civil
engineers may need to be consulted to determine that the file room can effectively
withstand the weight of shelves and file cabinets filled with paper; historically, some
military vessels were designed to take into account the weight of their operating
procedures on paper as part of their ballast equation (modern record-keeping
technologies have transferred much of that information to electronic storage). In
addition to on-site storage of records, many organizations operate their own off-site
records centers or contract with commercial records centers.

13.14 Retrieval of Records

In addition to being able to store records, enterprises must also establish the proper
capabilities for retrieval of records, in the event they are needed for a purpose such
as an audit or litigation, or for the case of destruction. Record retrieval capabilities
become complex when dealing with electronic records, especially when they have
not been adequately tagged or classified for discovery.

13.15 Circulating Records

Tracking the record while it is away from the normal storage area is referred to as
circulation. Often this is handled by simple written recording procedures. However,
many modern records environments use a computerized system involving bar code
scanners, or radio-frequency identification technology (RFID) to track movement of

93
 the records. These can also be used for periodic auditing to identify unauthorized
movement of the record.

13.16 Disposal of Records

Disposal of records does not always mean destruction. It can also include transfer to
a historical archive, museum, or private individual. Destruction of records ought to be
authorized by law, statute, regulation, or operating procedure, and the records
should be disposed of with care to avoid inadvertent disclosure of information. The
process needs to be well-documented, starting with a records retention schedule
and policies and procedures that have been approved at the highest level. An
inventory of the records disposed of should be maintained, including certification that
they have been destroyed. Records should never simply be discarded as refuse.
Most organizations use processes including pulverization, paper shredding or
incineration.

Commercially available products can manage records through all processes active,
inactive, archival, retention scheduling and disposal. Some also utilize RFID
technology for the tracking of the physical file.

13.16 Managing Digital Records

The general principles of records management apply to records in any format. Digital
records, however, raise specific issues. It is more difficult to ensure that the content,
context and structure of records is preserved and protected when the records do not
have a physical existence. This has important implications for the authenticity,
reliability, and trustworthiness of records.

Much research is being conducted on the management of digital records. The

International Research on Permanent Authentic Records in Electronic Systems
(InterPARES) Project is one example of such an initiative. Based at the School of
Library, Archival and Information Studies at the University of British Columbia, in
Vancouver, British Columbia, Canada, the InterPARES Project is a collaborative
project between researchers all across the world committed to developing theories
and methodologies to ensure the reliability, accuracy, and authenticity of digital
records.

Functional requirements for computer systems to manage digital records have been
produced by the US Department of Defense. The United Kingdom's National
Archives and the European Commission, whose MoReq (Model Requirements for
the Management of Electronic Records) specification has been translated into at
least twelve languages funded by the European Commission.

Particular concerns exist about the ability to access and read digital records over
time, since the rapid pace of change in technology can make the software used to
create the records obsolete, leaving the records unreadable. A considerable amount
of research is being undertaken to address this, under the heading of digital
preservation. The Public Record Office Victoria (PROV) located in Melbourne,
Australia published the Victorian Electronic Records Strategy (VERS) which includes
a standard for the preservation, long-term storage and access to permanent
electronic records. The VERS standard has been adopted by all Victorian
Government departments. A digital archive has been established by PROV to
94
 enable the general public to access permanent records. Archives New Zealand is
also setting up a digital archive.

13.17 Electronic Tax Records

Electronic Tax Records are computer-based/non-paper versions of records required
by tax agencies like the Internal Revenue Service. There is substantial confusion
about what constitutes acceptable digital records for the IRS, as the concept is
relatively new. The subject is discussed in Publication 583 and Bulletin 1997-13, but
not in specific detail.

Businesses and individuals wishing to convert their paper records into scanned
copies may be at risk if they do so. For example, it is unclear if an IRS auditor would
accept a JPEG, PNG, or PDF format scanned copy of a purchase receipt for a
deducted expense item.

13.18 Current Issues

13.18.1 Compliance and Legal Issues
While public administration, healthcare and the legal profession have a long history
of records management, the corporate sector has generally shown less interest. This
has changed in recent years due to new compliance requirements, driven in part by
scandals such as the Enron/Andersen affair and more recent problems at Morgan
Stanley. Corporate records compliance issues including retention period
requirements and the need to disclose information as a result of litigation have come
to be seen as important. Statutes such as the US Sarbanes-Oxley Act have resulted
in greater standardization of records management practices. Since the 1990s the
shift towards electronic records has seen a need for close working relations between
records managers and IT managers, particularly including the legal aspects, focused
on compliance and risk management.

13.18.2 Security
Privacy, data protection, and identity theft have become issues of increasing
interest. The role of the records manager in the protection of an organization's
records has grown as a result. The need to ensure personal information is not
retained unnecessarily has brought greater focus to retention schedules and records
disposal.

13.18.3 Transparency
The increased importance of transparency and accountability in public
administration, marked by the widespread adoption of Freedom of Information laws,
has led to a focus on the need to manage records so that they can be easily
accessed by the public. For instance, in the United Kingdom, Section 46 of the
Freedom of Information Act 2000 required the government to publish a Code of
Practice on Records Management for public authorities. Similarly, European Union
legislation on Data Protection and

Environmental Information, requiring organisations to disclose information on

request, create a need for effective management of such records.

95
13.18.4 Adoption and Implementation
Implementing required changes to organisational culture is a major challenge, since
records management is often seen as an unnecessary or low priority administrative
task that can be performed at the lowest levels within an organization. Reputational
damage caused by poor records management has demonstrated that records
management is the responsibility of all individuals within an organization.

An issue that has been very controversial among records managers has been the
uncritical adoption of Electronic document and records management systems.

13.18.5 Impact of Internet and Social Media

Another issue of great interest to records managers is the impact of the internet and
related social media, such as wikis, blogs, forums, and companies such as
Facebook and Twitter, on traditional records management practices, principles, and
concepts, since many of these tools allow rapid creation and dissemination of
records and, often, even in anonymous form.

13.18.6 Records Life Cycle Management

A difficult challenge for many enterprises is tied to the tracking of records through
their entire information life cycle so that it's clear, at all times, where a record exists
or if it still exists at all. The tracking of records through their life cycles allows records
management staff to understand when and how to apply records related rules, such
as rules for legal hold or destruction.

13.18.7 Conversion of Paper Records to Electronic Form

As the world becomes more digitals in nature, an ever-growing issue for the records
management community is the conversion of existing or incoming paper records to
electronic form. Such conversions are most often performed with the intent of saving
storage costs, storage space, and in hopes of reducing records retrieval time.

Tools such as document scanners, optical character recognition software, and

electronic document management systems are used to facilitate such conversions.

13.19 `Electronic Records Management Systems

An Electronic Document and Records Management System is a computer program
or set of programs used to track and store records. The term is distinguished from
imaging and document management systems that specialize in paper capture and
document management respectively. Electronic records management Systems
commonly provide specialized security and auditing functionality tailored to the
needs of records managers.
The National Archives and Records Administration (NARA) has endorsed the U.S.
Department of Defense standard 5015.2 as an "adequate and appropriate basis for
addressing the basic challenges of managing records in the automated environment
that increasingly characterizes the creation and use of records." Records
Management Vendors can be certified as compliant with the DoD 5015.2-STD after
verification from the Joint Interoperability Test Command which builds test case
procedures, writes detailed and summary final reports on 5015.2-certified products,
and performs on-site inspection of software.

96
 The National Archives in the UK has published two sets of functional requirements to
promote the development of the electronic records management software market
(1999 and 2002). It ran a program to evaluate products against the 2002
requirements. While these requirements were initially formulated in collaboration
with central government, they have been taken up with enthusiasm by many parts of
the wider public sector in the UK and in other parts of the world. The testing program
has now closed; The National Archives is no longer accepting applications for
testing. The National Archives 2002 requirements remain current.

The European Commission has published "MoReq", the Model Requirements for
Electronic Records and Document Management in 2001. Although not a formal
standard, it is widely regarded and referred to as a standard. This was funded by the
Commission's IDA program, and was developed at the instigation of the DLM Forum.
A major update of MoReq, known as MoReq2, was published in February 2008. This
too was initiated by the DLM Forum and funded by the European Commission, on
this occasion by its IDABC program (the successor to IDA). A software testing
framework and an XML schema accompany MoReq2; a software compliance testing
regime was agreed at the DLM Forum conference in Toulouse in December 2008.

The National Archives of Australia (NAA) published the Functional Specifications for
Electronic Records Management Systems Software (ERMS), and the associated
Guidelines for Implementing the Functional Specifications for Electronic Records
Management Systems Software, as exposure drafts in February 2006.

Archives New Zealand published a 'discretionary best practice' Electronic

Recordkeeping Systems Standard (Standard 5) in June 2005, issued under the
authority of Section 27 of the Public Records Act 2005.

13.20 Commercial Records Centers

Commercial records centers are facilities which provide services for the storage for
paper records for organizations. In some cases, they also offer storage for records
maintained in electronic formats. Commercial records centers provide high density
storage for paper records and some offer climate controlled storage for sensitive
nonpaper and critical (vital) paper media. There is a trade organization for
commercial records centers (for example, PRISM International), however, not all
service providers are members.

97
 REFERENCES
David Griffiths. "Internal audit – Risk based – Introduction". Internal audit. biz.

"Format of Internal Audit Report". Internal audit expert. in. Archived from the original on 7
December 2013. Retrieved 3 December 2013.

Frigo, Mark L. A Balanced Scorecard Framework for Internal Auditing Departments.IIA

Research Foundation. Altamonte Springs, FL.: 2002.

"IIA-GAIN Study-Knowledge Report—Measuring Internal Audit Performance— September

2009".Theiia.org. 2000-01-01.Archived from the original on 2012-03- 08.Retrieved
2013-09-04.

"IIA Article "Getting a Leg Up"". Findarticles.com. Retrieved 2013-09-04.

"Internal Auditor Magazine".na.theiia.org. 2000-01-01. Retrieved 2013-09-04.

"Internal Audit Checklists of various processes". Internal Audit Expert.internalauditexpert.in.

Archived from the original on 13 December 2013. Retrieved 12 December 2013.

"Management of Internal Audit", Internal Audit Handbook, Berlin, Heidelberg: Springer

Berlin Heidelberg, pp. 547–552, ISBN 978-3-540-70886-5, retrieved 2020-11-14.

"Pages – Standards". theiia.org.

"Pages – Developing the Internal Audit Strategic Plan Practice Guide".theiia.org.

"Peer Review: IIA, GAGAS and ISSAI". projectauditors.com. 2012-01-01. Retrieved 2014-
03-26.

"PWC-2012 State of the Internal Audit Profession Survey-March 2012".Pwc.com. 2012-03-

20.Retrieved 2013-09-04.

"Role of Internal Auditing in ERM". Archived from the original on 2013-09-05.Retrieved

2013-09-04.

Sawyer, Lawrence (2003). Sawyer's Internal Auditing 5th Edition. Institute of Internal
Auditors. ISBN 978-0894135095.

"The IIA-History and Evolution of Internal Auditing" (PDF).Retrieved 2013-09-04.

"UK and Ireland Certifications". Eciia.eu. 2013-06-25.Archived from the original on 2013-
08-20.Retrieved 2013-09-04.

Wikipedia

Wood, David A. (May 2012). "Corporate Managers' Reliance on Internal Auditor Recommendations".
AUDITING: A Journal of Practice & Theory. 31 (2): 151–166. doi:10.2308/ajpt-10234.
98
Wood, David A. (July 2009). "Internal Audit Quality and Earnings Management". The Accounting Review. 84
(4): 1255–1280. doi:10.2308/accr.2009.84.4.1255.

Wood, David A. (September 2013). "A Descriptive Study of Factors Associated with the
Internal Audit Function Policies Having an Impact: Comparisons Between
Organizations in a Developed and an Emerging Economy". Turkish Studies. 14 (3):
581–606. doi:10.1080/14683849.2013.833019.

Wood, David A. (November 2011). "The Effect of Using the Internal Audit Function as a
Management Training Ground on the External Auditor's Reliance Decision". The
Accounting Review.86 (6): 2131–2154.doi:10.2308/accr-10136

99