List of Abbreviations xi

1 Introduction 1

Introduction 1

1.1 Reasoning behind the Book 2

1.2 The IIA Standards and Links to the Book 3

1.3 How to Navigate around the Book 4

1.4 The Essential Guide as a Development Tool 7

1.5 The Development of Internal Auditing 7

Summary and Conclusions 11

Endnotes 12

2 Corporate Governance Perspectives 13

Introduction 13

2.1 The Agency Model 14

2.2 Corporate Ethics and Accountability 17

2.3 International Scandals and Their Impact 20

2.4 Models of Corporate Governance 26

2.5 The Institute of Internal Auditors 31

2.6 The External Audit 33

2.7 The Audit Committee 39

2.8 Internal Audit 42

2.9 The Link to Risk Management and Internal Control 43

2.10 Reporting on Governance, Risk and Internal Controls 44

2.11 New Developments 48

Summary and Conclusions 53

Endnotes 56

3 Managing Risk 59

Introduction 59

3.1 What is Risk? 60

3.2 The Risk Challenge 61

3.3 Risk Management Process 63

3.4 Mitigation through Controls 66

3.5 Risk Registers and Appetites 69

3.6 The Risk Policy 74

3.7 Enterprise-Wide Risk Management 79

3.8 Control Self-Assessment 81

3.9 Embedding Risk Management 82

3.10 The Internal Audit Role in Risk Management 82

3.11 New Developments 86

Summary and Conclusions 89

Endnotes 92

4 Internal Controls 95

Introduction 95

4.1 Why Controls? 96

4.2 Control Framework - COSO 104

4.3 Control Framework - CoCo 109

4.4 Other Control Models 111

4.5 Links to Risk Management 113

4.6 Control Mechanisms 114

4.7 Importance of Procedures 121

4.8 Integrating Controls 122

4.9 The Fallacy of Perfection 124

4.10 The Complete Control Model 125

4.11 New Developments 127

Summary and Conclusions 129

Endnotes 130

5 The Internal Audit Role 131

Introduction 131

5.1 Defining Internal Audit 131

5.2 The Four Main Elements 134

5.3 The Audit Charter 137

5.4 Audit Services 139

5.5 Independence 141

5.6 Audit Ethics 146

5.7 Police Officer versus Consultant 149

5.8 Managing Expectations through Web Design 151

5.9 Audit Competencies 155

5.10 Training and Development 157

5.11 New Developments 160

Summary and Conclusions 164

Endnotes 165

6 Professionalism 167

Introduction 167

6.1 Audit Professionalism 167

6.2 Internal Auditing Standards 170

6.3 Due Professional Care 184

6.4 Professional Consulting Services 186

6.5 The Quality Concept 188

6.6 Supervision 189

6.7 Internal Review 191

6.8 External Reviews 192

6.9 Marketing the Audit Role 196

6.10 Creating the Audit Image 197

6.11 New Developments 199

Summary and Conclusions 200

Endnotes 201

7 The Audit Approach 203

Introduction 203

7.1 The Risk-Based Systems Approach 203

7.2 Control Risk Self-Assessment (CRSA) 208

7.3 The CRSA Process 210

7.4 Integrating Self-Assessment and Audit 210

7.5 Fraud Investigations 211

7.6 Information Systems Auditing 217

7.7 Compliance 221

7.8 Value for Money (VFM) 223

7.9 The Consulting Approach 224

7.10 The 'Right' Structure 226

7.11 New Developments 227

Summary and Conclusions 233

Endnotes 234

8 Setting an Audit Strategy 235

Introduction 235

8.1 Risk-Based Strategic Planning 235

8.2 Resourcing the Strategy 242

8.3 Managing Performance 245

8.4 The Auditor Appraisal Scheme 246

8.5 Methods of Staff Appraisal 248

8.6 The Audit Manual 250

8.7 Time Monitoring System 252

8.8 Audit Planning Process 253

8.9 The Annual Audit Plan 255

8.10 The Quarterly Audit Plan 255

8.11 New Developments 256

Summary and Conclusions 261

Endnotes 262

9 Audit Fieldwork 263

Introduction 263

9.1 Planning the Audit 263

9.2 Interviewing Skills 270

9.3 Ascertaining the System 275

9.4 Evaluation 278

9.5 Testing Strategies 282

9.6 Evidence and Working Papers 290

9.7 Statistical Sampling 292

9.8 Audit Testing and Statistical Sampling 296

9.9 Reporting Results of the Audit 297

9.10 Structuring the Audit Report 304

9.11 Audit Committee Reporting 306

9.12 New Developments 308

Summary and Conclusions 311

Endnotes 314

10 Meeting the Challenge 315

Introduction 315

10.1 The New Dimensions of Internal Auditing 315

10.2 The Audit Reputation 316

10.3 Globalization 318

10.4 Providing Audit Assurances 319

10.5 Meeting the Challenge 326

Summary and Conclusions 327

Endnotes 329

Appendix A Auditing the Risk Management Process: A Case Study 331

Index 359