ABC Co. Ltd. is a steel manufacturing company having its registered office in NOIDA (UP) and its main plant facilities at Raipur (CG) and several other plants at various locations in India. Company's business has increas

CS Professional · Internal and Forensic Audit · PYQS · December 2025
ABC Co. Ltd. is a steel manufacturing company having its registered office in NOIDA (UP) and its main plant facilities at Raipur (CG) and several other plants at various locations in India. Company's business has increased manifold in last two years. All purchases are centralized and orders are placed by the MD office and payments are also made by head office. It results in delays in ordering and delivery of goods and payments to suppliers and also resulting into delays in project completions. Company's main customers are Public Sector Undertakings. Timely supply of materials and execution of projects are critical not only to avoid cost and time overruns but to avoid huge penalties and fines. Therefore, now company wants to decentralize its processes and to get studied and evaluated all the processes. Company wants to get implemented sound internal control systems and risk management in its all-critical processes. Company's statutory auditors in their recent audit report, have raised serious concern that has caught attention of lenders and other stakeholders. Statutory Auditors have pointed out lack of segregation of duties, lack of periodical verification of assets and non-reconciliation of debtors and creditors, amongst other missing operational controls. Risk management relates to how an organization sets objectives, then identifies, analyses, and responds to those risks that could potentially impact its ability to realize its objectives. Management performs risk assessment activities as part of the ordinary course of business in each of these categories. Examples include strategic planning, marketing planning, capital planning, budgeting, hedging, and incentive pay out structure. Internal controls are measures, put in place by management to ensure reliability of financial reporting, promote efficiency and effectiveness in operations and compliance with laws. The objective of an internal audit is to evaluate compliance with company's laid down procedures, applicable laws, and international standards. Data and reports are reviewed to assure consistency and compliance. Thus, internal audit provides a value-added service to management and to the board of directors by detecting and correcting weaknesses in a process before external audits discover them. This can protect the organization from loss of reputation and regulatory fines. Company has engaged you, as an Internal Auditor. In the light of the above, answer the following questions: Explain the role of internal audit in internal control and in risk management.

Answer & Explanation:

Role of Internal Audit in Internal Control The Internal auditor should examine and contribute to the ongoing effectiveness of the internal control system through evaluation and recommendations. However, the internal auditor is not vested with management's primary responsibility for designing, implementing, maintaining and documenting internal control. Internal audit functions add value to an organization's internal control system by bringing a systematic, disciplined approach to the evaluation of risk and by making recommendations to strengthen the effectiveness of risk management efforts. The internal auditor should focus towards improving the internal control structure and promoting better corporate governance. The role of the internal auditor encompasses: Evaluation of the efficiency and effectiveness of controls Recommending new controls where needed or discontinuing unnecessary controls Using control frameworks Developing Control self-assessment. Role of Internal Audit in Risk Management Internal auditing professional standards require the function to monitor and evaluate the effectiveness of the organization's Risk management processes. Risk management relates to how an organization sets objectives, then identifies, analyzes, and responds to those risks that could potentially impact its ability to realize its objectives. Under the COSO Enterprise Risk Management (ERM) Framework, risks fall under strategic, operational, financial reporting, and legal/regulatory categories. Management performs risk assessment activities as part of the ordinary course of business in each of these categories. Examples include: strategic planning, marketing planning, capital planning, budgeting, hedging, incentive payout structure, and credit/lending practices. Sarbanes-Oxley regulations also require extensive risk assessment of financial reporting processes. Corporate legal counsel often prepares comprehensive assessments of the current and potential litigation a company faces. Internal auditors may evaluate each of these activities, or focus on the processes used by management to report and monitor the risks identified. For example, internal auditors can advise management regarding the reporting of forward-looking operating measures to the Board, to help identify emerging risks. In larger organizations, major strategic initiatives are implemented to achieve objectives and drive changes. As a member of senior management, the Chief Audit Executive (CAE) may participate in status updates on these major initiatives. This places the CAE in the position to report on many of the major risks the organization faces to the Audit Committee, or ensure management's reporting is effective for that purpose.

Topics: Internal Audit

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic