The old definition of internal audit by the International Institute of Internal Auditors is reflected in its statement on internal audit responsibility (revised version 1990): "Internal audit is an independent evaluation function established within an organization, with the purpose of inspecting and evaluating its activities and serving the organization. It should provide analysis, evaluation, suggestions, advice and information on inspection activities to assist members of the organization to effectively perform their duties. " By comparing the old and new definitions, we can notice that the International Institute of Internal Auditors emphasizes objectivity in the new definition.

In the traditional concept, "independence" is an important feature of internal audit and is also considered as an important requirement to ensure the effectiveness of internal audit. However, in essence, objectivity is a more fundamental and extensive concept. In the process of drafting the new definition, the steering group did not use the concept of "independence" at first, nor did it intend to define it. They believe that the broad meaning of "objectivity" is a remarkable feature of the internal audit profession. The requirement of "independence" imposes unnecessary constraints on internal auditors, limiting who can provide services and what services they can provide. Moreover, putting "independence" above other concepts will make the internal audit department at a competitive disadvantage compared with external service providers when providing services, because the latter is often in a "more independent" position.

Internal audit departments can add value to enterprises because their analysis and suggestions on improving operation and control are objective. Independence is the means to ensure objectivity, and objectivity is the ultimate goal. Imagine that if the audit activity is independent, but it does not reflect the objective appearance of things for various reasons, then this activity will be inefficient and ineffective, and even lead to decision-making mistakes, which is very harmful. Conversely, as long as objectivity is guaranteed, there is no need to cling to independence. For internal audit, its formal independence is definitely not as good as external audit. It is absurd to think that internal audit is inferior to external audit.

For a long time, people often confuse the difference between goals and means. Although the purpose and the means should be unified, taking the means as the purpose will inevitably lead to the alienation of the purpose, and the means will eventually lose its meaning. The most obvious example is the rule-oriented accounting standard model originally advocated by the Financial Accounting Standards Committee. Due to blind attention to rules (that is, means), many companies finally took advantage of loopholes, resulting in false accounting scandals such as Enron and WorldCom. This model has caused at least the following problems:

(1) has no clear goal, and a lot of details cover up the intention of the code;

(2) Too many exceptions and boundary tests provide convenience for financial designers to obtain the required results;

(3) A large number of detailed guidelines, including a large number of contradictory treatment methods.

The Securities and Exchange Commission of the United States published a research report "Research on the adoption of principle-based accounting system in American financial reporting", arguing that it is necessary to abandon the rule-oriented model of the United States and the pure principle-oriented model advocated by the International Accounting Standards Committee and adopt the goal-oriented model. This clearly shows that the goal is the first, and the rules and even principles are just the means to achieve the goal. If the direction is wrong, the means will only go further and further on the wrong road, or even deviate from the goal faster; With the right direction, all means can be developed. For example, from a historical perspective, the evolution of independent audit objectives, that is, from checking errors and preventing fraud to verifying the fairness of financial statements, has been emphasized until now, and its audit techniques and methods have also changed or developed. The application of system-based audit and audit sampling has only developed to the stage of verifying the fairness of financial statements. Without this goal, the establishment of these methods and procedures is hard to imagine.

Therefore, these research achievements, successful experiences and failed lessons of the International Association of Internal Auditors provide a good reference for understanding the essence of internal auditing and then formulating China's own internal auditing standards.

What needs to be explained is not that the concept of independence is useless, but that it should play its role as a means. "Independence" is a variable, and its interpretation and importance depend on a series of factors, such as the industry type of enterprises, laws and regulations of regions and countries, and the nature of related services. Observing independence helps to achieve objectivity. In the current research of American Accounting Association, "independence" is expressed as "the ability to determine the scope of work and complete the work without hindrance", and the guiding working group finally adopted this understanding, retaining "independence" and holding that "internal audit activities should be undisturbed when determining the scope of internal audit, carrying out work and reporting results". The International Association of Internal Auditors believes that independence is aimed at audit activities and objectivity is aimed at internal auditors. Obviously, audit activities are based on internal auditors. In order to maintain objectivity, the International Institute of Internal Auditors believes that internal auditors:

(1) shall not participate in any activities or relationships that may or should damage its fair evaluation. Including activities or relationships that may conflict with the interests of the organization.

(2) They should not accept anything that may damage or may damage their professional judgment.

(3) All known important facts should be disclosed. As long as they are not disclosed, the report of the activities under review will be distorted.

(B) to expand the field of vision to the outside of the organization

According to the general understanding, internal audit seems to be carried out by people and institutions within the organization. However, this is a misunderstanding. In the new definition of internal audit by the International Association of Internal Auditors, the word "internal" has been abandoned. Internal audit is the internal audit business of an organization, and it is a concept of scope, which is different from the subjective concept of "audit business engaged by internal auditors". Although some people think that the concept of "internal" is the most important feature of the internal audit profession, it is flawed to retain this concept in theory. This wording tries to make the internal audit industry monopolize all related services and perform all functions, and tries to prevent outsiders from participating in the competition of internal audit services. Moreover, with the expansion of service scope, it becomes uneconomical for enterprises to have all necessary technologies inside, which also leads many enterprises to purchase services from outside, that is, the so-called externalization of internal audit. The only value of the concept of "internal" is that the internal audit service should still be managed by the enterprise, and should not be completely entrusted to the outside.

Part or all of the internal audit business is extended to the outside, and its obvious advantages are as follows:

1. Get economies of scale. The external audit organization is not only economical in organizational scale, but also economical in business scale. The high service cost can be compensated or shared by a large number of customers, so the lowest cost can be achieved under the same service or the more efficient service can be achieved at the same cost. Most of the audit business is done by people, but some parts need to use computer-aided technology and management analysis technology. The cost of software and hardware in these technologies is not what ordinary companies are willing or able to bear, but first-class accounting companies can and are willing to bear, because these fixed costs can be shared among a large number of customers.

2. Reduce the total cost. If an organization has established its own internal audit department, it needs to pay employees' salaries, training fees and management fees. Externalization of internal audit can save these expenses, and enterprises can only hire them when necessary to maintain the flexibility of expenditure control. That is, the fixed cost required to set up the internal audit department will be transformed into variable cost, and the uncontrollable cost will be transformed into the controllable cost of the management department. At the same time, if external auditors undertake internal audit, the methods and procedures of internal audit can be highly consistent with external audit, which means that external auditors can rely more on internal audit and enterprises can benefit from paying less audit fees.

3. Maintain an appropriate organizational scale. Almost every enterprise can benefit from the internal audit function, but for small and medium-sized enterprises, it is difficult to recruit top talents by setting up an internal audit department with only one or two people, and it is also impossible to establish enough expert opinion libraries. Accounting firms can effectively analyze risks and provide menu-based professional services to meet the different needs of customers in different periods.

4. Let the management pay attention to the core competitiveness. The daily audit of the internal audit department is often inefficient and may also distract the management. If the internal audit is externalized, enterprises can free up management time and resources, so that management can focus on core competitiveness and pursue more strategic goals instead of spending a lot of energy on low-return daily management.

5. Organizations have the initiative in outsourcing internal audit services. When an organization decides to outsource internal audit services, it can choose according to the specific situation of the enterprise and the advantages of different accounting firms, and to a great extent, it has mastered the initiative. In the process of receiving services, the board of directors and the audit committee can supervise the internal audit work, evaluate the service quality of external auditors and determine the completion of contracts. If they are not satisfied with their services, because there are other external personnel in the market who can provide internal audit services, enterprises can sign long-term price agreements with employers, or consider reintroducing internal audit institutions.

6. External audit institutions have advanced audit technology and rich audit experience, and some first-class accounting companies also have unique quality control and assurance systems.

Therefore, with the development of internal audit and the continuous improvement of external requirements for internal audit, the externalization of internal audit will be a trend. We should conform to the trend and break away from convention in order to enhance the value of this organization and help it achieve its goals.

(C) the ultimate goal of internal audit is to increase organizational value

Traditional internal audit theory holds that internal audit has the functions of economic supervision, economic management, economic evaluation and economic verification. This understanding is also reflected in the old definition of internal audit. In the latest definition of internal audit, the International Institute of Internal Auditors believes that "internal audit is an independent and objective certification and consulting service, and its goal is to increase value and improve the operation of the organization." This is completely different from the traditional "independent evaluation function" theory.

The proposal of "adding value and improving management" has made this profession full of unprecedented vitality. Under the traditional concept, internal audit is to reduce agency costs to a great extent, and people don't care about its contribution to enterprise management, which is often invisible. In today's highly competitive and cost-sensitive market, major companies divide their business processes into value-added processes and non-value-added processes, and then compress the non-value-added processes as much as possible, expecting everyone in the company to create value for them. In the final analysis, an organization can exist and survive only if it is valuable, otherwise it will have no place in society. Therefore, any activity can only be valued by the organization and survive if it creates or adds value to the enterprise. If the internal audit still adheres to the past position, it can only be eliminated. The new role orientation requires internal audit to actively participate in value creation activities, so as to win a place for its continued existence. If the internal audit is not aimed at increasing the value of the organization, it will not be tolerated by the organization. While participating in value creation, internal audit should show its contribution in the process of value creation to the world, and let the management department, board of directors and other stakeholders of the company know the necessity and importance of its existence, so as to maintain and improve its professional status. However, it should be noted that the range of reducing cost or improving efficiency should not be used as the standard to measure the performance of internal audit, which will weaken the objectivity of its work. Because the contribution of internal audit to value creation is often indirect.

At the same time, the activities that internal audit pays attention to are also promoted to the level of the whole organization, rather than the activities aimed at individuals or a certain department in the past. The core of its goal is to help an enterprise achieve its strategic goal, that is, to increase value, and at the same time, it also links internal audit with the core business processes and key success factors of the enterprise. With the improvement of attention, internal audit has changed from "functional thinking" of local functions to considering problems and proposing solutions from the overall value chain, which has promoted effective cooperation among various departments and aspects from a global and long-term perspective. This also expands the function of internal audit in essence, which requires that this factor be fully considered in the recruitment, training and team building activities of internal auditors.

(D) put risk management in an important position

In the field of auditing, the word "risk" seems to be more associated with independent auditing. Traditional internal audit also focuses on internal control system and operation mechanism. However, due to the uncertainty of the internal and external environment faced by enterprises under the market economy, the risks of enterprises generally increase, such as the lack of internal financial and business information, the failure to implement policy plans and standards, the loss of assets, the waste and ineffective use of resources, the change of external consumer preferences, the adjustment of national macro policies, and the turmoil in international financial markets. Therefore, enterprises urgently need internal audit to evaluate and improve the effect of risk management, control and governance process through a set of systematic and standardized methods. In order to meet this requirement, the new definition also adds the content of risk management. The overall management control mechanism of an enterprise is generally more inclined to link the management control system with the long-term goals of the organization and the risk of failing to achieve these goals. In order to help enterprises achieve their goals, we must attach importance to risk management. The new definition shows that control is no longer abstract and implicit, but can actually help organizations to carry out risk management and formulate effective management procedures, and there are many "correct" methods for each situation. The risk control system makes it necessary for internal auditors to constantly improve their control methods with the changes of global market and competitive nature, the emergence of new asset forms and the changes of information acquisition tools. The saying that "one control means is suitable for all kinds of control" and the general control mode no longer exist.

The risk control system also determines that certification and consulting services can create value for the organization. There are many successful examples in this regard. For example, a foreign trade group company has more than 10 subsidiaries. In the second half of 2002, the internal auditors of the group reviewed the signing and implementation of business contracts of these subsidiaries, and found that soybean meal alone accounted for 16% of the large-value import commodity contracts of more than RMB 10, involving an amount of RMB 500 million. According to international practice, the purchase of soybean meal must sign a futures contract six months in advance. All subsidiaries import soybean meal at the same time. For the whole group, it takes too much money in a certain commodity, which will inevitably increase business risks. The internal auditor immediately suggested to the management of the group that the soybean meal import should be hedged to avoid the operational risk brought by the price drop. Sure enough, there was a bumper harvest of soybean meal in South America in 2002, and the price of soybean meal in the international market plummeted all the way. The internal auditor's advice saved the group from a loss of nearly 200 million yuan.

With the integration of international economy and China's entry into the World Trade Organization, the competition among enterprises will become more and more fierce. Internal audit has irreplaceable advantages in helping enterprises achieve their goals, so it is paid more and more attention by management authorities. However, China's internal audit needs to be improved both in theory and practice. How to seize the opportunity and develop the internal audit profession while improving the competitiveness of enterprises is a major issue faced by every internal auditor.