The objective of the Internal Audit function is to independently examine and evaluate the activities and assist the management in discharging their responsibilities, as a service to the Audit Committee. The Internal Audit Department will furnish them with analysis, recommendations, advices and reports concerning the activities examined.
The internal audit process is to follow a planned approach based upon risk assessments. The planning framework comprises the following:
An Internal Audit Annual Plan, which consists of objectives, priority, timing and resource requirement is to be prepared for each year, approved by Audit Committee. An individual audit plan/program prepared for each audit review, approved by the Head of Internal Audit.
Audit working papers contain the principal evidence to support the Internal Audit report and they provide the basis for review of Internal Audit work. The internal auditor(s) are to employ an audit methodology, which requires the production of working papers, which document, at least, the following:
- examination and evaluation of the adequacy and effectiveness of internal controls;
- the audit procedures employed, the information obtained and the conclusions reached;
- reporting; and
Prior to the commencement of reviews, the Head of Internal Audit will normally advise the auditee on the audit purpose, scope and expected timing of the work. However, in the case of special investigations such prior notification may not be given where doing so may jeopardise the success of the investigation. In such an event, the prior approval of the Group CEO is required.
During the conduct of reviews, internal auditors are to consult, orally and/or in writing, with relevant staff to:
- ensure information gathered is accurate and properly interpreted
- allow auditee to make clarification to ensure the formation of a balanced judgment;
- ensure recommendations are cost effective and practicable; and
- keep auditee informed on the progress of the audit.
A written report is to be prepared, and issued by the Head of Internal Audit. The reports are to be submitted to the Group CEO, with copies to the Audit Committee and the auditee.