Internal audit consulting service is the service that Baker Tilly provides to its clients on outsourced or co-sourced basis in order to carry out the internal audit engagements within business entities, which help the audit committee or Board of Directors obtain assurance about risk management, control and governance processes. The internal audit services provide several benefits that businesses gain significantly, assisting the management with identifying, measuring and monitoring the internal controls; identifying deficiencies in processes and procedures; defining recommendations and guidance required to rectify the deficiency from within the business entity; achieving the established goals; and ensuring compliance with laws and regulations.
We, at Baker Tilly, offer highly professional delivery of internal audit engagements through employing specialist professionals with extensive experience in working with different industries, and applying the regulators’ instructions and international standards governing the internal audit engagements.
What is Internal Audit Service?
Internal audit is defined as an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluating and improving the effectiveness of risk management, control, and governance processes.
(Source: The Institute of Internal Auditors)
The above definition establishes basic cornerstones of internal audit to be objective consulting activity focusing on risks and governance.
What is the importance of having an internal audit function in business entities?
Internal Audit helps an entity accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. The Internal Audit plays a pivotal role in assessing the efficiency and effectiveness of the following functions:
- Risk assessment – help the business entity identify and assess key areas of risk and the necessary measures to deal with the same.
- Procedures assessment and documentation – this is achieved through understanding and documenting the procedures adopted by the business, and providing the necessary recommendations to enhance the same.
- Internal controls assessment – identify deficiencies in internal control systems and methods to address them.
- Reporting – provide findings and recommendations intended to improve processes and internal control systems.
What are the international standards governing the internal audit?
The International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors in the USA govern the internal audit activities and practices. Such Standards have two main categories: The first category is the Attribute Standards, which define the attributes of professional firms and individuals performing internal auditing activity. The second category is the Performance Standards, which set out the nature of internal auditing and provide quality criteria employed to measure the performance of these services. Each category comprises a set of standards.
Are all business entities required to set up an internal audit department/ office/ unit?
Not all business entities are required to set up an Internal Audit department/ office/ unit. However, it is a mandatory requirement only for business entities regulated by the Central Bank of Kuwait such as banks, financing companies, and exchange companies. It is also a mandatory requirement for business entities regulated by the Capital Markets Authority (the “CMA”) such as Bourse listed companies and licensed companies in accordance with the provisions of the Executive Regulations, Module 15, Article 6-7:
|Article 6-7 || |
- The IA function shall report to the Audit Committee and accordingly the board of directors;
- The Internal Audit function’s Manager shall be directly appointed by the board of directors based on the Audit Committee’s nomination; and
- The board of directors shall determine the roles and responsibilities of the Internal Audit function.
Is the internal audit officer position registrable with Capital Markets Authority?
Yes, Internal Audit Officer at listed companies and licensed persons is a CMA registrable position. Module 5 – Securities Activities and Registered Persons – of the CMA Executive Regulations set forth in Appendix (3) the academic qualifications and experience to be met by registrable positions in accordance with efficiency and integrity rules of Licensed Person.
What is the organizational unit charged with the supervision of the Internal Audit department/ office/ unit and what are its powers in accordance with Capital Markets Authority Executive Regulations?
The board Audit Committee is responsible for supervising Internal Audit department/ office/ unit. Furthermore, the authorities of Audit Committee are determined in accordance with the Executive Regulations, Module 15 – Corporate Governance, Article 5-7:
|Article 5-7 ||The authorities and responsibilities of the Audit Committee are as follows: |
- Technically supervise the Internal Audit function of the company to verify its effectiveness in performing the activities and assignments as defined by the board of directors;
- Recommend the appointment, transfer, and termination of Internal Audit Manager, appraise their performance, and assess the Internal Audit function performance;
- Review and approve the audit plan proposed by the internal auditor and provide feedback thereon;
- Review the findings set out in the internal audit reports and ensure that the necessary corrective actions have been taken with respect to the findings stated in the reports.
What are the characteristics of the internal audit report as per CMA instructions?
Module 15 – Corporate Governance of Executive Regulations sets forth the following requirements regarding the internal audit report:
|Article 6-8 ||The internal audit department/ office/ unit shall prepare a report including review and evaluation of the internal control systems in place in the Company. Such report shall include the following: |
- The procedures for control and supervision of the efficiency and effectiveness of internal control systems required to safeguard the Company’s assets and ensure the authenticity of financial statements and efficiency of its management, financial, and accounting operations;
- Comparison of risk factors development within the Company and the systems in place to assess the efficiency of the Company’s day-to-day activities and address unforeseen changes in the market;
- Assessment of the executive management’s performance in implementing the internal control systems; and
- Causes of failure in implementing internal controls, implementation weaknesses or emergencies that affected or may affect the Company’s financial performance, and the action adopted by the Company to address the failure in implementing the internal control.
Do the CMA Executive Regulations require the regulated business entities to review and assess the performance of the internal audit department/ office/ unit periodically by an audit firm?
Yes, the CMA Executive Regulations require the listed companies and licensed persons to review and assess the performance of the internal audit department/ office/ unit periodically every three years by another audit firm than the auditor engaged to audit the financial statements together with providing the Internal Audit Committee and the Board of Directors with a copy of the report. This is set out in the following article of Module 15:
|Article 6-9 ||Further, another audit firm shall review and assess the performance of the internal audit department/ office/ unit regularly every three years. Copy of such report shall be submitted to the Internal Audit Committee and the board of directors. |
What is the added value to business entities from the engagement of Internal Audit Services in Kuwait?
- Comply with laws, regulations, resolutions, and instructions issued by Capital Markets Authority;
- Identify efficiency and effectiveness of the internal control systems in place in the business entity through addition or updates to ensure sustainable updates; and
- Enhance the business entity’s performance efficiency and competitive capabilities through having the ability to face unforeseen changes in the market and define the causes of failure to implement the internal control systems.
What are the Internal Audit Services in Kuwait provided by Baker Tilly?
- Provision of internal audit services on an outsourced or co-sourced basis.
- Implement all corrective actions that arise from internal audit reports.
- Develop the manual internal control system.
- Implement all corrective actions that arise from internal control review reports.