An internal audit system is a crucial governance foundation that helps businesses protect their assets and ensure the accuracy of their financial reporting. In the context of the digital economy, establishing a rigorous control mechanism is a mandatory requirement under Decree 05/2019/ND-CP for listed companies and state-owned enterprises.
Statistics from tax audits show that over 701 TP3T material misstatements stemmed from lax internal audit systems. Compliance Accounting Law 88/2015/QH13 and Circular 66/2020/TT-BTC This will help businesses optimize tax costs and minimize legal risks. Let's explore the roadmap for building this system below.
Internal audit systems and their strategic role in businesses.
We need to understand that the internal audit system is not simply a number-checking department. It is an ongoing process established by the Board of Directors and the Management Board to provide reasonable assurance that operational and governance objectives are being achieved.
Role in financial transparency
Transparency is a core value that investors and tax authorities strive for. An internal audit system acts as the first line of defense, detecting fraud from the documentation stage to the balance sheet, ensuring that the data has a solid legal basis.
Role in tax risk management
In the field of taxation, misapplying regulations or lacking invoices can lead to huge penalties. A well-functioning internal audit system will review related-party transactions, check the validity of expenses, and reduce the risk of being subject to back taxes under the Law on Tax Administration 38/2019/QH14.
| Comparison criteria | Internal audit | Internal control |
| Purpose | Evaluating process effectiveness | Implement error prevention procedures. |
| Independence | Cao (reports directly to the Board of Directors) | Lower level (within the operations department) |
| Scope | Comprehensive (financial, operational) | Focus on specific tasks. |
Legal framework governing the internal audit system in Vietnam
Establishing an internal audit system must be based on current legal regulations to ensure its legality. This helps businesses avoid administrative penalties and enhance their reputation with state management agencies.
Decree 05/2019/ND-CP: A boost for professionalism
This decree clearly defines the entities required to have an internal audit system, including listed companies and state-owned enterprises holding more than 50% of the capital. Non-compliance may result in severe penalties regarding corporate governance and information transparency.
Circular 66/2020/TT-BTC: Guidance on the implementation of standards
The Ministry of Finance issued Circular 66 to specify ethical standards and implementation procedures. This serves as a guideline for internal auditors in planning, gathering evidence, and issuing audit reports that meet quality standards.
Important terms to note:
- Article 10: Regulations regarding the independence and objectivity of the audit department.
- Article 12: Requirements regarding the professional competence of internal auditors.
- Article 15: The process for reporting audit results to the relevant authorities.
The optimal structure of a modern internal audit system.
To the system internal audit To operate effectively, its structure is often designed according to the international "Three Lines of Defense" model. This approach helps to clearly define the responsibilities and authority of each department in risk management.
First line of defense: Operational components
This is where daily risks arise in operational departments. Here, the internal audit system establishes direct control rules such as multi-level approval, periodic reconciliation, and clear assignment of responsibilities to prevent errors at the source.
Second line of defense: Risk management and compliance
This department oversees process implementation at the first line of defense. They ensure that new risks are identified and addressed promptly before they have significant consequences for the overall internal audit system. This is a crucial step in maintaining system stability.
Third line of defense: Independent internal audit
This is the core component for objectively evaluating the entire organization. The internal audit system at this level does not participate in operations but focuses on verifying the effectiveness of the two levels above, providing an independent view to the Board of Directors.
The 5-step process for building a standard internal audit system.
Building an internal audit system is a process that requires investment of time and strategic thinking. A well-structured process will help businesses save resources and achieve their control objectives sooner.
Step 1: Survey and assess the control environment.
Businesses need to define their governance culture and employee awareness of risks. If the control environment is weak, no matter how rigorous the processes are, the internal audit system will struggle to effectively protect assets and ensure compliance.
Step 2: Identify and classify risks
Based on the specifics of their industry, businesses list potential risks. For example, in tax accounting, risks related to transfer pricing or VAT refunds are always a top priority for internal audit systems today.
Step 3: Design control activities
At this stage, procedures and work instructions are documented. The internal audit system needs control points to prevent errors, such as mandatory use of digital signatures and an ERP system for managing cash flow.
Step 4: Information and Communication
Any changes to the internal audit system need to be widely communicated. Employee understanding facilitates smooth operation and reduces resistance. Effective communication ensures that all members are aware of their roles within the system.
Step 5: Regular monitoring and improvement
Internal audit systems are never perfect forever. Periodic reviews based on real-world feedback help the system adapt to new tax and accounting regulations, ensuring continued effectiveness in a volatile business environment.
See more articles: Internal audit services
Analyzing the relationship between internal audit systems and financial audits.
In audit of financial statementsIndependent auditors typically assess the reliability of a client's internal audit system. A strong system increases confidence in the figures presented in the financial statements.
Impact on audit scope
If a company has a strong internal audit system, independent auditors can reduce the amount of detailed testing required. This saves audit costs and increases the reliability of financial statements, shortening the time to report issuance.
Identifying material errors
Major errors in tax accounting are often overlooked by internal audit systems due to a lack of highly specialized personnel. In such cases, the role of external consulting firms is crucial to supplement the company's control capabilities.
| Type of risk | Impact on financial statements | The role of internal control systems |
| Revenue fraud | Profit and tax discrepancies | Verify the authenticity of the order. |
| Warehouse errors | Impact on cost of goods sold | Physical inventory, warehouse reconciliation. |
| Tax violations | Collection of arrears and penalties for late payment. | Review tax returns periodically. |
Challenges in implementing internal audit systems in Vietnam.
Although the role of internal audit systems is undeniable, Vietnamese businesses still face many difficulties. Identifying these challenges correctly is the first step in finding effective solutions.
Limitations in the availability of specialized human resources.
Finding internal auditors knowledgeable in accounting standards (VAS/VFRS), tax law, and governance is a major challenge. This has resulted in internal audit systems in many places being merely формаl, lacking in-depth risk assessment.
A culture that resists change and fears scrutiny.
Many departments view audits as a stressful form of scrutiny. To succeed, leadership needs to build a culture of "control to protect," helping employees understand that the internal audit system is a tool to help them complete their work in accordance with regulations.
The application of information technology is not yet synchronized.
Manual, paper-based controls are outdated. A robust internal audit system needs to be integrated into management software such as SAP, Oracle, or specialized accounting software to automate the alerting and monitoring of risk indicators.
Optimizing the internal audit system from a tax and legal perspective.
For an internal audit system to truly deliver value, it needs to be integrated into the tax compliance process. This coordination ensures that businesses are always proactive in the face of inspections and audits from regulatory authorities.
Control of input and output documents
Documents are the soul of accounting. Internal audit systems need to clearly define the circulation deadlines and methods for verifying the legality of electronic invoices to avoid the risks of "ghost invoices," which are currently being strictly controlled by tax authorities.
Review of corporate income tax and personal income tax settlements.
Before each tax year, the internal audit system should conduct a mock audit. This helps detect invalid expenses and make timely adjustments, avoiding the disallowance of expenses during a formal tax audit.
Key inspection criteria:
- The reasonableness of salary allowances in the contract.
- Are the advertising and entertainment expenses supported by original documents?
- The allocation of asset depreciation is governed by Circular 45/2013/TT-BTC.
A real-world example of an internal audit system failure.
Major economic cases in Vietnam reveal a common thread: the auditing system exists only on paper. The internal audit system is neutralized by the absolute power of individuals, leading to serious violations that have persisted for many years.
Typically, in some banks, a lack of control over credit approvals has led to a surge in bad debts. If the internal audit system had properly fulfilled its independent role, reporting directly to the Supervisory Board, these disastrous financial consequences could have been prevented in time.
Future trends of internal audit systems in the 4.0 era.
We are shifting from sample-based auditing to full-data auditing powered by AI and Big Data. This shift requires internal audit systems to quickly adapt and upgrade their digital capabilities to maintain effectiveness.
Continuous Auditing
In the future, internal audit systems will not wait until the end of the quarter to conduct audits. Automated algorithms will scan every transaction and send real-time alerts about any anomalies, allowing management to respond immediately to risks.
Risk forecasting analysis
Instead of simply looking back at the past, modern internal audit systems use historical data to forecast future risks. This includes predicting exchange rate fluctuations or changes in tax policies so that businesses can develop appropriate contingency plans.
Conclude
An internal audit system is a steel shield protecting a business's sustainability against market fluctuations. A well-functioning system helps businesses comply with accounting and tax regulations and builds trust with shareholders and partners. Investing in an internal audit system is an investment in long-term growth.
Understanding the challenges faced by businesses, MAN – Master Accountant Network provides auditing services and consulting on building a comprehensive control system. With experienced experts, we are committed to helping your business optimize processes, ensure data transparency, and minimize tax risks.
Other services
- Financial statement audit services
- Internal audit services
- Internal Control System Assessment Service
- Auditing services on request
- Professional tax audit services
- Construction auditing services
- Completed project settlement audit service
Service contact information at MAN – Master Accountant Network
- Address: No. 19A, Street 43, Tan Thuan Ward, Ho Chi Minh City
- Mobile/Zalo: 0903 963 163 – 0903 428 622
- Email: man@man.net.vn
Content production by: Mr. Le Hoang Tuyen – Founder & CEO MAN – Master Accountant Network, Vietnamese CPA Auditor with over 30 years of experience in Accounting, Auditing and Financial Consulting.
Frequently Asked Questions about Internal Audit Systems
Do small businesses need to establish an internal audit system?
Although not mandated by law, small businesses should still have basic elements of an internal audit system to prevent asset losses and help business owners gain the most accurate understanding of their management practices.
What is the biggest difference between an internal auditor and a chief accountant?
The chief accountant is responsible for organizing and implementing accounting practices and preparing reports. Meanwhile, the internal audit system assesses whether the chief accountant's work and the entire organization are compliant, efficient, and honest.
Are the operating costs of an internal audit system high?
The initial investment cost may be significant, but it is far less than the losses incurred due to fraud or tax penalties. Businesses can outsource the service to optimize costs while still ensuring the quality of their internal audit system.
