Internal Audit and Management System Control

Internal audit is an independent, objective assurance and consulting activity within an organisation. It assesses whether governance processes, risk management and internal controls are in place and actually working. Internal audit does not run business processes or make operational decisions; it examines them and reports findings and recommendations to management and the governing bodies.

The purpose is for management and the board to gain a reliable picture of where controls are weak and which risks are not adequately covered, before they materialise as losses, shortfalls, fraud or regulatory action. The outcome is not just a list of findings, but an action plan with deadlines and responsibilities, followed by tracking of whether the measures were actually implemented.

In regulated financial institutions, the internal audit function is organised in line with applicable sectoral and regulatory requirements. Outside the financial sector, the need is assessed through organisational complexity, risk exposure, the number of processes and locations, governance requirements, the regulatory environment and reliance on IT systems.

In some organisations, internal audit can be organised through outsourcing or co-sourcing, depending on the applicable legal and regulatory framework and the governance model. Under co-sourcing, an external team covers specialised areas such as IT or AML controls. Responsibility for the internal control system remains with management; internal audit does not assume it, it evaluates it.

The plan starts with process mapping and a risk assessment by area, taking into account financial significance, regulatory exposure, prior findings and business changes. Areas are ranked by risk level, and available resources are allocated to priorities. The plan is approved by the governing body and revised during the year if risks change materially.

This is an approach in which internal audit resources are directed towards the areas with the highest assessed risk, rather than reviewing all processes evenly in turn. Instead of routinely checking everything, the controls that most affect financial statements, compliance and business continuity are tested. The approach gives clearer priorities and a more measurable effect per engagement.

Internal audit is a continuous function serving management and the board, covering controls, risks and processes, and reporting internally. External audit is an independent engagement resulting in an opinion on the financial statements intended for owners, banks and regulators. Zirex provides both services, but for the same client independence rules are observed, so the roles remain separate.