International IIA joins outsourcing debate During the past few years, there has been an increase in the prac- tice of organizations outsourcing internal audit activities to exter- nal providers, princi- pally major accounting firms. In some cases, specific activities, in- cluding information systems auditing, have been outsourced to cover gaps in internal audit expertise.

The practice of out- sourcing internal audit- ing to the same firm that provides external auditing services was questioned in Novem- ber 1994 in the United States by Walter D. Scheutze, Chief Ac- countant of the Securi- ties and Exchange Commission. Speaking at an American Institute of Certified Public Accountants (AICPA) conference, he referred to AICPA’s Ethics Rul- ing 97. This ruling, issued in 1993, high- lighted that external auditors: cannot per- form management functions or make man- agement decisions; can- not be part of the client’s approval pro- cess; and cannot be part of the internal control system, without impair- ing their independence.

Scheutze argued that the Ethics Ruling, read carefully, is restric- tive as the external auditor could not

therefore make man- agement decisions on the projects to be per- formed under the scope of the ‘internal audit’ work.

Recently, William G. Bishop III, President of the Institute of Internal Auditors at their inter- national headquarters in Florida, supported this view and ques- tioned how a firm of accountants could pro- vide an independent opinion of an organiza- tion’s financial statement if it also per- forms an internal audit- ing engagement upon which management bases its opinion.

He explained that “the internal auditing function provides the major supporting assur- ance that allows man- agement to make a public assertion as to the adequacy and effec- tiveness of its organiza- tion’s internal control structure. If a public accounting firm per- forms all the internal auditing activities on an outsourced basis, it becomes at the very least, an indirect advo- cate of management’s assertion”. He warned that this may result in public confidence in the integrity of the pro- cesses that provide vital information to the in- ternal control reporting process.

Bishop noted.

Historically, he pointed out, the busi- ness community has been well served by internal auditing. As outsourcing represents a significant departure from this tradition, its practice should be of deep concern to the outsourcing company, its shareholders, and the public interest.

“The control envir- onment of the organiza- tion is adversely impacted by the disrup- tion of the roles of internal and external auditors. Boards of di- rectors, management, regulators, and the gen- eral public have come to rely on the checks and balances inherent in the relationship be- tween these auditors,”

“Internal auditors routinely comment to audit committees on the sufficiency of the external auditor. Simi- larly, external auditors respond to audit com- mittee enquiries about internal auditor perfor- mance. When internal and external auditors are one, this check and balance is eliminated and the control envir- onment is weakened.”

He suggested that companies which use external auditors to perform their internal audits should be re- quired to disclose the practice in their annual reports.

IIA Inc.

David Bentley, Regional Director,

‘Faulty’ mouse disrupts computer system A department of a UK District Council experi- enced some ‘technical’ problems with one of its PCs recently reports Computer Weekly. After having spent a considerable amount of time and in depth technical know-how trying to solve the computer glitch, the department involved finally identified the cause of the problems - a small brown field mouse had gnawed through some of the cables. The depart- ment caught the mouse alive, nicknamed it Byter and then let it go.

The amazing fact missing from this tale is that the department involved was the Pest Control Department, of course!

Computer Audit Update l March 1996 0 1996, Elsevier Science Ltd.