Internal Audit Services

Internal Audit Services

An internal audit service is a crucial tool for evaluating and improving the effectiveness of risk management, control, and governance processes within business entities, ultimately contributing to success and sustainability in the market.

Why do business entities need internal audit services?

Many benefits business entities may gain from internal audit services, including:

  1. Effective Risk Management:

    Internal audit can identify and measure the risks faced by business entities and help businesses develop strategies to deal with them and mitigate their impact on the business.

  2. Strengthening internal control:

    Internal audit helps evaluate and improve the internal control activities within business entities by ensuring clear lines of accountability and responsibility, segregation of duties, and emphasizing the role of dual control.

  3. Enhancing governance:

    Internal audit helps enhance governance within business entities by adhering to the regulations and laws applicable in the industry through evaluating the efficiency and effectiveness of governance and identifies areas of improvement.

  4. Improving efficiency and effectiveness:

    Internal audit can analyze the operations of business entities and provide recommendations to improve efficiency and effectiveness, which helps leverage the efficiency of operational processes in business entities.

  5. Asset protection:

    Internal audit helps protect business entities’ assets, such as money, property, and sensitive information from theft, corruption, and manipulation.

  6. Enhancing transparency and integrity:

    Internal audit contributes to enhancing levels of transparency and integrity within business entities. Additionally, Internal audit reports help the Board of Directors and shareholders understand the performance of business entities and make strategic decisions.

  7. Achieving goals:

    Internal audit can help business entities achieve their objectives by providing reports and recommendations that help achieve development and growth.

What is the definition of internal audit?

Internal audit is defined as:

An independent and objective assurance and consulting activity designed to add value to and improve an organization’s operations and help it achieve its objectives by providing a structured and disciplined methodology to evaluate and improve the effectiveness of risk management, control and governance processes.

(Source: The Institute of Internal Auditors)

What are the international standards governing the internal audit?

The International Standards for the Professional Practice of Internal Auditing issued by the Institute of Internal Auditors in the USA govern internal audit activities and practices. Such Standards fall under two main categories, and each category comprises a set of standards as follows:

Attribute Standards: define the attributes of professional firms and individuals performing internal audit activity.

Performance Standards: set out the nature of internal audit and provide quality criteria employed to measure the performance of these services.

Are all business entities required to set up an Internal Audit Department/ Office/ Unit?

Not all business entities are required to set up an Internal Audit Department/ Office/ Unit. However, it is a mandatory requirement for business entities regulated by the Central Bank of Kuwait, such as banks, financing companies, and exchange companies.

It is also a mandatory requirement for business entities regulated by the Capital Markets Authority (CMA), such as Boursa-listed companies and CMA-licensed persons in accordance with the provisions of the Executive Bylaws, Module 15 “Corporate Governance”, Article 6-7:

Article 6-7

The Company shall establish an Internal Audit Department/Office/Unit that has full technical independence according to the following:

  • The Internal Audit Department/Office/Unit shall report to the Audit Committee and, accordingly, the Board of Directors.
  • A manager of the Internal Audit function shall be directly appointed by the board of directors based on the Audit Committee’s nomination; and
  • The Board of Directors shall determine the roles and responsibilities of the Internal Audit Department/Office/Unit.

Shall the Internal Audit Officer position be registered with the Capital Markets Authority?

Yes, the Internal Audit Officer at the listed companies and CMA-licensed persons shall be registered with the CMA. Module 5, “Securities Activities and Registered Persons” of the CMA Executive Bylaws, sets forth in Appendix (3) the academic and professional qualifications and experience to be met by the registered employment positions in accordance with the competence and integrity rules of Licensed Person.

What is the organizational unit charged with supervising the Internal Audit Department/ Office/ Unit, and what are its powers in accordance with the Capital Markets Authority’s Executive Bylaws?

The Board Audit Committee (BAC) is responsible for supervising the Internal Audit Department/ Office/ Unit. Furthermore, the authorities of the Audit Committee are determined in accordance with the Executive Bylaws, Module 15 “Corporate Governance”, Article 5-7:

Article 5-7

The authorities and responsibilities of the Audit Committee are as follows:

  1. Technically supervise the Internal Audit function of the company to verify its effectiveness in performing the activities and assignments as defined by the Board of Directors.
  2. Recommend the appointment, transfer, and termination of Internal Audit Managers, appraise their performance, and assess the Internal Audit function performance.
  3. Review, approve and provide feedback on the audit plan proposed by the internal auditor.
  4. Review the findings set out in the internal audit reports and ensure that the necessary corrective actions have been taken with respect to the findings stated in the reports.

What are the characteristics of the internal audit report as per the Capital Markets Authority’s instructions?

Module 15 “Corporate Governance” of Executive Bylaws, sets forth the following requirements regarding the internal audit report:

Article 6-8

The Internal Audit Department/ Office/ Unit shall prepare a report including a review and evaluation of the internal controls in place within the Company. Such report shall include the following:

  1. The procedures for control and supervision of the efficiency and effectiveness of internal controls required to safeguard the Company’s assets and ensure the authenticity of financial statements and efficiency of its management, financial, and accounting operations.
  2. Comparison of risk factors development within the Company and the internal controls implemented to assess the efficiency of the Company’s day-to-day activities and address unforeseen changes in the market.
  3. Assessment of the executive management’s performance in implementing the internal controls; and
  4. Causes of failure in implementing internal controls, implementation weaknesses or emergencies that affected or may affect the Company’s financial performance, and the action adopted by the Company to address the failure in implementing the internal control.

Does the Capital Markets Authority’s Executive Bylaws require regulated business entities to have the performance of the Internal Audit Department/ Office/ Unit periodically reviewed and assessed by an audit firm?

Yes, the CMA Executive Bylaws requires the listed companies and licensed persons to have the performance of the Internal Audit Department/ Office/ Unit periodically reviewed and assessed every three years by an audit firm other than the auditor engaged to audit the financial statements together with providing the Internal Audit Committee and the Board of Directors with a copy of the report.

This is set out in the following article of Module 15 “Corporate Governance”:

Article 6-9

Further, another audit firm shall review and assess the performance of the Internal Audit Department/ Office/ Unit regularly every three years. Copy of such report shall be submitted to the Internal Audit Committee and the Board of Directors.

What is the internal audit as Outsourcing or Co-Sourcing?

  1. Outsourcing: A business entity engages a consulting firm or company specialized in providing internal audit services to submit its reports independently to the business entity’s management.
  2. Co-Sourcing: Business entities request a consulting firm or company specialized in providing internal audit services to provide them with human resources specialized in internal audit to perform a specific scope of work and submit their reports directly to the head of the internal audit office in the business entity.

Does the Capital Markets Authority permit licensed persons to outsource the internal audit function?

Yes, Resolution No. 146 of 2022 regarding outsourcing certain registered employment positions introduced amendments to the Executive Bylaws of Law No. 7 of 2010 on the Establishment of CMA and Regulation of Securities Activity, namely Module 1 “Definition”, Module 5 “Securities Activities and Registered Persons” and Appendix 3 to Module 5 as well as adding Appendix 20 and Appendix 21 to Module 5.

Pursuant to such amendments, Article 3-2-8 of Module 5, “Securities Activities and Registered Persons,” sets forth as follows:

The licensed person may assign an external entity to undertake the tasks of the Registered Employment Positions according to the following provisions:

  1. An external entity may be assigned to undertake the tasks of the following Registered Employment Positions:

    • Risk Management Officer
    • Internal Audit Officer
    • Sharia Audit Office”

What is the added value to business entities from the Internal Audit Services?

  1. Comply with laws, regulations, resolutions, and instructions issued by the Capital Markets Authority.
  2. Identify the efficiency and effectiveness of the internal controls in place within the business entity through addition or update to ensure sustainable updates.
  3. Enhance the business entity’s performance efficiency and competitive capabilities by having the ability to face unforeseen changes in the market and define the causes of failure to implement internal controls.
  4. Enhance transparency and accountability by following up on activities and reports.

What are the Internal Audit Services provided by Baker Tilly Kuwait?

  1. Deliver internal audit services on an outsourced basis.
  2. Deliver internal audit services on a co-sourced basis.
  3. Implement all corrective actions that arise from internal audit reports.