STANDARDS ON INTERNAL AUDIT - An Overview By CA R.

slide1. STANDARDS ON INTERNAL AUDIT  -
An Overview



By CA R. A. Sharma, Jaipur FCA, DISA
Mobile No. 93511 45820
e mail: rasharma.ca@rediffmail.com 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide2. Continouous udating in profession During last 44 years journey as professional:
Companies Act 1956 and 2013
Tax Audit, VAT Audit, GST Audit
Rajasthan Sales Tax –Rajasthan Vat Act-GST Law
Accounting and Auditing Standards
Code of conduct 1963-2009-2020
Labor Laws 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide3. the Standards----Accounting Standards-Total 27 AS 1, Disclosure of Accounting Policies
AS 2, Valuation of Inventories
AS 3, Cash Flow Statements
AS 4, Contingencies and Events Occurring After the Balance Sheet Date
AS 5, Net Profit or Loss for the Period, Prior Period Items and Changes in Accounting Policies
AS 7, Construction Contracts
AS 9, Revenue Recognition
AS 10, Property, Plant and Equipment
AS 11, The Effects of Changes in Foreign Exchange Rates
AS 12, Accounting for Government Grants
AS 13, Accounting for Investments
AS 14, Accounting for Amalgamations 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide4. the Standards…AS …..contd AS 15, Employee Benefits
AS 16, Borrowing Costs
AS 17, Segment Reporting
AS 18, Related Party Disclosures
AS 19, Leases
AS 20, Earnings Per Share (EPS)
AS 21, Consolidated Financial Statements
AS 22, Accounting for Taxes on Income
AS 23, Accounting for Investments in Associates in Consolidated Financial Statements
AS 24, Discontinuing Operations
AS 25, Interim Financial Reporting
AS 26, Intangible Assets
AS 27, Financial Reporting of Interests in Joint Ventures
AS 28, Impairment of Assets
AS 29, Provisions, Contingent Liabilities and Contingent Assets 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide5. Auditing Standards- Total 37 General Principles and Responsibilities:
SA 200: Overall Objectives of the Independent Auditors & Conduct of Audit in Accordance with Standards on Auditing
SA 210: Agreeing the Terms of Audit Engagement
SA 220: Quality Control for an Audit of Financial Statements
SA 230: Audit Documentation
SA 240: The Auditor’s Responsibilities Relating to Fraud in an Audit of Financial Statements
SA 250: Consideration of Laws and Regulations in an Audit of Financial Statements
SA 260: Communications of Audit Matters with Those Charged with Governance
SA 265: Communicating Deficiencies in internal controls to TCWG and Management.
SA 299: Responsibility of Joint Auditors 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide6. Auditing Standards…Contd Risk Assessment and Response to Assessed Risk
SA 300 : Planning an Audit of Financial Statement
SA 315: Identifying and Assessing the Risks of Material Misstatement through Understanding the Entity and its Environment
SA 320: Audit Materiality
SA 330: The Auditor’s Responses to Assessed Risks
SA 402: Audit Considerations Relating To Entities Using Service Organizations
SA 450 : Evaluation of Misstatements identified during the Audit 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide7. Auditing Standards….contd Audit Evidence
SA 500: Audit Evidence
SA 501: Audit Evidence- Specified Consideration For Selected Items
SA 505: External Confirmations
SA 510: Initial Engagements- Opening Balances
SA 520: Analytical Procedures
SA 530: Audit Sampling
SA 540 : Auditing Accounting Estimates, Including Fair Value Accounting Estimates, and Related Disclosures
SA 550: Related Parties
SA 560: Subsequent Events
SA-570: Going Concern
SA 580: Written Representations 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide8. Auditing Standards….Contd Using Work of Others
SA 600: Using the Work of another Auditor
SA 610: Using the work of Internal Auditor
SA 620: Using the Work of an Expert
Audit Conclusions and Reporting
SA 700 :Forming an Opinion and Reporting on Financial Statements & Independent Auditors' Report
SA 705: Modifications to opinion in the Independent Auditors Report
SA 706:Emphasis of matter paragraphs and other matter paragraphs in the independent auditor’s report
SA 710 :Comparative Information—Corresponding Figures and Comparative Financial Statements
SA 720 : The Auditor's Responsibility in relation to Other Information in Documents Containing Audited Financial Statements 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide9. Auditing Standards…contd Specialized Areas
SA 800: Special Considerations: Audit of Financial Statements Prepared in Accordance with Special Purpose Frameworks
SA 805 : Special Considerations – Audits of Single Financial Statements and Specific Elements, Accounts or Items of a Financial Statement.
SA 810 : Engagements to Report on Summary Financial Statements 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide10. Regulators -Expanded Companies Act-ROC-RD-SFI
ICAI-ESB/DC, QRB, TAQRB
NFRA
SEBI
RBI
Income Tax 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide11. Common observations why not reported ?: 1. Stock records, verification and valuation(SA 501)
2. Verification of sundry creditors/debtors(SA 505)
3. Verification of cash and Bank(GN)
4. Any other non compliance of AS like-
Disclosure of Accounting Policies (AS1)
Valuation of Inventories (AS2)
Employees Benefits(AS15),
Government Grants(AS12 )
Accounting for Taxes(AS22)
Foreign Exchange Transactions(AS 11) 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide12. Internal audit defined Internal audit provides independent assurance on the effectiveness of internal controls and risk management processes to enhance governance and achieve organisational objectives 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide13. Key Terms of IA definition Independence

Internal controls and risk management

Governance

Organizational objectives 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide14. Standards on Internal Audit (SIAs) Establish uniform evaluation criteria, methods, processes and practices
The Standards are pronouncements which from the basis for conducting all internal audit activity.
Designed to help the Internal Auditor to discharge his responsibilities.
These SIAs should be read in conjunction with the “Preface to the Standards on Internal Audit” , “Framework Governing Internal Audits” and “Basic Principles of Internal Audit”
Total 19 Standards prescribed
SIAs are recommendatory 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide15. Standards on Internal Audit (SIAs) The Standards on Internal Audit (SIAs) are a set of minimum requirements that apply to all members of the ICAI while performing internal audit of any entity or body corporate.

As per section 138 of Companies Act, 2013, the board of a Company may, besides a Chartered Accountant, appoint a cost accountant or any other professional to conduct Internal Audits.

The ICAI recommends the adoption of the SIAs by non-members of the ICAI who are performing internal audits so as to ensure a consistent approach and quality in the discharge of their professional duties. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide16. The objectives and functions of the Board are as follows: To review existing and emerging internal auditing practices worldwide and identify areas in which Standards on Internal Audit (SIAs) need to be developed
To formulate Standards on Internal Audit, which may be issued under the authority of the Council of the Institute.
To formulate Guidance Notes on issues relating to internal audit, including those arising from the SIAs, or pertaining to any specific industry, which may be issued under the authority of the Council of the Institute.
To continuously review the existing Standards and Guidance on Internal Audit and to undertake their revision, if necessary.
To formulate and review Implementation Guides, Technical Guides, Practice Manuals, Studies and other papers which may be issued under its own authority for guidance of the members, as felt appropriate by the Board
To undertake research and promote knowledge dissemination in the field of internal audit. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide17. Mandatory Nature of Framework and Standards The Council of the ICAI has decided that the Standards will be made mandatory in a phased manner. As on date all standards on Internal Audit are recommendatory.

The SIAs shall initially be mandatory for members performing internal audits in all listed companies, as per Section 138 of the Companies Act, 2013, read with Rule 13 of Companies (Accounts) Rules 2014 from the effective date of the SIA, and all other companies from one year thereafter. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide18. The Standards on Internal Audit (SIA), as and when issued, will be classified and numbered in a series format, as follows: 100 Series: Standards on Key Concepts(5 Standards)

200 Series: Standards on Internal Audit Management(5 Standards)

300-400 Series: Standards on the Conduct of Audit Assignments(7 Standards)

500 Series :Standards on Specialized Areas(2 Standards)

600 Series: Standards on Quality

700 Series: Other / Miscellaneous Matters 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide19. 100 Series : Standards on Key Concepts SIA 110- Nature of Assurance
SIA 120- Internal Controls
SIA 130- Risk Management
SIA 140- Governance
SIA 150- Compliance with Laws and Regulations 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide20. SIA 110- Nature of Assurance Covers ONLY those assignments where an opinion is expressed through an Internal Audit Report.
This SIA clarifies the minimum requirements to be in place before an audit opinion report can be issued.
Reasonable Assurance Assignment - provide an opinion over whole subject matter after conducting an audit of whole subject matter
"Reasonable assurance is less than absolute assurance"
Limited Assurance Assignment- provide an opinion over whole or part of subject matter after conducting limited audit procedures over subject matter 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide21. SIA 110 CONTD The main objective of this Standard is to provide clarity on-
a) Whether the internal auditor can provide any assurance at all;
b) Essential requirements which must be satisfied to be able to provide the assurance, and
c) Nature of assurance that can be provided (Reasonable or Limited) and under what circumstances. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide22. SIA 120 - Internal Controls Key concept in IA
Systematic and procedural steps adopted by an organization to mitigate risks
Internal Controls that mitigate risks of financial exposure -Internal Financial Controls
Internal Controls that mitigate operational risks – Operational Controls
Overall responsibility for designing, assessing the adequacy, implementing and maintaining the operating effectiveness of Internal Controls-Board of Directors and the Management. IA to ensure IC is effective and efficient. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide23. SIA 130 – Risk Management Key concept in IA
Risk-probability of threat exploiting vulnerability of business assets or processes or controls by occurrence of an event
Risk management - process with a series of steps, on a continuous basis to identify the threats & vulnerability
This standard shall apply to ALL Risk Based Internal Audits
Explains responsibilities of Board of Directors, Risk Management Department and Management w.r.t Risk Management as mandated by law and regulations
Responsibilities of Internal Auditor in RBIA and give recommendations for
Improvement and suggestion 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide24. SIA 140 – Governance Key concept in IA
Governance ensures that every one is aligned to the best interest of the organization, and does what they are supposed to do, to help achieve the organizational objectives
Governance is an essential element of business functioning, and IA is key element of governance.
SIA explains responsibilities of Board of Directors and Management, Audit Committee with regard to governance.(Companies Act 2013-Sec 166 Duties of Directors, SEBI LODR Regulations)
Responsibilities of Internal Auditor - nature and extent off procedures depend on the framework in place and maturity of the processes. If any short comings are observed, auditors shall give recommendations for improvement and suggestions to make governance framework more efficient and effective in line with stated objectives. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide25. SIA 150-Compliance with Laws and Regulations Key Concept in IA
Compliance is a term used to describe the process of following, in letter and spirit, the applicable laws and regulations.
Any act contrary to the laid down laws and regulations, either through omission or commission and is performed intentionally or unintentionally it is a Non Compliance (or violation) and may result in fines, penalties, litigation or other such consequences
Responsibility of Board and Management (Co Act 134 (5) clause f & also SEBI LODR regulations)
Responsibility of Internal Auditor –Design and conduct audit procedures based on framework in place & maturity of the process, make recommendations for improvement, suggestions to make compliance framework more effective and efficient. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide26. 200 Series: Standards on Internal Audit Management SIA 210:Managing the Internal Audit Function
SIA 220:Conducting Over all Internal Planning
SIA 230:Objectives of Internal Audit
SIA 240:Using the Work of an Expert
SIA 250:Communication with Those Charged with Governance {TCWG) 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide27. SIA 210: Managing the Internal Audit Function Achievement of overall objectives of Internal Audit (as outlined in its Charter or Terms of Engagement)
Deployment of skilled resources and expertise
IA assignments- systematic, disciplined and professional manner
Work is done in conformance with the SIA and other related pronouncements
Timely completion 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide28. SIA 220 : CONDUCTING OVERALL INTERNAL PLANNING Failing to plan is planning to Fail
Overall IA plan for entire entity is prepared for given period of time (usually a year) and presented to highest governing body responsible for Internal audits, normally, the BOD or the Audit Committee
The SIA covers first level of planning for entire entity as a whole
It is undertaken prior to beginning of plan period (generally the financial year).
It is comprehensive in nature covering entire entity (i.e all locations, functions, business units and legal entities including third parties wherever relevant) alongwith the periodicity of assignments
Normally prepared by Chief Internal Auditor (or Engagement Partner where external service provider is appointed to conduct IA )
Overall IA Plan should be reviewed & approved by Governing body responsible of IA
Scope shall be consistent with the goals & objectives and also nature and extent of the assurance to be provided
Certain deviations may be required to be notified to stakeholders or even formal modification of plan may be required
Significant modification to the plan should be done ONLY after consultation with those who had approved the plan formerly 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide29. Contd. Use professional judgement
Document planning process
Involves extensive discussion with management & TCWG
Prioritize and focus audit work on high risk areas
Due attention to matters of importance, considering complexity & sensitivity has to be considered
Detailed work schedule
Technology deployment – IT in business operation and transaction processing – plan to use IT tools, data mining & analytical procedures & expertise required. Seek additional resources if required.
IA plan should be continuously monitored during execution phase to achieve objectives and identify deviations if any. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide30. SIA 230: Objectives of Internal Audit Depends on size, structure & complexity of entity subject to IA
Also depends on the Laws & regulations and specific requirements of management & TCWG
While specific objectives on any IA may vary from company to company, objectives are generally consistent with definition of IA
Once the objectives of IA are defined, they help to establish the operating parameters within overall IA agenda
These objectives & operating parameters are formally recorded:
Internal Audit Charter – in house audit team
Engagement letter – if outsourced to IA service provider 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide31. SIA 240 : Using the Work of an Expert IA may seek assistance & reliance on work of an expert in complex matters/areas (Info Tech, civil, Electrical, mechanical engineering, oil and gas industry, actuarial services etc.)
Internal Auditor should conduct independent evaluation of the qualifications and credentials of the expert. He should also validate the independence and objectivity of expert.
Internal Auditor should retail the ultimate responsibility for IA conclusions & opinions. Further, he shall not refer work of an expert in IA report 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide32. SIA 250 : Communication with Those Charged with Governance (TCWG) Mandates the need to have effective 2 way communication with Management for achievement of IA objectives
It should be on periodic basis
There should be a continuous dialogue and discussions between IA and TCWG
At the same time the communication should be independent, definite, effective and timely manner.
The entire communication has to be documented. (Refer SIA 330) 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide33. 300-400 Series : Standards on Conduct of Audit Assignments SIA 310: Planning the Internal Audit Assignment
SIA 320 : Internal Audit Evidence
SIA 330 : Internal Audit Documentation
SIA 350 : Review and Supervision of Audit Assignments
SIA 360 : Communication with Management
SIA 370 : Reporting Results
SIA 390 : Monitoring and Reporting of Prior Audit Issues 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide34. SIA 310 : Planning the Internal Audit Assignment IA planning is conducted at 2 levels-
first level is overall plan for the entire entity
second level involves planning for a particular part of entity
( SIA 220covers first level)
SIA 310- Planning the Internal Audit Assignment – which generally completed in shorter period. The other parameters of planning remain same. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide35. SIA 320: Internal Audit Evidence Internal Audit evidence refers to all the information used IA in arriving at conclusions
The information- collected from underlying records & processes + informance of various audit activities and testing procedures.
Overall objectives of obtaining appropriate and reliable evidence is to allow IA to form an opinion on the outcome of audit procedures completed.
Sufficiency and Appropriateness are inter related
Sufficiency – refers to quantity and quantum
Appropriateness – refers to quality or relevance and reliability. Documentation – what, how, by whom- about obtained evidence 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide36. SIA 330: Internal Audit Documentation Internal Audit Documentation refers to the written records (electronic or otherwise) of the IA procedures performed, relevant audit evidence obtained and conclusions reached by Internal Auditor.
Term such as “Working papers” or “Work Papers” are used to refer Documentation
IA is expected to record and collate all the evidence obtained.
This SIA applies to all IA assignments
Overall objective of preparing audit documentation is to allow the auditor to form an opinion.
IA must record nature, timing & extent of completion of all internal audit activities and testing procedures. He should also identify performer & reviewer
IA work paper files should be completed prior to issue of Final Report
Pending administrative matters shall also be completed within 60 days of release of Final Report
Ownership and custody of IA work papers shall remain with the Internal Auditor 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide37. SIA 350: Review and Supervision of Audit Assignments Review – It is an exercise undertaken post completion of the work to be reviewed
Supervision – Ongoing exercise
R & S covers all audit aspects- audit planning, sampling, testing procedures, collecting evidence, documentation, using work of expert, conclusions.
It varies based on nature, extent, complexity, extent of automation and competency of staff.
Review and Supervision of IA is done to ensure effective performance and completion of work.
Overall objective of this SIA is to accomplish the objectives of the IA
The documentation (earlier SIA discussed ) shall record evidence of supervision and review conducted including performance of any audit procedures subsequent to the review. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide38. SIA 360: Communication with Management Objective of this SIA is to have clarity and consensus with Internal Auditor & Management w.r.t scope, approach, objective and timing of IA.
And also to help resolve any conflict in a timely manner
There is also a reference about this communication with management in the SIAs that we have discussed earlier in SIA 110, 210 and 310. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide39. SIA 370: Reporting Results Dissemination of the results of internal audits and reporting the findings to management and TCWG, is an essential part of any internal audit.
Objectives of this SIA is to share with audited, details of all significant findings based on audit procedures undertaken
Allow management to take corrective action in a methodical and comprehensive manner
Overall objective is to highlight the effectiveness of internal controls and risk management processes to enhance governance
The IA results shall be issued within reasonable time frame from completion of IA works 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide40. SIA 390: Monitoring and Reporting of Prior Audit Issues This SIA deals with the responsibility of Internal Auditor in monitoring and reporting of prior audit issues in the form of an “Action Taken Report” (ATR) of previous audits
Overall objective of this standard is to ensure that the auditee mitigates the risk highlighted in the audit observations through timely corrective actions or that a conscious decision is taken to accept the risks, in case recommendations are delayed or not implemented.
Chief Internal Auditor is responsible for continuously monitoring the closure of prior audits issues. However, the responsibility to implement the action plan remains with the management. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide41. SIA 520: Internal Auditing in an Information Technology Environment SIA 520 is specifically applicable for entities that have implemented IT systems which are managed in- house by the company.

Overall objective of an internal audit do not change in an ITE- Information Technology Environment. The objective is to provide independent assurance and help in making improvements in ITE, thereby enabling the achievement of business objectives. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide42. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>
slide43. 26-Feb-24 Jaipur Branch of CIRC of ICAI<br>