FACTS: We reviewed an interview with Alchemy’s CAE and the external auditing team to identify areas of improvements and noncompliance with The Institute of Internal Auditors’ standards.
ISSUES: The following issues were identified while watching the footage.
• Authorization o No Charter for the internal audit team to follow.
• Reporting o Report is edited by the CEO. o Limited Scope with no audits by parent company. o No interactions with external audit teams. o CAE must report periodically to senior management and the board and share information with external providers. **
• Competence and Experience o Young staff with no prior experience or CPA licenses. o CAE relatively young and inexperienced for position. CAE has financial audit background only. o Proficiency and Due Professional Care require internal auditors to possess the knowledge, skills, and other competencies. ***
• Risk Assessment and Audit Planning (Sampling and Follow up) o No audit schedule designed and approved by the board. o No risk assessment done. o CAE must establish a risk-based plan to determine the priorities of the internal audit activity. Internal auditors must develop and document a plan. *
• Corporate Governance o Ineffective whistle blow hotlines o CAE reports directly to CEO. CEO knows content of audit and modifies audit reports before presenting it to the board. o Disclosures of Nonconformance must be reported to the Board. ****
• Professional Skepticism o No follow up with OSHA on eye exam requirements. o No audit of manufacturing per CEO request even though the CAE recommended.
RECOMMENDATION: I recommend that the audit committee and upper management address all of the issues identified