ACCA Applied Skills · Audit and Assurance

Internal audit and governance and the differences between external audit and internal audit: formula sheet

Full chapter guide

Key formulas

Core principles: Accountability + Transparency + Fairness (plus integrity, independence, responsibility); Use these as headings in written answers and link each to the scenario.
Comply or explain: Follow the provision OR disclose and justify the departure; A listed company is not breaking the code if it explains a departure. The explanation must be genuine.
Separation of roles: Chair ≠ Chief executive; Splitting the roles avoids too much power in one person.
Key board structures: Audit committee + Remuneration committee + Nomination committee, led by non-executive directors; Committees bring independent oversight of reporting, pay and board appointments.
Audit committee composition (best practice): Independent NEDs only (or mainly) + at least one with recent, relevant financial experience; Codes differ by country. Present this as best practice, not as a universal legal rule.
Five areas of audit committee responsibility: Financial reporting + Internal control and risk + Internal audit + External audit + Whistleblowing and fraud; Use this as a checklist for any 'describe the role' question.
Four NED roles: Strategy + Scrutiny + Risk + People; A common way to organise NED contribution: challenge strategy, scrutinise management, oversee risk and controls, and handle appointments and pay.
External audit link: Recommend appointment/removal + Approve fees + Assess independence + Agree scope + Set non-audit services policy; Shows how the committee supports auditor independence and objectivity.
Three areas of internal audit scope: Risk management + Internal control + Governance; Use these as a checklist to structure any answer on the role of internal audit.
Other typical internal audit activities: Financial and operating information review; value for money; compliance with laws; fraud work; IT review; Scope is set by management or the audit committee, so it is not fixed.
Key responsibility rule: Management owns internal control; internal audit evaluates and advises; Never say internal audit is responsible for the control system.
Independence rule: Independence comes from reporting to the audit committee and having no operational duties; Internal audit is organisationally independent of the areas it audits, but is still part of the entity.
Core decision rule: Internal audit is justified if benefits of independent assurance > cost of the function; A judgement, not a calculation. Support it with scenario facts.
Factors increasing the need: Scale + diversity + complexity + staff numbers + regulation + risk/control weaknesses + supportive management; Use as a checklist and link each to the scenario.
Factors reducing the need: Small size + simple operations + close owner/management oversight + high cost relative to benefit; Use when the scenario describes a small, simple entity.
Governance codes position: Listed companies: board reviews annually whether internal audit is needed; if none, explains why; Describe this as general code practice and avoid quoting clause numbers.
Three Es of value for money: VFM = Economy + Efficiency + Effectiveness; Economy: inputs at lowest cost for suitable quality. Efficiency: maximum output from given inputs. Effectiveness: outputs achieve the intended objectives.
Assignment match rule: Objective in scenario → assignment type; Costs and resource use = VFM. Accuracy of records = financial. Rules and policies = compliance. Systems and security = IT. Process or department = operational. Risk process = risk review.
Outsourcing issue check: Advantages vs disadvantages: skills, cost, flexibility vs knowledge, control, confidentiality, independence; Use as a checklist for outsourcing questions.
Objective: External: opinion on financial statements. Internal: improve risk management, control and governance.; Use this as the first line of any comparison answer.
Reporting: External: to members (shareholders). Internal: to management or the audit committee.; The internal audit reporting line affects its objectivity.
Appointment: External: members appoint, by law. Internal: management or those charged with governance decide.; Say who can remove them as well if asked about independence.
Assessing internal audit before reliance: Objectivity, technical competence, due professional care, and communication between the two.; Use these four factors to answer any question on whether the external auditor can rely on internal audit.
Responsibility: External auditor keeps sole responsibility for the opinion, even if internal audit work is used.; Never say the responsibility is shared or reduced.
Preferred reporting line: Head of internal audit → audit committee (functional) ; chief executive (administrative); Reporting to the finance director or to the managers being audited weakens objectivity.
Audit committee control: Charter + plan + budget + appointment/removal/pay of head of internal audit; Use this list to show how the committee protects independence.
Threat to safeguard answer pattern: Threat → why it harms objectivity → safeguard; Marks are earned by linking each safeguard to a specific threat.
Typical threats: Self-review, familiarity, intimidation, self-interest, lack of status or resources; Match each to the scenario facts.

Quick revision

Corporate governance is the system by which a company is directed and controlled.
The audit committee is usually made up of independent non-executive directors.
The audit committee oversees financial reporting, internal control, internal audit and the external auditor relationship.
Non-executive directors bring independent judgement and scrutiny of executives.
Internal audit evaluates and improves risk management, control and governance processes.
External audit gives an opinion on the financial statements to the shareholders; internal audit reports to management or the audit committee.
External auditors are independent of the company and appointed by shareholders; internal auditors are usually employees or an outsourced provider.
Internal audit scope is set by the company and can cover any area; external audit scope is set by law and standards.
Factors affecting need for internal audit include company size, complexity, risk, and regulatory demands.
Assignments include operational, financial, compliance, value for money and IT reviews.
Internal audit independence is best supported by reporting to the audit committee.
Internal audit does not give an audit opinion on the financial statements. Its role is to evaluate and improve risk management, control and governance, and it reports to management or the audit committee, although it may review financial controls and information.

Common mistakes

Listing code provisions from memory without linking them to the scenario. Fix: Start from the scenario facts. Name only the provisions that relate to them and explain the effect.
Saying a company breaks the code whenever it departs from a provision. Fix: Say that the company must explain the departure. A departure is a concern only if the explanation is weak or missing.
Saying the audit committee prepares the financial statements or carries out the audit. Fix: State that it oversees and reviews. Directors prepare the statements and the external auditor audits.
Treating NEDs as part of management who run the business daily. Fix: Describe NEDs as independent members who challenge and scrutinise, not manage operations.
Saying internal audit is responsible for the internal control system. Fix: Management is responsible for designing and operating controls. Internal audit evaluates them and recommends improvements.
Mixing up internal and external audit objectives. Fix: External audit gives an opinion on the financial statements to shareholders. Internal audit's work is set by management or governance and reports to them.
Saying every company must have internal audit. Fix: State that it is generally not legally required, except in some regulated sectors, and is a management decision.
Listing factors without applying them. Fix: Tie each factor to a scenario fact and say whether it raises or lowers the need.
Treating internal financial audit as the same as the statutory audit. Fix: Remember internal audit serves management, is not required by law and gives no true and fair opinion.
Mixing up economy, efficiency and effectiveness. Fix: Economy = cost of inputs, efficiency = output per input, effectiveness = achieving objectives.

Exam tips

Always tie each point to a fact in the scenario. Generic code lists score few marks.
Use the terms accountability, transparency and fairness as anchors. Markers recognise them quickly.
In objective tests, read for the exact scenario fact. An option can be correct in theory but wrong for the case.
Say 'comply or explain' when a listed company departs from a provision, and judge the quality of the explanation.
In longer answers, add a short recommendation. Many requirements ask what should change, not just what is wrong.
In written questions, state the duty and then its purpose. A bare list of duties earns fewer marks.
In objective tests, remember that the committee oversees and reviews. Options saying it prepares the accounts or performs the audit are wrong.
Read the scenario for governance weaknesses, because Section B and C questions often reward application over recall.