Internal Audit

The internal audit function is defined as a systematic and independent control, and consultancy activity carried out in order to improve the internal processes of an institution, to improve its activities, and to add value to those activities. So here we put process improvement as the main focus. The first thing that comes to mind of the person who hears this subject is "They will try to find out where, how, what I did wrong.". This understanding does not reflect internal control. On the contrary, internal audit means performing an assurance function that focuses on processes from a modern point of view, focuses on how to make processes better, examines them as independent and impartial, i.e objective, and adds advice and control.

Here, we use the old and modern, old and new concepts as a gradual. To put this more clearly; the emergence of internal audit is not new. It has existed since ancient times, but it is a concept that became famous especially in the 1980s. We could say that in those days, the concept itself really focused on finding mistakes a little more. However, in today's world, since the 2000s, the event, process-based business management, and "I found the mistake, but what should I do?", "How can I transform it into a value-creating one? How can I see the error as an opportunity and use this opportunity?", it has evolved to seek the answers to questions. The internal audit activity is now becoming a proactive activity. It used to be an activity that remained static by looking back at the past of current or current behavior, in the 80s and 90s. Today, it is defined as a process and risk-based activity. In the past, the definition of internal audit ended as weighted control. 

Today's internal audit is an internal guidance activity that will enable companies to turn their activities into a state where they can create value. It is useful to see internal audit as an early warning system for institutions and companies. For example, think of yourself as the owner, board member, shareholder of a company, the internal audit activity actually makes early alarm bells ring within your company. What are those early alarm bells? It includes the discovery of the out-of-control or the points that you cannot see, reach and touch that emerged with the growth of your company, and the analysis of how to do them more correctly after the discovery, and finally the formulation of these analyzes into concrete suggestions and guidance projects. As a board member, company owner, you must be the person who most desires and demands the internal audit function. Your instinct to demand this should be evaluated as to where there are opportunities to create more value, where there are opportunities to create more value, where there are opportunities to create more value, and internal audit structure should be built with this motivation. 

Corporate risk management mostly provides an accurate view of the future of the company, while internal audit provides a mostly accurate view of the past. These lines were much sharper in the past, internal audit completely covered the old. Today, the sharpness of these two concepts has decreased. We can see that both of them overlap and support each other in the sense of short past and short future, both of which are used in the same sentence because process-based control is now dominant. There are already some formulated and detailed suggestions regarding the determination of corporate risk structures in the internal audit activity. Incorporate risk management, involves revealing what the company actually does in its current structure, how these are effective on the results, how important results these may have, and the consequences of the past. When considered, both internal audit and corporate risk management become concepts that deserve to be used side by side in the same sentence. In fact, one of the modern definitions of internal audit today is; corporate risk management is guidance, assurance, and consultancy activity that aims to make governance and internal control mechanisms systematic and sustainable. Therefore, you can often see internal audit and corporate risk management in the same definition.

There are 5 main types of internal audits. These;

1.      Compliance Audit

2.      Performance Control

3.      Financial Audit

4.      Information Technology Audit

5.      System Check

Compliance Check

A compliance check is to check compliance with a situation. Conformity audit is the documents that explain the facts, rules, regulations, directives, instructions, procedures, how a job or process should be done as tools that will facilitate this management during the corporate management. This documentation is just a form of being documented. The most important thing is the implementation. This documentation indicates how the company should be managed and operated, and the legislation that concerns all operational processes in every area (not specific processes and departments) and to what extent the implementation steps defined in this legislation are carried out in accordance with that legislation, how differently they are carried out, where there are bottlenecks, what determining that it is made differently according to the legislation, justifying and exemplifying this determination and presenting concrete improvement suggestions as a result of this exemplification.

Performance Audit

A performance audit is established to serve a purpose as a company, institution, organization, and existence. Every firm has a goal. These targets may be long-term targets such as 5-10-15 years as stated in strategic plans, or they may be annual targets. How this is handled in the internal audit; As the senior management, we set goals, set the direction to go, and set numerically measurable goals on how to understand whether this direction will be successful or not. A performance audit is a name given to the type of audit that shows us how harmoniously we are progressing towards these goals, namely these performance targets, how much the route is followed at each top glance, and the bottom view of each process and department. Performance audit tries to measure the difference between goals and achievement of goals. It is to do this on a general basis (ie institution-company-wide) as well as process and department-specific. Therefore, by entering the sub-headings, it checks the compliance of the performance of the company's subtitles to the goals, based on the principle that the combination of each subheading will actually achieve the final result. Therefore, a performance audit is performed.

Financial Control

Financial control focuses purely on numbers. Every corporation-company is established with a profit instinct or an instinct to achieve financial success, and sets goals execute its operations, and make an effort in this way. It is the financial-fiscal data that also shows whether this effort has been paid for. These can be listed as follows; company turnover, annual sales income data, financial structure data, cash flow data, profitability data, financial statement data. At the same time, as a result of the combination of various financial data such as the debt-to-debt status of the company, how much debt can be rolled over, short-long-term debt ratios, the company carries out its activities and can observe whether success occurs. Whether all these financial data reflect the truth in both the upper perspective and the sub-breakdowns of each, whether the data is healthy in real terms, whether it is applied correctly in the sense that even if it is healthy, whether it is applied correctly in the sense that it affects the result, whether they are ultimately overlapping with real operations and financially. The type of internal audit that sets itself a goal is called a financial audit.

Information Technology Audit 

Information technology control which was mentioned less in the 80s and 90s, but has become an indispensable part of our lives in the 2020s, can also take on the name of digital transformation control. According to the accepted view, information technology audit is the end-to-end information technologies used in all operations carried out by a board, firm, company itself, from the purchase of a good to the production and dispatch of that good, from the performance evaluation of a new employee recruited by a human resource to career management. (software, hardware, industry 4.0, big data) is a type of internal audit that checks to what extent it is sustainable and can be used continuously.

These activities must be defined within the company. It wouldn't be great if the company used such software. What is essential in information technology control is to use existing systems in a sustainable and safe manner. Considering that information technologies are spreading all over companies, even programs such as excel and word running on computers are information technology. While entering the company, finger reading-card reading systems are also information technology. Information technology audit is the area where the answers to the topics such as how sustainable, reliable, systematic, personal data security provided and usable are collected.

 

System Audit

The area where an internal audit is needed is very related to the concept of the system, because when it is considered, a company that performs very good activities with the right strategy and effectiveness, management grows, and later on, it makes investments by enlarging the business and incorporating new technologies. Later, the company will observe that the system related to all these new changes is out of control. Because maybe it will not even be integrated into the existing system yet. For example, imagine that a breastfed baby grows suddenly, you will observe that his clothes are not for him. This will bring systemic difference with it, but at the point where you try to make old clothes crap, everything will get messy. Therefore, you will need to renew the existing system and buy a new outfit, because there is a systemic deficiency or improvement.

At this point, it is necessary to create and develop value in the current system, and if it is necessary to combine lean philosophy with internal control, continuous auditing and continuous improvement must become a must for a company. Therefore, the concept of system audit, which we have listed in the type of audit as the main heading, is the type that emerges with the growth, development, new investment of companies and naturally includes that the manager of the company thinks that he has lost control. You are the owner of a company and at this point, you made a new breakthrough by first setting up your system. You will go from 100 people to 500 people. At this point, you may have set up certain internal control systems for 100 people. For example, with your employees and your factory, you can produce 10,000 products with 100 people a day. When you increase your employees from 100 to 500, many factors that you need to change in your system will come into play. At this point, system control comes into play.

 

A system audit is an audit activity that examines and analyzes questions such as how effective the existing systems, how much the current operation is included, are their places left without a system in the current ongoing operation, how to systematize, how deep and to what extent systems can be installed, and reports the results of the analysis. The system audit is an activity that forms the heart of internal auditing.

To talk about the standards of internal auditing, with some exceptions, internal auditing is not a mandatory activity in some countries and sectors. Therefore, it would not be right to talk about this as a globally required standard, internal audit is a set of practices. Internal audit has become an indispensable corporate function, as all companies and institutions have come to the same point with the logic that, consequently, the way of mind is one. Over the years, it has been observed that different applications have started to be applied differently in different countries and in different companies, institutions, public sector, private sector, and different organizations within the private sector and it has been observed that different methodologies have emerged.

The United States has taken the first steps in internal audit. In the United States, institutions such as the internal audit institute and the internal auditors' institute were established in the 80s. And these institutions have started to publish certain internal audit standards in order to achieve this commonality among themselves. Later, as these internal audit standards became widespread around the world, an organization called the Institute of Internal Auditors (IIA) was established. This organization has published internal audit standards that are widely accepted around the world. Therefore, when we talk about standards here, we mean the standards published by the International Institute of Internal Auditors.

These standards are very comprehensive and they are standards that are constantly revised, take additional modules, develop to meet the emerging concepts as the world develops, and consist of different subtitles of hundreds of pages. Internal audit functions and internal auditors around the world are generally expected to act in accordance with these standards. When new changes emerge with the developing world, these standards are constantly updated during a certain follow-up period (years-months). There are two main categories of standards;

•       Qualifications Standards (what the nature of the internal audit should be, how it should be, how to answer that question should be standards)
•       Performance Standards (Standards that answer the questions of how to measure the performance of internal audit, how it should be, how much performance should be performed)

Internal audit is mandatory in some sectors. For example, the banking sector in the US for the internal audit is a rule within the framework of the law. There are inspection boards and inspectors in banking with its widely known name. Inspection and inspector is the old language of inspection. In fact, the inspection board is the internal audit board, and bank inspectors are internal auditors. There are many inspection agencies within the Bank since ancient years both in the US and in the world as otherwise required by law.

Internal audit is an activity that is carried out solely to improve companies' own performance and activities. However, there are some quality standards of the internationally accepted ISO, which can appeal to different sectors that envision the same goal. These;

 

As ISO 9-1001 2015

ISO 14-1001 2015

OHSAS 18-1001 2015 standards

With the new approach in 2015 in all three, the concept of process-based audit and internal audit has actually become an integral part of these quality management systems. However, the perspective here should be formed by saying that as a company, I need an internal audit rather than establishing the internal audit function to obtain the quality system certificate. Why do companies need this? In order to improve activities, to add value, to identify where wrongdoings have been done, to recognize areas of improvement, and to regain control of growth or get out of control. This is how we can summarize the link between the quality management system and internal audit standards.

While defining internal audit, we talked about the essential functions in the organization; one is neutrality and the other is independence. If these two do not occur, there is no question of an internal audit. There should be a direct internal audit unit, which should report to the company's top management. It should not even be subordinate to the general manager, because the general manager normally has the right to hire, dismiss, promote, and determine the salary.

However, if you are directly affiliated with the board of directors, only the board of directors is accountable and one can be independent and objective as much as possible. In fact, one of the examples of this good practice is to form committees such as the early detection and audit of risk committee within the board of directors (or there may be cases where there are two separate committees), and if possible, by establishing structures in which the independent member of the company's board of directors is chairman, these structures should be accounted for and these structures should be moved directly.

Therefore, companies should have an internal audit unit, should be directly attached to and accountable to the top management of the company, and a structure consisting of internal audit manager and internal auditors, and the independence and objectivity of all these are guaranteed by the internal audit regulation to be issued by the executive board. The senior management has a function here. The work does not end just by establishing a department, companies have to guarantee the relationships with other departments and processes. Therefore, companies have to ensure that the internal audit directive and regulation will be signed and published under the top management.