Internal Audit Process and Report

The objective of the Internal Audit function is to independently examine and evaluate the activities and assist the management in discharging their responsibilities, as a service to the Audit Committee. The Internal Audit Department will furnish them with analysis, recommendations, advices and reports concerning the activities examined.

Planning

The audit process is to follow a planned approach based upon risk assessments. The planning framework comprises the following:

• An Internal Audit Annual Plan, which consists of objectives, priority, timing and resource requirement is to be prepared for each year, approved by Audit Committee
• An individual audit plan/program prepared for each audit review, approved by the Head of Internal Audit.

Documentation

Audit working papers contain the principal evidence to support the Internal Audit report and they provide the basis for review of Internal Audit work. The internal auditor(s) are to employ an audit methodology, which requires the production of working papers, which document, at least, the following:

• planning;
• examination and evaluation of the adequacy and effectiveness of internal controls;
• the audit procedures employed, the information obtained and the conclusions reached;
• review;
• reporting; and
• follow-up.

Consultation

Prior to the commencement of reviews, the Head of Internal Audit will normally advise the auditee on the audit purpose, scope and expected timing of the work.  However, in the case of special investigations such prior notification may not be given where doing so may jeopardise the success of the investigation.  In such an event, the prior approval of the Group CEO is required.

During the conduct of reviews, internal auditors are to consult, orally and/or in writing, with relevant staff to:

• ensure information gathered is accurate and properly interpreted
• allow auditee to make clarification to ensure the formation of a balanced judgment;
• ensure recommendations are cost effective and practicable; and
• keep auditee informed on the progress of the audit.

Reporting

A written report is to be prepared, and issued by the Head of Internal Audit. The reports are to be submitted to the Group CEO, with copies to the Audit Committee and the auditee.

Audit reports are to include the coverage of:

• audit objectives;
• scope of coverage;
• conclusions on all key issues identified;
• recommendations; and
• action agreed upon (management response).

A follow-up report will be prepared for every audit after a maximum of six months from the finalisation of the initial audit report.

As well as providing reports on audits, the Head of Internal Audit will provide the Group CEO and the Audit Committee, with periodic reports on progress in terms of the Internal Audit Plan other significant matters.