Transcription
Chapter 4: Assurance and Consulting Services 97CHAPTER 4ASSURANCE ANDCONSULTING SERVICESUrton AndersonThe Institute of Internal Auditors Research Foundation
DisclosureCopyright 2003 by The Institute of Internal Auditors, 247 Maitland Avenue, Altamonte Springs, Florida32701-4201. All rights reserved. Printed in the United States of America. No part of this publication may bereproduced, stored in a retrieval system, or transmitted in any form by any means — electronic, mechanical,photocopying, recording, or otherwise — without prior written permission of the publisher.The IIA publishes this document for informational and educational purposes. This document is intendedto provide information, but is not a substitute for legal or accounting advice. The IIA does not provide suchadvice and makes no warranty as to any legal or accounting results through its publication of this document.When legal or accounting issues arise, professional assistance should be sought and retained.The Professional Practices Framework for Internal Auditing (PPF) was designed by The IIA Board of Directors’Guidance Task Force to appropriately organize the full range of existing and developing practice guidancefor the profession. Based on the definition of internal auditing, the PPF comprises Ethics and Standards,Practice Advisories, and Development and Practice Aids, and paves the way to world-class internal auditing.This guidance fits into the Framework under the heading Development and Practice Aids.ISBN 0-89413-498-102404 01/03First Printing
98 Research Opportunities in Internal AuditingI. IntroductionInternal auditing provides a variety of services to the organization. These services mayrange from conducting financial, performance, compliance, system security, and due diligenceaudits, to participating on committees to select new accounting software, to revising theorganization’s code of conduct, to teaching training courses in internal control to newmanagers. If one were to limit one’s thinking about internal auditing to just the traditionalauditing of internal controls, one would be missing a significant part of the work beingperformed by the internal audit function in many organizations. In this section we look atinternal audit from a much broader perspective than that used in traditional audit researchwhere auditing is treated primarily as a matter of attesting to management’s assertions.We begin with the question of how the internal audit function adds value to the organization.Next we describe the range of value-added internal audit services and examine the nature ofassurance and consulting activities. Four specific issues in providing assurance services arethen discussed: Levels of assuranceThe relation of evidence to type and level of assuranceProviding assurance outside the organizationThe nature of assurance in fraud investigationConsulting services also has a number of issues with which practice struggles. We willdiscuss four of particular concern: Blended engagementsBalancing assurance and consultingLimits on the extent of consulting an internal audit function should undertakeThe risk and reward of providing consulting servicesThroughout our examination of each of these topics, potential research questions will beidentified. These questions are summarized in an appendix at the end of this chapter.II. Adding ValueHow does one determine if an activity adds value? To begin to answer that question onemust first identify the activity’s customer. As Exhibit 4-1 illustrates, in the case of internalauditing, the identification of a single or even a primary customer is not clear. Is it the CEO?The Institute of Internal Auditors Research Foundation
Chapter 4: Assurance and Consulting Services 99Throughout the 1970s and 1980s, writers such as Larry Sawyer (1973) took this positionwith their view of the internal audit function being “the eyes and ears of management.” Is itthe audit committee? Those seeking to solve the problems of organizational governancewould argue that internal audit should rather be “the eyes and ears of the audit committee.”Others argue that it is the auditee or operating management that is the customer and that thevalue the internal audit function adds is in its ability to improve the efficiency and effectivenessof operations. Such is the thinking of those who would evaluate the internal audit functionon projected cost savings and improvements. Is it the external auditor? There were thosecompanies in the late 1970s and early 1980s where the raison d’etre of the internal auditfunction was to reduce the external audit fee. In fact, today most practicing internal auditorswould acknowledge the demands from each of these customers and that somehow the internalaudit function must balance its work to meet their needs.Exhibit 4-1Internal Audit CustomersThe Institute of Internal Auditors Research Foundation
100 Research Opportunities in Internal AuditingNot only does the internal audit function have a variety of customers, what adds value (thevalue proposition) for that customer will also vary. Appendix F of the report of The IIA’sGuidance Task Force (IIA, 1999, 79-81) provides an initial analysis of the internal auditfunction’s customers and the products these customers value. For example, operating linemanagers (often the auditee) are interested in the ways internal audit can improve the efficiencyand effectiveness of their operations. The external auditor looks to internal audit as anadditional internal control which, if operating effectively, can reduce the extent of the workthe external auditor must perform to issue an opinion on the organization’s financial statements.Suppliers and customers are looking to internal audit to provide assurance on the reliabilityand security of the information in the systems forming the interface between them and theorganization. The line staff of auditees are looking for internal audit to bring them innovationsand best practices from across the organization. These various value propositions not onlyvary but often can be in conflict in terms of allocation of audit resources and, in some cases,tasks.The tension created from these various customers and their differing demands is best illustratedby considering the audit function’s two extreme customers — operating managers and theaudit committee. Operating managers are focused on how they can meet their operatingobjectives. For them the audit adds value by identifying opportunities for improving theiroperations by either increasing effectiveness or, more commonly, identifying potential costsavings and making operations more efficient. They focus on the recommendations madein the report or suggested during the audit. They are less concerned with the auditor’s viewsor opinions on the adequacy of their internal controls other than the effect reporting suchopinions has on their superior’s evaluation. The audit committee (board of directors), on theother hand, has relatively little interest in recommendations to improve efficiency. They areconcerned with the opinion of the auditor regarding whether internal controls are adequate,the data being provided by managers is reliable, laws and regulations are being followed,and assets are safeguarded. If we think in terms of the traditional scope of internal auditwork as presented in The IIA’s Standards for the Professional Practice of Internal Auditing(Standards), we see in Exhibit 4-2 that the value comes from different “audit” objectives. Inthe current terminology of the “new” internal audit definition, this is a distinction betweenassurance services and consulting services.Can these customer demands be met with a single product? Until the 1990s internal auditattempted to do so through the traditional operational audit. The assurance was provided inthe “opinion” on the adequacy of internal controls or through the implied opinion that controlswere adequate through the disclosure of any significant control issues. The consulting sidewas addressed through the recommendations targeted to the auditee. Attempting to serveboth demands through a single product, however, has its limitations. The inherent tensionThe Institute of Internal Auditors Research Foundation
Chapter 4: Assurance and Consulting Services 101Exhibit 4-2What the Customers Value by Scope of WorkAudit Committee/Board Safeguarding Assets Compliance with Laws andRegulations Reliability of DataValue: Improve quality of InformationOperating Management Effectiveness and Efficiency ofOperationsValue: Agent of changebetween these two demands can be seen in the many variations found in audit practice.One underlying theme in the internal audit literature that reflects this tension is the issueof whether an internal audit report should have an overall audit opinion. There has beenno requirement for one either in the prior version of the Standards or in the currentversion. Practice varies with strong advocates both for and against. Likewise, must anaudit result in recommendations? The Standards do not require that it do so.The literature has basically presented recommendations as a marketing tool for audit, ameans for getting auditees to address control issues by presenting them with a practicaloption. With the pressure in the late 1980s and early 1990s for every part of theorganization to demonstrate its ability to add value, the single product approach begins tobe challenged. We saw many audit functions expanding “products” through activitiessuch as control self-assessment, involvement in quality and re-engineering initiatives, andimplementation of enterprise risk management systems. Currently, a growing number ofaudit functions are taking a multi-product approach. For example the audit function ofFirstEnergy Corp. offers its customers 21 distinct services ranging from investigation intoalleged fraud, to surveying customers to determine satisfaction, to facilitation of groupsto arrive at process improvements as well as the traditional audit (Roth, 2002, pp.168169).The Institute of Internal Auditors Research Foundation
102 Research Opportunities in Internal AuditingGiven the various different demands from different customers, how in a world of limitedresources does the internal audit function balance the services provided to meet these variouscustomers’ needs? This is the fundamental question of internal audit management — onewhich current events have brought to the forefront of the profession. But before we canaddress the issue of balancing these various customer needs, we must first answer the question,“Is there an ultimate customer?” In other words, are all of internal audit’s customers andtheir needs equally important? And, if not, who is the ultimate customer of internal audit?Currently, there does not seem to be agreement on the answer to the questions of the ultimatecustomer in the profession and, in fact, it is a question rarely directly discussed or addressed.It is not a question practicing audit directors are comfortable talking about because of thedelicate balance a director must maintain among these various groups. In the days of Sawyerthings were simple — “audit was the eyes and ears of management” — and the term“management” meant the upper management of the organization, the people who hiredauditors and determined if they got a raise. Life was simple for the audit director — keep theCEO (or CFO where often internal audit reported) happy and you were doing the job. In thewords of the Statement of Responsibilities of Internal Auditing, “the objective of internalauditing is to assist all members of management in the effective discharge of their responsibilityby furnishing them with analyses, appraisals, recommendations, and pertinent commentsconcerning the activities reviewed” (as found in Sawyer, 1973, p. 513).While in many sectors and regions of the world this “eyes and ears of management” is stillthe predominate approach, attempts to solve organizational governance problems have shiftedthe internal audit to also become “the eyes and ears of the audit committee.” For example,the report from the Joint Committee on Corporate Governance (2001) in Canada envisions astrong role of the internal audit function in assisting the audit committee in fulfilling its role:There are many operational aspects of the audit committee’s relationship with theinternal audit function that are important for the effective oversight of the internalcontrol framework and culture. Where a corporation has an internal audit function,the audit committee should approve its mandate, be satisfied that it has adequateresources to perform its responsibilities, and ensure that the director of internal audithas direct and open communication with the committee .Where internal audit doesnot exist, the audit committee has an important oversight role that goes beyond thenormal operational issues. (2001, p. 31)A similar view is found in the United Kingdom:Senior management and the board may desire objective assurance and advice onrisk and control. An adequately resourced internal audit function (or its equivalentThe Institute of Internal Auditors Research Foundation
Chapter 4: Assurance and Consulting Services 103where, for example, a third party is contracted to perform some or all of the workconcerned) may provide such assurance and advice .In the absence of an internalaudit function, management needs to apply other monitoring processes in order toassure itself and the board that the system of internal control is functioning as intended.In these circumstances, the board will need to assess whether such processes providesufficient and objective assurance .The board of a company that does not have aninternal audit function should assess the need for such a function annually havingregard to the factors referred to in paragraphs 43 and 45 above. Where there is aninternal audit function, the board should annually review its scope of work, authorityand resource
assurance services and consulting services. Can these customer demands be met with a single product? Until the 1990s internal audit attempted to do so through the traditional operational audit. The assurance was provided in the “opinion” on the adequacy of internal controls or through the implied opinion that controls were adequate through the disclosure of any significant control issues .
