建立一個有效的內部審計部門-ESTABLISHING-AN-EFFECTIVE-Internal-Audit-Department

建立一個有效的內部審計部門ESTABLISHINGANEFFECTIVEInternalAuditDepartment

Abstract

Ifyouarewonderinghowtoestablishaneffectiveinternalauditdepartment(IAD),TheSchwanFoodCodidjustthatwiththehelpofRandyJustwhenhewasthechiefauditexecutive(CAE)atthecompany.FindingaqualifieddepartmentheadisacrucialfirsttaskinestablishinganeffectiveIAD.OncetheCAEishired,he/sheshouldleadthedevelopmentofthewrittenauditcharter,whichsetsforththepurpose,authority,andresponsibilitiesoftheIAD.Oncethestaffingwascompleted,Justworkedwithtwoofhismanagerstodeveloparisk-basedassessmentmethodologytiedtotheCommitteeofSponsoringOrganizationsoftheTreadwayCommissioninternalcontrolframeworkandaconsumerproductsbusinessprocessmodel.Theriskassessmentframeworkcloselyincorporatedtheconceptsofriskandcontrol.Initsfirstyear,thedepartmentreceivedalargenumberofrequestsforotherprojects,andthatwasclearlyviewedasasubstantialmeasureofsuccess.

Fulltest

Thedemandforinternalauditingserviceshasskyrocketedwithtworecentevents.

First,Section404oftheSarbanes-OxleyAct(SOX)mandatedpubliccompaniestoincludewiththeirannualreportaninternalcontrolreportthatcontainsanassessmentbymanagementoftheeffectivenessofthecompany‘sfinancialreportinginternalcontrolsystem.Internalauditorshavethetechnicalexpertiseandprofessionalobjectivitytoassistinthisassessmentprocess.

Second,theNewYorkStockExchangerequiredalllistedcompaniesto"maintainaninternalauditfunctiontoprovidemanagementandtheauditcommitteewithongoingassessmentsofthecompany‘sriskmanagementprocessesandsystemofinternalcontrol"byOctober31,2004.Butthebenefitsofaninternalauditdepartmentaren‘tuniquetopubliccompanies.Theyarealsoapplicabletoprivatecompanies.

Ifyouarewonderinghowtoestablishaneffectiveinternalauditdepartment,TheSchwanFoodCompanydidjustthatwiththehelpofRandyJust,oneofthecoauthorsofthisarticle,whenhewasthechiefauditexecutive(CAE)atthecompany.Sadly,RandydiedunexpectedlyinJanuary.Headdedatremendousamounttothebodyofknowledgeonestablishinganeffectiveinternalauditdepartment,andhiscontributionswillbesorelymissed.Hisco-authorsdedicatethisarticletohismemory.

WHYESTABLISHANINTERNALAUDITDEPARTMENT?

Themottooftheinternalauditdepartment(IAD)atSchwanis"advancingthebusiness."Thereareamultitudeofwaysinwhichinternalauditorscanhelpaccomplishthatobjective.First,aneffectiveIADcanhelpacompanyreachitsgoalsbyhelpingmanagementimprovecontrols,businessprocesses,andbusinessriskmanagement.second,internalauditorsserveacriticalroleaspartofthecorporategovernancestructurebyensuringthatthecompanyachievesitsobjectivesinanethical,legal,andwell-governedmanner.

Third,internalauditorshelpfightthebattleagainstfraud.In2004,theAssociationofCertifiedFraudExaminers(ACFE)obtaineddataon508fraudcasestotalingmorethan$761millioninlosses.Intheresulting2004ReporttotheNation,theACFEstatedthatapproximately57%ofthevictimorganizationsinitsstudyhadaninternalauditfunctionandthatthoseorganizationssufferedamedianfraudlossof$80,000comparedtomedianlossesof$130,000forcompanieswithoutinternalauditdepartments.ThisresultissimilartotheACFE‘s2002studywherethemedianfraudlosseswere$87,500forentitieswithinternalauditorsvs.$153,000forthosewithout.

TheIADisacriticalpartofcorporategovernancealongwithseniormanagement,theauditcommittee,andtheexternalauditors.Internalauditorscanbeconsideredtheeyesandearsofmanagementaswellasthecorporateconscience.Givenitsimportance,howshouldacompanybegintoestablishaneffectiveIAD?

STARTWITHTHELEADER

Findingaqualifieddepartmentheadisacrucialfirsttask.Notonlyshouldthechiefauditexecutivepossessthenecessaryinternalaudittechnicalskills,butheorsheshouldalsobeabletogainrespectfrombothmanagementandtheauditcommittee.Goodcommunicationskills,objectivity,andstrongmoralcharacterarealsodesirablecharacteristics.

ThecreationofSchwan‘sIADwasdrivenbypersonnelchangesintopmanagement.Thefirstnonfamily-memberCEO,whohadalonganddistinguishedcareerinthefoodbusiness,cameonboardin1999.Ataboutthesametime,anewauditcommitteechairbeganhisservice.In2002,anewCFOwashiredwhohadextensivepublicaccountingexperience.

Thisnewleadershiphelpedthecompanyslowlymakechanges.Itimprovedthegovernancestructurebyestablishinganinternalauditdepartmentwhileretainingthepositiveaspectsofthecompany‘scorporateculture,includingitshighstandardsofethics,values,andhardwork.Thus,thecreationoftheIADwaspartofacompany-wideefforttoimprovecontrolandgovernancestructuresforaprivatelyheldbutglobalcompanythathadthegoalofdoublinginsizefrom2002to2007.

Afterconductingaregionalandnationalsearchthrougharecruitingfirm,themanagementteamchoseRandyJusttobetheirCAE.Hebroughtwithhimextensivepublicaccountingandinternalauditingexperience.

THECHARTERANDMISSION

OncetheCAEishired,he/sheshouldleadthedevelopmentofthewrittenauditcharter,whichsetsforththepurpose,authority,andresponsibilitiesoftheIAD.Suchacharter,whichshouldbeapprovedbytheauditcommitteeonbehalfoftheboardofdirectors,iscrucialforsendingthemessagethroughouttheorganizationthatinternalauditingisviewedasapriorityandhastheendorsementofbothexecutivemanagementandtheauditcommittee.

ThechartershouldalsoclearlyestablishtheindependenceoftheIADbecauseit‘scriticalthatinternalauditorsbeorganizationallyindependentofmanagementinordertoenhancetheireffectiveness.Thisindependenceallowstheauditorstoperformtheirworkobjectivelyandwithoutbiasorconcernthattheywouldbeundulyinfluencedbymanagement.

SchwandecideditsIADshouldreportdirectlytotheCFOforadministrativepurposes.Forpurposesofgovernance,itestablishedanadvisoryrelationshipbetweentheIADandtheboard‘sauditcommittee.Buttheserelationships,whetherdirectreportingoradvisory,wereflexible,dependingonthestylesofindividualmanagers.Schwan‘sauditcommitteechairwasvery"handson"andviewedhisrelationshipwiththeIADtobeasdirectastheCFO/IADrelationship.

TheauditcharterprotectedtheIAD‘sindependencebyensuringfullaccessbytheCAEtotheauditcommitteeandprotectingtheCAEfromremovalwithouttheapprovaloftheauditcommittee.Inaddition,Schwan‘sauditcommitteecharterestablishedthattheIADwasaccountabletotheboardofdirectorsthroughtheauditc

ommittee.

TheIADmissionstatementshouldbespecifiedinthecharter.ThemissionofSchwan‘sIADwas:

"Toprovideindependent,objectiveassuranceservicesdesignedtoaddvalueandimprovetheSchwanCompany‘soperations.TheIADhelpstheorganizationaccomplishitsobjectivesbybringingasystematic,disciplinedapproachtoevaluateandimprovetheeffectivenessoftheoverallcontrolenvironmentandthenetworkofenterprisebusinessriskmanagementcontrolandgovernanceprocesses."

ThismissionstatementisalmostverbatimwiththeInstituteofInternalAuditors‘a(chǎn)pproveddefinitionofthepurposeofinternalauditing.Inotherwords,thedepartment‘smissioncorrespondswithSchwan‘soverallmissioninthattheIADexiststohelpthecompanyreachitsgoalsandachieveitsbusinessobjectivesinanethical,legal,well-governedmanner.Thismissionisaccomplishedbyhelpingimprovecontrols,businessprocesses,andbusinessriskmanagement.

TopromotegoodrelationsandintroducethelAD‘smissionatSchwan,RandyJustinitiallymetwithallthemembersofexecutivemanagementandthentheseniormanagementtogainanunderstandingoftheirexpectations.Throughthesemeetingshewasabletointroduceinternalauditingasaservicefunctionchargedwithhelpingmanagementtoachievecompanyobjectivesratherthanassomethingtofearorviewasathreat.

STAFFINGTHEDEPARTMENT

BasedontheanalysisofSchwan‘sexternalauditor,theauditcommitteeandseniormanagementdecidedtostafftheIADwith10internalauditorssupportedbyanannualbudgetofapproximately$million.Thesizeofthefunctionwasexpectedtoincreaseasthecompanygrew.Ideally,Justwantedpeopleattheseniorandmanagerleveltohavepublicaccountingexperienceaswellasinternalauditingworkinindustry.Herecognizedthatitwasn‘tpossibletofindpeopleatthestafflevelwiththatcombinationofexperience.HestaffedtheIADsoitpossessedafairlybroad-basedassortmentofexpertiseinfinancial,operational,compliance,andinformationsystemsauditing.

Initially,thegreatestchallengewasconvincingqualifiedpeopletorelocatetoSchwan‘scorporateheadquartersinMarshall,Minn.,acommunitythreehoursfromMinneapoliswithapopulationof12,000.Whilethisisanattractivecommunityforindividualswithafamily-basedlifestyle,itwasahurdletoovercomeinseekingtocompletelystaffanewIAD.Thecompanyusedindustrycontactstorecruitstaffinadditiontoreceivingassistancefromoutsiderecruitingorganizations.Afterafewmonths,Schwanwasabletofillallthepositions.

OVERALLSTRATEGY

Oncethestaffingwascompleted,Justworkedwithtwoofhismanagerstodeveloparisk-basedassessmentmethodologytiedtotheCOSO(CommitteeofSponsoringOrganizationsoftheTreadwayCommission)internalcontrolframeworkandaconsumerproductsbusinessprocessmodel.TheIADusedthisrisk-basedapproachtodeterminethescopeofitsservices.

Aspartofthisriskassessmentprocess,Justreviewedthestrategicplansofthecompanyanditsbusinessunits.ThelAD‘seffortsfocusedonthekeyareasandobjectivesonwhichthecompanyandthebusinessunitsfocused.Thiswasaccomplishedbyhavingauditorsmeetwithexecutivesatthevariousbusinessunitsandwalkthroughaquestionnairetheydevelopedaspartoftherisk-basedassessmentapproach

TheIADthenweightedandprioritizedpotentialprojectsacrossallthebusinessunits,givingconsiderationtothevolumeoftheiractivitiesandtheirimportancetothecompany‘soverallstrategicplan.

RISK-BASEDASSESSMENT

Theriskassessmentframeworkcloselyincorporatedtheconceptsofriskandcontrol.Schwanestablishedbusinessobjectivesatalllevelsofthecompanyfromcorporatedownthrougheachbusinessunit.Toachievetheseobjectives,itputinplacecorebusinessprocessesthatweregroupingsofrelatedbusinessactivities(,procurematerials,manufactureproducts,distributeproducts,sellproducts,servecustomers).Thecorebusinesspracticesweresupportedbyprocessesthatprovidedresourcesandservicestothem.

Risksthreatentheachievementofbusinessobjectivesatalllevels,whilecontrolsaretheactivitiesputintoplacetomanageormitigatetherisks.Controlsareoftenbuiltintothecorebusinessprocessesandsupportprocesses.

Withineachprocess,theIADassessed:

*Grossrisk(threatsorimpedimentstotheaccomplishmentofcorporateorprocessobjectives),

*Strengthofrelevantcontrolsandmanagement‘sresponsetotheidentifiedrisks,and

*Residualrisk(areevaluationofriskinlightofcontrolsandmanagement‘sresponse).

TheIADratedtherisksbasedonthemagnitudeoftheimpactoftheriskaswellasitsprobability.Theyconductedresidualriskassessmentsthroughfocusedinterviewswithmultiplelevelsofmanagement,areviewofbusinessplans,analysisoffinancialandoperationalreports,andareviewofmiscellaneousinformation(,industryinformation,processdocumentation).Forvalidation,theydiscussedtheassessmentresultswiththeappropriatelevelsofmanagement.

AtSchwan,foodqualityandsafetyisoneareaofcontinualvigilance.EverysinglebatchofrawmaterialsorproductthatcomesintoSchwan‘sfactoriesistestedforcontamination,andtheIADassessesagrossriskofcontaminationofrawmaterialsatacertainlevel.AsaresultofSchwan‘sverystringentcontrols,residualriskhasbeenassessedasextremelylow.

ASSESSINGEFFECTIVENESS

Onaverage,Justreviewedthestatusoftheinternalauditingplanwiththeauditingcommitteefivetimesayear.ThemaincriterionagainstwhichthesuccessoftheIADwasmeasuredwaswhethertheinternalauditorswereaddingvalue.Forexample,werethemajorprojectsbeingperformed?WastheIADreceivingrequestsfromthebusinessunitsforotherprojects?

Justbudgetedapproximately80%oftheinternalauditstafftimeforprojectsidentifiedthroughtheriskassessmentprocess,leaving20%oftheirtimeopenforemergingpriorities.Initsfirstyear,thedepartmentreceivedalargenumberofrequestsforotherprojects,andthatwasclearlyviewedasasubstantialmeasureofsuccess.

Duringthemeetingswiththeauditcommittee,Justalsoreportedwhatpercentageoftheauditplanwascomplete,althoughthatwasn‘ttheprimarymeasureofsuccesssincetheIADwascreatedtoaddressriskasitarises.Consequently,theannualinternalauditplancouldberevisitedthroughouttheyearandchangedasneeddictated.

Anothermajormeasureofsuccesswastheopenacceptancebythebusinessunitsandtheirwillingnesstoworkwiththeinternalauditors.Ontheauditsthatcameupintheriskassessmentprocess,companypersonnelwerewillingtoofferideasonareaswheretheyfelttheycoulduseaudits,andtheycalledtheinternalauditorsforprojects.

[Sidebar]

HistoryofTheSchwanFoodCompany

TheSchwanFoodCompanybeganin1952withonemanandonetruck.MarvinSchwan,thefounder,wasthesonofGermanimmigrantswhocametothein1920.HeandhisparentsranacreameryinMarshall,Minn.,butwerehavingtroublemakingendsmeet.Marvindiscoveredthat,becauseofgovernmentpricingstructures,hecouldsellicecreamforafewcentsmoreinYellowMedicineCounty,immediatelynorthofMarshall.OnMarch18,1952,heborrowedsomedryicebags,and,withaused1946Dodgepanelvan,heheadednorthwith14gallonsoficecream.Heknockedonfarmhousedoorsandsoldalltheicecream.Thenextdayhedidthesamethingagain.Now,54yearslater,Schwanhasgonefromonemanandonetruckto6,500driversinthehomedeliverypartofthebusiness,whichconstitutesapproximately40%ofthecompany‘stotalrevenues.Inadditiontohomedelivery,Schwan‘sprimarybusinessunitshavegrowntoincludeitsglobalconsumerbrandsanditsfoodservicesgroup.Theglobalconsumerbrandsmanufactures,markets,anddeliversfrozenfoodstogrocery,warehouse,club,andconveniencestoresacrossthecountry.Thefoodservicesgroupmanufactures,markets,anddistributesvalue-addedfrozenfoodproductstopublicandprivateschools,universities,healthcarefacilities,conveniencestores,andchainrestaurants.Todaythecompany‘sworkforceconsistsofapproximately24,000people.

建立一個有效的內部審計部門

HughDPforsich，BonitaKPetersonKramer

摘要

你是否想知道怎么建立一個有效的內部審計部門，當蘭迪還是Schwan食物公司的首席審計執(zhí)行委員的時候，他幫公司做到了。他們發(fā)現(xiàn)建立一個有效的內部審計部門的首要任務是要有一位稱職的部門主管。一旦公司的首席審計執(zhí)行委員被聘用,他應該帶動審計條例的建全,在其中提出內部審計部門的目的、權威和責任。一旦職員的設置完成后，就要和他的兩個經(jīng)理建立發(fā)展COSO委員會的方法，就是以風險為基礎的內部控制結構和一個消費者產(chǎn)品程序模型。風險評估結構最大限度地吸收了風險和控制的概念。在第一年里，部門收到了對其它計劃很多的請求，而且很清楚地被看作是對成功明確的測量。

全文

最近發(fā)生的兩件事使得對內部審計服務的需求猛增。

第一，薩班斯法案的第404條要求上市公司在每年的年報里面要有一份包含對公司業(yè)績的評估以及財務控制制度在內的內控制度報告。內部審計擁有技術上的優(yōu)勢和專業(yè)的客觀性協(xié)助這個評估程序。

第二，紐約股票市場要求的所有上市公司在2004年10月31日之前，要維護內部審計的作用，這將給管理層和審計委員會提供公司風險管理程序和內部控制系統(tǒng)的評估。但是內部審計部門的這種好處并不是上市公司所專有的。他們也一樣適用于非上市公司。

你是否想知道如何建立一個有效的內部審計部門,Schwan食品公司蘭迪的努力下做到了。而且他也這篇文章的執(zhí)筆者之一。當他還是公司的首席審計執(zhí)行委員的時候，但是非常地可惜，蘭迪突然在1月份去世。他將他的很大一部分精力投入在建立一個有效的內部審計部門，而他的貢獻也隨之消失。他的共同執(zhí)筆者用這篇文章還表達對他的思念。

為什么要建立一個有效的內部審計部門呢？

在Schwan的內審部門中有這么一句箴言"advancingthebusiness."內部審計的幫助下很多方法都可以達到這個目標。

首生，一個有效的內部審計部門可以幫助公司實現(xiàn)改善控制、業(yè)務流程和經(jīng)營風險管理的目標。

其次，內部審計服務作為公司管理結構的一個重要的角色，確保了公司以道德、法律和較好的管理方法達到目的。

第三，內部審計還可以幫助進行反對欺詐的斗爭。2004年，被ACFE查處的508件欺詐案件共造成了$761萬的損失。2004年關于的國家報告中,ACFE陳述了它的研究，大約57%的受害人組織有了一個內部審計的功能而且那些組織遭受的損失相對于沒有內部審計部門的公司造成的$130,000的損失而言是$80,000的欺詐損失。$87,500的欺詐損失相比于沒有內審部門的$153,000的欺詐損失，這個結果和ACFE在2002年的欺詐損失很相近。

內部審計部門是公司管理方法的一個重要組成部份。它與高級管理、審計委員會和外部審計組成了公司的管理方法。內審人員被認為是公司的管理的眼睛和耳朵甚至是公司的良心?；谒闹匾?，公司應該怎樣開始建立有效的內部審計部門呢？

從領導開始

找到一個合格的部門主管是首要也是關鍵的任務。主要的審計主管不僅要有一定的內部審計技術，而且他要能夠贏得管理層和審計委員會的尊敬。同時他還要有很好的溝通能力、客觀性和強烈的道德個性的特征。

Schwan的內部審計部門的構成受到公司高層人員變化的影響。第一任的CEO有著很長且卓越的食品事務經(jīng)歷。1999年，董事會成立。大約在同一時間，新的一任審計委員會主席開始了他的任期。在2002年，被聘用的是一位新的CFO，他有著豐富的會計經(jīng)驗。

這位新的領導慢慢地幫助公司做變動。他保留公司了企業(yè)文化積極的方面，包括它的道德規(guī)范的高標準,價值和堅苦工作方面。建立起一個內部審計部門來改良公司的管理結構。因此，內部審計部門的創(chuàng)立是公司改善控制和公司管理結構的一部分，幫助公司從2002年到2007年加快完成全球化的公司的目標。

通過企業(yè)對地方和全國的一次調查后，管理層最終選擇蘭迪作為他們公司的首席審計執(zhí)行委員。這是因為他有著廣泛的公共會計和內部審計經(jīng)驗。

章程和使命

一旦首席審計執(zhí)行委員被聘用，他就應該著手編寫審計章程，在章程要指出內部審計部門的目的、權威和責任。這種章程應該要由代表公司董事會利益的審計委員的會的批準。這對內部審計在傳達信息過程中得到一種優(yōu)先權和有行政管理層和審計委員會的支持是決定性的。

章程應該要清楚地指出內部審計部門的獨立性。這是因為內審人員的獨立管理對于提高他們的效率有著重要的作用。這種獨立性也允許審計人員客觀地進行工作并且沒有成見或是不用擔心受到管理層的影響。

章程要求公司的內部審計部門要直接地向CFO報告。為了實現(xiàn)管理層的目的，它在董事會和內部審計部門之間建立起一個情況報告的關系。但是這個關系是否直接報告還是通知都是靈活的。這是取決定于各自的經(jīng)理的樣式。Schwan的審計委員會主席與內部審計部門的關系被看作CFO與內部審計部門的關系。

通過確保首席審計執(zhí)行委員對審計委員會的完全控制和沒有審計委員會的認同下保護首席審計執(zhí)行委員免受撤除來實現(xiàn)審計章程對內部審計部門獨立性的保護。另外，Schwan的審計委員會章程規(guī)定了內部審計部門通過審計委員會向董事會匯報情況。

內部審計部門的任務應該在章程中指出。Schwan內部審計部門的任務是：

為了要提供獨立，客觀的服務確保能夠增加價值并且改善公司的經(jīng)營，內部審計部門要通過系統(tǒng)方法來評估和改進整體控制環(huán)境，企業(yè)的經(jīng)營風險管理控制和網(wǎng)絡管理程序，從而幫助公司實現(xiàn)它的目的。

這個任務幾乎一字不差地闡述了內審人員內部審計地定義。換句話說就是部門的任務和公司的整體任務是一致的。這是因為內部審計部門幫助公司以合理的道德,法律和很好被治理的方式來達到公司的目標和商業(yè)目的。這個任務會幫助公司實現(xiàn)改進控制、業(yè)務流程和經(jīng)營風險管理的目的。

為了在Schwan發(fā)展好這種關系和介紹內部審計部門的任務，蘭迪