Internal Audit can be conceptualized as an element of control, which has as one of its objectives, the assessment of the company’s internal controls. The auditor uses a survey of the system, which includes the organization plan and the procedures policy, in order to verify whether it offers protection to the company’s assets and reliability of information and data of a managerial nature. In a second step, it is up to the auditor, through the application of audit tests, to evaluate the operational efficiency of the system and to verify if there is adherence to the guidelines established by management.
The information necessary for the evaluation of the system is obtained by the auditor through interviews with company employees, procedure manuals, records or documents, etc., being evidenced in organization charts, flowcharts, internal control manuals and evaluation questionnaires, which must be periodically reviewed. and updated.
The extent and nature of the audit tests to be adopted to assess the system’s operational efficiency is substantially influenced by the procedures adopted by the company. In the specific aspects in which the controls are considered weak, the auditor should carry out more in-depth audit examinations and / or expand the extent of them.
Management is responsible for creating and maintaining internal controls, limiting the auditor’s responsibility to:
- evaluate the procedures in force and determine whether they offer a reasonable degree of confidence;
- verify that the system is being correctly applied;
- report observed flaws, offering recommendations to remedy them.
The study and evaluation, as well as the recommendations made by the Audit, do not exempt or diminish the responsibility of the managers of an activity. The corrective action suggested by the Audit, even when this action is explicitly the modification of a control procedure, does not imply the transfer of the responsibility of the administrators to the auditor.
