Internal audit processes serve as a crucial third line of defense, helping businesses protect their value and optimize operations. In a volatile economic environment, implementing standardized procedures is not only a self-imposed requirement but also a legal responsibility. Decree No. 05/2019/ND-CPData from the Institute of Internal Auditors (IIA) shows that organizations implementing well-structured processes can reduce losses due to fraud and systemic errors by up to 451 TP3T.
Modern internal audit processes have extensively integrated technology and data-driven risk assessment. According to experts at MAN – Master Accountant Network, mastering the steps from planning to post-audit follow-up provides management with an objective view of the control system. This article provides a detailed roadmap to help accountants and auditors standardize their practices according to international standards and current regulations in Vietnam.
Legal basis and definition of internal audit process
Before delving into the details, we need to understand the legal regulations governing this activity. In Vietnam, the internal audit process is built upon a key legal framework including the Accounting Law 2015, Decree 05/2019/ND-CP on mandatory subjects, and Circular 8/2021/TT-BTC Vietnam issued the Internal Auditing Standards.
Internal auditing is a systematic series of activities aimed at evaluating the appropriateness and effectiveness of internal controls and risk management. This process goes beyond simply examining financial figures. It extends to assessing operational efficiency and compliance with internal regulations and applicable laws within the enterprise.
Phase 1: Planning in the internal audit process
The planning phase is considered the guiding principle for the entire audit. A small mistake in this step can lead to wasted resources or the omission of material risks that affect the final outcome.
Define the objectives and scope of the audit.
Auditors need to clarify the purpose of the audit: to assess compliance, operational efficiency, or the accuracy of financial statements. The scope of the audit will be limited to a specific time period or a particular department or process, such as asset procurement or warehouse management.
Gather information and conduct a preliminary risk assessment.
In the process internal auditTherefore, a thorough understanding of the unit's current situation is mandatory. Information to be gathered includes the organizational chart and internal procedures. financial reports The most recent data and the results of previous audits are used. Based on this data, the auditor identifies potential risks through the following risk matrix:
| Type of risk | The likelihood of it happening | Impact | Risk score | Audit orientation |
| Payment fraud | High | Big | 9/10 | Check 100% payment voucher |
| Accounting errors | Medium | Fit | 6/10 | Sampling experiment |
| Violation of tax regulations | High | Big | 8/10 | Review tax settlement documents |
Develop a detailed audit program.
The audit program is a document that provides specific guidance on the steps to be taken in the field. It includes audit procedures (interviews, observations, recalculations), personnel assignments based on expertise, and a detailed schedule for each stage of the process.
Phase 2: Conducting internal audit (Fieldwork)
This is the stage of direct interaction with the audited entity to gather the most complete and appropriate evidence.
Assessing the suitability of the control design.
Before conducting an operational audit, auditors need to assess whether the current process has any design flaws. For example, a single person both proposing and approving a payment is a serious control error. Internal audit procedures require identifying these weaknesses from the outset of the field survey.
Perform control tests and baseline tests.
To demonstrate that the control system is effective, auditors conduct walkthrough testing, compliance testing, and substantive testing on original documents. According to Article 14 of Circular 8/2021/TT-BTC, evidence must be reliable and directly relevant to the audit objectives, and working records must be systematically archived.
Record and exchange preliminary results.
All findings from the internal audit process must be documented in working papers. When errors are discovered, auditors should immediately communicate with the responsible officer at the unit. This helps to objectively verify the facts and avoid unnecessary misunderstandings due to lack of information or data discrepancies.
Phase 3: Audit Reporting
The ultimate product of the internal audit process is a constructive report that helps the organization improve its current management systems.
Analyzing causes and assessing impacts
Instead of simply pointing out monetary errors, the report should clarify whether the cause stems from personnel incompetence or software vulnerabilities. Simultaneously, auditors must assess the impact, such as the risk of tax penalties, asset losses, or the potential for material misrepresentation in the financial statements.
Develop recommendations for improvement.
Recommendations must be feasible according to the SMART model. If a business faces complex tax issues, auditors may recommend using professional tax advisory services from MAN – Master Accountant Network to ensure compliance and optimize legal costs.
The process for drafting and releasing official reports.
The report issuance process includes drafting, soliciting feedback from the audited entity, and holding a closing meeting to resolve any contentious issues. Once finalized, the official report is signed and sent to the Board of Directors and the Management Board for implementation.
Phase 4: Follow-up and monitoring after the audit
The audit is only truly complete when the recommendations have been implemented. This is the most crucial stage in creating practical value for the business within the internal audit process.
Monitoring remediation progress
The audited entity is responsible for developing a specific action plan. The internal audit department will periodically review the progress of these commitments. If a material risk remains unaddressed, the auditor must promptly report it to the Supervisory Board or the Board of Directors.
Evaluating the effectiveness after editing
Auditors not only examine implementation but also assess whether the measure actually reduces risk. Sometimes, a new corrective action may create a different risk that needs to be identified and addressed in the next internal audit cycle.
New developments in the internal audit process.
Internal audit processes are shifting strongly towards digitalization with three main trends: AI-powered auditing to scan data, continuous auditing in real time, and a focus on ESG (Environmental, Social, and Governance) risks in line with sustainability trends.
In Vietnam, large corporations are applying IFRS standardsThis necessitates that internal audit processes enhance their ability to evaluate complex accounting estimates. This change requires auditors to continuously update their knowledge of the latest technologies and international standards.
The role of technology and data in the internal audit process.
Technology today doesn't replace humans, but it's completely changing the way steps in the traditional internal audit process are carried out.
Data Analytics
Instead of manually selecting samples, auditors use SQL, Python, or Power BI to analyze unusual trends in cash flow. This technique helps quickly detect fraudulent activities such as suppliers sharing the same address as company employees or unusual duplicate transactions.
Audit Management Software
Using specialized software helps to centrally store working papers and manage scientific recommendations. This system ensures data continuity and high transparency for the internal audit process across multiple periods, making retrieval and comparison more convenient.
Comparison table of internal audit and independent audit
To clearly differentiate between these two types, MAN provides the following comparison table of core criteria:
| Criteria | Internal audit | Independent audit |
| The subject of execution | Unit employees or outsourced staff | Independent auditing organization |
| Main purpose | Support for governance and risk management. | Verify the accuracy of financial statements. |
| Reporting responsibility | Board of Directors, Management Board | Shareholders, government regulatory agencies |
| Implementation process | Continuous internal audit process | According to the annual periodic audit. |
| Scope | All business activities | Focus on the financial numbers. |
Conclude
The internal audit process is a continuous journey to improve the governance and control system. Implementing this process not only helps comply with laws such as Decree 05/2019/ND-CP but also builds trust with partners. A well-structured process from planning to monitoring will create sustainable added value for the organization.
In a complex business environment, companies need professional partners to optimize their internal audit processes. MAN – Master Accountant Network is proud to offer comprehensive solutions in this area. auditing servicesContact us for expert advice to help your business grow confidently and optimize its legal benefits.
Other services
- Financial statement audit services
- Internal audit services
- Internal Control System Assessment Service
- Auditing services on request
- Professional tax audit services
- Construction auditing services
- Completed project settlement audit service
Service contact information at MAN – Master Accountant Network
- Address: No. 19A, Street 43, Tan Thuan Ward, Ho Chi Minh City
- Mobile/Zalo: 0903 963 163 – 0903 428 622
- Email: man@man.net.vn
Content production by: Mr. Le Hoang Tuyen – Founder & CEO MAN – Master Accountant Network, Vietnamese CPA Auditor with over 30 years of experience in Accounting, Auditing and Financial Consulting.
Frequently Asked Questions about the Internal Audit Process
Which entities are required to conduct internal audits under Vietnamese law?
According to Decree 05/2019/ND-CP, the mandatory entities include state-owned units, state-owned enterprises, listed companies, and parent companies in which the state holds more than 50% of the charter capital operating under a parent-subsidiary model.
Is an internal audit process necessary for small and medium-sized enterprises?
Although not legally mandated, SMEs should still adopt streamlined processes to protect assets and prevent losses. This helps optimize operating costs and build a solid governance foundation from the outset.
How much does it cost to build a professional internal audit department?
Costs vary depending on size but are often quite high if building an in-house team. Many businesses choose to outsource services from firms like MAN – Master Accountant Network to ensure professional quality while saving budget.
Do internal auditors need a professional license?
Auditors need a university degree in a relevant field and professional knowledge. However, possessing an international certification like CIA will help affirm professional competence and credibility in the eyes of investors.
How can we ensure the independence of the internal audit process?
Independence is ensured when the audit department reports directly to the Board of Directors or the Audit Committee. This helps prevent interference from the Executive Board in the scope and results of the audit.
