29.01.2013 Views

ethics - The Institute of Internal Auditors South Africa

ethics - The Institute of Internal Auditors South Africa

ethics - The Institute of Internal Auditors South Africa

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

THE AUDITORS ARE BACK!<br />

During the audit, auditors identify control weaknesses <strong>of</strong> varying signifi<br />

cance and agree on a plan <strong>of</strong> action with management to rectify<br />

these weaknesses within a reasonable period <strong>of</strong> time.<br />

<strong>The</strong> return <strong>of</strong> the auditors could cause consternation amongst management<br />

if they are not sure about the resolution <strong>of</strong> control weakness<br />

fi ndings that were raised during prior audits. Without a sound<br />

system for tracking control weakness raised in audit reports leadership<br />

and management will be unable to ensure systemic continuous<br />

improvements in the control environment.<br />

As part <strong>of</strong> initial audit procedures, during subsequent audit, a follow up<br />

on prior year fi ndings is performed to assess progress and sign <strong>of</strong>f the<br />

fi ndings that have been resolved. Sometimes a follow up on fi ndings is<br />

performed more frequently, especially for fi ndings relating to high risk<br />

exposure. This exercise could become another opportunity for management<br />

to open a debate on whether some <strong>of</strong> the fi ndings should have<br />

been raised in the fi rst place. This is usually the case when management<br />

has not taken any action to rectify the identifi ed control weakness. <strong>The</strong><br />

other side this exercise could present some comfort to auditor that there<br />

has been some improvement in the control environment, if management<br />

have indicated and gathered audit evidence that corroborates<br />

that promised action plans were implemented.<br />

Issue tracking can be a key driver <strong>of</strong> continuous improvement in the<br />

Tel: +27 11 785 4930<br />

Fax: +27 11 785 4939<br />

www.wexford.co.za<br />

��������������������������<br />

�����������������<br />

�������������<br />

INTERNAL AUDITORS<br />

R500 000 – R400 000 CTC, Bryanston<br />

����������������������������������������������������������������������������<br />

��������������������������������������������������������������������������<br />

�����������������������������������������������������������������������<br />

��������������������������������������������������������������������������<br />

����� tanya@wexford.co.za<br />

INTERNAL AUDITOR<br />

R450 000 – R400 000 CTC, Sandton<br />

����� ��������������� ��������� ��� �������� ����� ������� ��������� ������������<br />

����������������������������������������������������������������������������<br />

���������������������������������������������������������������������������<br />

��������������������������������������������������������������������������<br />

�����������������������������������������������������������������������������<br />

�����������������������������������������������������janet.b@wexford.co.za<br />

INTERNAL AUDITOR<br />

R420 000 – R350 000 CTC, Sandton<br />

�������������������������������������������������������������������������<br />

������������������������������������������������������������������������<br />

������������������������ candice@wexford.co.za<br />

INTERNAL AUDIT MANAGER<br />

R800 000 – R600 000 CTC, North<br />

������������������������������������������������������������������������������<br />

����������������������������������������������������������������������������<br />

�����������������������������������������������������������������������������<br />

����������������������������liz@wexford.co.za<br />

INTERNAL AUDITOR<br />

R500 000 – R350 000 CTC, North<br />

������������ ������������� ������������� ��������� ������������ ��� ��� ���� ���<br />

��������������������������������������������������������������������������<br />

�������������������������������������������������������������������������<br />

���������������������������������������������������������������������������<br />

felicia@wexford.co.za<br />

20 | IA ADVISER September 2011<br />

internal control environment in the organisation. If applied eff ectively,<br />

the audit committee can place reasonable reliance on this process<br />

in ensuring that management applies the most suited practices for<br />

the organisation in managing risk.<br />

When doing research on this topic for my thesis in 2010 it became<br />

evident that no academic research has been done on this process.<br />

<strong>The</strong> outcome <strong>of</strong> this study highlighted quite a number <strong>of</strong> areas that<br />

are under-researched within enterprise risk management and no research<br />

has been done on the tracking <strong>of</strong> audit fi ndings.<br />

<strong>The</strong> study I covered whether completed targeted institutions had a formalised<br />

issue tracking process, governance and positioning issue tracking<br />

process in the organisational structure and factors that are taken into<br />

account in concluding that the fi ndings is resolved. Furthermore opinions<br />

<strong>of</strong> risk <strong>of</strong>fi cers were sought on the eff ectiveness <strong>of</strong> issue tracking in<br />

the process <strong>of</strong> improving the quality <strong>of</strong> internal control environment.<br />

It was plausible that all banks that were participating in the study had<br />

issue tracking process in place. Varying observations were made with<br />

respect to governance and positioning <strong>of</strong> this process. Some banks had<br />

fi ndings tracking being driven by the executive committee; however,<br />

most banks rely on internal audit department to drive this process. In<br />

some instances the internal audit function was solely responsible for<br />

tracking their fi ndings and always in dispute with management about<br />

long outstanding fi ndings. <strong>The</strong> result <strong>of</strong> this was long outstanding fi ndings<br />

and a possibility that some fi ndings identifi ed were lost during system<br />

changes.<br />

<strong>The</strong> study could not conclude on the factors that are taken into account<br />

to conclude on whether the issue has been resolved, this was<br />

because management did not agree with all factors that were considered<br />

to be an indication <strong>of</strong> resolution <strong>of</strong> control weakness. All risk<br />

<strong>of</strong>fi cers agreed that issue tracking process is a key driver <strong>of</strong> improvements<br />

in the quality <strong>of</strong> internal control.<br />

<strong>The</strong> study recommended that issue tracking should remain the responsibility<br />

<strong>of</strong> management because it is a stage <strong>of</strong> risk management<br />

and it should be positioned as a strategic imperative <strong>of</strong> the organisation.<br />

Furthermore this process should follow an integrated approach,<br />

and not limit fi ndings to those raised by internal auditors, but also<br />

those self identifi ed fi ndings during managements’ risk control self<br />

assessment, external auditors during statutory audits and those<br />

identifi ed by other assurance providers.<br />

Issues <strong>of</strong> control weakness should be considered rectifi ed once corrective<br />

action has been fully embedded in the internal control process<br />

i.e. these may include updating and communicating the entity’s<br />

policy document, updating staff s job description and or updating<br />

staff ’s performance scorecards.<br />

To minimise stress levels on management during the return <strong>of</strong> independent<br />

assurance providers (internal and external auditors), management<br />

should realise the business case <strong>of</strong> improving the quality <strong>of</strong><br />

internal controls and the key role that a sound issue tracking process<br />

should play in improving overrall corporate governance. <strong>The</strong> return <strong>of</strong><br />

auditors will then be seen as providing independent assurance on the<br />

design and operation <strong>of</strong> internal controls and more value adding.<br />

Sethu Nsele (BCom, CIA, CFSA, MBL), Manager - Credit Risk<br />

Audit, GIA

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!