Internal Audit as An Attribute of Management During the Economic Crisis

Susmanschi, Georgiana Article Internal Audit as An Attribute of Management During the Economic Crisis CES Working Papers Provided in Cooperation with: Centre for European Studies, Alexandru Ioan Cuza University Suggested Citation: Susmanschi, Georgiana (2012) : Internal Audit as An Attribute of Management During the Economic Crisis, CES Working Papers, ISSN 2067-7693, Alexandru Ioan Cuza University of Iasi, Centre for European Studies, Iasi, Vol. 4, Iss. 3, pp. 419-428 This Version is available at: https://hdl.handle.net/10419/198187 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/4.0/ C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 419 INTERNAL AUDIT AS AN ATTRIBUTE OF MANAGEMENT DURING THE ECONOMIC CRISIS Georgiana Susmanschi The Bucharest University of Economic Studies”, România [email protected] Abstract: Internal audit provides through its tasks reasonable assurance that decisions implemented and on-going objectives are under control. Internal audit has passed from a simple check to a role in assisting management in order to have better control over operations, thus the internal audit function overcomes its primordial role to provide simple stage directions functional, following his path to becoming a useful leverage to optimize the company. Any company, irrespective of its business and operating environment, faces a number of risks, frauds. The most effective tools in preventing fraud are management control and internal audit, the latter being of prime importance in the field of corporate governance. The present paper follows to highlight the place and role that internal audit has in the economic entities which it is labeled as an attribute of management. A negative element identified at the level of the affected companies is the failure to identify risk management, due to increasing complexity of services and risky nature of the business. Although internal audit is not responsible for implementation of actions as a response to risks, it is responsible for providing reports to the management of significant information showing key risk assessment and so helps the management to become more efficient. Keywords: internal audit, management, internal control, risk management, economic crisis JEL Classification: M10, M14, M42 INTRODUCTION IN MANAGEMENT The field of management evolved along with the human society, characterized by the need of humans to organize their time and activities. Perhaps the Sumerians, the Egyptians or Alexander the Great did not know words as performance, efficiency, profitability, but they surely understood the need for organizing and coordinating of activities, even if we refer to building pyramids or military campaigns. Over time, the concept of management has evolved and continues to evolve (as far as the human society exists), as a result of developing of world states and as an effect of the dynamism and the complexity of business environment. Therefore, management has known various interpretations, from definitions consisting in a few words, like achieving objectives through others (Makenzie, 1959) to thick definitions. The management activity can be considered the most important activity in an economic entity. Why is that? Because at this level decisions are made, plans and forecasts are undertaken, objectives and priorities are established. But the management itself is not the only activity carried out in an economic entity; actually it cannot exist alone. For a management to work there should be C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 420 performers, people that effectively implement decisions taken at higher level. Therefore, we say that management is the activity that takes place with and through people. Experience has shown that to be effective a company cannot rely only on clever ideas and on some people who occupy key positions in the company, but should pay extra attention to continuous improvement and training of all workers. The existence of a company depends on the existence of several departments, each department having its own objectives (which are in connection and contribute to the main objectives of the company). The management as a professional activity involves collaboration of several groups of people, thus meaning that the management process is mediated by the existence of a group of people who have a common objective and the existence of a leader, that being the manager. In the vision of Peter Drucker the management activity is equivalent to those governing. According to Massie management is the art of a leader to accomplish objectives using other people’s efforts. Management is the most important factor to streamline the economy and companies. The performance of an economic entity, on commercial, economical, technological plan, depends in a significant way on the managerial performance (performance of the management). In today's economic market conditions due to globalization, due to harmonization or at least the attempt to harmonize in various fields (accounting, tax, legal) an economic entity needs strategies, plans on which to take their decisions and conducts its business. It is not enough to carry out each activity; the company must conduct operations with minimum of cost but maximum of efficiency. 1. INTERNAL AUDIT AND ITS CONNECTION WITH THE MANAGEMENT A modern management of economic entities cannot be made without a rigorous, but flexible control. The management of an entity requires continuous and systematic monitoring of the activities. Internal audit, in its form of superior control, consists in numerous elements, among them: Appraising the reliability and integrity of financial and operating information by evaluating the means developed by management to identify, classify, measure, and report such information; Appraising the systems management has established to ensure compliance with policies, plans, procedures, laws and regulations that could have a significant impact on operations and reports, and determining whether the organization is in compliance; C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 421 Appraising the means management has established to safeguard assets, and, as appropriate, verifying the existence of such assets; Appraising the systems management has established to ensure economical and efficient use of resources; Appraising the systems management has established to ensure results are consistent with established objectives/goals and operations or programs are carried out as planned. Internal audit is a discipline with managerial orientations that has evolved rapidly after World War II. Having been used in the beginning only in the financial and accounting activities, internal audit is used today in a large range of operational activities and also offers a wide choice of assurance and consulting services. We said that a pregnant characteristic of the management refers to the decision making process. The internal audit must guarantee the reasonable safety that the operations performed, the decisions made are under control and that in this way it contributes to the improvement of management decisions regarding the achievement of tasks set by companies (Terci, 2009). The development of internal audit is due to the increase and extent of the deregulation, the complexity and technological development in the operating cycle, but also due to the necessity of independent ways and evaluation aims and improving risk management, leadership and control (Ivanescu and Ivanescu, 2010). Internal audit represents everything that a manager should do in order to assure that he has a good control over situations, if he had time and would know how to proceed (Renard, 2002). Internal audit is a profession that does not improvise and as such, must be made by specialists. Internal audit is a privilege / of employees’ organization working for the benefit of its managers, highlighting the level of mastery over activities, if it finds dysfunction, they can make recommendations for improvement. The internal auditor is a consultant with autonomy to formulate recommendations, and not a controller, this autonomy is provided by reference standards, methods and tools, auditor’s work must be conduct within the established rules of internal audit (Stoian and Muntean, 2004). The basic framework for the professional practice of internal auditing is composed of:  The Statement of Responsibilities of Internal Auditing;  The Code of Ethics;  The Standards for the Professional Practice of Internal Auditing;  The Statements on Internal Auditing Standards; C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 422  Professional practice releases. A long term and systematic internal auditing of management will certainly determine an increase in sustained performance management. Through management as an auditable domain we understand an aggregate consisting on all activities / processes / subsystems that compile a management system (Zecheru and Nastase, 2005). 1.1 Internal audit facing internal control In practice management face a number of risks, categorized by various criteria. In order to deal with these risks, the management develops an internal control system that consists of all control activities implemented in the company. When one or more of the risks identified (or not) produce effects, suggests that control activity was overwhelmed or did not work. Therefore, control or inspection will be triggered having as purpose the instrumentation of irregularities/malfunctions. Subsequent the department of internal audit will analyze the risks and control activities that were implemented with the scope of avoiding repetition of such situations in future (Ghita, 2009). Internal audit has an important role in assisting the reorganization of the internal control system and in advising general management. The primary objective of internal controls is to give managers reasonable assurance that:  Financial and operating information is accurate and reliable;  Policies, procedures, plans, laws and regulations are complied with;  Assets are safeguarded against loss and theft;  Resources are used economically and efficiently;  Established program/operating goals and objectives will be met. When we combine the definition of internal control with the scope of internal auditing, five possible audit objectives emerge regarding how managers plan, organize and direct activities. Internal auditors seek to answer one or more of the following questions (Simmons, n.d.):  Do controls on financial and operating data provide managers with reasonable assurance that the financial and operating data is accurate and reliable;  Do controls on compliance with policies, procedures, plans, laws and regulations provide managers with reasonable assurance that proper compliance actually occurs; C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 423  Do controls on assets provide managers with reasonable assurance that assets exist and are protected against loss that could result from theft, fire, improper or illegal activities, or exposure to the elements;  Do controls on operations provide managers with reasonable assurance that resources are used efficiently and economically;  Do controls on operations and programs provide managers with reasonable assurance that the operations and programs are being carried out as planned, and that the results of operations are consistent with established goals and objectives. In the next few rows, we present a short parallel between internal audit and internal control. Table 1- Parallel between internal control and internal audit No. Reference Internal control Internal audit 1 Status/position established within the organization as a system of management and internal control (management control system) Part of the management control system, but refers to the evaluation of the system 2 Beneficiary Employees, the general management The general management 3 Objectives Established by the annual control plan Established by the auditors team and supervised by the head of the auditing department 4 Applicability According to the approved control plan All areas of the entity are considered to be auditable domains 5 Periodicity Periodic activity, influenced by the evolution of risks A permanent and planed activity 6 Purpose investigating an irregularity, misconduct, irregularity by checking the compliance with the legal and procedural framework A reasonable assurance of compliance activities and the effectiveness of those activities 7 Organization control activities dissipates on the flow processes is organized as an internal audit department consisting of 2-3 people in order to be functional 8 Finalization The controller sets the size of the irregularities and violations found and those responsible and finalize the mission with a minute of the control findings and recommendations are materializing in an internal audit report 9 Findings, recommendations, conclusions The control findings and conclusions must be accepted. If not contestate remain final recommendations of internal audit are optional for management, but good practice requires an explanation for their failure to implement 10 Results sets size of the irregularities and responsibilities regarding procedural and legal framework provide reasonable assurance of management control systems Source: Ghita, 2009, p. 60 Internal control is not organized as a separate department in the entity; it is found in the structure and functions of management, of each activity and is the responsibility of every employee. Internal control system includes more controls, namely: self-control, mutual control, hierarchical C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 424 control, control of partnership, quality control, preventive financial control, inventories, accounting control, financial control, inspections. These controls can be grouped as follows: - Ex-ante controls: self-control, mutual control, hierarchical control and preventive financial control; - Ex-post controls: self-control, mutual control, hierarchical control, inventories, cashier control, accounting control, financial control, quality control, inspection. All these controls are not organized as stand-alone sections, but are found in the flow of operations between the stages of procedures, performed by each job, at every level of responsibility or by delegation of authority, attached to current activities. 1.2 Internal auditor’s status within a company It is said that an internal auditor has a thousand eyes, but no heart. This remark comes from the fact that the internal auditor has access to all economic entity, considering all departments, all activities undertaken within the company and has an objective in finding irregularities, malfunctions, which will be reported to the management and upon the auditor will issue recommendations. The internal auditor has a special status within the company. It must have a clear position, detached. As mentioned, the internal auditors evaluate any department, function or activity of the economic entity for reporting to general management. From this perspective, the relationship between internal auditors and the audited person must be a professional one. The auditor will be focused on screening systems and identifying any problems. Internal auditor is responsible for assisting in identifying solutions, together with those audited in order to eliminate malfunctions/irregularities. However, internal auditors should not be isolated so that they can be able to perform their work in an effective manner. Internal auditors should be an important part of the collective. Internal auditors should take part as observers in the activities undertaken in the entity so that they can rely on thorough knowledge regarding the activities audited. The management and the employees should not look at the internal auditors as if he is a police-officer, ready to apply sanctions. All the participants at the activities developed in the form should understand that the internal auditor is there to observe, have notes, identify risks and give recommendations. For that internal auditor must find the ideal way to communicate with all departments of the economic entity, in order to understand processes that occur in the firm? The auditor has to take in consideration that all employees make efforts (large or small) to integrate the new process and the purpose of an audit is to find solutions, not to find guilt/someone C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 425 to blame for the non-conformities . In that aspect, the auditor would talk to as many people about how they see the process, what benefits they believe are, if they see improvement process, how they feel with the new duties, if they feel any difference than it was before (in cases of changes of processes). 1.3. Internal audit and risk management In today knowledge-based society it can be identified a number of five tendencies, as: globalization, changes in risk management, technological progress, organizational talent and capacities, changes regarding internal audit role. All of these are expected to have an important impact over internal audit during the following years. That’s way it is essential the proper understanding of these tendencies, and also of their implications, in such way so that internal audit could supply the help needed in identifying and managing risks; so in the end internal audit has an effective contribution in adding plus value to economic entities (Pop and Bota-Avram, 2009). We must emphasize that the internal auditor is responsible only with providing recommendations. The responsibility for implementing the recommendations remains in charge of the management, who can take into account or not these recommendations, but they know that when they disregard them they will assume certain risks. In this regard, the relation between management and internal auditors should be characterized by partnership, having the same goals, objectives, among them numbering an efficient management and achieving (proposed/estimated) targets. Managers should be capable to understand what internal auditors want to express, should clearly understand the recommendations and as a follow up the manager will understand why is suitable to apply those recommendations. Internal audit and risk management have the same goal: the control of risk. There are various roles for the internal audit in respect of risk management. The main limitations of internal audit in respect of risk management regards assuming risk management tasks. The objectives of internal audit functions differ between organizations, but the main objective should be to assess and improve the efficiency and effectiveness of the management to maintain and improve the internal control system. Within the organization the board, the executive management, the risk committee, the experts and the employees are responsible for the risk management. Nevertheless risk is considered to be the responsibility of operational management. Important benefits of risk management are: C CE ES S W Wo or rk ki in ng g P Pa ap pe er rs s 426  Increased likelihood of achieving corporate objectives;  Reduced cost of risk;  Calculated risk taking. There are many roles that internal audit can fulfil in respect of the risk management process implemented within the organization. Internal audit assumes at least two important roles in respect of the risk management. First, internal audit can act as an advisor helping the organization in respect of risk awareness. This can be done by improving the management understanding of the major risks facing the organization. It should be mention that the risk management process can be used by internal auditors in identifying areas for review. In these ways the internal auditors can focus their activity on the key systems and controls within the organization. Second, internal auditors can act as trainers in risk management workshops. In this way internal auditors aid line managers understand better organizational risks and controls. This is how internal audit can help the managers to identify various risks. Analysing the potential causes of economic crisis from internal audit perspective, specialists consider that certain situations could be the basis for generating these negative phenomena.  The internal audit department was not interested in compliance and ensure compliance with internal audit standards, this disinterest being transmitted to the management, who considered this a leaflet (something insignificant);  The internal audit department carried out its assessment regarding risk management and sent reports to executives on risks likely to threaten the normal development of business, but was not capable enough to identify and report them in time;  The internal audit department carried out its assessment regarding risk management, but its procedures did not mention the necessity of reporting results to the management;  The internal audit department has complied fully with internal audit standards, doing assessment, monitoring and reporting to management the results on risk management, but the management and the audit committee totally ignored these reports, not granting them due importance.