Internal Audit Plan Research Articles

The effect of internal audit planning on risk factors: evidence from Yemen’s banks

This study aims to determine the extension of implicating risk factors in strategic planning for internal audit in Yemeni commercial banks, including inherent risk factors and control risks, whether caused by internal or external influences, and focuses on the strategic purpose of internal audit. A questionnaire instrument, specifically designed for this research purposes, was distributed to 58 respondents comprising internal auditors of commercial banks, as well as auditors of the External Control Department of the Central Bank of Yemen. The study determines whether Yemeni commercial banks include internal auditing in their operational structure. It also determines the risks that internal auditors prioritize while developing their internal audit strategies. This study uses Smart PLS methodologies to evaluate the hypotheses through data analysis. The results indicate that internal audit is considered one of the important operational activities in the structure of commercial banks of Yemen, and that the planning process for internal audit largely takes into account the inherent risk factors and control risk factors, whether the audit process is carried out by internal auditors or auditors of Central Bank of Yemen. AcknowledgmentThe authors extend their appreciation to the Deanship of Scientific Research at King Khalid University for funding this work through a large-group Research Project under grant number (RGP.2/131/45)”.

Analysis of Internal Audit Planning in Improving the Effectiveness of Organizational Performance at the Btm Sinar Mentari Tuban Cooperative

This study aims to describe the implementation of an internal audit in the BTM Sinar Mentari Tuban Cooperative and to describe internal audit planning in increasing the effectiveness of the performance of the BTM Sinar Mentari Tuban Rice Cooperative organization. Data collection techniques are carried out using questionnaires, observations, and interviews. Data analysis techniques are measurements with a Likert scale and descriptive statistics. Based on data analysis conducted on internal audits in increasing the effectiveness of organizational performance at the BTM Sinar Mentari Tuban cooperative, it can be seen that The results of research on the effectiveness of the role of internal audit at the Sinar Mentari BTM Cooperative show effective results. This can be seen from the calculation results showing 92.80%. The results of calculating the effectiveness of the company's performance show 92.46%; this means that the company's performance will be effective if there is an internal audit role in the company.

СТАН ТА РОЗВИТОК ІТ-АУДИТУ В УМОВАХ ЦИФРОВОЇ ЕКОНОМІКИ

The article examines issues of the state and directions of IT audit development. The relevance of the topic lies in the fact that the conditions of the digital economy are characterized by the rapid pace of changes in the field of information technologies, which requires IT audit to constantly develop and adapt to new challenges. The purpose of the article is to generalize views on the interpretation of the essence of IT audit, to characterize the tasks, types, standards in the field of IT audit, to justify the main stages of IT audit, to generalize the tools of IT audit, to determine the main directions of the development of IT audit in the conditions of the digital economy. Methodical approaches to the essence of IT audit by scientists and practitioners are analyzed in the article. Studies have shown that some specialists define IT audit as a type of audit, others propose to understand and apply it only as an intermediate stage of financial audit, and some - as a separate IT consulting service. The tasks of IT audit, its types and standards are described. The main types of audit evidence, methods and tools, as well as sources of information that can be used when conducting an IT audit are analyzed. The main stages of an IT audit are highlighted: preliminary research of the IT audit object and internal audit planning; IT audit and analysis; reporting on IT audit results; tracking the results of implementation of audit recommendations. The recommended process of organizing an internal IT audit at the enterprise. The IT audit toolkit is summarized, namely: IT audit goals; the necessity of its implementation; objects of IT audit; equipment and software used in IT audit, etc. Based on the conducted research, the advantages of conducting an IT audit are summarized. The following areas of IT audit development in the conditions of the digital economy have been determined: digital transformation; cyber security; data analytics; cloud technologies; automation; regulatory requirements. The development of IT audit is aimed at improving its methods and approaches, which would meet the modern requirements of business and technology, ensuring the reliability and efficiency of information systems of enterprises.

Ризик-орієнтований підхід до планування внутрішнього аудиту в банку

A vital role in the effective management of banking institutions is played by internal audit as an essential element of the risk management system, which ensures timely detection and resolution of problems, increases transparency and trust in the banking system, and ensures its stability and sustainability. The article aims to reveal the main criteria for risk assessment in the areas of internal audit, which is carried out in the bank based on a risk-based approach, to identify the main problems and substantiate the theoretical aspects of integrating a risk-oriented approach into practice. The role of internal audit in risk management of banking activity was revealed. Arguments were presented regarding implementing a risk-based approach to internal audit planning in the bank. The article analyzes the audit planning procedures and systematizes risk assessment criteria in audit areas. To determine the priority of audit areas, evaluating each area according to the specified criteria and distributing them according to the degree of risk is necessary. This will allow effective planning of audits, directing resources to the most risky areas. The study results indicate that audit planning in Ukrainian banks should be based on a comprehensive assessment of risks, which will allow for the taking into account internal and external factors. As a result, banks can quickly respond to changes in the external and internal environment and effectively allocate resources. To implement this task, it is necessary to develop a detailed audit plan based on a comprehensive risk assessment, and it is necessary to include all key business processes and bank organizational units. Constant monitoring of risks will allow for quick changes to the audit plan in response to new threats or opportunities. The theoretical and practical principles of audit planning based on a risk-based approach, presented in the article, are the basis for building a banking risk assessment model.

Fishbone diagram: Application of root cause analysis in internal audit planning

Purpose: This study applies a fishbone diagram to analyze the root cause of problems in the internal audit planning of J Corp, an Indonesian state-owned enterprise. Research methodology: A qualitative approach was employed to conduct a case study at the internal audit unit of an Indonesian state-owned enterprise. Research data were gathered from the results of focus group discussions with internal auditors, the analysis of the company’s standard operating procedure for internal auditing, and the observation of the workflow of internal audit planning. These data were then analyzed to identify the root causes of these problems. Results: Six key factors were identified that cause poor internal audit planning at J Corp. These are policies, processes, people, plants, programs, and products. To overcome these problems, this study provides several suggestions that can be implemented in the internal audit unit of J Corp. Limitations: This study is limited by the nature of the business and environment of J Corp, which affected the problems arising in the process of its internal audit planning; hence, the need to understand the entity to replicate this method for future research. Contribution: This study could be directly beneficial for internal auditors at J Corp to immediately improve the business process of internal audit planning. Furthermore, this study could contribute to future studies in which researchers or practitioners could replicate this method in another context. Novelty: The fishbone diagram was used to analyze the root causes of problems in the process of internal audit planning. Studies on the improvement of internal audit planning have been limited.

Internal Audit Function and Budgeting Efficiency in Financial Institutions: A Case of Rwanda Social Security Board

The main purpose of this research is to examine Internal audit function and budgeting efficiency in financial institutions in Rwanda specifically in Rwanda Social Security Board (RSSB). The research used descriptive research design with a mixed approach of qualitative and quantitative data. The formula developed by Taro Yamane was employed to determine the sample size (n=52). The findings showed that internal audit plan provides guidelines for auditors’ regular audits (mean 4.29); and internal audit reviews for budgets were made available (mean 4.32). It was also revealed that internal audit advised on budgeting (mean 4.25); internal audit provided assurance to the budgeting efficiency (mean 4.15); the internal audit assured budget management that there was an effective internal control for budgeting (mean 4.21); the internal auditor established audit objectives and scopes accordingly (mean 4.41); and internal audit prevented risks and fraudulent malpractices occurring when budgeting (mean 4.34). and those internal auditors follow up on the agreed management action plan based on audit recommendations (mean 4.24); internal auditors provide follow-up reports within a specified duration of time as guided by the organization’s policies for the exercise (mean 4.01); follow-up reports were shared (mean 4.61). According to the research, there is a strong positive correlation between RSSB's internal audit frequent review and budgeting efficiency (r= .713 r= .000); strong positive degree of relationship between internal audit recommendation and budgeting efficiency (r = .634, r = .004) and strong positive correlation between internal audit follow up and budgeting efficiency (r= .784; r = .000). The study concluded that internal audit, through regular reviews, provision of recommendations, and follow-up contributed to the efficiency of budgeting at RSSB. The study recommended that RSSB should strengthen its internal audit plan as a measure of ensuring that auditors are guided on the strategic follow-up plans to adopt and capture recommendations effectively. Key words: Internal audit, Budgeting efficiency, Public institutions, RSSB

A multi-objective optimization approach for integrated risk-based internal audit planning.

Annual audit planning is a multi-criteria decision-making problem faced by internal audit departments of all organizations. Due to the constrained audit resources, the planning process primarily involves the analysis and evaluation of complex factors for selecting auditable units that maximize the full potential of internal audit. Previous research on internal audit planning only focused on the goal of risk minimization and applied ranking methods to prioritize alternatives. In order to enable internal audit activities to add more value to the organization, the integrated risk-based internal audit planning is proposed to assist audit department in achieving multiple objectives in addition to risk management. Meanwhile, a multi-stage framework is proposed to support the development of such value-added internal audit plan. The new framework integrates the risk assessment of auditable units with the selection of audit activities and resource allocation through a combined analytic hierarchy process (AHP), fuzzy comprehensive evaluation (FCE) and weighted multi-choice goal programming (WMCGP) approach. The model considers both qualitative and quantitative decision criteria. A real-life case study of the development of an integrated risk-based annual audit plan is presented, and sensitivity analysis is performed to illustrate the validity of the proposed approach. The results indicate that the proposed framework is a useful tool for internal audit planning and the implications of the study can be extended to various selection and allocation problems.

Using the Agile Internal Audit Work Method and its Reflection on the Sustainable Development Report- By Application to a Sample of Economic Units Listed in the Iraq Stock Exchange

The research aims to study the use of the agile internal audit work method and its reflection on the dimensions of sustainable development. To achieve the goal of the research, the two researchers prepared a questionnaire consisting of a set of questions to test the research hypothesis, which states (there is no statistically significant effect relationship between the method of agile internal audit work on the sustainable development report). 6) Private banks listed in the Iraq Stock Exchange, which number 69, after reviewing the periodic reports prepared by the Central Bank of Iraq. The two researchers reached a set of conclusions, the most important of which is the absence of an influence relationship between the agile internal audit work style and the sustainable development report of the research sample banks, and this proves the research hypothesis (there is no statistically significant effect relationship between the agile internal audit work style on the sustainable development report). The researchers presented a set of recommendations, the most important of which is the continuous attention to the periodic reports prepared by the agile internal audit team, as it is one of the important steps in determining the start of auditing the elements and activities of the highest importance and ending them, and then starting to audit the elements and activities of less importance and the need to streamline the procedures of the annual traditional internal audit plan. To get results faster and less time, as well as preparing internal auditor reports periodically within a short period of time.

Risk-Based Auditing, Quality Assurance and Improvement Program in the Practices of Internal Auditing

The purpose of this article is to outline internal auditing approaches' risk-based audits, quality assurance, and improvement programs. This paper provides a comprehensive review of risk-based auditing, quality assurance, and improvement initiatives for internal audit practitioners, audit committees, and senior management in organizations. Internal audits are designed to find flaws in a firm's operational procedures and internal controls so they may be quickly remedied to avoid harm to the company or its stakeholders. To identify the functional areas where a corporation is most exposed, the internal audit plan should be risk-driven. The internal audit plan ought to consider the organization's strategic needs. Similarly, each internal audit purpose should be in line with the audit strategy. The researcher combed through a vast number of academic publications. This study was created using desk-based research and secondary data. The study's findings will be of interest to academics and policymakers.

Internal audit in a credit institution as a tool for improving the economic security of an economic entity

When writing this scientific article, the author considered the role of internal audit in the economic security of credit institutions. The formed conditions of instability of the economic system and negative external impact, manifested in sanctions pressure, mediate the need to increase the effectiveness of internal audit in credit institutions in order to increase the economic security of an economic entity. The author considers the definition of internal audit in accordance with the legislation of the Russian Federation, identifies the tasks of internal audit, as well as the prerequisites for the formation of an internal audit service in an organization, and the main functions of internal audit. Internal audit is an independent and objective activity of providing guarantees and consulting, which improves the activities of the organization and increases its value. The differences between internal audit and other forms of control are highlighted. It is important to note that internal audit occupies one of the most important roles in the structure of the organization and is in constant interaction with the system of economic security of the organization. Internal audit is considered the foundation of the organization and is considered as a key element for the application of the accounting system. Effective internal audit planning allows audit activities to be one of the aspects that protects the organization and increases economic security. Moreover, effective internal audit planning and prioritization of the units to be audited are important both from the point of view of the effective use of internal auditors and from the point of view of the effective use of economic resources. Thus, the tasks assigned to the study can be considered completed. The problems of the research topic were fully developed, a block of relevant information was presented and analyzed for each of the tasks, and appropriate conclusions were drawn.

Active Role of Risk Management in Internal Audit Planning of Ministry of Energy and Mineral Resources

Active Role of Risk Management in Internal Audit Planning of Ministry of Energy and Mineral Resources

A reference model for auditing organisational resilience

There is a growing interest in the organisational resilience. The internal audit function can contribute to growing and maintaining organisational resilience by including the topic in the internal audit plan. Auditing it requires a reference model. The study described used a mixed methods approach to develop a reference model for auditing organisational resilience. Six relevant hard and soft (behavioural) elements of resilience are determined: people, culture, strategy, processes, governance and regulation. The internal audit function can use the tool to assess attention areas to include in the audit scope and formulate a specific reference framework for the organisation.

Risk identification, assessment and management in the Greek public hospitals: The contribution of the board of directors and internal audit

Research Question: Our study examines the development of a reliable internal audit plan in the Greek public hospitals, focusing on how to identify, assess and evaluate the relevant risks by the Boards of Directors. Data: We use an exceptional database drawing information from a large sample of Greek hospitals based on a structured questionnaire for the period from September 1, 2015 to March 31, 2017. Tools: As our primary source of data we conduct interviews with CAEs of Greek hospitals’, while secondary data sources come from corporate governance codes, COSO framework for ERM, Greek corporate governance laws, regulations, best practices and published articles. Findings: Taking into account the financial crisis of the last ten years in Greece as well as the pathogenesis of the healthcare system, we note the poorly organized risk management in Greek hospitals. The results show that the financial crisis had a direct impact on the way risk management of public hospitals operates. Furthermore, we observe denial of the application and implementation in the form of formal guidelines to the members of the hospitals’ Board of Directors. Contribution: Research findings can have a catalytic effect on hospital management and those who implement public policies.

ОРГАНІЗАЦІЙНО-МЕТОДИЧНІ ЗАСАДИ ВНУТРІШНЬОГО АУДИТУ ІННОВАЦІЙНОЇ ДІЯЛЬНОСТІ ІТ КОМПАНІЙ

The article updates the consideration of the innovation process as a separate subject of attention, part of the internal audit plan of IT companies that consider innovation as an important element of the development strategy. The purpose of the article is to review and systematize the organizational and methodological principles of internal audit of innovative activities of IT companies. Achieving this goal is conditioned by the need to expand control and supervisory tools in order to strengthen rationality, transparency, and responsibility in the innovative activities of these companies. As a result, the organizational and methodological principles of the internal audit of innovative activities of IT companies were systematized. As the main goal of the internal audit of the innovative activity of IT companies, the need for the formation of guidelines for making innovative decisions, as well as the outline of the ways of the innovative development of the IT company, has been determined. The scope of coverage of the internal audit of the innovative activity of the IT company has been determined. The need to expand control and supervisory tools with the aim of strengthening rationality, transparency, and responsibility in the innovative activities of IT companies has been identified. It is shown that the methodology of auditing the innovative activity of an IT company should include policies and procedures available for implementation in the conditions of specific companies, which ensure the protection of the assets of the business entity, the accuracy and reliability of its reporting, and prompt compliance with management standards. It is noted that the use of an audit sample in audit tasks gives auditors certain advantages defined in the article. The toolkit and procedures related to the formation of audit reports are characterized, which are expedient to implement in the process of internal audit of innovative activities of IT companies in view of the specifics of their activities. The results of this study are a prerequisite for the development of methodological tools for the audit of innovative activities in the IT sphere.

Remote Auditing : An Alternative Approach to Face the Internal Audit Challenges During The COVID-19 Pandemic

The research aims to define the roles that the internal audit activity can play in Egyptian business enterprises to confront the crisis of the spread of the Corona virus (Covid-19), and discover the challenges that the internal auditors may face while performing their work during the period of the epidemic. The research also aims to study the factors that should be taken into consideration when preparing and implementing the internal audit plan and reporting on the audit findings during the Corona virus (COVID-19) crisis, in addition to suggesting an alternative approach to facilitate the performance of internal audit tasks efficiently during this period, which is the remote auditing approach. To achieve these goals, the research relied on using the positive approach through the use of the deductive approach to analyze previous studies related to the research topic and derive the research hypotheses, in addition to using the inductive approach to test the validity of the research hypotheses in the real practice in the Egyptian business environment. This was done through a field study conducted on a sample of 95 individuals, which included three categories: the academics represented by the professors of accounting and auditing in the faculties of commerce in Egyptian universities, in addition to the members of the audit committees and the internal auditors of some joint stock companies listed on the Egyptian Stock Exchange. Statistical tests were used commensurate with the nature of the data collected. And based on the results of the statistical hypothesis test, the first hypothesis was accepted, which states that there is agreement between the study sample groups about the importance of the roles that the internal audit activity can play in business enterprises to confront the crisis of the Corona virus (Covid-19). Also, the second hypothesis was accepted , Which states that there is agreement between the study sample groups about the challenges that may face the internal auditors during the Corona virus (Covid-19) pandemic, as well as the third hypothesis which states that there is agreement between the study sample groups about the factors that should be considered when preparing and implementing the internal audit plan and reporting on the audit results during the Corona virus (Covid-19) crisis. Also, based on the results of the field study, it becomes clear the importance of developing the method of performing the internal audit activity during the Corona pandemic crisis, through applying modern audit methods, such as the remote audit approach, which relies on using information and communication technology to perform internal audit tasks efficiently , which enables the internal audit activity to provide the roles assigned to it and meet the needs of stakeholders , and overcome the challenges facing the internal auditors during the period of the epidemic on the other hand.

Internal Audit Risk Assessment in the Function of Fraud Detection

Abstract We are witnessing an increasing frequency of illegal actions and fraud in the business of legal entities, which directly reflects on the quality of information presented in financial statements. Internal audit does not primarily deal with the audit of financial statements, but through verifying the application of accounting policies and procedures it helps to gain reasonable assurance that the financial statements are reliable and that they are presented fairly. The role of internal audit in the fraud detection process is reflected in the fraud risk assessment in the internal audit planning process, and through performing work engagements to detecting them. In this paper, we will present risk assessment techniques, which the internal auditor can apply in quantitative and qualitative assessment of fraud risk, and in identifying priority areas/audit processes. The aim of this paper is to point out the importance of the role of internal audit, through the application of techniques, tools and prescribed responsibilities for risk assessment, in the process of detecting fraud in companies that cause incalculable damage on a daily basis.

The Relationship between Corporate Governance and Firm Performance: The Effect of Internal Audit and Enterprise Resource Planning (ERP)

This research aims to explore the effect of good corporate governance on the performance of listed companies in Saudi Arabia. In particular, the research focuses on the effect of effective internal audit and ERP on corporate governance and, subsequently, firm performance. A questionnaire was used to collect the data. The results indicated that effective corporate governance could be attained by having a good internal audit and ERP system. The results conclude that proper corporate governance positively affects firm performance, and effective internal audit activities and successful ERP implementation enhance corporate governance, eventually leading to better performance. The findings of this study are beneficial to Saudi listed companies and other GCC and their policymakers since social, political, and economic contexts are similar. Even though the study’s findings provide extensive evidence regarding corporate governance and firm performance, this study has its limitation as respondents represented a small sample of listed companies and cannot be generalized to all listed companies.

An integrated FAHP-MCGP approach to project selection and resource allocation in risk-based internal audit planning: A case study

Effective audit planning could drive internal audit function to be the catalyst for company development by launching audit projects that protect and create organization value. In the risk-based internal audit planning process, once risk assessment is completed, audit projects should be selected and resources are allocated accordingly. However, an optimal annual audit plan cannot be realized based on subjective selection of projects and manual distribution of available hours merely. In the planning process, the risk level that can be mitigated by performing individual audit project is vague and there is also uncertainty with the time to be spent on each project. By developing a structured three-phase framework for risk-based audit planning, this paper proposes a novel approach that combines fuzzy analytic hierarchy process (FAHP) and multi-choice goal programming (MCGP) to fill the gap between prioritization and allocation technique. An exploratory estimation of risk reduction factor for each candidate project is performed using FAHP, and then MCGP assists in making a more informed choice so as to minimize the total deviations from predefined goals concerning the risk coverage, flexibility and optimal mix of project portfolio. A real case study of annual audit plan for a global internal audit team is presented to illustrate how the proposed FAHP-MCGP approach could be applied in practice. The results of this research indicate that the proposed FAHP-MCGP approach is a useful tool for selecting potential projects and allocating staff time during risk-based internal audit panning and has substantial practical application.

Understanding the internal audit function in a digitalised business environment

Purpose This paper aims to gain an in-depth understanding of how the internal audit function evolves in an increasingly digitalised business environment. Design/methodology/approach This paper is based on 29 semi-structured interviews with members of management committees and internal auditors based in Belgium. Findings The analysis reveals that a digitalised business environment affects the internal audit function in three respects. First, it impacts its scope. The agility of the internal audit planning and the required digital knowledge are expected to increase and information technology (IT) risks gain importance, especially cybersecurity threats. Second, the demand for consulting activities performed by internal auditors is higher and third, digitalisation modifies the working practices of internal auditors in their day-to-day tasks. New technologies such as data analytics tools are being implemented progressively in internal audit departments and digital skills are considered a critical asset. Research limitations/implications This research was conducted in the European Union and gathers opinions of members of management committees and internal auditors. Future research could focus on other internal auditing stakeholders in other legal contexts. Practical implications The internal audit function needs to integrate IT and data analytics skills. In addition, the internal audit function should develop consulting activities to help organisations deal with the digitalisation of the business environment. Originality/value The impact of digitalisation on the internal audit function and its effect on internal audit practices is an underexplored area.

THE ROLE OF INTERNAL AUDIT IN THE FIGHT AGAINST CYBER CRIME

The internet is constantly changing the way we live and conduct business. Global business surroundings impose all organizations across to have a secure digital infrastructure for fighting against cybercrime. Cyber crime is on the raise in this decade. Cyber crime is a criminal activity that is focused against compromising security of information systems in enterprises, in order to acquire certain profits, or to incur damage, theft or loss. Types of cyber crime include theft, evasion, or using information in order to unlawfully obtain profits from them. This paper will present certain information about cyber crime and most common types of it. According to international standards for internal audits, internal auditors are authorized for fight against fraud, which means authorization for fight against cyber crime. Main purpose of this paper is to find model for organizing internal audit for purpose of fighting cyber crime. Therefore, it is necessary to determine: internal audit standards that your organization must adhere to in fight against cybercrime, identify security requirements for standards, determine the goals, risks and security policy of the organization, raise employee awareness of the dangers of cybercrime, involve top management in the orbit against cybercrime, conduct employee training on data security and the like. Cyber security is basically about managing future risk, and requires insight into current and future vulnerabilities and how to prevent or reduce them, the likelihood of threats and costs associated with potential outcomes, and how to mitigate them. Internal auditors must be aware of impending regulatory changes based on IIA standards (The International Standards for the Professional Practice of Internal Auditing) related to computer security. Internal auditors should understand the impact of cyber threats on the organization. In particular, they should include this in their internal audit plan based on the risk of cybercrime. Internal auditors should have a strong partnership with the CIO (Chief Information Officer) and CISO (Chief Information Security Officer), for the sake of a trusted advisor in the fight against cybercrime. Internal auditors should provide an independent overview of the cyber security strategy. Modal will be based on COSO (The Committee of Sponsoring Organizations of the Treadway Commission’s) Internal Control — Integrated Framework and will feature five core principles: 1) creating control environment for fighting against cyber crime, 2) risk assessment for cyber crime, 3) projecting and implementing activities for fighting against cyber crime, and 5) monitoring activities. Research results will show new scientific facts and knowledge about methods for fighting cyber crime worldwide. Managers and internal auditors will have practical benefit from research results for implementing cyber crime prevention programs.