Certified Internal Auditor - Part 1 The Internal Audit Activitys Role in Governance Risk and Control

The situation described has the greatest negative impact on the control environment component of internal control. The control environment sets the tone for the organization, influencing the control consciousness of its people. It includes the integrity, ethical values, and competence of the entity’s people; management's philosophy and operating style; and the way management assigns authority and responsibility, and organizes and develops its people. In this case, the reluctance to deny reimbursement for non-allowable charges due to fear of losing top sales representatives indicates a weak control environment where ethical standards and integrity are being compromised.

Unusual pressures on management can affect the control risk of a company. Control risk is the risk that a company’s internal controls will not prevent or detect a material misstatement. If management is under unusual pressures, they may override internal controls or manipulate financial information, increasing the overall control risk. Other factors such as technological obsolescence, complex accounts, or segregation of duties are either unrelated to control risk or directly related to other types of risks such as operational or inherent risks.

One appropriate role for the board in governance is ensuring that the financial statements are understandable, transparent, and reliable. This aligns with the board's responsibility to provide oversight and ensure accountability for financial reporting, thereby safeguarding the interests of stakeholders. Preparing written policies, assisting internal audits, or developing litigation strategies are tasks more aligned with management or specialist roles rather than the governance oversight provided by the board.

According to the International Professional Practices Framework, the appropriate division of responsibilities for the coordination of internal and external audit efforts should involve oversight of the work by the board and the coordination of activities by the chief audit executive. This ensures that the top-level governance (the board) is overseeing the audit process while operational coordination is managed by the professional responsible for auditing.

The organizational status of the internal audit activity must be sufficient to permit the accomplishment of its audit responsibilities. This is a fundamental principle to ensure the internal audit activity has the necessary authority and access to fulfill its role effectively.