The emergence and development of internal audit is a long historical process, which has gone through three stages: ancient internal audit, modern internal audit and modern internal audit. Modern internal audit began in America. 194 1 year is considered as the beginning of modern internal audit. Before 1940, in the United States, internal audit was only the assistant of external accounting companies. At 194 1, Victor. Brink completed his doctoral thesis in new york University, and expounded the breakthrough research results of internal audit, including the nature and scope of internal audit. Brink pointed out that internal audit should be the server of company management, not the assistant of external audit (external accounting company audit). With this paper, Brink became the "originator" of the "internal audit" discipline in the United States. In the same year, JohnBThurston, director of the internal audit department of North American companies, wrote a monograph on internal audit, entitled "Principles and Techniques of Internal Audit". Brink also published the first comprehensive and systematic book "Principles and Practice of Internal Auditing" in the United States on 1942. This book has been constantly updated, and the fifth edition was published on 200 1. The above events show that the system theory of internal audit has begun to take shape, which is the first turning point of internal audit.

From 65438 to 0978, the International Institute of Internal Auditors (IIA) formally promulgated the Code of Practice for Internal Auditing. This is the embryonic form of "internal auditing standards". Therefore, 1978 is a critical period for the development of internal audit in the United States, and it is also the second turning point in the historical development of internal audit. The first page of the Code of Practice for Internal Auditing is a comprehensive and rigorous definition of the concept of "internal auditing", which was quite perfect in the economic and auditing fields at that time. After the promulgation of this standard, it has been widely recognized by the auditing circles all over the world and has been translated into 9 languages.

From June, 65438 to June, 1999, the International Association of Internal Auditors and its research fund, after repeated discussions, research and soliciting opinions from all sides, formally promulgated the Internal Auditing Practice Framework. Just like the framework of financial accounting standards, the practical framework of internal auditing is the core of internal auditing standards, so1June 1999 is the third "historic turning point" in the historical development of internal auditing in the United States. Relevant documents have been issued one after another.

Internal audit practice framework

At present, the internal audit practice framework followed by internal audit in various countries includes three levels:

(1) The first level is mandatory, and its core content includes the definition of internal audit, code of ethics and code of practice of internal audit.

1. Definition of internal audit

In the latest definition of internal audit, the Institute of Internal Auditors defines internal audit as: "Internal audit is an independent and objective certification and consulting service, and its goal is to increase value and improve operation. It evaluates and improves the effectiveness of risk management, control and governance processes through a set of systematic and standardized methods to help organizations achieve their goals. "

2. Code of Ethics

The purpose of establishing moral standards is to promote the moral culture of the internal audit industry. Moral standards are necessary and appropriate for the internal audit profession, because internal audit is based on a kind of trust, which provides an objective guarantee for risk management, control and governance. The code of ethics extends the definition of internal audit.

3. Standards for Internal Auditing Practice

The internal audit code of practice consists of attribute code, performance code and implementation code. The attribute standard discusses the characteristics of organizations and individuals engaged in internal audit activities. Performance standards discuss the essence of internal audit activities and provide quality standards for measuring internal audit performance. Attribute standards and performance standards are applicable to all internal audit activities. The implementation guidelines apply attribute standards and performance standards to specific businesses (such as compliance audit, fraud investigation and control self-assessment). There is only one set of attribute standards and performance standards, but there may be multiple sets of implementation standards, and each set of standards corresponds to a major internal audit activity.

(2) The second level is practical advice (that is, the previous guide), which is not mandatory, but it has also been recognized by the International Association of Internal Auditors and is strongly recommended. It is helpful to explain the standards of internal auditing practice or apply them to a specific internal auditing environment. Although some practical suggestions may be applicable to all internal auditors, others are mainly used in specific industries, specific audit fields or specific regions.

(3) The third level is the development and practice guide, including all kinds of materials developed or approved by the International Institute of Internal Auditors, which is not mandatory. It includes research reports, books, seminars and other products and services related to internal audit practice, and is the most extensive part of the audit practice framework. The Development and Practice Guide is used to help implement the Code of Ethics, the Code of Practice and the Practical Advice, and to provide the best practical skills and skills.

Development of international internal auditing standards

The above briefly introduces the internal audit practice framework of the International Association of Internal Auditors, from which we can see the development of its concept and get some useful enlightenment.

From independence to objectivity

The old definition of internal audit by the International Institute of Internal Auditors is reflected in its statement on internal audit responsibility (revised version 1990): "Internal audit is an independent evaluation function established within an organization, with the purpose of inspecting and evaluating its activities and serving the organization. It should provide analysis, evaluation, suggestions, advice and information on inspection activities to assist members of the organization to effectively perform their duties. " By comparing the old and new definitions, we can notice that the International Institute of Internal Auditors emphasizes objectivity in the new definition.

In the traditional concept, "independence" is an important feature of internal audit and is also considered as an important requirement to ensure the effectiveness of internal audit. However, in essence, objectivity is a more fundamental and extensive concept. [2] In the process of drafting the new definition, the guiding working group did not use the concept of "independence" at first, nor did it intend to define it. They believe that the broad meaning of "objectivity" is a remarkable feature of the internal audit profession. The requirement of "independence" imposes unnecessary constraints on internal auditors, limiting who can provide services and what services they can provide. Moreover, putting "independence" above other concepts will make the internal audit department at a competitive disadvantage compared with external service providers when providing services, because the latter is often in a "more independent" position.

Internal audit departments can add value to enterprises because their analysis and suggestions on improving operation and control are objective. Independence is the means to ensure objectivity, and objectivity is the ultimate goal. Imagine that if the audit activity is independent, but it does not reflect the objective appearance of things for various reasons, then this activity will be inefficient and ineffective, and even lead to decision-making mistakes, which is very harmful. Conversely, as long as objectivity is guaranteed, there is no need to cling to independence. For internal audit, its formal independence is definitely not as good as external audit. It is absurd to think that internal audit is inferior to external audit.

For a long time, people often confuse the difference between goals and means. Although the purpose and the means should be unified, taking the means as the purpose will inevitably lead to the alienation of the purpose, and the means will eventually lose its meaning. The most obvious example is the rule-oriented accounting standard model originally advocated by the Financial Accounting Standards Committee. Due to blind attention to rules (that is, means), many companies finally took advantage of loopholes, resulting in false accounting scandals such as Enron and WorldCom. This model has caused at least the following problems:

(1) has no clear goal, and a lot of details cover up the intention of the code;

(2) Too many exceptions and boundary tests provide convenience for financial designers to obtain the required results;

(3) A large number of detailed guidelines, including a large number of contradictory treatment methods.

The Securities and Exchange Commission of the United States published a research report "Research on the adoption of principle-based accounting system in American financial reporting", arguing that it is necessary to abandon the rule-oriented model of the United States and the pure principle-oriented model advocated by the International Accounting Standards Committee and adopt the goal-oriented model. This clearly shows that the goal is the first, and the rules and even principles are just the means to achieve the goal. If the direction is wrong, the means will only go further and further on the wrong road, or even deviate from the goal faster; With the right direction, all means can be developed. For example, from a historical perspective, the evolution of independent audit objectives, that is, from checking errors and preventing fraud to verifying the fairness of financial statements, has been emphasized until now, and its audit techniques and methods have also changed or developed. The application of system-based audit and audit sampling has only developed to the stage of verifying the fairness of financial statements. Without this goal, the establishment of these methods and procedures is hard to imagine.

Therefore, these research achievements, successful experiences and failed lessons of the International Association of Internal Auditors provide a good reference for understanding the essence of internal auditing and then formulating China's own internal auditing standards.

What needs to be explained is not that the concept of independence is useless, but that it should play its role as a means. "Independence" is a variable, and its interpretation and importance depend on a series of factors, such as the industry type of enterprises, laws and regulations of regions and countries, and the nature of related services. Observing independence helps to achieve objectivity. In the current research of American Accounting Association, "independence" is expressed as "the ability to determine the scope of work and complete the work without hindrance", and the guiding working group finally adopted this understanding, retaining "independence" and holding that "internal audit activities should be undisturbed when determining the scope of internal audit, carrying out work and reporting results". The International Association of Internal Auditors believes that independence is aimed at audit activities and objectivity is aimed at internal auditors. Obviously, audit activities are based on internal auditors. In order to maintain objectivity, the International Institute of Internal Auditors believes that internal auditors:

(1) shall not participate in any activities or relationships that may or should damage its fair evaluation. Including activities or relationships that may conflict with the interests of the organization.

(2) They should not accept anything that may damage or may damage their professional judgment.

(3) All known important facts should be disclosed. As long as they are not disclosed, the report of the activities under review will be distorted.

(B) to expand the field of vision to the outside of the organization

According to the general understanding, internal audit seems to be carried out by people and institutions within the organization. However, this is a misunderstanding. In the new definition of internal audit by the International Association of Internal Auditors, the word "internal" has been abandoned. Internal audit is the internal audit business of an organization, and it is a concept of scope, which is different from the subjective concept of "audit business engaged by internal auditors". Although some people think that the concept of "internal" is the most important feature of the internal audit profession, it is flawed to retain this concept in theory. This wording tries to make the internal audit industry monopolize all related services and perform all functions, and tries to prevent outsiders from participating in the competition of internal audit services. Moreover, with the expansion of the scope of services, it becomes uneconomical to have all the needed technologies in enterprises, which also leads many enterprises to purchase services from outside, that is, the so-called externalization of internal audit. The only value of the concept of "internal" is that the internal audit service should still be managed by the enterprise, and should not be completely entrusted to the outside.

Part or all of the internal audit business is extended to the outside, and its obvious advantages are as follows:

1. Get economies of scale. The external audit organization is not only economical in organizational scale, but also economical in business scale. The high service cost can be compensated or shared by a large number of customers, so the lowest cost can be achieved under the same service or the more efficient service can be achieved at the same cost. Most of the audit business is done by people, but some parts need to use computer-aided technology and management analysis technology. The cost of software and hardware in these technologies is not what ordinary companies are willing or able to bear, but first-class accounting companies can and are willing to bear, because these fixed costs can be shared among a large number of customers.

2. Reduce the total cost. If an organization has established its own internal audit department, it needs to pay employees' salaries, training fees and management fees. Externalization of internal audit can save these expenses, and enterprises can only hire them when necessary to maintain the flexibility of expenditure control. That is, the fixed cost required to set up the internal audit department will be transformed into variable cost, and the uncontrollable cost will be transformed into the controllable cost of the management department. At the same time, if external auditors undertake internal audit, the methods and procedures of internal audit can be highly consistent with external audit, which means that external auditors can rely more on internal audit and enterprises can benefit from paying less audit fees.

3. Maintain an appropriate organizational scale. Almost every enterprise can benefit from the internal audit function, but for small and medium-sized enterprises, it is difficult to recruit top talents by setting up an internal audit department with only one or two people, and it is also impossible to establish enough expert opinion libraries. Accounting firms can effectively analyze risks and provide menu-based professional services to meet the different needs of customers in different periods.

4. Let the management pay attention to the core competitiveness. The daily audit of the internal audit department is often inefficient and may also distract the management. If the internal audit is externalized, enterprises can free up management time and resources, so that management can focus on core competitiveness and pursue more strategic goals instead of spending a lot of energy on low-return daily management.

5. Organizations have the initiative in outsourcing internal audit services. When an organization decides to outsource internal audit services, it can choose according to the specific situation of the enterprise and the advantages of different accounting firms, and to a great extent, it has mastered the initiative. In the process of receiving services, the board of directors and the audit committee can supervise the internal audit work, evaluate the service quality of external auditors and determine the completion of contracts. If they are not satisfied with their services, because there are other external personnel in the market who can provide internal audit services, enterprises can sign long-term price agreements with employers, or consider reintroducing internal audit institutions.

6. External audit institutions have advanced audit technology and rich audit experience, and some first-class accounting companies also have unique quality control and assurance systems.

Therefore, with the development of internal audit and the continuous improvement of external requirements for internal audit, the externalization of internal audit will be a trend. We should conform to the trend and break away from convention in order to enhance the value of this organization and help it achieve its goals.

(C) the ultimate goal of internal audit is to increase organizational value

Traditional internal audit theory holds that internal audit has the functions of economic supervision, economic management, economic evaluation and economic verification. This understanding is also reflected in the old definition of internal audit. In the latest definition of internal audit, the International Institute of Internal Auditors believes that "internal audit is an independent and objective certification and consulting service, and its goal is to increase value and improve the operation of the organization." This is completely different from the traditional "independent evaluation function" theory.

The proposal of "adding value and improving management" has made this profession full of unprecedented vitality. Under the traditional concept, internal audit is to reduce agency costs to a great extent, and people don't care about its contribution to enterprise management, which is often invisible. In today's highly competitive and cost-sensitive market, major companies divide their business processes into value-added processes and non-value-added processes, and then compress the non-value-added processes as much as possible, expecting everyone in the company to create value for them. In the final analysis, an organization can exist and survive only if it is valuable, otherwise it will have no place in society. Therefore, any activity can only be valued by the organization and survive if it creates or adds value to the enterprise. If the internal audit still adheres to the past position, it can only be eliminated. The new role orientation requires internal audit to actively participate in value creation activities, so as to win a place for its continued existence. If the internal audit is not aimed at increasing the value of the organization, it will not be tolerated by the organization. While participating in value creation, internal audit should show its contribution in the process of value creation to the world, and let the management department, board of directors and other stakeholders of the company know the necessity and importance of its existence, so as to maintain and improve its professional status. However, it should be noted that the range of reducing cost or improving efficiency should not be used as the standard to measure the performance of internal audit, which will weaken the objectivity of its work. Because the contribution of internal audit to value creation is often indirect.

At the same time, the activities that internal audit pays attention to are also promoted to the level of the whole organization, rather than the activities aimed at individuals or a certain department in the past. The core of its goal is to help an enterprise achieve its strategic goal, that is, to increase value, and at the same time, it also links internal audit with the core business processes and key success factors of the enterprise. With the improvement of attention, internal audit has changed from "functional thinking" of local functions to considering problems and proposing solutions from the overall value chain, which has promoted effective cooperation among various departments and aspects from a global and long-term perspective. This also expands the function of internal audit in essence, which requires that this factor be fully considered in the recruitment, training and team building activities of internal auditors.

(D) put risk management in an important position

In the field of auditing, the word "risk" seems to be more associated with independent auditing. Traditional internal audit also focuses on internal control system and operation mechanism. However, due to the uncertainty of the internal and external environment faced by enterprises under the market economy, the risks of enterprises generally increase, such as the lack of internal financial and business information, the failure to implement policy plans and standards, the loss of assets, the waste and ineffective use of resources, the change of external consumer preferences, the adjustment of national macro policies, and the turmoil in international financial markets. Therefore, enterprises urgently need internal audit to evaluate and improve the effect of risk management, control and governance process through a set of systematic and standardized methods. In order to meet this requirement, the new definition also adds the content of risk management. The overall management control mechanism of an enterprise is generally more inclined to link the management control system with the long-term goals of the organization and the risk of failing to achieve these goals. In order to help enterprises achieve their goals, we must attach importance to risk management. The new definition shows that control is no longer abstract and implicit, but can actually help organizations to carry out risk management and formulate effective management procedures, and there are many "correct" methods for each situation. The risk control system makes it necessary for internal auditors to constantly improve their control methods with the changes of global market and competitive nature, the emergence of new asset forms and the changes of information acquisition tools. The saying that "one control means is suitable for all kinds of control" and the general control mode no longer exist.

The risk control system also determines that certification and consulting services can create value for the organization. There are many successful examples in this regard. For example, a foreign trade group company has more than 10 subsidiaries. In the second half of 2002, the internal auditors of the group reviewed the signing and implementation of business contracts of these subsidiaries, and found that soybean meal alone accounted for 16% of the large-value import commodity contracts of more than RMB 10, involving an amount of RMB 500 million. According to international practice, the purchase of soybean meal must sign a futures contract six months in advance. All subsidiaries import soybean meal at the same time. For the whole group, it takes too much money in a certain commodity, which will inevitably increase business risks. The internal auditor immediately suggested to the management of the group that the soybean meal import should be hedged to avoid the operational risk brought by the price drop. Sure enough, there was a bumper harvest of soybean meal in South America in 2002, and the price of soybean meal in the international market plummeted all the way. The internal auditor's advice saved the group from a loss of nearly 200 million yuan.

With the integration of international economy and China's entry into the World Trade Organization, the competition among enterprises will become more and more fierce. Internal audit has irreplaceable advantages in helping enterprises achieve their goals, so it is paid more and more attention by management authorities. However, China's internal audit needs to be improved both in theory and practice. How to seize the opportunity and develop the internal audit profession while improving the competitiveness of enterprises is a major issue faced by every internal auditor.