Internal Audit Function

What the law requires

• a joint-stock company with assets at a book value above 100,000 BCV (44 billion soums at a BCV of 440,000) must establish an internal audit service (Article 108 of the Law on Joint-Stock Companies);
• the service reports to the supervisory board, or to the audit committee if there is one;
• the supervisory board establishes the service, appoints its staff and hears its reports every quarter;
• the service oversees the executive body and branches, the reliability of accounting and reporting, and the safeguarding of assets;
• the procedure for the service's activity is set by the Cabinet of Ministers.

Reporting lines decide everything

If the head of internal audit reports to the finance director, they cannot objectively audit the finance function. Functional reporting to the owner or the supervisory board is not a formality but a condition for the function to work.

The annual audit plan

• Built on a risk assessment, not on the principle of "let's audit everyone in turn"
• Approved by the body to which the function reports
• Leaves time in reserve for unscheduled audits at management's request
• Includes follow-up on remediation of previously identified weaknesses

How to tell the function is working

The measure of effectiveness is not the number of audits or the volume of reports, but the share of identified weaknesses that are actually fixed. A function whose recommendations go unimplemented for years is not doing its job, however many reports it issues.