Internal audit is about efficiency and effectiveness of the audit entity, whereas statutory audit is about truth and fairness of accounts.
It is not uncommon for a teacher himself to make a grave mistake on the subject he teaches day in and day out. It is not uncommon either for a skilled sportsman to goof-up on something fundamental. The ICAI too has now forgotten its own lessons — internal audit is about efficiency and effectiveness of the audit entity, whereas statutory audit is about truth and fairness of accounts.
The line of demarcation is clear, though admittedly there can be overlapping areas given the focus of both on accounting information in the main. An internal auditor is not a conscious keeper nor entrusted with the role of blowing the whistle so much so that all these years no eyebrows went up when he was found to be one of the employees as was the case with Satyam whose promoters defrauded the company and its shareholders on a gargantuan scale pulling wool over everybody's eyes for several years.
The ICAI seems to have come to the conclusion that the internal auditor ought to be an outsider lest his independence and objectivity are compromised and the reason for this dawning realisation and change of heart is that Raju and others forged documents and committed other frauds using the internal auditor as the handmaiden.
It has not occurred to it that the chief accounts officer or for that matter anyone at all in the company well-versed with accounts, finance and banking could have come equally handy. Implicit in the ICAI's stance is the view that the internal auditor far from blowing the whistle was in fact complicit in the fraud and that an outsider, on the other hand, would have blown the whistle besides refusing to play ball with the management.
There is a school of thought which believes that external internal auditors are better than the internal-internal auditors because they are more hands-on and less hand-washing in their approach to the work. May be, but the key question is the role of the internal auditor vis-à-vis that of the statutory auditor.
Role of internal auditor
The internal auditor's remit is to ensure that the system and internal controls are not only in place but foolproof as well. And in addition he has to ensure that resources are used efficiently and effectively.
To wit, a statutory auditor does not lose sleep over under-utilisation of capacity whereas this would figure prominently in the internal auditor's report to the management.
Missing cash of course should exercise the minds of both. But if the internal auditor is drafted by the management for the dubious role of forging of documents and accounts in a manner of fence eating the crop and the statutory auditor says he has had no clue all these years as to the goings on, well it is more a reflection on the quality of the statutory auditor than on having an internal-internal auditor.
The buck stops with the statutory auditor. For, the law places on him the onerous responsibility of pronouncing on the truth and fairness of accounts. Accounts obviously cannot be true and fair when either the sales are inflated or huge cash is missing or both. The point is internal auditor's remit is limited and different.
On paper, an outsider internal auditor can be counted upon to be more objective and independent but a moment's reflection would show that he is as much beholden to the management for his office as the internal-internal auditor so much so that he too can be pusillanimous enough in looking the other way if not involve himself directly in the fraud.
The ICAI's change of heart seems to suggest that Satyam happened because of the failure of internal audit. The truth is it was a management fraud and would have happened with the connivance of anyone with a supple conscience and, therefore, it would be idle to wish that an outsider internal auditor is going to emerge as the knight in a shining armour to refurbish the image of the auditing profession and prevent frauds from happening.
(The author is a Delhi-based chartered accountant.)