Common Internal Audit Misconceptions Explained
Despite established MAS regulatory requirements and expectations around internal audit, in practice, we have observed several common misconceptions among CMSL holders when establishing and maintaining an effective internal audit arrangement.
Our Annual Financial Audit Covers Internal Audit
This is perhaps one of the most common misunderstandings. The annual external audit does not satisfy the MAS requirement for an internal audit.
While external auditors may review certain internal controls as part of their annual audit procedures, their work is not designed to provide a comprehensive evaluation of governance and risk management and control frameworks given that their primary objective is to express an opinion on the firm’s financial statements. Therefore, an external audit should not be viewed as a substitute for an internal audit.
Notably, external auditors commonly request to review the results of completed internal audits and any required post-audit remediation as part of the limited internal control reviews they may undertake.
We Have Policies and Compliance Monitoring in Place, so Our Controls Are Covered
Implementing a compliance function and formally documenting policies and procedures is certainly important, although it does not eliminate the need for internal audit.
While a compliance function constitutes the second line of defense by establishing the policies on the intended internal controls framework and monitoring ongoing adherence to regulatory requirements, internal audit, as the third line of defense, independently assesses whether these controls function effectively in practice. Each serves a distinct role, and together they comprise a robust governance and controls environment. Accordingly, neither compliance monitoring nor documented policies should be regarded as a replacement for an independent internal audit function.
We Can Limit the Scope of Internal Audit to Areas We Choose
Another common misconception is that internal audit can be confined to a single operational area of the firm’s choosing, such as accounting or finance processes.
On the contrary, the MAS requirement is much broader. Internal audit should encompass overall business activities and operations and should include inquiries into whether such activities and operations comply with applicable laws and regulations. As such, the audit scope should be risk-based and sufficiently comprehensive to cover key areas of the governance, risk management and control framework including, among others, advisory/portfolio management activities, controls to prevent money laundering and the financing of terrorism, conflicts of interest, BCM and operational resilience, key operational risks and outsourcing.
A narrowly scoped review that focuses only on selected functions while excluding material regulatory and operational risks may not provide adequate assurance and may fall short of the MAS requirements and expectations.
We Can Simply Conduct the Same Audit Every Year
A further common misconception is that once an internal audit program has been established, the same audit scope can be repeated year after year.
In reality, effective internal audit programs evolve with the risk profile and business of the given firm. Changes in investment strategies and products, personnel, technology and regulatory requirements may introduce new risks that should be considered in an internal audit plan. Areas of heightened regulatory focus, material organizational changes and emerging risks should also be considered when determining audit priorities.
Accordingly, internal audit plans should be reviewed periodically and updated based on the given firm’s current risk landscape. A risk-based audit plan helps ensure that internal audit resources are directed toward areas of higher risk exposure.
