1 Too narrow concept of internal audit
Risk managment and governance not evaluated
Sixteen of the respondents answered that their structure comprised an Internal Audit (IA) organic unity, while others expressed their intention to create one. However, only five companies knew about the full breadth of the Internal Audit concept and applied it, since the remaining limited their activity to simple monitoring internal control, neglecting aspects such as evaluation of the processes of risk management and governance.
2 Former managers as auditors
Risk: insufficient independence of internal audits
These internal auditors were, in general (87%), hired internally. It turns out that 29 (15%) of those internal auditors had previously worked in management positions, and this is a situation that enhances the risks to the independence of the operations of Internal Audit organic units.
3 Lack of performance indicators and external assessment
Uncertain quality level
Of the 16 companies that had Internal Audit activity, 5 did not define indicators for measuring the performance of the respective unit, which did not allow for its quantification and qualification. In addition, as a rule, its activity was not subject to an independent external evaluation.
Background
The cost of the Internal Audit function of the companies surveyed rose, in 2008, to 15.9 million euros. The average annual cost of each Internal Audit department was about 933.100 euros and an internal auditor 79.700 Euro / year, equivalent to 5.700 Euro / month.
Objectives
This report deals with the findings of a performance audit entitled "The internal audit function within the State Owned Enterprises" for the year 2008 and covering 20 of such entities.