Publicly traded companies are required by the Securities and Exchange Commission to validate their financial positions with an audit, and although they're not legally required to, privately held companies often perform audits at the request of banks, investors, and other key stakeholders.

Their goal is to assure investors and other stakeholders that their cash flow balance sheets, profit, and loss statements, aren't materially misstated. Firms like KPMG are often hired to perform these audits because they can provide an independent review of how a company operates and gain valuable insight into how their business is performing.

Publicly traded companies are required by the Securities and Exchange Commission to validate their financial positions with an audit, and although they're not legally required to, privately held companies often perform audits at the request of banks, investors, and other key stakeholders.

Their goal is to assure investors and other stakeholders that their cash flow balance sheets, profit, and loss statements, aren't materially misstated. Firms like KPMG are often hired to perform these audits because they can provide an independent review of how a company operates and gain valuable insight into how their business is performing.

What is an audit?

Audits are official inspections of an organization's accounts, typically conducted by an independent body. Many large organizations also have their own Internal Audit departments. Audits are conducted to confirm that an organization is operating within the guidelines (standards) set by Accounting bodies that govern that organization.

Audits are also conducted so as to ascertain that the financial results are presented fairly and that there is no fraud taking place in the organization.

The word audit means to evaluate, so you could say auditors are the ones who evaluate where the money is coming from, where it's going, and what it's doing, each step of the way. Accounts receivables, vendor acquisitions, operating expenses, there are a lot of channels that money can flow through, and the bigger the organization the more accounts there are to follow.

Auditing Business Case

Let’s imagine a typical audit team auditing a multi-billion-dollar company.

There may be multiple partners working in multiple locations around the world, there may be managers, senior associates of associates working in multiple times there may even be specialists from tax or advisory practice offering their expertise on everything from tax compliance to IT controls, testing senior members leadership actions and direction, but there's a fair amount of autonomy, so each team member should be capable of self-management.

Auditors think critically to understand what business decisions drive the transactions they're auditing, why does a transaction benefits the company and how does it fit in the company's strategy.

Auditors understand motivations for each transaction, bring the right level of professional skepticism to the project, look at the financial statements and see what companies say, and verify that it's correct or not.

An audit engagement can take anywhere from a few months to a full year, depending on the size of the client and the complexity of the project.

Unlike advisory where most of our clients are engaged on a project-by-project basis, most audit clients are annuity clients, that perform audits year after year.

Some auditing teams may even require setting up permanent workstations in the client’s office, as it requires spending a lot of time comparing documents the company uses in their day-to-day operations against what they've recorded in their financial statements.

For example, they might take the receivables a company plans to report and compare them with actual orders that customers have placed, may also contact vendors to ensure that the number is listed, and the purchase orders are accurate, then take that information and compare it with the information the company is required to report in their SEC filing.

Auditing is continuous work, major contracts can be revoked or won by the company, meaning now there's a new transaction. The company could purchase another company, requiring a new audit of that company and its assets or a subsidiary could go bankrupt requiring auditors to evaluate its vitality to the parent company.

Changes like this can occur at any time and have a profound impact on past auditing already done, but that's the real world and it's one of the great advantages of working with an external auditing company.

What are the differences between internal and external audits?

There are many differences between internal & external auditors.

These can be split into three sections:

1. Appointment – Internal Auditors are company employees, whilst External Auditors are appointed by a Shareholders’ vote and guided by the directors of the company.

2. Objectives – The objectives of Internal Auditors, are to examine issues related to company business practices and risks, whilst the objectives of External Auditors are to examine the financial records and issue an opinion on the financial statements of the company.

3. Responsibilities – The Internal Audit department is responsible to the company’s senior management, whereby External Auditors are held responsible to shareholders.

Internal audits are conducted throughout the year, moving from one department to another, whereby their internal audit reports are used by management.

External audits are conducted yearly at the close of an organization’s accounts. The (external) audit reports that are generated are not only used by external parties (as mentioned earlier), but also by internal management for Budget meetings, Strategic planning, and Annual Reviews.

What do businesses ultimately gain from auditing?

Companies gain from the services and accounting firm offers, after all, and all, it's not done just to meet investor or SEC requirements. Many companies use their audit findings as a basis to make strategic plans for their future, as such an auditor provides one of the most important business functions. They verify the results of companies reporting are correct while ensuring the obligations they've made to the stakeholders are being honored and that's kind of a big deal.

5 components of a company’s Internal Control

We have identified five different components of internal control.

They are the organization's control environment, its risk assessment process, the internal controls themselves, the quality of the organization's information, and how it's able to communicate that information, and ultimately, its ability to monitor the effectiveness of its internal controls.

Let's discuss each of these in turn.

We'll start with the control environment that's the standards, the processes, the structures that make the actual foundation for internal control throughout the entire organization.

This includes the tone at the top (the attitude of top management; let's take the CEO for example)

Does the CEO view internal control? is just something that they're forced to do, and they don't really care about it and take it that seriously, or is the CEO somebody who's very ethical and takes internal control very seriously. That's going to affect the environment a lot.

Do the lower-level employees take internal control seriously if the CEO does not? it's unlikely that other people in the organization are going to take internal control seriously so the environment is very important for setting the attitude throughout the organization toward internal control.

Each organization is going to have some type of risk assessment process for identifying and managing any type of risk that faces the business. How does this relate to auditing and the financial statements?

Well, the company should be assessing the risk of financial statement fraud and that's gonna have a bearing on the company's internal controls.

If they take it more seriously and they actually go and say this is a risk that we need to assess, we need to understand, the management could be playing games with the estimates of depreciation or things like that,  if then that's going to affect the internal controls for the company.

When we look at the controls themselves,  these are just policies and procedures that are put in place to address the risk that we've identified here.

In step two, we're saying okay, what are the risks of financials and fraud and other issues and once identified those risks, hopefully, they're going to implement some internal controls to try and address those risks.

For example segregation of duties, authorization of transactions - not just anybody can authorize for example inventory to be dispersed from the warehouse or reconciling the cash account right to the company's cash account, to the bank balance cash account.

These are examples of internal controls that an organization could set in place to address the risks of financial statement fraud. 

Why are information and communication important and critical to effective internal control?

Think about it, if you have an accounting that is not producing quality financial information if you're getting information from the financial statement or from your accounting system that cannot be trusted and there are all kinds of issues for example you don't have information about, the dates when journal entries are recorded that would be pretty ridiculous that's a pretty poor accounting system.

But let's say that’s the case if you don't have that information then it's going to be difficult to assess things like cut off when a sale was actually recorded and so forth, was it recorded in the proper period, or was it recorded in the wrong period.

Also, not just your accounting system, but thinking about the internal control responsibilities and are those responsibilities being adequately conveyed to the employees by either top management ... that could be through an email perhaps, top management sends an email and explains to the employees that an employee is in charge of this and so forth, or the organization could have formal policy manuals that lay out the procedures for internal controls...

Internal controls aren't going to be that helpful if you have them in place, but nobody knows what they are or how to operate them and finally, we look at the monitoring activities and monitoring has to do with evaluating the internal controls.

You have to continuously be evaluating the internal controls and see okay are they effective? are people actually applying the internal controls as designed? are the internal controls working? are the internal controls catching any mistakes or misstatements?

If you are a publicly listed firm, a large organization, or just a company that is looking for funding from investors or lenders, favorable opinions on your financial statements by external auditors will help you along your way.

If you are lucky to have an Internal Audit department within your organization, then they will guide you in making sure that the company’s results are fair and accurate before the External Auditors come waltzing through your company.

If you‘re looking to get your business audited, go through Dokalinks’ selection of Top Audit Consulting Firms.