- Email: [email protected]
International IIA joins outsourcing debate
International IIA joins outsourcing debate During the past few years, there has been an increase in the practice of organizations outsourcing internal audit activities to external providers, principally major accounting firms. In some cases, specific activities, including information systems auditing, have been outsourced to cover gaps in internal audit expertise. The practice of outsourcing internal auditing to the same firm that provides external auditing services was questioned in November 1994 in the United States by Walter D. Scheutze, Chief Accountant of the Securities and Exchange Commission. Speaking at an American Institute of Certified Public Accountants (AICPA) conference, he referred to AICPA’s Ethics Ruling 97. This ruling, issued in 1993, highlighted that external auditors: cannot perform management functions or make management decisions; cannot be part of the client’s approval process; and cannot be part of the internal control system, without impairing their independence. Scheutze argued that the Ethics Ruling, read carefully, is restrictive as the external auditor could not
therefore make management decisions on the projects to be performed under the scope of the ‘internal audit’ work. Recently, William G. Bishop III, President of the Institute of Internal Auditors at their international headquarters in Florida, supported this view and questioned how a firm of accountants could provide an independent opinion of an organization’s financial statement if it also performs an internal auditing engagement upon which management bases its opinion. He explained that “the internal auditing function provides the major supporting assurance that allows management to make a public assertion as to the adequacy and effectiveness of its organization’s internal control structure. If a public accounting firm performs all the internal auditing activities on an outsourced basis, it becomes at the very least, an indirect advocate of management’s assertion”. He warned that this may result in public confidence in the integrity of the processes that provide vital information to the internal control reporting process.
Computer Audit Update l March 0 1996, Elsevier Science Ltd.
1996
Historically, he pointed out, the business community has been well served by internal auditing. As outsourcing represents a significant departure from this tradition, its practice should be of deep concern to the outsourcing company, its shareholders, and the public interest. “The control environment of the organization is adversely impacted by the disruption of the roles of internal and external auditors. Boards of directors, management, regulators, and the general public have come to rely on the checks and balances inherent in the relationship between these auditors,” Bishop noted.
“Internal auditors routinely comment to audit committees on the sufficiency of the external auditor. Similarly, external auditors respond to audit committee enquiries about internal auditor performance. When internal and external auditors are one, this check and balance is eliminated and the control environment is weakened.” He suggested that companies which use external auditors to perform their internal audits should be required to disclose the practice in their annual reports. David Regional IIA Inc.
Bentley, Director,
‘Faulty’ mouse disrupts computer system A department of a UK District Council experienced some ‘technical’ problems with one of its PCs recently reports Computer Weekly. After having spent a considerable amount of time and in depth technical know-how trying to solve the computer glitch, the department involved finally identified the cause of the problems - a small brown field mouse had gnawed through some of the cables. The department caught the mouse alive, nicknamed it Byter and then let it go. The amazing fact missing from this tale is that the department involved was the Pest Control Department, of course!
therefore make management decisions on the projects to be performed under the scope of the ‘internal audit’ work. Recently, William G. Bishop III, President of the Institute of Internal Auditors at their international headquarters in Florida, supported this view and questioned how a firm of accountants could provide an independent opinion of an organization’s financial statement if it also performs an internal auditing engagement upon which management bases its opinion. He explained that “the internal auditing function provides the major supporting assurance that allows management to make a public assertion as to the adequacy and effectiveness of its organization’s internal control structure. If a public accounting firm performs all the internal auditing activities on an outsourced basis, it becomes at the very least, an indirect advocate of management’s assertion”. He warned that this may result in public confidence in the integrity of the processes that provide vital information to the internal control reporting process.
Computer Audit Update l March 0 1996, Elsevier Science Ltd.
1996
Historically, he pointed out, the business community has been well served by internal auditing. As outsourcing represents a significant departure from this tradition, its practice should be of deep concern to the outsourcing company, its shareholders, and the public interest. “The control environment of the organization is adversely impacted by the disruption of the roles of internal and external auditors. Boards of directors, management, regulators, and the general public have come to rely on the checks and balances inherent in the relationship between these auditors,” Bishop noted.
“Internal auditors routinely comment to audit committees on the sufficiency of the external auditor. Similarly, external auditors respond to audit committee enquiries about internal auditor performance. When internal and external auditors are one, this check and balance is eliminated and the control environment is weakened.” He suggested that companies which use external auditors to perform their internal audits should be required to disclose the practice in their annual reports. David Regional IIA Inc.
Bentley, Director,
‘Faulty’ mouse disrupts computer system A department of a UK District Council experienced some ‘technical’ problems with one of its PCs recently reports Computer Weekly. After having spent a considerable amount of time and in depth technical know-how trying to solve the computer glitch, the department involved finally identified the cause of the problems - a small brown field mouse had gnawed through some of the cables. The department caught the mouse alive, nicknamed it Byter and then let it go. The amazing fact missing from this tale is that the department involved was the Pest Control Department, of course!