Challenges facing South African private healthcare

Get Complete Project Material File(s) Now! »

Chapter 3 Internal Audit

Corporate risk management is a natural fit for internal auditing involvement. Modern internal auditors are accustomed to identifying and evaluating risks, and they typically have extensive knowledge of the overall business
Walker et al., 2002: 16

Introduction

To achieve its business objectives, management should ensure that sound risk management processes are in place and functioning. Boards have an oversight role to determine that appropriate risk management processes are in place and that these processes are adequate and effective. Internal auditors should assist both management and the board by examining, evaluating, reporting and recommending improvements on the adequacy and effectiveness of management’s risk processes (IIA Standards, 2002).
Rarely are demands for professionalism, knowledge, integrity, and leadership more stringent than those placed on today’s internal auditors. Effective auditors serve as the businesses corporate consciousness and they champion operational effectively, internal control, and risk management. They can also educate and make recommendations to management and the board of directors to support the business in meeting is goals and objectives.

Aim

The aim of this chapter will be to introduce internal auditing, its governing body and the role that the activity can play in the corporate risk management initiative of the healthcare financing organisation.

The Institute of Internal Auditors Inc.

The Institute of Internal Auditors Inc. (IIA) was established in 1941 and serves nearly 85,000 members in internal auditing, governance and internal control, IT audit, education, and security worldwide. The IIA provides for certification, education, research, and technological guidance, it also serves as the profession’s watchdog and resource on significant auditing issues around the globe (www.theiia.org.).
In the years preceding the incorporation of the IIA in 1941, growth and expansion made it increasingly difficult for organisations to maintain control and operational efficiency. The shift to a war economy further expanded organisations’ responsibilities for scheduling, availability of materials and labourers, compliance with government regulations and an increased emphasis on cost reduction (ibid.).
Management found it impossible to visually observe all of the operating areas in their respective areas of responsibility or to have sufficient personal contact with individuals who directly or indirectly reported to them. In seeking ways to deal with these new problems, management appointed special staff people to review and report on what was happening. These people came to be known as internal auditors (Sawyer et al., 1996).
The internal auditing function varied greatly as to the number of people assigned to perform it and in the scope and nature of the work being done. In some organisations, internal auditors were used to check on routine financial and operational activities with a heavy emphasis on compliance, security, and detection of fraud. In others, internal auditors were given higher levels of status and were asked to analyse and appraise more substantive financial and operational activities. As the profession evolved, a number of internal auditors began pushing vigorously for greater understanding and recognition of their function, and began to develop contacts and relationships with professionals in other organisations in an attempt to share problems and to advance their common interests (ibid.).
John B. Thurston, head of the internal auditing function at the North American Company utility company, was among the first to push vigorously for greater understanding and recognition of the internal auditing function. He is credited with being the person most responsible for the creation of the IIA. Thurston was joined in his thinking by Robert B. Milne, general auditor of the Columbia Engineering Corporation, and Victor Z. Brink, a former auditor and Columbia University educator who authored the first major book on internal auditing (www.theiia.org.).
Thurston, Milne, and Brink, acting as an organising committee, contacted 40 friends and associates from the utilities industries, public accounting firms, and other industries, 25 of whom agreed to participate in forming a new organisation for internal auditors. Seventeen individuals attended an organisational meeting on September 23, 1941, at the Williams Club in New York City and agreed to start a new professional organisation for internal auditors. Thurston was appointed interim organising director and Arthur E. Hald of Consolidated Edison Co. was asked to oversee creation of a charter and bylaws (ibid.).
On November 17, The IIA’s Certificate of Incorporation was filed which officially established The IIA’s name; recognised the IIA as a membership corporation; and identified corporation’s specific purposes, which were:
“To cultivate, promote, and disseminate knowledge and information concerning internal auditing and subjects related thereto; to establish and maintain high standards of integrity, honour, and character among internal auditors; to furnish information regarding internal auditing and the practice and methods thereof to its members, and of other persons interested therein, and to the general public; to cause the publication of articles relating to internal auditing and practices and methods thereof; to establish and maintain a library and reading rooms, meeting rooms, and social rooms for the use of its members; to promote social intercourse among its members; and to do any and all things which shall be lawful and appropriate in furtherance of any of the purpose herein before expressed.” (ibid.)
The IIA was a national organisation at the outset with several of its 24 original members hailing from both the East Coast and the Midwest of the United States. IIA membership grew to 104 members by the end of the first year, and increased to 1,018 at the end of five years and to 3,700 by 1957, with 20 percent of the latter located outside the United States (ibid.).
The IIA’s current mission is to be the primary international professional association, organised on a worldwide basis, dedicated to the promotion and development of the practice of internal auditing. The IIA is committed to (ibid.):

• Providing, on an international scale, comprehensive professional development activities, standards for the practice of internal auditing, and certification.
• Researching, disseminating, and promoting to its members and to the public throughout the world, knowledge and information concerning internal auditing, including internal control and related subjects.
• Establishing meetings worldwide in order to educate members and others as to the practice of internal auditing as it exists in various countries throughout the world.
• Bringing together internal auditors from all countries to share information and experiences in internal auditing and promoting education in the field of internal auditing.

In June of 1999, the IIA’s Board of Directors voted to approve a new definition of internal auditing and a new Professional Practices Framework. Both were based on the recommendations of the Guidance Task Force, a special committee of IIA charged with examining the adequacy of current standards and guidance for the practice of internal auditing. The Task Force concluded that a significant gap existed between available guidance and current practice and that a new framework was needed to carry the profession into the 21st century. In order to meet this goal, The IIA has developed the Professional Practices Framework (PPF). In general; the framework provides a structural blueprint of how a body of knowledge and guidance fits together. As a coherent system, it facilitates consistent development, interpretation, and application of concepts, methodologies, and techniques useful to a discipline or profession. Specifically, the purpose of the PPF is to organise the full range of internal audit guidance in a manner that is readily accessible on a timely basis. By encompassing current internal audit practice as well as allowing for future expansion, the PPF is intended to assist practitioners throughout the world in being responsive to the expanding market for high quality internal audit services (IIA Standards, 2002).
Throughout the world, internal auditing is performed in diverse environments and within organisations that vary in purpose, size, and structure. In addition, the laws and customs within various countries differ from one another. These differences may affect the practice of internal auditing in each environment. The implementation of the PPF, therefore, will be governed by the environment in which the internal audit activity carries out its assigned responsibilities. No information contained within the PPF should be construed in a manner that conflicts with applicable laws or regulations. If a situation arises where information contained within the PPF may be in conflict with legislation or regulation, internal auditors are encouraged to contact The IIA or legal counsel for further guidance (ibid.)
The Professional Practices Framework consists of three categories of guidance: Standards and Ethics, Practice Advisories, and Development and Practice Aids. The first category (Mandatory Guidance) consists of core materials: the Code of Ethics and the International Standards for the Professional Practice of Internal Auditing (Standards). All mandatory guidance has been submitted for review by the profession through the exposure draft process and is considered to be essential for the professional practice of internal auditing. Other elements of the Framework are linked to these Standards (ibid.).
The purpose of IIA’s Code of Ethics is to promote an ethical culture in the profession of internal auditing. A code of ethics is necessary and appropriate for the profession of internal auditing, founded as it is on the trust placed in its objective assurance about risk management, control, and governance (ibid.).
Standards, as described within the PPF, are the criteria by which the operations of an internal audit department are evaluated and measured. They are intended to represent the practice of internal auditing as it should be. The Standards are meant to serve the entire profession of internal auditing, in all types of organisations where internal auditors are found. Within the new framework, the Guidance Task Force called for the development of three sets of standards: Attribute, Performance, and Implementation Standards. The Attribute Standards address the attributes of organisations and individuals performing internal audit services. The Performance Standards describe the nature of internal audit services and provide quality criteria against which the performance of these services can be measured. The Attribute and Performance Standards apply to all internal audit services. The Implementation Standards expand upon the Attribute and Performance Standards, providing guidance applicable in specific types of engagements. These standards ultimately may deal with industry-specific, regional, or specialty types of audit services (ibid.).
Compliance with the concepts enunciated in the mandatory guidance is essential before the responsibilities of internal auditors can be met. As stated in the Code of Ethics, internal auditors shall perform internal audit services in accordance with the Standards. All members of the IIA and all Certified Internal Auditors agree to abide by the Standards and Code of Ethics, and this guidance is intended to be applicable to all members of the internal audit profession, whether or not they are members of the IIA (ibid.).
To be widely applicable, mandatory guidance must necessarily be somewhat generic in nature. Therefore, the PPF includes two additional categories of guidance. Guidance in the second category, the Practice Advisories (formerly known as Guidelines) are strongly recommended and endorsed by The IIA. Although not mandatory, Practice Advisories represent best practices endorsed by the IIA as ways to implement Standards. In part, Practice Advisories may help to interpret the Standards or to apply them in specific internal audit environments. Many Practice Advisories are applicable to all internal auditors, while others may be developed to meet the needs of internal auditors in a specific industry, audit specialty, or geographic area. All Practice Advisories are submitted to a formal review process by the IIA’s Professional Issues committee or other group designated by the Guidance Planning Committee (ibid.).
The third category of guidance (Development and Practice Aids) includes a variety of materials that are developed and/or endorsed by the IIA. This category includes research studies, books, seminars, conferences, and other products and services related to the professional practice of internal auditing that do not meet the criteria for inclusion in mandatory guidance or Practice Advisories. Development and practice aids can help to implement the guidance offered in the Code of Ethics, Standards, and Practice Advisories. Development and practice aids provide internal audit practitioners with the views of various experts on techniques and processes related to the professional practice of internal auditing (www.theiia.org).

Internal auditing activity

As mentioned earlier, the IIA redefined internal auditing in June 1999. The revised definition being (IIA Standards, 2002):
“Internal Auditing as an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by brining a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes”
The internal auditing profession worldwide is undergoing significant reengineering (Gupta, 2001: 3-5). This reengineering is involving the optimal restructuring of internal audit functions to focus on core and support business processes thereby aiding organisations in achieving their business objectives in risk intelligent ways.

Summary 
List of Figures 
List of Tables 
Chapter 1 Introduction 
1.1 Background
1.2 Challenges facing South African private healthcare
1.3 Purpose and reason for study
1.4 Research methodology
1.5 Summary and conclusion
Chapter 2 Risk
2.1 Introduction
2.2 Aim
2.3 Origin of risk
2.4 Human perception of the risk concept
2.5 Philosophy of the risk concept
2.6 Definition of risk
2.7 Summary and conclusion
Chapter 3 Internal Audit 
3.1 Introduction
3.2 Aim
3.3 The Institute of Internal Auditors Inc.
3.4 Internal auditing activity
3.5 Internal auditing of the corporate risk management methodology
3.6 Summary and conclusion
Chapter 4 Corporate Risk Management 
4.1 Introduction
4.2 Aim
4.3 Beginnings of risk management
4.4 Reasons and benefits of corporate risk management
4.5 Corporate governance requirements
4.6 Defining corporate risk management
4.7 Corporate risk management in South Africa
4.8 Summary
4.9 Conclusion
Chapter 5 Private Healthcare 
5.1 Introduction
5.2 Aim
5.3 United States and Europe
5.4 The business of a medical aid scheme
5.5 Roles and responsibilities of governing bodies
5.6 Roles and responsibilities of medical scheme administrators
5.7 Statutory financial reporting
5.8 Empirical survey results
5.9 Summary
5.10 Conclusion
Chapter 6 Medical Scheme Risks 
6.1 Introduction
6.2 Aim
6.3 Risks faced by the private healthcare administration organisation
6.4 Summary and conclusion
Chapter 7 Methodology Initiation 
7.1 Introduction
7.2 Aim
7.3 Corporate risk management methodology
7.4 Implementation feasibility
7.5 Adopt goals, objectives and oversight
7.6 Corporate risk management in South Africa
7.7 Summary
7.8 Conclusion
Chapter 8 Common Language and Strategies 
8.1 Introduction
8.2 Aim
8.3 Common language
8.4 Risk tolerances
8.5 Risk management strategies
8.6 Corporate risk management in South Africa
8.7 Summary
8.8 Conclusion
Chapter 9 Uniform Process & Facilitation 
9.1 Introduction
9.2 Aim
9.3 Uniform process
9.4 Facilitation
9.5 Corporate risk management in South Africa
9.6 Summary
9.7 Conclusion
Chapter 10 Project Management and Continuous Improvement
10.1 Introduction
10.2 Aim
10.3 Project management
10.4 Continuous improvement
10.5 Corporate risk management in South Africa
10.6 Summary
10.7 Conclusion
Chapter 11 Conclusion 
11.1 Summary
11.2 Areas of further research
11.3 Conclusion
Annexures
GET THE COMPLETE PROJECT