Internal Auditing, Term Paper Example

Internal Auditors have to adhere to certain standards that ensure a free and fair market. These standards are fundamentally the professional and ethical standards that have been put in place by fellow practitioners and the government to ensure a fair and legal market. These standards are embodied in the COSMO ERM. They include:

Purpose, Authority and Responsibility: The responsibilities, authority and purpose of every internal auditor have to be defined formally in an internal audit charter. These will have to be in line with the Code of Ethics (Moeller, 2007, p. 15).

Independence and Objectivity: An internal auditor and internal audit activity have to be completely independent while observing objectivity in their work.

Organizational Independence: the chief audit executive has to report to a level in the organization under audit. This will permit internal audit activity realize it set responsibilities. The chief audit executive is has to meet with the board on an annual basis the state and nature of independence of the internal audit activity.

Proficiency and Due Professional Care: all internal auditors have to have the capacity, skills and knowledge that is required to execute their responsibilities. The auditors have to apply the skill and care that is required of a competent and prudent internal auditor (Moeller, 2007, p. 16).

When risk is quantified, it provides important data on which they can base their strategies in the planning phase. It helps managers in the following ways:

Risk Identification: it keeps managers aware of the risk factors that the organization is exposed to. It helps to identify which risk that each job within the organization is prone to. It helps in ranking the risks by identifying the nature and location of the risk, the magnitude of the risk, and how this risk can be distributed (Moeller, 2007, p. 21). This is owing to the fact that each risk has an approximate damage value, should the organization be affected by the risk. This affects the profitability of the company.

After assessing the risk, the audit manager is expected to undertake corrective measures as it suits the situation and the financial position of the company. There are numerous corrective measures that can be put into place. They include:

Avoidance: this is the alteration of the project plan so as to remove the risk.

Transference: this is passing the risk off to a third party such as a subcontractor at a cost or the client.

Mitigation: this is putting in place structures, measures and policies to reduce the impact that the risk would have on the organization.

Acceptance: this is put in place to handle the risk as nothing can be done to avert or mitigate the risk.

The audit manager is expected to create a risk response protocol by developing a risk plan together with a mechanism that allows them to monitor the risks.

Opinion

I believe that the audit manager is in charge of the identification of risks that the company is prone to. This position should therefore be fully independent of the company itself as this provides for an objective and factual audit. However, it is up to the management to take action when it comes to audit assessments reports. As such, it is the duty of the top management to create a transparent structure that can be used to clearly identify and handle the risks that the organization is exposed to.

References

Moeller, R. R. (2007). COSO enterprise risk management : understanding the new integrated. Hoboken: John Wiley & Sons.