Internal Audit Lawyers and Legal Experts

How legal consultant and legal expert may contribute and improve internal audit results, adding value to the organisation?

Borislav Dimitrov

In Bulgaria, the role of the legal consultant in public sector internal auditing is given by the nature and scope of internal audit described in Article 5, 2 (b) of The Public Sector Internal Audit Act. Internal audit shall support the organisation in the achievement of its goals by evaluating the adequacy and efficiency of financial management and control systems in terms of „compliance with legislation and internal acts and contracts”. In this area and scope of internal audit everything is about law and regulation. There is a wide scope of applicable law and regulation as legal framework and legal issues involved in public sector internal auditing. Assessments for compliance with legislation and internal acts and contracts are part of every audit assignment for providing assurance with an objective evaluation of evidence by the internal auditor in order to provide an independent opinion or conclusion concerning a process, system or another item covered by the audit. The core of the legal consultant involvement in internal auditing is an audit assignment for consulting services consisting in the provision of an advice, opinion, training and other services designed to improve the processes of risk management and control, without the internal auditor assuming any managerial accountability therefore. Audit assignments for consulting services are initiated by the head of the organisation and legal consultant may consult by request the head of internal audit.

The highlights of legal counsel’ participation in internal audit could be found at the International Standards for the Professional Practice of Internal Auditing and The International Professional Practice Framework (IPPF), which is the conceptual framework that organizes authoritative guidance promulgated by The Institute of Internal Auditors.

The role of the legal counsel and expert in internal audit is strongly related with the professional competence and due care of the internal auditors. The audit team members have a duty to conduct themselves in a professional manner at all times and to apply high professional standards in carrying out their work to enable them to perform their duties competently and with impartiality. The audit team members should not undertake work they are not competent to perform and should know and

follow applicable auditing standards, policies, procedures and practices. Likewise, they must possess a good understanding of the constitutional, legal and institutional principles and regulations governing the operations of the audited entity. Meeting these standards of professional competence, objectivity and integrity requires careful selection and training of personnel at all levels within the audit autority, and establishment and operation of adequate policies and procedures for the conduct, supervision and review of professional work undertaken by individual audit teams.

The legal consultant may act as safeguard for the independence, objectivity and proficiency of the head of internal audit and internal auditors. Contributing to internal auditor work to ensure compliance with policies, procedure, laws and regulation, legal counsel involved as an internal or external expert may enhance the value of internal audit.

According to Standard 320 - Compliance with Policies, Procedures, Laws, and Regulations - If the scope of the audit included a review of systems established to ensure compliance with policies, procedures, laws, regulations, and other items that could have a significant impact on operations, determine whether the auditors obtained sufficient background information and legal or other expert advice to identify and interpret these items.

Standard 2440 – Disseminating Results, states that the chief audit executive must communicate results to the appropriate parties. The chief executive or designee reviews and approves the final engagement communication before issuance and decides to whom and how it will be disseminated. According the 2440.A.1, The chief audit executive is responsible for communicating the final results to parties who can ensure that the results are given due consideration. Standard 2440.A2 – states, If not otherwise mandated by legal, statutory, or regulatory requirements, prior to releasing results to parties outside the organization the chief audit executive must assess the potential risk to the organization; consult with senior management and/or legal counsel as appropriate; and control dissemination by restricting the use of the results.In Bulgaria the entry point for the legal professionals in internal audit is Article 24.2 of the Bulgarian Public Sector Internal Audit Act, Promulgated, State Gazette, No. 27/31.03.2006, amended, SG No. 64/8.08.2006, SG No. 102/19.12.2006 - the Head of Internal Audit shall have the right to propose to the head of the organisation to appoint an expert, where special knowledge and skills related to the performance of internal audit are needed.

There are few directions involving expert and legal counsel in internal audit, listed at The International Standards for the Professional Practice of Internal Auditing. According to Standard 1200 – Proficiency and Due Professional Care, assurance and consulting services /engagements/ should be performed with proficiency and professional care. Internal auditors should possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity collectively should possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities /1210 – Proficiency/. The chief audit executive should obtain competent advice and assistance if the internal audit staff lacks the knowledge, skills, or other competencies needed to perform all or part of the engagement /1210.A1/. The chief audit executive must decline the consulting

engagement or obtain competent advice and assistance if the internal auditors lack the knowledge, skills, or other competencies needed to perform all or part of the engagement /1210.C1/. Internal Audit Proficiency should be applicable to the legal consultant involved as expert in internal audit engagements. Legal consultant assisting internal auditors should possess proficiency in applying internal audit standards, procedures, methodology and techniques in performing engagements. This legal practitioner’ proficiency in internal audit should include knowledge to identify the indicators of fraud, an understanding of management principles to recognize and evaluate the materiality and significance of deviations from good business practices, an understanding means the ability to apply broad knowledge to situations likely to be encountered, to recognize significant deviations, and to be able to carry out the research necessary to arrive at reasonable solutions. Internal auditor or legal consultant proficiency is always an appreciation of the fundamentals of public management, budgeting, business subjects such as accounting, economics, commercial law, taxation, finance, quantitative methods, information technology, risk management, and fraud. An appreciation means the ability to recognize the existence of problems or potential problems and to identify the additional research to be undertaken or the assistance to be obtained.

Legal counsel may participate in internal audit as an external service provider, a person or firm outside of the organization that has special knowledge, skill, and experience in a particular discipline or area of law.

The decision to engage lawyer, legal consultant, specialist or expert in the internal audit is the responsibility of the head of internal audit or leader of the audit team. This consideration should begin early in the engagement cycle although the need for specialists or experts can arise at any time during the audit process.

There are many areas where legal consultants or experts may benefit the audit process.

Article 7, par.2, point 1 from the Regulation № 2 from 24 March 2009 for the order and the manner of performance, coordination and harmonisation of specific audit activities of the funds and programs of the European Union foresees the possibility of performing specific audit activities by external specialists when there special knowledge, expertise and experience is needed, which is the auditors of the audit authority do not possess.

International Standards on Auditing (ISA) are professional standards for the performance of financial audit of financial information. These standards are issued by International Federation of Accountants (IFAC) through the International Auditing and Assurance Standards Board (IAASB). The purpose of this International Standard on Auditing (ISA) – ISA 620 /using the work of an expert/ is to establish standards and provide guidance on using the work of an expert as audit evidence.

In obtaining an understanding the auditee and performing further procedures in response to assessed risks, in some audit engagements the audit team need to obtain audit evidence in the form of reports, opinions, valuations and statements of an expert. Examples are:

• Valuations of certain types of assets, for example, land and buildings, plant and machinery, works of art, and precious stones. • Determination of quantities or physical condition of assets and the remaining useful life of plant and machinery.

• Determination of amounts using specialized techniques or methods.

• The measurement of work completed and to be completed on contracts in progress, legal opinions concerning interpretations of agreements, statutes and regulations. The leader of the audit team should assess the appropriateness of the expert's work as audit evidence by considering whether the substance of the expert's findings is significant for the audit process and by considering: • Source data used • Assumptions and methods used • Results of the expert's work in the light of the audit team overall knowledge of the auditee and of the results of other audit procedures • When considering whether the expert has used source data that is appropriate in the circumstances, the audit team should consider the following procedures: • Making inquiries regarding any procedures undertaken by the expert to establish whether the source data is sufficient, relevant and reliable • Reviewing or testing the data used by the expert

The appropriateness and reasonableness of assumptions and methods used and their application are the responsibility of the expert. The audit team does not possess the same expertise and, therefore, cannot always challenge the expert's assumptions and methods.

However, the audit team will need to obtain an understanding of the assumptions and methods used and to consider whether they are appropriate and reasonable, based on their knowledge and the results of other audit procedures. In addition, the audit team will need to consider whether the results of the experts work appear reasonable, based on their knowledge and the results of other audit procedures.

The audit team should evaluate and satisfy itself to the expert's professional competence, objectivity and experience of the expert by considering the following:

• the expert's professional qualifications, for example, professional certification, license or other recognition of the competence of the expert in the field, as appropriate; • the experience and reputation of the expert in the field in which we the audit evidence is required; • the expert's objectivity or relationship, if any, to the auditee, including but not limited to financial interests or employment relationships In those cases where the audit team intends to rely on the work of an expert, consideration should be given to the need to communicate with the expert to confirm the terms of the expert's engagement and to cover such other matters as:

• The objectives and scope of the expert's work.

• A general outline as to the specific items the audit team expects the expert's report to cover. • The intended use of the expert's work, including the possible communication to third parties of the expert's identity and extent of involvement. • The extent of the expert's access to appropriate records and files. • Clarification of the expert's relationship with the auditee, if any. • Confidentiality of the auditee's information. • Information as to the assumptions and methods intended to be used by the expert

The audit team should obtain sufficient appropriate evidence that the expert's work is adequate for the purposes of the audit (i.e. it constitutes appropriate audit evidence addressing the initially identified audit objective/risk) by considering the following factors:

• the objectives and scope of the expert's work; • the source data used; • the assumptions and methods • when the expert carried out the work; • the results of the expert's work in the light of both our overall knowledge of the auditee and the results of other audit procedures.

Where the expert's work should be subject to a recognised methodology, for example published by organisation to which expert belongs, confirm this has been used. If the results of the expert's work do not provide sufficient appropriate audit evidence or if the results are not consistent with other audit evidence, the audit team should resolve the matter. This may involve discussions with the auditee and the specialist/expert, applying additional procedures, including possibly engaging another specialist/expert, or modifying the auditor's report.

In such circumstances the audit team should consider performing more extensive procedures than would otherwise have been planned, or possibly engaging another expert.

The engagement team should seek reasonable assurance that the expert's work constitutes appropriate evidence in support of our engagement. The nature of the evidence to be considered will vary according to the nature of the expert's work but may include our considering: The engagement team should also obtain satisfaction that the substance of the expert's findings is properly reflected in our conclusions and report.