ជំនាញការសវនកម្មផ្ទៃក្នុង- Internal Audit Profession

Respective roles of each of the three lines of defense:

When a fraud suspect is found, the flow of the fraud investigation typically involves the following steps by the three lines of defense in an organization.

1. First Line of Defense:
- The front-line employees who identified the potential fraud will gather and document all relevant information about the suspect and the fraudulent activity.
- They will escalate the case to the appropriate department within the bank, such as the fraud investigation unit.
- They may also temporarily freeze or monitor the suspect's accounts to prevent further fraudulent transactions.

2. Second Line of Defense:
- The organization’s risk management, fraud investigation unit will take over the investigation from the first line.
- They will conduct a thorough review of the case, including analyzing transaction data, reviewing account activities, and gathering additional evidence if necessary.
- They may involve specialized fraud detection tools and software to assess the extent of the fraud and identify any associated risks.
- Based on the findings, they will decide on the appropriate course of action, which may include contacting law enforcement, freezing assets, or pursuing legal actions against the suspect.

3. Third Line of Defense:
- The internal audit and independent review functions will provide oversight and assurance during the fraud investigation process.
- They will periodically review the effectiveness of the bank's fraud prevention system, including how the first and second lines of defense handle fraud cases.
- In the specific fraud investigation involving the suspect, they will perform an independent evaluation of the investigation procedures followed by the first and second lines.
- They will ensure that all necessary controls were in place, proper documentation was maintained, and the investigation was conducted in accordance with regulatory requirements.

Throughout the investigation, there will be coordination and communication between the three lines of defense to share information, discuss findings, and make informed decisions. The goal is to detect and prevent fraud, mitigate risks, and ensure the overall integrity of the organization’s operations.

TONE AT THE TOP is important in leading the organizational culture to the right direction to where the company want it to be.

SO WHAT IS THE “TONE AT THE TOP”?
Tone at the top refers to the ethical atmosphere that is created in the workplace by the organization's leadership. Whatever tone management sets will have a trickle-down effect on employees of the company. If the tone set by managers upholds ethics and integrity, employees will be more inclined to uphold those same values. However, if upper management appears unconcerned with ethics and focuses solely on the bottom line, employees will be more prone to commit fraud because they feel that ethical conduct is not a focus or priority within the organization. Employees pay close attention to the behavior and actions of their bosses, and they follow their lead. In short, employees will do what they witness their bosses doing.

It is crucial to a company’s success for executives and management to set an ethical example (or tone) of how their employees should behave in the workplace. When those in top positions set the wrong, unethical example by committing fraud, conduct unethical behavior, their employees will take heed and follow in their bosses’ fraudulent footsteps and unethical behavior, creating an entire culture of workplace fraud and unethical behavior. When executives put pressure on their employees to meet unrealistic goals to yield profits for the company, they are essentially forcing employees to do whatever it takes to achieve those goals, whether they achieve those goals improperly or not. In their minds, the end justifies the means.

To set the right tone, those in top positions of management have to follow four very important steps: communicate to employees what is expected of them; lead by example; provide a safe mechanism for reporting violations; and reward integrity. These steps will be discussed in greater detail in next issues.

Role of Internal Auditors with regard to Prakas on Liquidity Risk Management Framework dated 27 September 2017

Article 10:
The framework shall be regularly, independently, and comprehensively examined. The examination shall be done independently by professional staff with full right in questioning treasurer and risk management team.

Internal Audit Work shall be done independently on the framework at least once a year and shall report the result to the BoD and senior management. Institute shall immediately solve all improvement points raised by risk team or internal auditors.

Question: are you doing as required? How did you do?

To all auditors, do you know that the Definition of Internal Auditing ?

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. I helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of governance process, risk management, and controls (GRC). In comment box, please find the work of auditor to support GRC.

There are 10 core principles for professional practice of Internal Auditing. For internal audit function to be considered effective, all Principles should be present and operating effectively.

Those core principles includes:
1) Demonstrate integrity
2) Demonstrate competence and due professional care
3) Is objective and free from undue influence (independence)
4) Align with the strategi s, objectives, and risks of the organization
5) Is appropriately positioned and adequately resourced
6) Demonstrate quality and continuous improvement
7) Communicates effectively
8)Provides risk/based assurance
9) Is insightful, proactive, and future focused
10) Promotes organizational improvement

In IPPF, the Mission of Internal Audit is to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.

The Institute of Internal Auditors (The IIA) provides audit practitioners the International Professional Practice Framework (IPPF).
IPPF consists of:
Mission
Mandatory Guidance ( 1. Core Principles 2. Definition of Internal Audit 3. Code of Ethics and 4. Standards)
Recommended Guidance (1. Implementation Guidance and 2. Supplemental Guidance)

The Standards, refers to The International Standards for the Professional Practice of Internal Auditing, consists of 1) Attribute Standards are numbered in the 1000s range 2) Performance Standards are numbered in the 2000s range.

Internal auditing is a discipline that works on behalf of management, board of directors, and other stakeholders of public and private entities to improve and add value to governance, risk management, and control procedures. This is in contrast to external auditing, which serves third parties who require reliable financial information based on reliable supporting records. Instead, internal auditors typically have a broader focus (based on its approved internal audit activities charter) that requires them to examine and appraise controls, financial performance, compliance with laws and regulations, and operational performance for their effectiveness. Rather than focus on historical events as external auditors do, internal auditors also help the board and management make current as well as future oriented decision.

Recap all from standards:

Question of CIA part I:
A specific objective of an audit of an organization’s expenditure cycle is to determine if all goods paid for have been received and charged to the correct account. This objective would address which of the following primary objectives identified in the Standards?
I. Reliability and integrity of financial and operational information.
II. Compliance with laws, regulations, and contracts.
III. Effectiveness and efficiency of operations.
IV. Safeguarding of assets.

a. I and II only.
b. I and IV only.
c. I, II, and IV only.
d. II, III, and IV only