|The company should establish an effective internal audit function that is adequately resourced and independent of the activities it audits.|
Internal audit is often regarded as an extended arm of the Audit Committee (AC) to help the AC discharge its oversight responsibilities in risk management and internal controls. Internal audit primarily conducts routine and ad hoc internal control reviews.
It is important that the Board and AC establish an effective internal audit function that is able to independently perform its reviews. When properly implemented, the function provides significant value to the AC as an assurance provider, problem solver, insight generator and a trusted adviser.
- State that the internal auditor reports to the AC, and that the internal auditor should have unfettered access to perform its work (Guideline 13.1).
- Describe the resourcing for the internal audit function (Guideline 13.2).
- Set out the competency requirements of the internal audit staff (Guideline 13.3).
- Encourage the internal audit function to comply with the standards of recognised professional bodies (Guideline 13.4).
- Require the AC to review the internal audit function (Guideline 13.5).
The Internal Auditor's primary line of reporting should be to the AC Chairman although the Internal Auditor would also report administratively to the CEO.
The AC approves the hiring, removal, evaluation and compensation of the head of the internal audit function, or the accounting / auditing firm or corporation to which the internal audit function is outsourced. The Internal Auditor should have unfettered access to all the company's documents, records, properties and personnel, including access to the AC.
The AC should ensure that the internal audit function is adequately resourced and has appropriate standing within the company. For the avoidance of doubt, the internal audit function can be in-house, outsourced to a reputable accounting/auditing firm or corporation, or performed by a major shareholder, holding company or controlling enterprise with an internal audit staff.
The internal audit function should be staffed with persons with the relevant qualifications and experience.
The Internal Auditor should carry out its function according to the standards set by nationally or internationally recognised professional bodies including the Standards for the Professional Practice of Internal Auditing set by The Institute of Internal Auditors.
The AC should, at least annually, review the adequacy and effectiveness of the internal audit function.