3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT

Forward|ObjectivesandScopeofInternalAudit|StaffingandTraining|Relationship|DueCare|Planning,ControllingandRecording
|EvaluationoftheInternalControlSystem|Evidence|ReportingandFollowup|AppendixGlossaryofTermsUsedinTheseGuidelines

::Foreword::
TheCounciloftheMalaysianInstituteofAccountantshasapprovedthisGuidelineforpublication.
These guidelines have been adapted by the Internal Audit Committee of the Malaysian Institute of Accountants from the publication
"GuidanceforInternalAuditors"issuedinJune1990undertheaegisoftheConsultativeCommitteeofAccountancyBodies(CCAB)inthe
UnitedKingdom.
Theseguidelinesprovideadvicetointernalauditorsonthemainissuesandprocedureswhichtheyneedtoconsideraspartoftheirwork
in both the commercial and public sectors. They should also be of benefit to organisations considering establishing an internal audit
function.
InternalauditorsshouldreadtheseguidelinesinconjunctionwiththeApprovedAuditingStandardscontainedintheMembers' Handbook
andtheInstitute'sByLaws(OnProfessionalEthics,ConductandPractice)[IssuedJanuary2007]andanyrequirementsregardinginternal
auditsetoutintherelevantstatutesorregulations.
Theseguidelinesareintendedtobepersuasiveonly.
Aglossaryoftermsusedintheseguidelinesaregivenintheappendixtotheguideline.
::OBJECTIVESANDSCOPEOFINTERNALAUDIT::
1. Internal audit is an independent appraisal function established by the management of an organisation for the review of the internal
control system as a service to the organisation. It objectively examines, evaluates and reports on the adequacy of internal control as a
contributiontotheproper,economicandeffectiveuseofresources.
2.Theessentialsforeffectiveinternalauditingare:
(a)independence
The internal auditor should have the independence in terms of organisational status and personal objectivity which
permitstheproperperformanceofhisduties(paragraphs11to14).

(b)staffingandtraining
The internal audit unit should be appropriately staffed in terms of numbers, grades, qualifications and experience,
having regard to its responsibilities and objectives. The internal auditor should be properly trained to fulfil all his
responsibilities(paragraphs15to26).

(c)relationships
Theinternalauditorshouldseektofosterconstructiveworkingrelationshipandmutualunderstandingwithmanagement,
withexternalauditors,withanyotherreviewagenciesand,whereoneexist,theauditcommittee(paragraphs27to37).

(d)duecare
Theinternalauditorshouldexerciseduecareinfulfillinghisresponsibilities(paragraphs38to44).

(e)planning,controllingandrecording
Theinternalauditorshouldadequatelyplan,controlandrecordhiswork(paragraphs45to58).

(f)evaluationoftheinternalcontrolsystem
Theinternalauditorshouldidentifyandevaluatetheorganisation'sinternalcontrolsystemasabasisforreporting upon
itsadequacyandeffectiveness(paragraphs59to62).

(g)evidence
Theinternalauditorshouldobtainsufficient,relevantandreliableevidenceonwhichtobasereasonableconclusions and
recommendations(paragraphs63to69).

(h)reportingandfollowup

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

1/7

3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT
The internal auditor should ensure that findings, conclusions and recommendations arising from each internal audit
assignmentarecommunicatedpromptlytotheappropriatelevelofmanagementandheshouldactivelyseekaresponse.
Heshouldensurethatarrangementsaremadetofollowupauditrecommendationstomonitorwhatactionhasbeentaken
onthem(paragraphs70to78).

3.Thetermsofreferencefortheinternalauditfunctionshouldbeformallyconfirmedbytheorganisationandshouldhaveproperregard
tothecontentsofthisguidelinedemonstrableindependenceofthefunctioniscrucialtoitseffectiveness.

4.Forcertainpublicsectororganisationstheneedforaninternalauditingfunctionisprescribedbystatuteandthisprovidesabasisfor
definingspecificstandardsandguidanceforthepracticeofinternalauditingintheseorganisations.

5. To achieve full effectiveness the scope of the internal audit function should provide an unrestricted range of coverage of the
organisation's operations, and the internal auditor should have sufficient authority to allow him access to such records, assets and
personnelasarenecessaryforproperfulfilmentofhisresponsibilities.

6.Itisamanagementresponsibilitytodeterminetheextentofinternalcontrolintheorganisation'ssystemswhichshouldnotdependon
internal audit as a substitute for effective controls. Internal audit, as a service to the organisation, contributes to internal control by
examining, evaluating and reporting to management on its adequacy and effectiveness. Internal audit activity may lead to the
strengtheningofinternalcontrolasaresultofmanagementresponse.

7.Oneoftheobjectivesofinternalauditingistoassistmanagementinthepursuitofvalueformoney.Thisisachievedthrougheconomic,
efficientandeffectiveuseofresources.

8.Itisamanagement responsibility to maintain the internal control system and to ensure that the organisation's resources are properly
appliedinthemannerandontheactivitiesintended.Thisincludesresponsibilityforthepreventionanddetectionoffraudandotherillegal
acts.

9. The internal auditor should have regard to the possibility of such malpractice and should seek to identify serious defects in internal
controlwhichmightpermittheoccurrenceofsuchanevent.

10. An internal auditor who discovers evidence of, or suspects malpractice should report firm evidence, or reasonable suspicions to the
appropriatelevelofmanagement.Itisamanagementresponsibilitytodeterminewhatfurtheractiontotake.

Independence
11.Independenceisachievedthroughtheorganisationalstatusofinternalauditandtheobjectivityofinternalauditors.

Organisationalstatus
12.Thestatusofinternalauditshouldenableittofunctioneffectively.Thesupportofmanagement is essential. Internal audit should be
involved in the determination of its own priorities, in consultation with management. Accordingly the head of internal audit should have
directaccessto,andfreedomtoreporttoallseniormanagementincludingthechiefexecutive,boardofdirectorsand,whereoneexists,
theauditcommittee.

Objectivityoftheinternalauditor
13. Each internal auditor should have an objective attitude of mind and be in a sufficiently independent position to be able to exercise
judgement,expressopinionsandpresentrecommendationswithimpartiality.
(a)Theinternalauditor,notwithstandinghisemploymentbytheorganisation,shouldbefreefromanyconflictofinterest
arising either from professional or personal relationships or from pecuniary or other interests in an organisation or
activitywhichissubjecttoaudit.
(b)Theinternalauditorshouldbefreefromundueinfluenceswhicheitherrestrictormodifythescopeorconductof his
workoroverruleorsignificantlyaffectjudgementastothecontentoftheinternalauditreport.
(c) The internal auditor should not allow his objectivity to be impaired when auditing an activity for which he has had
authorityorresponsibility.
(d) An internal auditor should be consulted about significant proposed changes in the internal control system and the
implementation of new systems and make recommendations on the standards of control to be applied. This need not
prejudicetheauditor'sobjectivityinreviewingthosesystemssubsequently.
(e) An internal auditor should not normally undertake nonaudit duties but where he does so, exceptionally, he should
ensurethatmanagementunderstandsthatheisnotthenfunctioningasaninternalauditor.
14.Whereanyofthesituationsreferredtoinparagraphs13(a)to(c)arise,thisshouldbeclearlydeclaredbytheinternalauditorsothat
considerationcanbegiventotheneedforalternativearrangementsfortheauditassignment.

::STAFFINGANDTRAINING::

15. The effectiveness of internal audit depends substantially on the quality, training and experience of its staff. The aim should be to
appointstaffwiththeappropriatebackground,personalqualitiesandpotential.Thereafter,stepsshouldbetakentoprovidethenecessary
experience,trainingandcontinuingprofessionaleducation.

Staffing

16. The internal audit unit should be managed by a head of internal audit who should be suitably qualified and should possess wide
experience in internal audit and its management. He should plan, direct, control and motivate the resources available to ensure that the
responsibilitiesoftheinternalauditunitaremet.

17.Thefullrange of duties may require internal audit staff to be drawn from a variety of disciplines. The effectiveness of internal audit
maybeenhancedbytheuseofspecialiststaff,particularlyintheinternalauditofactivitiesofatechnicalnature.

18.Theinternalauditunitshouldemploystaffwithvaryingtypesandlevelsofskills,qualificationsandexperienceinordertosatisfythe
requirementsofeachinternalaudittask.

19.Theheadofinternalauditshouldparticipateintherecruitmentandselectionofhisstaff.New entrants to internal audit work should

havetimetofamiliarisethemselveswiththeactivitiesoftheinternalauditunitandtheorganisation,andtodemonstratetheirsuitabilityfor

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

2/7

3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT

auditwork.

Training

20.Theorganisationhasaresponsibilitytoensurethattheinternalauditorreceivesthetrainingnecessaryfortheperformanceofthefull
rangeofduties.

21. Training should be tailored to the needs of the individual. It should include both theoretical knowledge and its practical application
underthesupervisionofsuitablycompetentandexperiencedinternalauditors.Accountshouldbetakenof:
(a)internalauditobjectivesandpriorities
(b)thetypeofinternalauditwork
(c)previoustraining,experienceandqualificationsand
(d)personaldevelopmentinthelightoftheneedsoftheorganisationandtheinternalauditunit.
22.Trainingshouldbeaplannedandacontinuingprocessatalllevelsandshouldcover:
(a)basictrainingprovidingtheknowledgeofbasicauditingprinciplesandpracticeswhichallinternalauditorsshould
possess
(b)developmenttrainingingeneralauditskillsandtechniquesandinterpersonalskills,toimprovetheeffectiveness of
thosecurrentlyemployedininternalauditand
(c) specialised training for those responsible for the internal audit of activities which require special skills or
knowledge.
23. Other forms of staff development should be considered according to particular needs. These may include periods of attachment to
otherpartsoftheorganisationorsecondmenttootherorganisations.

24.Theinternalauditorshouldkeepabreastofcurrentdevelopments,improvements,newtechniquesandpracticesinauditing.

25.Theinternalauditorshouldmaintaintechnicalcompetencethroughprofessionaldevelopmentwhichmayinclude:
(a)privatereadingandstudyand
(b) participation in professional activities such as attending meetings, courses and conferences, lecturing, writing
articlesandpapersandcontributiontoresearchgroups.
26. The head of internal audit should coordinate, and keep under review, the training requirements of internal auditors. He should be
responsible for preparing training profiles which identify the training requirement for different grades of internal auditors, and should
maintainpersonaltrainingrecordsforeachindividual.Inlargeorganisationsthismaybeperformedbyadesignatedtrainingofficer.

::RELATIONSHIPS::

27. In order that the internal auditor may properly perform all his tasks, it is necessary for all those with whom he has contact to have
confidenceinhim.Constructiveworkingrelationshipsmakeitmorelikelythatinternalauditworkwillbeacceptedandactedupon,butthe
internalauditorshouldnotallowhisobjectivitytobeimpaired.

Organisationalrelationships

28.Theheadofinternalauditshouldpreparetheinternalauditplaninconsultationwithseniormanagement.Theinternalauditorshould
arrangethetimingofinternalauditassignmentsinconsultationwiththemanagementconcerned,exceptonthoserareoccasionswherean
unannounced visit is a necessary part of the audit approach. Consultation can lead to the identification of areas of concern or of other
interesttomanagement.

29.Matterswhichariseinthecourseoftheauditareconfidentialanddiscussionshouldberestrictedtomanagementdirectlyresponsible
fortheareabeingauditedunlesstheyhavegivenexpressagreementtobroadenthediscussion.

30. Discussions with management are necessary when preparing the audit report. This is an essential feature of the good relationship
betweentheauditorandthemanagement.

Relationshipwithexternalaudit

31.Therelationshipbetweeninternalandexternalauditneedstotakeaccountoftheirdifferingrolesandresponsibilities.Internalauditis
an independent appraisal function within the organisation and internal auditors are direct employees. The external auditor usually has a
statutoryresponsibilitytoexpressanindependentopiniononthefinancialstatementsandstewardshipoftheorganisation.

32. The aim should be to achieve mutual recognition and respect, leading to a joint improvement in performance and the avoidance of
unnecessary overlapping of work. It should be possible for the external and internal auditors to rely on each other's work, subject to
limits determined by their different responsibilities, respective strengths and special abilities. Consultations should be held and
consideration given to whether any work of either auditor is adequate for the purpose of the other. The internal auditor does not
automatically have a right of access to the records of the external auditor. However, the relationship between the internal and external
auditorwillusuallybesuchthattheexternalauditorwillbeabletoallowaccesstothenecessaryrecords.

33.Sinceinternalauditevaluatesanorganisation'sinternalcontrolsystemtheexternalauditor may need to be satisfied that the internal

auditfunctionisbeingplannedandperformedeffectively.Thisreviewneedstobeseenbybothpartiesasanecessarypartoftheworking
relationship(seetheInstitute'sInternationalAuditingGuidelineNo:10on"UsingtheworkofanInternalAuditor").

34. Regular meetings should be held between internal and external auditors at which joint audit planning, priorities, scope and audit
findings are discussed and information exchanged. The benefits of joint training programmes and joint audit work should also be
considered.

Reviewagenciesandspecialists

35. Certain information obtained during an internal audit assignment may assist a review agency, such as management services or
consultants, which are seeking to secure improvements in the organisation's performance. Management's formal approval should be
obtainedbeforereleasinganyauditreportorotherinformationtothereviewagencies.

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

3/7

3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT

36. The internal auditor should establish a regular dialogue with review agencies and obtain their reports for information, review and
commentwhereproposalsmayaffectinternalcontrolarrangements.

37.Whereitisnecessaryfortheinternalauditortohavecontactwithotherspecialiststhesamebasicprinciplesaboutinformationapply
asinthecaseofreviewagencies.

::DUECARE::

38.Theinternalauditorcannotbeexpectedtogivetotalassurancethatcontrolweaknessesorirregularitiesdonotexist.

39. In order to demonstrate that due care has been exercised the internal auditor should be able to show that his work has been
performedinawaywhichisconsistentwiththisguideline.
40.Theinternalauditorshouldpossessathoroughknowledgeoftheaimsoftheorganisationandtheinternalcontrolsystem.Heshould
alsobeawareoftherelevantlawsandtherequirementsofrelevantprofessionalandregulatorybodies.

Ethicalstandards

41. Bylaws (On Professional Conduct and Ethics) [Revised January 2002] issued by the Institute are relevant to the work of internal
auditors.

42. The internal auditor must be impartial in discharging all responsibilities bias, prejudice or undue influence must not be allowed to
limit or override objectivity. At all times, the integrity and conduct of the internal auditor must be above reproach. He should not place
himselfinapositionwhereresponsibilitiesandprivateinterestsconflictandanypersonalinterestsshouldbedeclared.

43.Theinternalauditorshouldnotimproperlydiscloseanyinformationobtainedduringthecourseofhiswork.

Qualityofinternalauditperformance

44.Theheadsofinternalauditunitshouldpromoteandmaintainadequatequalitystandards.Heshould establish methods of evaluating

theworkofhisstafftoensurethattheinternalauditunitfulfilsitsresponsibilitiesandhasproperregardtothisguideline.

::PLANNING,CONTROLLINGANDRECORDING::

45.Internalauditworkshouldbeplanned,controlledandrecordedinordertodeterminepriorities,establishandachieveobjectives,and
ensuretheeffectiveandefficientuseofauditresources.

Planning

46.Themainpurposesofinternalauditplanningare:
a)todetermineprioritiesandtoestablishthemostcosteffectivemeansofachievingauditobjectives
b)toassistinthedirectionandcontrolofauditwork
c)tohelpensurethatattentionisdevotedtocriticalaspectsofauditworkand
d)tohelpensurethatworkiscompletedinaccordancewithpredeterminedtargets.
47.Thestagesofinternalauditplanningare:
a)toidentifytheobjectivesoftheorganisation
b)todefineinternalauditobjectives
c)totakeaccountofrelevantchangesinlegislationandotherexternalfactors
d)toobtainacomprehensiveunderstandingoftheorganisation'ssystems,structureandoperations
e)toidentify,evaluateandrankriskstowhichtheorganisationisexposed
f)totakeaccountofchangesinstructuresormajorsystemsintheorganisation
g)totakeaccountofknownstrengthsandweaknessesintheinternalcontrolsystem
h)totakeaccountofmanagementconcernsandexpectations
i)toidentifyauditareasbyservice,functionsandmajorsystems
j)todeterminethetypeofaudit:e.g.systems,verificationorvalueformoney
k)totakeaccountoftheplansofexternalauditandotherreviewagenciesand
l)toassessstaffresourcesrequired,andmatchwithresourcesavailable.
48.Theinternalauditorshouldpreparestrategic,periodicandoperationalworkplans.

49.Thestrategicplanshouldusuallycoveraperiodofbetweentwotofiveyearsduringwhichallmajorsystemsandareasofactivitywill
be audited. It should set out audit objectives, audit areas, type of activity and frequency of audit and an assessment of resources to be
applied.

50. The periodic plan, typically for financial or calendar year, translates the strategic plan into a schedule of audit assignments to be
carried out in the ensuing period. It should define the purpose and duration of each audit assignment and allocate staff and other
resourcesaccordinglyandshouldbeformallyapprovedbymanagement.

51.Operationalworkplansshouldbepreparedforeachauditassignmentasitisarrangedcovering:
a)objectiveandscopeoftheaudit
b)timebudgetandstaffallocationand
c)methods,proceduresandreportingarrangements,includingsupervisionandallocationofresponsibilities.
52.Allinternalauditplansshouldbesufficientlyflexibletorespondtochangingpriorities.

Controlling

53. Control of the internal audit unit and of individual assignments is needed to ensure that internal audit objectives are achieved and
work is performed effectively. The most important elements of control are the direction and supervision of the internal audit staff and
review of their work. This will be assisted by an established audit approach and standard documentation. The degree of control and
supervisionrequireddependsonthecomplexityofassignmentsandtheexperienceandproficiencyoftheinternalauditstaff.

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

4/7

3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT

54.Theheadofinternalauditshouldestablisharrangements:
a.toallocateinternalauditassignmentsaccordingtothelevelofandproficiencyofinternalauditstaff
b.toensurethatinternalauditorsclearlyunderstandtheresponsibilitiesandinternalauditobjectives
c.tocommunicatethescopeofworktobeperformedandagreetheprogrammeofworkwitheachinternalauditor
d. to provide and document evidence of adequate supervision, review and guidance during the internal audit
assignment
e.toensurethatadequateworkingpapersarepreparedtosupportinternalauditfindingsandconclusionsand
f. to ensure that internal audit's performance is in accordance with the internal audit plan or that any significant
variationshavebeenexplained.
55.Theheadofinternalauditshouldestablisharrangementstoevaluatetheperformanceoftheinternal audit unit. He may also prepare
an annual report to management on the activities of the internal audit unit in which he gives an assessment of how effectively the
objectivesofthefunctionhavebeenmet.

Recording

56.Internalauditworkshouldbeproperlyrecordedbecause:
a.theheadofinternalauditneedstobeabletoensurethatworkdelegatedtostaffhasbeenproperlyperformed.Hecan generally
dothisonlybyreferencetodetailedworkingpaperspreparedbytheinternalauditstaffwhoperformedthework
b. working papers provide, for future reference, evidence of work performed, details of problems encountered and conclusions
drawnand
c.thepreparationofworkingpapersencourageseachinternalauditortoadoptamethodicalapproachtohiswork.
57.Theheadofinternalauditshouldspecifytherequiredstandardofinternalauditdocumentation and working papers and ensure that
thosestandardsaremaintained.
58.Internalauditworkingpapersshouldalwaysbesufficientlycompleteanddetailedtoenableanexperiencedinternalauditorwithno
previousconnectionwiththeinternalauditassignmentsubsequentlytoascertainfromthemwhatworkwasperformedandtosupportthe
conclusionsreached.Workingpapersshouldbepreparedastheinternalauditassignmentproceedssothatcriticaldetailsarenotomitted
andproblemsnotoverlooked.Theseshouldbereviewedbyinternalauditmanagement.
::EVALUATIONOFTHEINTERNALCONTROLSYSTEM::

59.Controls,whethertheyrelatetofinancialoroperationalareas,ensurethatprocessesacttomeetthesystem'sobjectives.

60.Themainobjectivesoftheinternalcontrolsystemare:
a. to ensure adherence to management policies and directives in order to achieve efficiently and economically the
organisation'sobjectives
b.tosafeguardassets
c.tosecuretherelevance,reliabilityandintegrityofinformation,soensuringasfaraspossiblethecompleteness and
accuracyofrecordsand
d.toensurecompliancewithstatutoryrequirements.
61.Whenevaluatinginternalcontrolsystemstheinternalauditorshouldconsidertheeffectwhichallthecontrolshaveoneachotherand
onrelatedsystems.

62. As part of the planning process the internal auditor should identify the whole range of systems within the organisation. For those
systems to be examined, the internal auditor should establish appropriate criteria to determine whether the controls are adequate and
assistinachievingtheobjectivesofthesystem.Thestagesofasystemsauditwouldnormallybe:
a.toidentifythesystemparameters
b.todeterminethecontrolobjectives
c.toidentifyexpectedcontrolstomeetcontrolobjectives
d.toreviewthesystemagainstexpectedcontrols
e.toappraisethecontrolsdesignedintothesystemagainstcontrolobjectives:
f.totesttheactualcontrolsforeffectivenessagainstcontrolobjectives
g.totesttheoperationofcontrolsinpracticeand
h.togiveanopinionbasedonauditobjectivesastowhetherthesystemprovidesanadequatebasisforeffectivecontrol
andwhetheritisproperlyoperatedinpractice.
::EVIDENCE::

63. Internal audit evidence is information obtained by an internal auditor which enables conclusions to be formed on which
recommendationscanbebased.

64. The internal auditor should determine what evidence will be necessary by exercising judgement in the light of the objectives of the
internalauditassignment.Thisjudgementwillbeinfluencedbythescopeoftheassignment,thesignificanceofthemattersunderreview,
therelevanceandthereliabilityofavailableevidenceandthecostandtimeinvolvedinobtainingit.

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

5/7

3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT

65. The collection and assessment of internal audit evidence should be recorded and reviewed to provide reasonable assurance that
conclusionsaresoundlybasedandinternalauditobjectivesachieved.

Sufficiency

66.Aninternalauditorshouldobtaintheevidenceconsiderednecessaryfortheachievementofthe internal audit assignment objectives.

Thisisinfluencedby,forinstance:
a.thelevelofassurancerequired
b.theobjectivesandscopeoftheinternalauditassignment
c.thescaleofactivityunderreviewandthedegreeofriskinvolved
d.thecostandtimeinvolvedinobtainingevidenceand
e.thereliabilityoftheevidence.
Relevance

67.Therelevanceoftheinternalauditevidenceshouldbeconsideredinrelationtotheobjectivesoftheinternalauditassignment.

Reliability

68.Reliableevidence can be achieved through the use of the appropriate internal audit techniques which should normally be selected in
advance,butwhichmaybeexpandedoralteredasnecessaryduringtheinternalauditassignment.
69. In order to place reliance on evidence the internal auditor should be satisfied with its nature, extent, adequacy, consistency and
relevancetotheinternalauditassignmentandwiththemethodsgoverningitscollection.

::REPORTINGANDFOLLOWUP::

70. Internal audit reports provide a formal means of communicating to management the results arising from audits undertaken. Such
reports should include audit findings, recommendations and conclusions relating to the adequacy of and compliance with the system of
internal control and the efficiency, effectiveness and economy of operations in the area covered by the audit. From the point of view of
completeness,managementresponsetotheauditfindingsshouldpreferablyalsobeincludedinthereport.Theaimofeveryinternalaudit
reportshouldbe:
a.topromptmanagementactiontoimplementrecommendationsforchangeleadingtoimprovementinperformanceand
controland
b.toprovideaformalrecordofpointsarisingfromtheinternalauditassignmentand,whereappropriate,ofagreements
reachedwithmanagement.
71.Reportingarrangement,includingtheformatanddistributionofinternalauditreports,shouldbeagreedwithmanagement.Thehead
of internal audit should ensure that reports are sent to managers who have a direct responsibility for the unit or function being audited
and who have the authority to take action on the internal audit recommendations. Internal audit reports are confidential documents and
theirdistributionshouldberestrictedtothosemanagerswhoneedtoknowandotherappropriatepersonsonaneedtobeinformedbasis.

72.Whiletheinternalauditormayclearminormatterswhichdonotindicateaconsistentorsystematic weakness with members of staff

directlyinvolved,mattersofconsequenceshouldbereportedformallyinwritingtomanagement.

73.Theinternalauditorshouldproduceclear,constructiveandconcisewrittenreportsbasedonsufficient,relevantandreliableevidence,
whichshould:

a.statethescope,purpose,extentandconclusionsoftheinternalauditassignment
b.makerecommendationswhichareappropriateandrelevant,andwhichflowfromtheconclusionsand
c.acknowledgetheactiontaken,orproposed,bymanagement.
74.Theinternalauditor should present an interim report, orally or in writing, where it is necessary to alert management to the need to
take immediate action to correct a serious weakness in performance or control, or where there are reasonable grounds for suspicion of
malpractice.Considerationshouldalsobegiventointerimreportingwherethereisasignificantchangeinthescopeoftheinternal audit
assignmentorwhereitisdesirabletoinformmanagementofprogress.Interimreportingdoesnotdiminishoreliminatetheneedforfinal
reporting.

75. The internal auditor should normally meet with management to discuss the audit findings at the completion of field work for each
internalauditassignmentandtheformalwrittenreportshouldbepresentedtomanagementassoonaspossiblethereafter.

76.Beforeissuing the final report, the internal auditor should normally discuss the contents with the appropriate levels of management,
andmaysubmitadraftreporttothem,forconfirmationoffactualaccuracy.

77. If the internal auditor and management disagree about the relevance of the factual content of the draft audit report, the internal
auditorshouldconsiderwhetherreferenceshouldbemadetothisinthefinalreport.

78. It is management's responsibility to ensure that proper consideration is given to internal audit reports. The internal auditor should
ensure that appropriate arrangements are made to determine whether action has been taken on internal audit recommendations or that
management has understood and assumed the risk of not taking action. The status of implementation, in respect of matters of
consequence,sodeterminedshouldbereportedtotheappropriatelevelsofmanagementtoenhanceinternalauditeffectiveness.

APPENDIXGLOSSARYOFTERMSUSEDINTHESEGUIDELINES

Organisation
AuditCommittee

Thebodyforwhichtheinternalauditorisprovidinganinternalauditservice.
Acommitteeofdirectors,mainlywithoutexecutiveresponsibilitywhichconsideramongstothersthe
externalandinternalauditplansandactivitiesandreviewsinternalcontrolarrangements.

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

6/7

3/15/2016

OBJECTIVESANDSCOPEOFINTERNALAUDIT
Management
InternalAuditor
System
InternalControl
InternalControl
System
Controls

A comprehensive term including all persons who have responsibility at various levels for activities
whichmaybethesubjectofinternalaudit.
An individual who takes responsibility for carrying out internal audit work within an organisation
whetherasanemployeeorasanexternalagency.
A series of interrelated procedures, composed of processes and controls designed to operate
togethertoachieveaplannedobjective.
Theregulationofactivitiesinanorganisationthroughsystemsdesignedandimplementedtofacilitate
theachievementofmanagementobjectives.
The whole system of controls, financial and otherwise, Control system established by the
managementinordertocarryonthebusinessofanorganisationinanorderlyandefficient manner,
ensure adherence to management policies, safeguard assets and secure as far as possible the
completenessandaccuracyofrecords.
Theindividualcomponentsofaninternalcontrolsystemareknownas'controls'or'internalcontrols'.
These ensure that processes work to meet the system's objectives. Controls may be preventive,
detective, or directive. They may include, but are not limited to, authorisation, written policies and
instructions, segregation of duties, standards, charts of account, forecasts, budgets, schedules
reports, records, checklists, matching of documents, supervisory review, comparing onhand
quantitieswithrecordedbalances,accountingforalldocuments,andreconciliation.

Forward|ObjectivesandScopeofInternalAudit|StaffingandTraining|Relationship|DueCare|Planning,ControllingandRecording
|EvaluationoftheInternalControlSystem|Evidence|ReportingandFollowup|AppendixGlossaryofTermsUsedinTheseGuidelines
Lastedited:Tuesday,05February200811:37AM
2005MalaysianInstituteofAccountants.Allrightsreserved.

http://www.mia.org.my/handbook/guide/IAG/IAG.htm

7/7