Internal audit support
Audit support
·
On demand
A purchase can have an approval on paper while payments still bypass it. A stock reconciliation can be prepared every month while differences remain unresolved. Internal audit examines how a process actually operates and whether its controls address the risks the business faces.
TheTaxCo. supports a business’s own internal audit and control review work: process walk-throughs, control testing, documentation and reports to management. It is support for management; it is not a statutory or tax audit, and it is not an attestation or assurance. The work may cover a business process, a location, a set of controls or a planned programme of reviews. Who receives our reports, and our access to records, are agreed before we start.
Decide what needs examination
The starting point is the business risk: loss of stock, unauthorised payments, unreliable reporting, revenue leakage or failure to follow an important requirement. Management’s concerns, earlier findings and changes in operations help determine the review priorities.
A process review might follow purchases from supplier creation through ordering, receipt, invoicing and payment. A payroll review might examine employee master changes, attendance inputs, approval of revisions and payment controls. A receivables review can connect credit approval, invoicing, collections, credit notes and write-offs.
We agree the period, locations, records and testing approach with management. A review of one warehouse does not support a conclusion about every warehouse. If the available population is incomplete, that affects the procedures and the conclusions that can be drawn.
Mandatory appointment and voluntary review
Section 138 of the Companies Act requires prescribed classes of companies to appoint an internal auditor. Whether it applies depends on the company’s category and financial criteria; being privately held is not, by itself, an exemption. Where it applies, the company decides whom to appoint, and we can support the appointed internal auditor or the company’s own team. A business outside mandatory coverage can still run a voluntary control review with our support. Companies Act, section 138
We check for conflicts before accepting the work. Section 144 bars a company’s statutory auditor from providing internal audit services to the company and specified related entities, directly or indirectly. Approval by the Board or audit committee does not override that bar. Companies Act, section 144
Test design and operation separately
A control may be poorly designed even if staff follow it. For example, allowing the same person to create a supplier and release its payment leaves a weakness in the approval structure. A properly designed control may also fail in operation when required approvals are skipped.
We walk through process documents and the actual workflow with the people responsible. Testing then considers evidence such as authorisations, transaction records, reconciliations, system permissions and the handling of exceptions. The sample and procedures follow the agreed risk and scope; we do not describe a sample review as an examination of every transaction.
Illustrative finding: a reconciliation was signed each month, but old differences were carried forward without an owner or investigation. The useful recommendation is to assign responsibility, investigate the differences and retain evidence of resolution. Requiring another signature alone would not address that failure.
Where a matter suggests possible misconduct, we record what we found and tell the person who receives our reports, so that management can decide on a separate investigation. Routine internal audit work does not mean every fraud will be detected.
Reports that support corrective action
Each material finding should state the condition found, the evidence and scope, why it matters, and the proposed corrective action. Management’s response is recorded alongside the action owner and target date. Differences of view remain visible rather than being removed to produce an agreeable report.
You receive a review plan, process walk-through notes, test working papers, a prioritised findings report for management and an action tracker. Reporting frequency depends on the assignment and the organisation’s needs. Significant matters may require earlier communication instead of waiting for the scheduled report.
Our follow-up checks whether the agreed action was implemented and whether it works. A procedure being rewritten is not proof that staff are following it. Closure requires evidence appropriate to the original finding.
Records and working arrangements
The initial request usually covers process descriptions, organisation and authority charts, relevant policies, transaction populations, previous findings and system or access information needed for the review. We then request the supporting records for selected tests through the agreed access arrangements.
The work estimate depends on the number of processes and sites, record quality, sample coverage and availability of staff. Business managers remain responsible for operating the controls and deciding on corrective action. Our role is to support the review: we test and report to management within the agreed scope.
Is internal audit the same as statutory audit?
No. Internal audit looks at agreed functions and controls for management. A statutory audit has a separate appointment and financial-reporting objective, and the company’s auditor carries it out. See statutory audit support for how we help with the preparation.
What if we suspect a diversion of funds?
A specific allegation usually needs a separately scoped investigation, led by your investigator, counsel or internal team, with defined evidence preservation, authority and reporting arrangements. Our forensic support can help with records and transaction trails. We first agree the question and the records at risk with whoever is leading the investigation.
Can we begin with one process?
Yes. A focused review can be appropriate where the concern is identifiable. The report will make the coverage and limitations clear so that its findings are not mistaken for a business-wide conclusion.
Email TheTaxCo., message us on WhatsApp or book a call. Share the process or concern, entities and locations involved, and the person or committee that will receive the report.