Spot the words ‘’internal’’, ‘’external’’ and ‘‘audit’’ in the same sentence and the next word that probably comes to mind is ‘‘crisis’’. But it doesn’t need to be that way! In this guide, we’ll give you the lowdown on what audits are, why they matter and the process involved for both internal and external audits.
What is an audit?
An audit is a bit like a health-check up for your business. Just like it’s a doctor’s job is to make sure your body is ticking over smoothly (quite literally if they’re a cardiologist), an auditor’s job is to check that your business is functioning as it should.
Internal audits are all about diagnosing potential risks before they become a problem. Your auditor might take a look at the control processes you’ve got in place, the quality of your security systems and how well your business might adapt to a change in the competitive landscape.
With external audits, the focus is on financial fitness. Your auditor will have the (extraordinarily dull) job of reviewing balance sheets and the like to determine that they’ve been prepared correctly. They’ll also be tasked with giving the budgets and forecasts a once over to ensure that your business isn’t heading towards premature mortality.
Are internal and external audits compulsory?
In most cases, no! Internal audits are 100% optional no matter the size of your business.
If you’re running a small or medium-sized business, external audits fall similarly into the “nice to have” category. However, when your business becomes large-scale and starts to turn over millions of pounds, you’ll need to get an external audit every year.
How are auditors selected?
Via a last-man standing battle royale.
For internal audits, the selection process offers business owners a surprising amount of freedom. Whilst protocol dictates that the person chosen is either an employee or a hire from an outside auditing agency, whether you opt to take this approach is entirely up to you!
With external audits, the prospective auditor must be deemed a ”Responsible Individual” (RI). Given that the standard definition would preclude almost anyone who attended a pub in their teenage years, the auditing regulator has been forced to set out its own criteria for RI status:
· The individual must be a certified member of ICAS, ICAEW, ICAI or ACCA
· The individual must currently be practising as an auditor.
In addition to the RI requirements, the person selected must also:
· Be entirely independent of the organisation they’re auditing. Obviously.
· Be agreed upon by the company shareholders (not as much of a hurdle as it might sound).
Whilst it’s important to find an auditor who can meet the legal bare minimums, that’s not all you need to consider:
· Experience: “Lots of” doesn’t always mean “better”; journeyman boxers are confined to undercards for a reason. That said, an auditor who’s been in the business for 15 years is probably a safer bet than someone very new.
· Price: Whilst many auditing companies will only offer fixed price options, some will allow you to build a custom service package that’s tailored to your budget and needs.
· Personality traits: You’re picking an auditor, not a new best friend. Still, make sure you choose someone who’s pleasant enough to be around. It’ll make your time together much less painful!
What happens during an audit?
The exact process and timescales will vary a little depending on the auditor(s) you choose. However, the the standard roadmap looks something like this:
1) Your planning phase. As a minimum, you’ll need to figure out your objectives, scope, likely budget and timescale.
2) Your auditor’s planning phase. Having sent over your list of requirements to your dream auditor, they’ll have their own planning to do. As well as double-checking whether or not your suggested scope, timescale etc. are feasible within the budget, they’ll also need to draw up their own schedule and list of responsibilities.
3) Indirect monitoring. Once the requirements have been agreed and the fateful day of audit arrives, the auditor will start by overseeing processes from afar. Though the presence of an omnipotent assessor isn’t likely to go *totally* unnoticed, auditors often look to keep workplace interference to a minimum in the early stages by completing tasks that require negligible amounts of guidance/contact (e.g. preliminary document reviews).
From here, the paths diverge…
Internal audits: At this stage, your auditor will be getting into the thick of things. Expect them to document workflows, test control processes and possibly even interview some of your staff.
Relevant aside: If your auditor is also an employee, be sure that any one-on-one “workplace productivity” discussions are not simply a ruse for frivolous chinwagging.
External audits: These may be slightly less hands-on than their internal counterparts. Work carried out at this stage may include examining accounting records, verifying the purchase of items and making enquiries into individual employees’ compliance with the law.
What’s next?
With internal audits, your auditor will write up their findings and then present these to your board (often via a report and a disappointingly animation-free slideshow). If the auditor has uncovered any issues, the findings will include a list of recommended remedial actions which your board can either choose to implement or decide to ignore. For obvious reasons, the contents of the report aren’t typically released for public consumption, though you should fully anticipate one or two would-be interlopers to ask/plead/offer their firstborn in exchange for a summary of the findings.
With external audits, burying the final report is not an option: you MUST make it readily available to the public by filing it with the Registrar of Companies. Whilst that means your business runs the risk of being hung, drawn and quartered if deemed to be performing poorly, investor confidence could well skyrocket if things are going more swimmingly.
Even if your business comes out of an external audit well, it’s likely that the auditor will ask you to make a few tweaks here and there to ensure you’re completely up to spec. We say “ask”, but it’s more of a “do it or else” kinda thing in reality. Expect a fine to come heading your way if you don’t make the changes within the agreed timescale.
Concluding thoughts
I hope we’ve been able to shed some light on how internal and external audits work!
If you have any further queries or would like to hear about the internal auditing services we offer, please book a FREE call with one of our ‘au-migos’ using the link below 😊
