“Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”- Institute of Internal Auditors
Internal Audit has evolved significantly from an essentially accounting oriented function to more of a management function in view of the support the role provides to the Board in the performance of its oversight function. Indeed, the CBN Code of Corporate Governance provides that the Head of Internal Audit should not be below the rank of an Assistant General Manager.
Within the context of corporate governance, an Internal Auditor provides an independent and objective assessment of the appropriateness or otherwise of the organization’s internal control structures and processes. Responsibilities of the function include:
– Develop an audit plan to evaluate the institution’s financial and operational controls.
– Assess the efficient use of resources.
– Determine the level of compliance with laws, regulations, company policies and procedures.
– Investigate cases of misappropriation and fraud.
– Follow-up on the adequacy of corrective actions.
– Keep the Audit Committee and Board fully informed on a timely basis of the activities of the Internal Audit Department.
– Support the Audit Committee in fulfilling its responsibilities.
A major challenge faced by the Internal Audit Function in ensuring sound corporate governance practice is that of independence. The SEC Code of Corporate Governance for Public Companies requires the Internal Audit function to report directly to the Audit C o m m i t t e e “ w h i l e h a v i n g a l i n e o f communication with the CEO/MD”. In practice, this is not always the case. More often than not, the Internal Auditor reports directly to the CEO who appraises his performance and can dismiss him.
Indeed, the NAICOM Code of Corporate Governance for Insurance Companies provides that the “Head of the Internal Audit Unit shall report directly to the MD/CEO but a copy of the Audit Report shall be forwarded to the Audit Committee on regular basis”. Where the insurance company is a public company, it is expected to comply with the SEC Code and in the event of conflict with the Industry specific Code, the Code with the stricter requirement prevails.
In an attempt to guarantee the objectivity of the Internal Audit Function, the exposure draft of the CBN Code of Corporate Governance in addition to the existing requirement that the Head of Internal Audit shall report directly to the Board Audit Committee (BAC), provides that the BAC shall be responsible for assessing the performance and objectivity of the Internal Audit Function as well as recommend to the Board the appointment and if necessary the dismissal of the Head of Internal Audit.
The SEC Code of Corporate Governance provides that an external assessment of the effectiveness of the Internal Audit Function be undertaken at least once every three years by a qualified independent reviewer. The Code also provides that the purpose, authority and responsibility of the Internal Audit Function be clearly defined in an Audit Charter approved by the Board.
Compliance with the letter and spirit of the SEC and CBN Codes will go a long way in safeguarding the independence and objectivity of the Internal Audit Function for maximum effectiveness.