Internal Audit and Compliance: The difference
By: Chomwa Shikati
Tags: Business, Company, Internal Audit, Compliance, Audit

Internal audit and compliance are both very essential functions in an organisation. In recent years, Compliance and Internal Audit have risen in importance, both signifying critical control components of an organization’s structure.

However, Compliance and Audit serve two very different roles in an organisation.

How so?

First of all, the Compliance function is meant to reasonably ensure that the company is complying with all applicable laws, rules and regulations, as well as internal codes of conduct, policies and procedures. The Internal Audit function is designed to monitor and evaluate the company’s internal control environment as to its adequacy, efficiency and effectiveness.

Therefore, Compliance’s objective is fundamentally operational. Looking at the present and towards the future to ensure that all activities are carried out in compliance with the prevailing regulatory requirements, because the appropriate policy and procedures are in place and being adhered to.

The internal Audit’s objective is fundamentally assurance. Looking at the past and present to provide assurance that all activities are being carried out in accordance the written policy and procedure.

Note the roles that these two functions play in the three line defence in corporate governance.

Compliance function mainly plays a second line of defence role within corporate governance, but it also has a place in the first line of defence for its own activities with ownership, responsibility and accountability for directly assessing, controlling and mitigating risks.

In this role the compliance function is responsible to monitor various specific risks such as noncompliance with applicable laws and regulations.

Internal Audit plays a third line of defence role within corporate governance, which is more independent than the other two lines of defence. Internal audit provides the independent assurance of the process and control in place not only about the end process owner, but the second life of defence risk management function as well.

Finally, the Compliance Function is concerned with regulatory risk only, and the scope therefore of operations is more restricted than that of the Internal Audit Function, who are concerned with all risks to the organisation.

Can internal audit and compliance professionals better collaborate for the benefit of their organization?

Absolutely. The two functions must work cooperatively. Audit and compliance — working together — are uniquely positioned to help the board and management understand the importance of an integrated approach to governance activities that enables wise resource use, prevents undesirable outcomes, and grasps advantages for achieving business objectives.

To ensure an effective coordination of activities between these two functions, it is essential that the two functions leverage a common language of risk and control. A common methodology for compliance and internal audit leads to an agreement about the definition of risk types and risk thresholds.

And of course Compliance must be audited to make sure that they are doing what they have said they will do.

What have I left out? Share your thoughts and comments in the section below.