Internal control system auditing is an independent, objective assessment aimed at ensuring the effectiveness and efficiency of risk management processes within a business. In the context of a rapidly developing digital economy, establishing an internal control system is crucial. Internal control system (ICS) A sound financial foundation not only helps protect assets but is also a prerequisite for businesses to comply with current accounting, auditing, and tax regulations in Vietnam.
According to surveys from international auditing organizations, more than 751 TP3T material misstatements in financial statements stem from lax internal controls. In Vietnam, Decree 05/2019/ND-CP Internal auditing has specifically defined mandatory requirements for public interest entities and state-owned enterprises. Conducting periodic audits provides management with a comprehensive overview of operational performance and helps prevent potential legal risks. Let's explore this professional process in detail below.
The nature of auditing internal control systems in businesses.
Auditing internal control systems is not simply about checking the numbers in accounting books. It's a process of assessing the entire operational "machinery" of the business, from document approval to the delegation of authority in financial management. The core objective is to confirm whether the control measures are appropriately designed and operating continuously.
This audit is based on the COSO (Committee of Sponsoring Organizations of the Treadway Commission) theoretical framework, which includes five components: Control Environment, Risk Assessment, Control Activities, Communication, and Monitoring. The harmonious coordination between these components creates a robust defense system against fraud and operational errors.
Importance for risk management and taxation
In tax administration, auditing the internal control system plays a crucial role in ensuring the integrity of economic transactions. When the control system is effective, the risks of incorrect declarations, missing invoices, or violations of regulations regarding deductible expenses during corporate income tax settlement are minimized. This helps businesses avoid unnecessary late payment penalties and tax arrears.
The relationship between internal control and financial statement auditing.
Auditing the internal control system is an indispensable preparatory step before conducting a financial statement audit. Auditors typically perform "Control Testing" to assess the reliability of the system. If the internal control system is strong, auditors can reduce the number of "Substantive Tests" (detailed tests), thereby optimizing audit time and costs for the entity.
Legal framework governing the auditing of internal control systems.
In Vietnam, businesses need to pay particular attention to legal regulations that guide and mandate the implementation of internal controls. A thorough understanding of the law not only helps businesses comply but also builds credibility with government agencies.
| Legal documents | The main content relates to internal control. | Applicable subjects |
| Accounting Law 2015 (Article 39) | Regulations regarding the responsibility for establishing and maintaining an internal control system. | All accounting units. |
| Decree 05/2019/ND-CP | Detailed regulations on internal audit procedures, powers, and responsibilities. | Listed companies, state-owned enterprises, and public service units. |
| Circular 214/2012/TT-BTC | The Vietnamese Auditing Standards System (VSA), particularly VSA 315 and VSA 330. | Auditors and the audited firm. |
| Law on Prevention and Combat of Corruption 2018 | Regulations on internal controls to prevent corruption in the private sector. | Public companies, credit institutions. |
Referring to legal provisions such as Article 39 of the 2015 Accounting Law shows that auditing the internal control system is a legal obligation to protect the interests of shareholders and investors. This system must ensure that assets are protected securely, financial information is timely, and there is absolute compliance with the law.
Professional internal control system audit procedures
A proper internal control system audit process typically goes through four main stages, requiring a combination of professional knowledge and practical experience from the auditor (Expertise).
Planning and system survey phase
Before beginning, the audit team needs to understand the business model, the legal environment, and the specific risks of the industry. Auditors will use internal control questionnaires or conduct interviews with management to gain a preliminary understanding of current processes.
Design evaluation phase for checkpoints
At this stage, the internal control system audit focuses on reviewing internal regulations and operating procedures (SOPs). Do these regulations cover all risks? For example, does the cash advance process require the Chief Financial Officer's (CFO) signature for expenditures exceeding 50 million VND?
Operational testing phase (Test of Controls)
This is a crucial stage of the internal control system audit. The auditor will select a sample of transactions performed during the year to check whether employees actually complied with established procedures. If the procedure requires three competitive bids for the purchase of fixed assets, the auditor will examine the bidding documents to verify the presence of these bids.
The stage of compiling and preparing the recommendations report.
The result of an internal control system audit is a detailed report that identifies weaknesses. The report should not only list errors but also provide practical solutions to improve the company's management system.
Key components of an internal control system according to COSO standards.
To understand why auditing internal control systems is complex, we need to delve into the five components that make up the "health" of an organization.
Control Environment
The control environment is the foundation of all other components. It encompasses the management philosophy, the operational style, and the compliance awareness of all employees. A business with a culture of transparency will facilitate the most effective auditing of its internal control system.
Risk Assessment Process
Every business entity faces risks from both external sources (changes in tax policies, market fluctuations) and internal sources (employee fraud, IT system failures). Internal control system audits examine how businesses identify and prioritize addressing these risks.
Control Activities
These are specific policies and procedures such as: approval, authorization, reconciliation, performance checks, and task separation. Separating tasks between cashiers and bookkeepers is a golden rule that internal control system auditors always prioritize.
Information and communication systems
Information flow within a business must be timely and accurate. Management reports must be sent to the right people with the authority to make appropriate business decisions. Auditors will assess the security and integrity of data on accounting software.
Monitoring activities
Internal control systems need to be monitored regularly to ensure they remain effective over time. This is typically handled by the internal audit department. Regular audits of the internal control system by an external entity will provide a more objective view of the effectiveness of this monitoring.
Analyzing common risks associated with a lack of internal control system audits.
If a business neglects to audit its internal control system, it will face serious consequences for both its finances and reputation. Below is a table summarizing common violations in Vietnam:
| Type of violation | Occurrence rate | Legal/Financial Consequences |
| Purchasing fraud (price gouging, collusion with suppliers) | 35% | Capital loss, increased input costs, impact on input VAT. |
| Misappropriation of cash/bank deposits | 20% | Short-term insolvency, misreporting of cash funds. |
| Inventory discrepancies (unreported losses, damage, etc.) | 25% | Incorrect cost of goods sold leads to discrepancies in corporate income tax. |
| Violation of human resources policy (fictitious salary payments) | 10% | Collect back taxes on personal income tax and social insurance contributions. |
| Cybersecurity risks (financial data leaks) | 10% | Administrative penalties and loss of credibility with customers. |
Through internal control system audits, experts can establish "checkpoints" at the stages with the highest rates of errors, thereby protecting cash flow and profits for owners.
The outstanding benefits of conducting periodic internal control system audits.
Investing in internal control system audits provides long-term value for businesses, helping to transform from passive to proactive management.
Optimizing business performance
By eliminating redundant processes and automating control steps, businesses can save on operating costs. Internal control system audits help identify bottlenecks in the approval process, leading to smoother workflows.
Ensuring compliance with laws and taxes.
As mentioned, tax regulations in Vietnam are very complex, with numerous guiding circulars such as Circular 80/2021/TT-BTCAuditing the internal control system ensures that tax records are prepared correctly, minimizing the risk of being assessed for tax liability by the tax authorities during an inspection.
Enhance credibility with stakeholders.
Banks and investors always highly value businesses with transparent internal control systems. The results of internal control system audits are valuable evidence of the management's governance capabilities, making it easier for businesses to access capital at preferential interest rates.
Common challenges and optimal solutions
Despite its many benefits, the process of auditing internal control systems also faces numerous obstacles, especially in small and medium-sized enterprises (SMEs).
Lack of cooperation from functional departments
Many employees view internal control system audits as a "nitpicking" activity. This leads to a defensive attitude and the provision of incomplete information.
Solution: Management needs to clearly communicate that the goal of the audit is to improve processes, support employees in working more efficiently and safely, and not to discipline them.
Limitations in resources and expertise.
Not all businesses have the budget to maintain a professional internal audit department. Performing internal control system audits in-house often lacks objectivity.
Solution: Outsourcing services from reputable organizations like MAN – Master Accountant Network is a smart choice, ensuring independence and expertise at a reasonable cost.
Conclude
Internal control system auditing is a guiding principle that helps businesses navigate safely in a volatile business environment. Building and evaluating a systematic control system not only helps prevent fraud risks but also demonstrates the organization's professionalism and transparency to investors and tax authorities. Investing in internal control is investing in the sustainable development of the business.
In the journey to optimize financial management, MAN – Master Accountant Network is proud to be a strategic partner providing auditing services and in-depth internal control system audits. With a team of experienced auditors who possess a deep understanding of Vietnamese tax and accounting laws, we are committed to providing valuable recommendations, helping businesses operate with peace of mind and enhance their market position.
Other services
- Financial statement audit services
- Internal audit services
- Internal Control System Assessment Service
- Auditing services on request
- Professional tax audit services
- Construction auditing services
- Completed project settlement audit service
Service contact information at MAN – Master Accountant Network
- Address: No. 19A, Street 43, Tan Thuan Ward, Ho Chi Minh City
- Mobile/Zalo: 0903 963 163 – 0903 428 622
- Email: man@man.net.vn
Content production by: Mr. Le Hoang Tuyen – Founder & CEO MAN – Master Accountant Network, Vietnamese CPA Auditor with over 30 years of experience in Accounting, Auditing and Financial Consulting.
Frequently Asked Questions about Internal Control System Audits
Are privately owned, unlisted companies required to conduct internal control system audits?
According to the 2015 Accounting Law, all accounting entities must establish an internal control system. However, auditing this system may not be legally mandatory as it is for listed companies, but it is extremely necessary to protect the owner's assets and avoid tax risks.
What is the cost of conducting an internal control system audit?
The cost depends on the size of the business, the number of branches, and the complexity of business processes. Typically, this cost represents only a very small fraction of the money a business could lose due to fraud or tax penalties.
How long does an internal control system audit take?
A standard audit typically lasts between two and four weeks, depending on how well-prepared the company's documentation is.
