Types of audit: who calls it, who it works for, and which audit does the law require?

Eleven people work in Gulnora's bakery. The bread is sold both to shops and to private customers. One day three people said three different things. The bank: "Bring an auditor's report for the loan." Her younger brother Aziz: "Sister, the till is a little short every month, someone should check." And the accountant: "I don't know whether the law makes us have an audit." All three say "audit", but they are talking about three different things. Today we will tell them apart.

How do we tell the types of audit apart?

In the first lesson we saw that audit is an independent check, and in the second we learned why it gives reasonable assurance rather than a guarantee. Now the question is: who does the checking, and why? By asking two different questions about the same check, we split it into types.

• Who carries it out? If it is an independent auditor from outside the company, that is external audit. If it is the company's own employee or department, that is internal audit.
• Why is it carried out? If it is because the law requires it, that is mandatory audit. If it is because the owner, the bank or a partner asked for it, or the company itself wants it, that is voluntary (initiative) audit.

These two questions are not linked to each other. An external audit can be both mandatory and voluntary. Internal audit, on the other hand, is usually run on the company's own decision. Look at the table below, and then we will open each one in turn.

These differences are also covered in the article "What is the difference between external and internal audit?". Here we will see how both work in one company.

Who is external audit for, and why from outside?

In the first lesson Rustam heard "everything is fine" from his salesperson and called in an independent person. That is the essence of external audit: if the person who prepared the statements judges their own work, trust is low. The auditor, by contrast, is independent of the company. The people who read the auditor's opinion are also mostly outside: the bank decides on a loan, the investor on their money, and the owner, from a distance, on their decisions, based on it.

As we said in the second lesson, an external auditor does not give an absolute guarantee: they give an opinion on whether the statements are prepared fairly in all material respects. International standards on auditing are the standards of auditing activity in Uzbekistan (Law on Auditing Activity, Article 9), so the external auditor's work rests on those standards.

The report Gulnora gives the bank is exactly this type: the bank needs to see that an independent person has looked at the company's statements.

What does internal audit look at, and how does it differ from external audit?

Internal audit looks not so much at the statements as at the work itself: how the cash is kept, who signs when goods are received, who can change prices. Its result is not an opinion but recommendations written to the manager. The company organises it itself, so an internal auditor works in the same organisation as the owner of the processes being checked. For that reason an internal auditor cannot be fully independent in the way an external auditor is. That does not mean the work is worthless: they know the company from the inside and keep watch all year round.

The bakery's cash shortage: how both auditors see the same thing

Aziz began counting the till at the end of every month. This is internal audit: simple, but regular. In the books this money sits in account 5010 "Cash in national currency". He wrote the difference between the book balance and the actual count in a table (in soum, hypothetical):

Let us check the arithmetic: the shortages are 60 000 + 80 000 + 90 000 = 230 000 soum. The takings for three months are 4 600 000 + 5 200 000 + 5 300 000 = 15 100 000, for the other nine months 39 900 000, a total of 55 000 000 soum. By the count, 55 000 000 − 230 000 = 54 770 000. The shortage as a share is 230 000 / 55 000 000 ≈ 0.42%.

At the end of the year the external auditor came. The difference is 0.42 percent of 55 million soum. The auditor sets the materiality threshold themselves (there will be a separate lesson on this), so I am not saying "this is immaterial"; I leave that debate to the auditor. But one thing is clear: as a single annual figure this difference may not look large. Internal audit, however, saw it three separate times and caught the pattern: the shortage appears only in months 4, 7 and 10, that is, once every three months, and it keeps growing a little. In the annual total figure this pattern is not visible.

Because Aziz found this pattern, he wrote a report for his sister: the person who closes the till and the person who counts it must be different people. It is useful to show this report to the external auditor: they see that the company has internal control and plan their check accordingly.

Two things are visible from the example. Internal audit checks often, so it has time to correct. External audit does not replace internal audit, and internal audit does not replace external audit. The question of one is "is our work organised properly?", and of the other "are the statements reliable?".

Mandatory audit and voluntary audit

Now let us turn to the question Gulnora's accountant asked: does the law make us have an audit?

Mandatory audit is carried out in cases where the law requires it. Which companies must undergo mandatory audit, and by what criteria, is set in legislation. Here I give no threshold, sum or type of company: if I wrote it without a source, it might be wrong. The accountant should get a precise answer from the legislative document itself and from an audit firm. Do the same for your own company.

Voluntary (initiative) audit is one the law does not require, but someone has asked for it. In Gulnora's case the bank asked for a report for the loan. Other examples: an owner wants the first bakery's statements checked before opening a second; a new partner wants to see the statements before joining. The audit method is the same; the only difference is the reason: here the reason is not the law but need.

Practical advice

1. First put the question clearly: who, why and for whom is it needed? That question decides which type to choose.
2. Check for yourself, from the legislative document, whether mandatory audit applies to you. If a friend says "that's how it is with us", that is not a source.
3. You do not need a big department to start internal audit. If one person, like Aziz, counts one process (the till, the warehouse) once a month and writes down the difference, that is already internal audit.
4. Write the difference down month by month. The annual total hides the pattern.
5. Show the external auditor the internal audit's written reports: they see that you have control.
6. An internal auditor should not do the work they check. If Aziz counts the till, he should not be the one who receives the money.

Next lesson

In the fourth lesson we look at the auditor and the audit firm themselves: what independence means, and why an auditor must not do the work of the company they are checking.