Articles Logan Wamsley Oct 28, 2024
INTOSAI’s guidance discusses the differences between internal and external audit functions in the public sector, and recommends ways they can work together.
In the public sector, no risk management strategy can be comprehensive without the participation of both internal and external auditors. However, while the roles and responsibilities of internal audit might be self-evident to internal auditors, external auditors may view internal audit work as redundant, or even irrelevant, compared to their own responsibilities. At the national level of most countries, these public sector external auditors are known as supreme audit institution (SAI) auditors.
New guidance from the International Organization of Supreme Audit Institutions (INTOSAI) — with input from The IIA — is aimed at helping external auditors better understand internal auditors. The guidance, ICS Guidance on Cooperation With Internal Auditors, explains how the internal auditor’s role differs from external auditors’ duties and how SAI auditors can better cooperate with the internal audit function.
In the public sector, there is a degree of alignment between internal audit and external audit functions. The INTOSAI guidance states, “Although the purpose, focus, methods, and timing of their engagements can be fundamentally different, both SAI and internal auditors are likely to look at an organization’s internal control system, risk management, and governance, with the aim of improving controls and performance. Therefore, the activities of a SAI audit team and those of an internal audit function can, in some cases, show similarities, and possibly also overlap.”
These similarities extend to the unique responsibilities of public sector auditors. For example, both external and internal auditors always should consider the public interest when assessing activities, decisions, policies, strategies, and laws. This can be valuable when assessing how public funds are spent.
Additionally, external auditing is more formally based on national legislation, while internal auditing — although it should conform to the Global Internal Audit Standards — is mostly based on internal regulations. However, some countries also regulate public sector internal audit functions through legislation.
When viewed more closely, however, differences between the functions are apparent. For example, external audit can have fundamentally different purposes, focuses, methods, and timing of engagements than internal audit.
Moreover, both functions ultimately are responsible for their own audits. According to Peru’s Lima Declaration, considered to be the “Magna Carta” of government auditing, “Internal audit services are established within government departments and institutions, whereas external audit services are not part of the organizational structure of the institutions to be audited. Supreme audit institutions are external audit services.”
When conducting its work, each respective function will adhere to its own structures and definitions. Sometimes, these structures do not align — particularly regarding independence.
“Internal auditors and SAI auditors agree 100% that independence is one of the fundamentals of the profession, but independence is understood a bit differently by each,” says Pawel Banaś, advisor to the President of the Supreme Audit Office of Poland. “There is a list of very crucial elements of independence that supreme audit institutions are usually very strict and clear about. Like finance, these should be independent from the government.”
On the surface, these differences could cause friction. However, the INTOSAI guidance stresses that internal auditors and external auditors should view each other as an opportunity for cooperation and collaboration.
“SAI auditors do not pay enough care to what was achieved, discovered, and established by internal audit functions, which harms SAI work,” says Banaś, who was involved in developing the guidance. “It makes our work more expensive and less effective. On the other hand, supporting the internal audit function, its quality, and its independence in organizations is worth the effort.”
For example, according to INTOSAI’s International Standards of Supreme Audit Institutions, external audit functions may use the work of internal auditors even if “the objectives of internal audit are different from those of external audit.” The use of this work promotes good governance for both functions. In the public sector, it also contributes “to transparency and accountability for the use of public resources, as well as economy, efficiency, and effectiveness in public administration.”
Beyond sharing work, both parties also may share knowledge. This may include audit reports and documentation, ad hoc communication, regular meetings, and joint training. The benefits of sharing include:
While the benefits of external and internal audit coordination are numerous, it comes with inherent risk if attempted haphazardly. According to INTOSAI’s guidance, risks for external auditors include:
With these risks in mind, external and internal audit functions should build a coordinated relationship with a degree of foresight. The guidance recommends establishing preconditions such as:
The last point is particularly relevant as external auditors may have reservations about internal audit’s capability to be independent and objective. Such reservations originally spurred the creation of the INTOSAI guidance.
“External auditors sometimes have doubts about the independence of internal auditors because they are part of the organization,” says Kamila Żyndul, chief expert, International Relations at The Supreme Audit Office of Poland, who also participated in developing the guidance. “We wanted to educate external auditors on the internal audit function, which will give them a basis to review internal audit so that they can judge whether it is trustworthy.”
This education should extend to the internal audit function, as well. According to the Standards, internal auditors also should undergo due diligence when accepting external auditors’ work.
Aligning with senior management and the board or governing body is critical to internal audit’s success. Equally important is aligning with relevant entities outside the organization such as external audit functions — even if there are differences at first glance. Ultimately, with appropriate planning and mutual understanding, collaboration between internal and external audit entities is worthwhile, Banaś says.
“Mutual understanding comes down to understanding details — technical details but also systemic details,” he explains. “During work on this paper, we sometimes discovered that what both sides needed more than anything was just more knowledge, more understanding of the other side. Legal regulations and rules may make the cooperation between the two sides quite difficult at times, but the main risk is not trying to cooperate at all.”