Internal auditing and internal control serve as a strong "defense mechanism" to help businesses operate on the right track and comply with the law. In a volatile economic environment, establishing a monitoring mechanism is not only a requirement of management but also a legal obligation. Accounting Law 2015 and Decree 05/2019/ND-CP.
According to statistics from the Association of Fraud Examiners (ACFE), businesses with effective internal audit and internal control systems can reduce fraud losses by up to 50%. Understanding the nature of these two concepts helps business owners allocate resources rationally, protect assets, and enhance their reputation in the capital market. Let's analyze the core differences with MAN – Master Accountant Network below.
The nature and differences between internal audit and internal control.
Although both aim at risk management, internal auditing and internal control have distinct characteristics in their operational methods. Below is a detailed comparison table based on professional accounting and auditing criteria.
Comparison table of internal control and internal audit according to the Accounting Law 2015
Below are the key differentiating criteria between these two systems to help businesses gain the most comprehensive overview:
| Criteria | Internal control (ICS) | Internal Audit |
| Define | It is the process of establishing mechanisms and policies to prevent and detect risks. | This involves checking and evaluating the completeness and effectiveness of the internal control system. |
| Time of execution | It happens frequently and continuously in all daily activities. | It takes place regularly according to plan or on an ad hoc basis when required. |
| Main purpose | Ensure asset security, accurate financial reporting, and compliance. | Assess compliance, identify vulnerabilities, and advise on system improvements. |
| The implementing entity | All staff and management levels within the accounting unit. | A dedicated audit department or an outsourced service provider. |
| Independence | It is closely linked to operational activities and a degree of relative independence. | Highly independent, reporting directly to the Board of Directors or the Supervisory Board. |
Internal control is a process – Internal audit is an evaluation activity.
In this relationship, internal control plays a fundamental role. According to Article 39 of the 2015 Accounting Law, internal control includes hierarchical management and separation of responsibilities to avoid conflicts of interest. For example, the person holding the money cannot simultaneously record it in the accounting books – this is a crucial control point.
Opposite, internal audit Internal control and internal audit are closely linked, with internal audit acting as a "checkpoint controller." If internal control refers to the actual operational processes, then internal audit is the measure used to assess whether those processes are running correctly and delivering real results for the organization.
Specific functions and responsibilities of the Internal Audit department
To understand why internal auditing and internal control always go hand in hand, we need to examine the tasks of internal auditing as outlined in Decree 05/2019/ND-CP.
Develop and implement an annual audit plan.
Each year, the internal audit department must develop a plan based on a realistic risk assessment. High-risk areas such as asset procurement, cash management, and revenue are always the focus of internal audit and internal control. Adhering to the plan helps businesses proactively prevent fraudulent activities from occurring early on.
Consulting and improving management systems.
Modern internal auditing and internal control practices emphasize added value rather than simply finding errors. Auditors will make recommendations for optimizing tax costs, streamlining processes, and proposing technological solutions. This helps automate outdated manual control mechanisms and improve efficiency.
Does internal auditing include unannounced audits?
This is a matter of concern for many leaders when implementing internal audit and internal control systems.
Regulations on unscheduled audits according to Decree 05/2019/ND-CP
Based on Clause 4, Article 20 of Decree 05/2019/ND-CP, the internal audit department has the full right to conduct unscheduled audits. This occurs upon request from the Board of Directors or the Management Board. Additionally, unscheduled audits will be triggered when there are signs of serious legal violations or unusual asset changes.
The significance of unscheduled audits in risk management.
The mechanism of surprise audits within the internal audit and internal control system creates a strong deterrent effect. When employees know that their operations may be subject to unexpected inspections, compliance increases. This is an effective tool for handling urgent issues that the annual plan may not fully cover.
Which businesses are required to conduct internal audits?
Vietnamese law stipulates a list of entities that must implement internal audits and internal controls to ensure transparency.
The group of individuals required to comply with current regulations.
According to Decree 05, the following entities are required to have an internal audit department:
- Listed companies: These companies trade on the stock exchange.
- State-owned enterprises: The parent company is state-owned with over 50% of its charter capital.
- Public non-profit organization: There is a budget estimate exceeding 20 billion VND or the employment of more than 200 workers.
Benefits of businesses voluntarily implementing internal auditing.
Many small and medium-sized enterprises (SMEs) are still proactively building internal audit and internal control systems. Internal audit helps increase loan eligibility through reliable financial reporting. At the same time, this system attracts strategic investors and minimizes the risk of tax arrears due to accounting errors.
Steps to building an effective internal audit and internal control system.
For internal audit and internal control systems to function effectively, businesses should adopt international standard procedures (COSO framework).
Establish a control environment.
This forms the foundation of internal auditing and internal control. Leaders must demonstrate a serious attitude towards compliance. Establishing a clear code of ethical conduct and organizational model is the first step in shaping a control culture throughout the company.
Risk assessment and control activities
Businesses need to define financial objectives and identify potential obstacles. Control activities such as approvals, reconciliation, and asset protection must be designed to address each type of risk. This ensures that any gaps in internal audit and internal control are addressed.
Information, communication and monitoring
A good system requires a smooth flow of information from employees to management. Regular monitoring helps identify weaknesses in internal audit and internal control so that adjustments can be made promptly. This process helps businesses adapt quickly to market changes.
Conclude
Internal auditing and internal control are the lifeblood of modern corporate governance. Clearly defining responsibilities ensures smooth operation, reduces internal conflicts, and minimizes financial risks. Investing in a control system is investing in the long-term growth and transparency of the business.
If you need to establish processes or conduct independent assessments, MAN – Master Accountant Network is ready to assist you. We provide in-depth internal audit and internal control consulting services, allowing you to focus on your business with peace of mind. Contact MAN today to receive the most comprehensive risk management solution!
Other services
- Financial statement audit services
- Internal audit services
- Internal Control System Assessment Service
- Auditing services on request
- Professional tax audit services
- Construction auditing services
- Completed project settlement audit service
Service contact information at MAN – Master Accountant Network
- Address: No. 19A, Street 43, Tan Thuan Ward, Ho Chi Minh City
- Mobile/Zalo: 0903 963 163 – 0903 428 622
- Email: man@man.net.vn
Content production by: Mr. Le Hoang Tuyen – Founder & CEO MAN – Master Accountant Network, Vietnamese CPA Auditor with over 30 years of experience in Accounting, Auditing and Financial Consulting.
Frequently Asked Questions about Internal Audit and Internal Control
Can one person perform both internal control and internal audit functions?
All employees participate in internal control. However, internal auditors must be independent of the department being audited. Auditors are not allowed to directly design the processes they will be evaluating to ensure objectivity.
Can businesses outsource their internal audit services?
Absolutely. Businesses can hire professional companies to perform internal audit functions. This saves on personnel costs and leverages the in-depth knowledge of leading experts.
