What internal audit means to Singapore businesses

Cash in hand that does not agree with cash balances in books of accounts, bogus bank accounts, ghost workers – these are just a few of the things that have been identified and rectified by internal auditors in the past.

No doubt internal audit or any audit for that matter causes a degree of “irritation” for company employees as it needs a high level of engagement from them.

Since “external audit” is mandatory and cannot be escaped, many people take it in their stride and co-operate to successfully complete this. Unfortunately this is not the case with internal audits. More often than not, internal auditors are considered as nit pickers.

In Singapore, it's not always compulsory

As we are aware, Singapore businesses that do not meet the requirements for mandatory audit need not get their year-end accounts audited. Given this state of affairs, it becomes necessary that the books of accounts are checked by an external party at some point of time for such companies.

A small example would drive this point home faster than anything else. Singapore registered Company A is a 100% subsidiary of Company B incorporated in Australia. Year after year, the “investment in subsidiary” figure represented on the parent company’s books was misrepresented.

This was discovered after three years of the company’s operations when the parent company wanted to complete a valuation on the subsidiary company. Yes, the subsidiary company was subject to statutory audit in Singapore – sadly the error in figure was not noticed by the company officials or the statutory auditors.

Needless to say, such discoveries at crucial points in a company lifecycle can cause major disruptions in their operational plans. Internal audits, limited reviews, soft audits are all effective tools to combat this kind of issues.

The entities that are not subject to statutory audit either because they do not meet the revenue threshold or the shareholding pattern rule should think about getting their books checked on periodic basis to avoid such unpleasant findings. Unfortunately many Singapore small and medium sized businesses ignore this factor.

What is internal audit?

As per the CIIA (Chartered Institute of Internal Auditors), the role of internal audit is to provide independent assurance that an organisation’s risk management, governance, and internal control processes are operating effectively. All internal audits should cover two areas on a periodic basis – checking to see whether:

1. the right processes are in place for adequate internal control and
2. the internal controls that are in place are operating effectively.

Internal audit and the Singapore story

In 2011, the Securities Investors Association of Singapore (SIAS) made it mandatory for all listed companies of the SGX to have an internal auditor. This followed when a host of S-chip companies requested for trading suspensions to investigate their accounts.

A recent study was conducted by KPMG which conducted a survey of the internal audit scenario in Singapore for 2013. The survey revealed some facts about the way internal audit is conducted and perceived.

It shows that other than the traditional areas of operational accounts (review of balance sheet, profit and loss accounts, etc.), today internal audit aims to focus on areas like enterprise risk, fraud, and IT-related risk mitigation, etc., also.

Does a small business need it?

While we know that for listed companies in Singapore, having and reporting on the effectiveness of internal controls are mandatory, for most of the small and medium sized businesses this is optional. Often, the finance and accounting function does not have a divide in such companies. It is performed by one and the same person.

Imagine a scenario where the person who raises an invoice also approves it and reconciles receipt for the same in the company bank account. Since the business runs on limited funds, it is impractical to hire a second employee to run a minimalistic finance function. This is where conducting internal audits can prove invaluable. Let us explore how.

A soft audit function is essentially a limited internal audit. The main area of attention would be whether the internal control processes that are established are working well – the entire focus is on operating effectiveness rather than process building. Since most small business have limited processes, they need to work well to mitigate the risks likely to arise.

A quarterly or half yearly review of accounts can identify issues in those areas of operations that are very crucial to the survival of many such firms. Some areas of interest are: cash flows, debtors, creditors, and capital budgeting which can use the insight of independent audit professionals.

Owners of small and medium sized businesses can rely on these professionals to investigate specific areas of operations as well. Imagine a scenario where the director of a company suspects weaknesses in the system but cannot pinpoint what is going wrong – he can very well highlight this to the internal auditor. A thorough examination undertaken by the internal audit team can identify the cause of worry or can put his mind at ease.

Another point of interest is internal control effectiveness, a major listing compliance step in Singapore. Hence the companies which are going the listing way should be prepared with appropriate internal control measures to ensure the post IPO transition is not too harsh. If these companies have never conducted a soft audit during the years of being a private company, it can only be imagined that the set-up of this function pre-IPO would be a major hurdle.

Go for it

Internal audit can fulfil the role of “trusted counsel” for many small businesses if they understand the true meaning and scope of this activity. But it is equally important for the business to have a meaningful and open relationship with the audit team to ensure that they are not simply performing audits but have a participative role in the company’s growth.