The above briefly introduces the internal audit practice framework of the International Institute of Internal Auditors, from which we can see the development of its concepts and get some useful inspiration.

From independence to objectivity

The old definition of internal auditing by the International Institute of Internal Auditors is reflected in its "Statement on Internal Auditing Responsibilities" (1990 Revision) : “Internal audit is an independent evaluation function established within an organization to inspect and evaluate its activities and serve the organization. It provides analysis, evaluation, suggestions, advisory opinions and information on inspection activities to assist the organization Members perform their duties effectively.” By comparing the old and new definitions, we can notice that the International Institute of Internal Auditors places more emphasis on objectivity in the new definition.

In traditional concepts, "independence" is an important feature of internal auditing and is also considered an important requirement to ensure the effectiveness of internal auditing. However, in essence, objectivity is a more fundamental and broader concept. [2] In the drafting process of the new definition, the Steering Task Force did not initially use the concept of "independence" and did not intend to define it. They believe that the broader meaning of "objectivity" is a distinctive feature of the internal audit profession. The requirement of "independence" places unnecessary constraints on internal auditors, limiting who can provide services and what services can be provided. Moreover, prioritizing “independence” over other concepts puts the internal audit function at a competitive disadvantage relative to external service providers when providing services, because the latter tend to be in a “more independent” position.

The internal audit department can add value to the enterprise because their analysis and suggestions for improving operations and controls are objective. Independence is to ensure objectivity and is a means, while objectivity is the ultimate goal. Just imagine if the audit activity is independent, but does not reflect the objective appearance of things due to various reasons, then this kind of activity will be inefficient and ineffective, and may even lead to decision-making errors, which is very harmful. On the other hand, as long as objectivity is ensured, there is no need to cling to independence. For internal auditing, its formal independence is certainly not as good as external auditing. It would be absurd to think that internal auditing is inferior to external auditing.

For a long time, people have often confused the difference between goals and means. Although the goal and the means should be unified, taking the means as the goal will inevitably lead to the alienation of the goal, causing the means to eventually lose their meaning. The most obvious example is the rule-oriented accounting standards model originally advocated by the US Financial Accounting Standards Board. Because it focused exclusively on rules (i.e. means), it eventually led to many companies taking advantage of the rules, such as Enron and WorldCom. Waiting for the false accounting scandal. This model has caused at least the following problems:

(1) There is no clear and clear goal, and a large number of details obscure the intention of the guidelines;

(2) Too many exceptions and boundaries Testing provides convenience for financial designers to obtain the required results;

(3) A large number of detailed guidelines, which contain a large number of contradictory treatments.

The U.S. Securities and Exchange Commission published a research report "A Study on the Adoption of a Principles-Based Accounting System for Financial Reporting in the United States" [3] arguing that it is necessary to abandon the rules-based model of the United States and international accounting. The Code Committee advocates a purely principle-oriented model in favor of a goal-oriented model. This move clearly illustrates that the goal is primary, and rules, and even principles, are just a means to achieve the goal. If the direction is wrong, no matter how perfect the means are, it will only go further and further down the wrong path, and even deviate from the goal faster; if the direction is right, all means can be developed accordingly. For example, historically, the objectives of independent auditing have evolved, from detecting errors and preventing fraud to verifying the fairness of financial statements, to now focusing on both, and its auditing techniques and methods have also changed accordingly, or in other words, Develop accordingly. The use of system-based auditing and audit sampling were developed during the stage of verifying the fairness of financial statements. Without this goal, the establishment of these methods and procedures is difficult to imagine.

Therefore, these research results, successful experiences and failure lessons of the International Institute of Internal Auditors provide us with a good basis for understanding the nature of internal auditing and formulating our own internal auditing standards. Learn from.

It should be noted that this does not mean that the concept of independence is useless. As a means, it should play its role. "Independence" is a variable, and its interpretation and importance depend on a series of factors, such as the industry type of the enterprise, regional and national laws and regulations, and the nature of related services. Observing independence helps achieve objectivity. In the current study of the American Accounting Association, "independence" is expressed as "the ability to determine the scope of work and complete the work without hindrance." The steering task force finally adopted this understanding and retained "independence," arguing that " The internal audit activity should be free from interference in determining the scope of the internal audit, conducting its work, and reporting its results.” The International Institute of Internal Auditors believes that independence refers to audit activities and objectivity refers to internal auditors as individuals. Obviously the audit activity is based on internal auditors. In order to maintain objectivity, the International Institute of Internal Auditors believes that internal auditors:

(1) Should not engage in any activities or relationships that may impair or be presumed to impair their unbiased assessment.

Includes activities or relationships that may conflict with the interests of the organization.

(2) Should not accept anything that might impair or be presumed to impair their professional judgment.

(3) All known material facts should be disclosed unless failure to disclose would distort the report on the activity under review.

Expand the horizon to the outside of the organization

Internal audit, according to ordinary people's understanding, seems to have to be conducted by people and institutions within the organization. However this is a misunderstanding. In the International Institute of Internal Auditors' new definition of internal auditing, the word "internal" has been abandoned. Internal audit is an audit service within an organization. It is a scope concept and is different from the subject concept of "audit service performed by internal auditors". Although some believe that the concept of "internal" is the most important attribute of the internal audit profession, retaining this concept in theory is flawed. This language attempts to give the internal audit profession a monopoly on all relevant services and to perform all functions, and attempts to prevent outsiders from competing for internal audit services. And as the scope of services expands, it becomes uneconomical to have all the required technology within the enterprise, which has also caused many enterprises to purchase services from outside, the so-called externalization of internal audit. The only valuable aspect of the concept of “internal” is that internal audit services should still be managed within the enterprise and should not be completely delegated to the outside.

Expanding part or all of the internal audit business to the outside has obvious advantages:

1. Gain economies of scale. External audit organizations are economical not only in organizational scale but also in business scale. High service costs can be compensated or shared among a large number of customers, thus achieving the lowest cost for equivalent services, or more efficient services at the same cost. Most of the audit work is completed by people, but some parts require the use of computing-assisted technology and management analysis technology. The cost of software and hardware in these technologies is not something that ordinary units are willing or able to bear, but first-class accounting companies can Also willing to bear it because these fixed costs can be spread over a large number of customers.

2. Reduce total costs. If an organization establishes its own internal audit department, it needs to pay staff salaries, training fees and administrative expenses. Externalizing internal audit can save these costs, and the enterprise can only hire when needed to maintain the flexibility of expenditure control. That is to say, the fixed costs required to establish an internal audit department are converted into variable costs, and uncontrollable costs are turned into controllable costs for the management department. At the same time, if external auditors are responsible for the internal audit work, the internal audit methods and procedures can maintain a high degree of consistency with the external audit, which means that the external auditors can rely more on the internal audit work, and the company can also pay less for the audit. Benefit from the fees.

3. Maintain appropriate organizational size. Almost every company can benefit from an internal audit function, but for small and medium-sized companies, setting up an internal audit department with only one or two people will make it difficult to recruit top talents and establish an adequate database of expert opinions. Accounting firms can effectively analyze risks and provide menu-based professional services to meet the different needs of customers at different times.

4. Make management focus on core competitiveness. Routine audits by internal audit departments are often inefficient and can distract management. If the internal audit is externalized, the company can free up management time and management resources, allowing management to focus on areas of core competitiveness and concentrate on pursuing more strategic goals, instead of spending a lot of energy on low-return daily tasks. Under management.

5. The organization takes the initiative when outsourcing internal audit services. When an organization decides to outsource internal audit services, it can choose according to the specific circumstances of the enterprise and combine the advantages of different accounting firms, thus taking the initiative to a large extent. In the process of receiving services, the board of directors and the audit committee supervise the internal audit work, evaluate the service quality of external auditors, and determine the completion of the contract. If you are not satisfied with its services, the company can sign a long-term price agreement with the retainer or consider reintroducing an internal audit agency since there are other external personnel on the market who can provide internal audit services.

6. External audit organizations have advanced auditing technology and rich auditing experience, and some first-class accounting companies also have unique quality control and assurance systems.

Therefore, with the development of internal auditing and the increasing external requirements for internal auditing, the externalization of internal auditing will be a trend. We should follow the trend and break the rules to enhance the value of the organization and help the organization achieve its goals.

The ultimate goal of internal auditing is to increase organizational value

Traditional internal auditing theory believes that internal auditing has functions such as economic supervision, economic management, economic evaluation, and economic assurance. This understanding is also reflected in the old definition of internal audit. The International Institute of Internal Auditors believes in its latest "Definition of Internal Auditing" that it is an independent, objective assurance and consulting service whose goal is to add value and improve the organization's operations. This is completely different from the traditional theory of "independent evaluation function".

The proposal of "adding value and improving operations" has made this profession full of unprecedented vitality. Under the traditional concept, internal auditing is largely designed to reduce agency costs. People do not care about its contribution to business operations, and this contribution is often intangible.

In today's highly competitive and cost-allergic market, major companies have divided their business processes into value-added processes and non-value-added processes, and then compressed the non-value-added processes as much as possible, expecting everyone in the company to do their best. Create value. In the final analysis, an organization is necessary and able to exist only if it has value, otherwise it will have no place in society. Therefore, any activity can only be valued by the organization and survive if it creates or adds value to the enterprise. If internal audit still sticks to its past position, it will only be eliminated. The new role positioning requires internal audit to actively participate in value creation activities, so as to gain a place for its continued existence. If internal auditing does not aim at increasing organizational value, it will be unacceptable to the organization. While internal audit participates in value creation, it must make its contribution to the value creation process clear to the world and let the company's management department, board of directors and other stakeholders understand the necessity and importance of its existence. Only in this way can the profession be maintained and improved. status. However, it should be noted that the extent of cost reduction or efficiency increase should not be used as a standard to measure the performance of internal audit work. Doing so will weaken the objectivity of its work. Because the contribution of internal audit work to value creation is often indirect.

At the same time, the activities that internal audit focuses on have been raised to the level of the entire organization, rather than the activities that were targeted at individuals or a certain department in the past. The core of its goal is to help an enterprise achieve its strategic goals, that is, to add value, and to connect internal audit with the enterprise's core business processes and key success factors. The increased level of attention has enabled internal audit to shift from the "functional thinking" of a local function to considering problems and proposing solutions from the overall value chain, taking a global and long-term perspective, and promoting effective cooperation in all aspects of various departments. This also substantially expands the functions of internal audit and requires that factors in this area be fully considered in the recruitment, training, and team-building activities of internal auditors.

Put risk management in an important position

In the field of auditing, the word "risk" seems to be more associated with independent auditing. Traditional internal audit also focuses on internal control systems and operating mechanisms. [4] However, due to the uncertainty of the internal and external environments faced by enterprises under market economy conditions, corporate risks have generally increased, such as insufficient internal financial and operating information, failure to implement policy plans and standards, loss of assets, and resource losses. Waste and ineffective use, etc. External factors include changes in consumer preferences, national macro policy adjustments, international financial market turbulence, etc. Therefore, enterprises urgently need internal audit to evaluate and improve the effectiveness of risk management, control, and governance processes through a systematic and standardized method. In response to this requirement, the content of risk management has also been added to the new definition. The overall management control mechanism of an enterprise generally tends to link the management control system with the long-term goals of the organization and the risks of failure to achieve these goals. To help companies achieve their goals, risk management must be taken seriously. The new definition shows that controls are no longer abstract and implicit, but can actually help organizations manage risks and develop effective management procedures, and that there are multiple "right" methods for every situation. The risk control system requires internal auditors to continuously improve control methods as the nature of global markets and competition changes, the emergence of new asset forms, and changes in information acquisition tools. The saying “one control fits all” and the universal control model no longer exist.

The risk control system also determines that assurance and consulting services can create value for the organization. There are many successful examples in this regard. For example, a foreign trade group company has more than 10 subsidiaries. The group's internal auditors reviewed the signing and execution of business contracts of these subsidiaries in the second half of 2002 and found that only soybean meal was included in the large-amount import contract of more than 10 million yuan. It accounts for 16%, involving an amount of 500 million yuan. According to international practice, futures contracts must be signed six months in advance to purchase soybean meal. Each subsidiary imports soybean meal at the same time. For the entire group, too much funds are tied up in a certain commodity, which will inevitably increase operating risks. The internal auditor immediately made a recommendation to the group management that soybean meal imports must be hedged to avoid operating risks caused by falling prices. Sure enough, there was a bumper harvest of soybean meal in South America in 2002, and the international market price of soybean meal plummeted. The internal auditor's recommendations helped the group avoid a loss of nearly $200 million.

With international economic integration and my country's accession to the World Trade Organization, competition among enterprises will become increasingly fierce. Internal audit has irreplaceable advantages in helping enterprises achieve their goals, so it is increasingly valued by management authorities. However, at present, my country's internal audit has many areas for improvement both in theory and practice. How to seize opportunities and develop the internal audit profession while improving corporate competitiveness is a major issue faced by every internal auditor.