The scope and objectives of internal audit activities vary widely and depend on the size and structure of the entity and the requirements of management and those charged with governance.

Internal audit activities might include:

• Monitoring of internal control – reviewing controls, monitoring their operation and recommending improvements to them.

• Examining financial and operating information by:
o Reviewing the means used to identify, measure, classify and report financial and operating information.
o Inquiring specifically into individual items including detailed testing of transactions, balances and procedures.

• Reviewing the economy, efficiency and effectiveness of operating activities including non-financial activities of an entity. • Reviewing compliance with:
o Laws, regulations and other external requirements.
o Management policies, directives and other internal requirements.

Examples of internal audit services that involve assuming management responsibilities include:

• Setting internal audit policies or the strategic direction of internal audit activities.
• Directing and taking responsibility for the actions of the entity’s internal audit employees.
• Deciding which recommendations resulting from internal audit activities to implement.
• Reporting the results of the internal audit activities to those charged with governance on behalf of management.
• Performing procedures that form part of the internal control, such as reviewing and approving changes to employee data access privileges.
• Taking responsibility for designing, implementing, monitoring and maintaining internal control.
• Performing outsourced internal audit services, comprising all or a substantial portion of the internal audit function, where the firm or network firm is responsible for determining the scope of the internal audit work; and might have responsibility for one or more of the matters noted above.