Helping NGOs do more with their money

Effective internal audits

This page answers the following frequently asked questions:

What is the focus of an internal audit?

The primary focus of an internal is to test the adequacy and effectiveness of the internal control systems in mitigating risks facing the organisation. The internal audit cycle is a way to ensure that the internal control systems are continuously improving.

What happens during an internal audit?

  1. Their work usually begins with consideration of the risks and they may review your risk register if you have one, as well as your finance manual as a starting point.
  2. They should follow up any recommendations from previous audits, to check that actions have been taken.
  3. They will normally then check a sample of transactions or processes to confirm that the proper procedures have been followed. They may conduct interviews with various staff, Board, Management, or beneficiaries. They may carry out site visits. They may use an internal audit checklist.
  4. If they identify any problems, these ‘findings’ are usually classified according to how serious they are. This may be a simple ‘red orange yellow’ flag system, or a more formal split between ‘major non-conformity, minor non-conformity, and observation’.

  5. When the internal auditor makes a ‘finding’, there is a need for action. There are two  types of action that can be taken:

Finally the internal auditor discusses his findings and recommendations, and prepares a written report. At the next audit, those recommendations are followed up and the cycle continues.

Back to top

Who does an internal audit?

The internal auditor needs to be independent from the internal control system, be sufficiently skilled to identify problems, and have enough confidence and integrity to report them.

Usually, only larger organisations (say 50+ people) can staff an internal audit team that can be kept busy and maintain a suitable level of independence from the day to day activities and staff in the organisation.

For smaller organisations it can be more useful and cost effective to hire the services of a professional firm to carry out the internal audits. Sometimes your external auditors may be able to offer this service if they also offer consultancy, risk assurance or advisory services. But be careful in case their independence is compromised.

Sometimes it is appropriate to compliment the technical skill of the auditor with some ‘on-the-ground’ knowledge of how things really work. In this case the auditors could be accompanied by a member of the audit committee on the Board, or even beneficiaries.

In some countries, especially in local government, an ‘internal auditor’ has to approve each and every payment before it can be processed. Such a person is actually just acting as another layer of authorisation. To be independent, the internal auditor should not have any executive authority. They should be outside the system looking in, not part of the system itself.

Back to top

How often should internal audits be done?

One of the great advantages of internal audit is that they can be more frequent than the annual external audit, enabling problems to be identified and corrected on a timely basis. More risky aspects of your operations (such as construction work) may need to be audited more frequently than others.

As a rule of thumb, every three months is a good time scale for internal audits, as it gives enough time to implement recommendations, at the same time providing timely feedback.

Back to top

Who should the internal auditor report to?

There are various groups of people who ought to have access to the internal auditor’s findings:

Internal audit checklist – useful starting point for carrying out an internal audit review

Back to top

Share this page