Internal-AuditEasy

3 min read · 485 words

What the seat actually does

The business does the work; risk and compliance set the constraints; and somebody independent of both checks afterwards that any of it actually happened. That third role is internal audit, and its defining feature is who it reports to — the board's audit committee rather than the management it is examining.

It tests controls, not transactions. The question is almost never "was this trade right"; it is "would the process have caught it if it were wrong". A control that works because a diligent person happened to be in the seat is a finding, not a pass.

• Planning — deciding what to look at, which is itself a risk judgement about where failure would matter.
• Fieldwork — sampling, testing and gathering evidence.
• Reporting — findings, ratings and agreed actions with dates on them.
• Follow-up, which is the half that decides whether any of it changed anything.

A day, and where it goes

• Testing — pulling a sample and asking for the evidence that each step was performed.
• Interviews, where the gap between the documented process and the actual one usually appears.
• Drafting. A finding has to survive being read by the people it is about.
• Overdue actions — the ones agreed last year that nobody has closed.

What it is measured on

• Coverage against the plan, and whether the plan pointed at the right places.
• Findings accepted and closed, rather than merely raised.
• Whether an external examination found something audit did not. That is the seat's real scorecard.
• Independence, which is structural: reporting line, budget and access, not a personal quality.

What it touches on this site

• The two lines it checks — risk management and compliance.
• What is being reported — reading financial statements and an annual report.
• The numbers it tests — product control, whose work is the most audited in a bank.
• When it goes wrong — 2020 and 1995, where one person controlled both the trade and the record of it.

How it goes wrong

• Auditing the documentation. A perfect procedure manual and an unperformed step both look identical on paper.
• Sampling where the loss is not. A clean sample of ordinary transactions says nothing about the unusual one.
• Findings negotiated down until they describe something nobody has to fix.
• Independence on the organisation chart only. If the budget and the careers run through the business, the reporting line is decoration.

Concepts to master

• Segregation of duties — the person who trades cannot be the person who confirms and records the trade. That single rule prevents more than any model.
• Absence of evidence is a finding, because a control that leaves no trace cannot be relied on.
• Sampling has statistics behind it, and a sample chosen for convenience carries none of them.
• Operational risk is where this seat lives — see which risk decides.