Steps to Establish an Internal Audit Department

It is encouraging to witness the increasing attention towards internal audit activities within governmental bodies, coupled with efforts to align with the latest international standards for internal auditing. This reflects a commitment to enhancing governance and the efficiency of procedures within governmental entities.

This trend holds promise for advancing internal audit functions across various organizations. However, there’s a disparity in the maturity of internal audit practices, particularly considering that the concept of internal audit in Saudi Arabia is relatively new. The establishment of the Saudi chapter of Institute of Internal Auditors by a decision of the Council of Ministers in 2011 marked the initial steps in this direction, with internal audit activities initially limited to a few multinational companies or local firms exhibiting strong governance frameworks.

Presently, organizations can be categorized into three groups based on their internal audit initiatives:

1. Group One: No internal audit department or any internal audit activities.
2. Group Two: Entities with ineffective internal audit functions, potentially comprising only one staff member within the finance department holding the title of internal auditor, or, in some instances, repurposing the monitoring department and its personnel as the internal audit function without adhering to internal audit standards.
3. Group Three: Organizations boasting a fully established internal audit department and activities conforming to international standards (IPPF), either due to the presence of an active board of directors and audit committee or to meet the requirements of the Capital Market Authority.

The establishment of an internal audit function within an organization entail integrating a comprehensive management system, including its procedures and personnel, into the organizational structure and daily operations. It involves assimilating its procedures with the organizational framework, transforming it into an integral component of the organizational culture. This process typically takes a minimum of two to three years to fully assimilate, and any errors in the establishment process can be costly to rectify.

Outlined below are fundamental steps that Groups One and Two may need to undertake to establish internal audit activities effectively:

1. Establish an audit committee at the board level or its equivalent.
2. Appoint a Head/Internal Audit Manager.
3. Develop the following documents in accordance with IPPF standards and obtain approval before commencing any activities: Audit Committee Charter Internal Audit Charter Internal Audit Policies and Procedures
4. Develop a risk-based internal audit plan (typically spanning 3-5 years) based on existing risk analyses and the organization's operational nature.
5. Determine the human and financial resources required for internal audit activities.
6. Enhance existing competencies and recruit additional talent as required.
7. Implement an ERP system or software solution tailored for internal audit operations to enhance departmental performance.

Challenges faced by senior management during the establishment phase include:

• The scarcity of national expertise with on-hand experience in the internal audit, resulting in higher costs as proficient internal auditors command higher salaries compared to finance staff others.
• Internal audit serves as a consultant service within the organizational framework, encompassing all operations and requiring a comprehensive understanding of numerous procedures beyond financial auditing.
• The audit scope, which may extend to technical departments such as IT and cybersecurity, often necessitates external resources from specialized consulting firms at a relatively high cost.
• The extent to which organizational decision-makers grasp the necessity and proper integration of internal audit activities, moving away from stereotypical perceptions of internal auditing.

As an internal auditor in your organization, based on your experience, what advice or challenges would you direct to the mentioned Groups One and Two?

Internal Audit Platform ???? ???????? ????????

Internal Audit Platform

??????? ?????? ??????? ????????? ????????? Arab Confederation for Institute of Internal Auditors