Chapter 21 - Internal Auditing

Question 1

Is Internal Auditing part of a Company’s control environment?

Answer 1

Yes, it is part of the 3rd line of defense.

Question 2

Is an Internal Audit Department required under SOX?

Answer 2

No, but in order for management to do independent testing of Internal Controls over Management Reporting they need a separate department in order to do so. Including a department that can do testing outside of ICFR.

Question 3

What standards do internal auditors use?

Answer 3

Institute of Internal Audit Standards (IIA)

Question 4

What type of audits does Internal Auditors Perform for a Company?

Answer 4

Financial Audit Control Testing
Compliance Control Testing
IT Testing of systems directly or indirectly associated with financial reporting
Operational performance reviews.

Question 5

When does internal Audit become effectively required?

Answer 5

While not legally required, Internal Audit becomes practically necessary when:
* The company is an accelerated filer with complex operations
* There are multiple locations or decentralized processes
* The control environment is immature or has prior deficiencies
* The audit committee expects independent assurance
* Management lacks bandwidth to perform ICFR testing themselves