Why have an internal audit?

If your business is above a certain size (e.g. turnover of £6.5 million or above) then by law you’ll need a regular audit, known as a ‘statutory’ audit.

However, even if yours is a lot smaller than that, you can benefit a great deal by arranging its own internal audit.

The reputation of your business depends on many things, such as the quality of the service you provide and how you treat the people who work for you.

But the way you operate is also important, particularly with regard to risk management and governance.

Although you can tell your shareholders, clients and trustees how well all these processes are working, they may only have your word for it.

An internal audit is a way to provide the extra level of credibility they may be looking for.

What is an internal company audit and why might I need one?

When you arrange an internal audit, you’re essentially asking someone independent from your company – an expert – to provide you with an objective evaluation of your internal controls and risk management.

Your auditor will either provide assurance that your company is operating in the right way, or identify its weaknesses and suggest solutions.

For audits to work properly, it is important that the auditor has the freedom they need to do their job effectively.

This means they should be fully independent and have no personal or professional ties to you whatsoever.

You don’t want anything to influence them, as the value of the internal audit comes from the professional independence of the auditor.

What is the purpose of auditing a company internally?

An audit should give you an objective, unbiased assessment of how your business operates day to day.

The auditor will also (if you want them to) look at a wider range of issues, such as your reputation, growth, environmental impact and employee welfare.

You can then measure this objective reality against your vision for the business, and address any discrepancies between them.

For larger companies, internal audits produce reports that tend to be targeted at the board and senior management.

For smaller companies, they may just be for you or your most senior managers, but the value is the same. You should always try and make sure your company is working in a way that not only helps you meet your commercial targets, but also fosters the right working environment and client relationships.

Regular audits let you track your performance and improve it over time.

Other benefits include:

• Making sure you meet your compliance requirements
• Ensuring you are handling sensitive data correctly
• Identifying factors that hinder productivity
• Assessing risks and protecting key assets
• Testing your internal controls

Internal and external audits

When you think of an audit, you may picture accountants going over stacks of financial information.

However, this applies mostly to external audits. An external audit is concerned with establishing the credibility and reliability of your business’ financial reports, and is generally intended to inform shareholders and other people outside your company.

By contrast, an internal audit may touch on your financial performance but only as part of a wider investigation into the effectiveness of your governance, risk management and control processes.

The other main difference between the two types of audit is their frequency. External audits are only carried out once a year, whereas you can have multiple internal audits during a single 12 month period.

The internal audit process

If you know exactly what is going to happen in an internal audit and what is required of you, disruption will be kept to a minimum.

Here is what you can expect:

Before the audit

You need to specify what aspects your business you want to cover in the audit.

Start by making a list of the different areas in your business and jot down how they contribute to your operations as a whole. Is there one piece of the puzzle that could halt your whole operation if something went wrong? And do any of these elements already make you feel anxious?

These may be the areas to focus on.

Make sure all the relevant people within your organisation know exactly what is happening.

Don’t spring an audit on people by surprise –  it will cause stress and you’re unlikely to obtain an accurate picture.

Spend time in preparation to make sure all the relevant documentation and data is easily available for the auditor.

This will minimise disruption for you as you continue to run the business.

During the audit

The main audit process is usually made up of interviews and document analysis.

It’s best to give the auditor their own working space away from the main activity of the rest of your company.

After the audit

The end product of the internal audit will be a report setting out its findings and (if necessary) recommendations.

It is up to you (i.e. the board or senior management) to decide on whether and how to act on this report. Don’t dismiss findings just because they make uncomfortable reading.

Who carries out audits?

Many accounting firms provide audit and assurance services.

This should be a different firm from the one that provides your regular accounting services, to avoid conflicts of interest.

You can however use the same auditors regularly, and indeed this can help them to build up a deeper understanding of your business and how to help you improve it.