CFEC-Afrique performs all or part of the internal audit function, as an outsourced service or alongside your own team, in line with the IIA’s Global Internal Audit Standards. We design or assess the internal control system against the COSO framework, then draft the procedures manual and the delegations of authority that go with it. Governance, risk management and compliance (GRC) are followed through continuous monitoring: risk register, indicators, automated tests and alerts. Management keeps its responsibilities; independence rules govern every engagement.
Three components of a single framework
Outsourced internal audit
- Full outsourcing or co-sourcing of the function
- Internal audit charter and risk-based plan
- Thematic engagements and on-site reviews
- Reports to management and the audit committee
Internal control & procedures
- Assessment against COSO: five components, seventeen principles
- Administrative, financial and accounting procedures manual
- Delegations of authority and segregation of duties
- SOX documentation and testing for subsidiaries of US-listed groups
GRC & continuous monitoring
- Risk mapping and risk register, appetite and tolerance thresholds
- Risk and control matrix and key risk indicators (KRIs)
- Regulatory monitoring and compliance testing
- Dashboards for management and the audit committee
Continuous auditing and continuous monitoring: distinct responsibilities
Continuous auditing is an audit activity. Continuous monitoring is performed by management and operational teams.
The auditor’s approach
Continuous auditing
The auditor uses automated tests and data analytics at regular intervals to assess risks and controls. Some tests may cover every transaction within a defined population. The results inform further audit work and conclusions.
Management’s system
Continuous monitoring
Management establishes controls and alerts to identify unusual transactions and departures from rules. Designated staff investigate alerts and decide what action to take. This monitoring forms part of the organisation’s internal control.
We can support either approach, depending on the engagement. Coordinating them can provide more timely assurance on risks and controls, provided that audit independence, access rights and responsibilities remain clearly defined.
Continuous monitoring tools
Automated extraction
Connectors to your ERP, bank statements and software robots: data are collected at regular intervals, without re-keying.
Testing the defined data population
Configured rules can be applied to all available transactions within the defined scope. Our in-house AI helps identify unusual items; a professional reviews the exceptions.
Alerts and follow-up
An exception triggers an alert sent to a named person; its analysis and resolution are traced through to closure.
GRC dashboards
Risk register, key risk indicators, status of controls and action plans, available to management and the audit committee.
What we do
- Outsourced or co-sourced internal audit services, drawing on the IIA’s Global Internal Audit Standards.
- Risk-based internal audit plan, discussed with management and submitted to the board or audit committee for approval in accordance with the governance arrangements.
- Design or assessment of the internal control system against the COSO framework: five components, seventeen principles.
- Drafting and updating of the administrative, financial and accounting procedures manual, delegations of authority and access-rights matrices.
- Process reviews: purchasing, treasury, payroll, inventories, fixed assets, sales.
- Sarbanes-Oxley (SOX) compliance: documentation and testing of controls at subsidiaries of groups listed in the United States.
- Deployment of a GRC system: risk mapping and risk register, risk and control matrix, key risk indicators and monitoring of regulatory compliance.
- Continuous auditing programme and design of ongoing management controls: automated data extraction, test rules, alert thresholds and exception-handling workflows.
- Automation of tests with software robots (RPA) and automated reading of documents with computer vision.
- Periodic reports to management, the audit committee, the board of directors or the donor.
Complementing periodic audits with ongoing assessment
Examples of automated tests
Our approach
Map
Processes, risks and key controls are identified with your teams and mapped against the organisation’s objectives.
Design and document
Controls, procedures and delegations are defined or improved with the managers concerned, then approved by management.
Configure
Each key control is given a test rule, a frequency, an alert threshold and an owner.
Test continuously
Available data is extracted and tested at the agreed frequency. Data quality, the relevance of the rules and exceptions are subject to professional review.
Report
Each exception is explained or corrected by the designated owner; dashboards and periodic reports give management and the audit committee an up-to-date view of the system.
Reports and deliverables
- Internal audit charter and risk-based internal audit plan; engagement reports.
- Internal control assessment report based on COSO and a procedures manual ready for distribution.
- Risk map, risk and control matrix and GRC dashboards.
- Action plans tracked through to closure.