From a general perspective, internal audit is independent and objective assurance and advisory activity designed to add value and improve the operations of the audited entity.
HOW MANY TYPES IS INTERNAL AUDIT IN ROMANIA?
Internal audit can take several forms, namely public internal audit, private sector internal audit and financial internal audit. In principle, carrying out an internal audit, whatever form it takes, involves several steps: planning the audit, preparing the audit assignment, performing the audit assignment, reporting the results and following up the recommendations.
Public internal audit is a “functionally independent and objective assurance and advisory activity designed to add value and improve the activities of the public entity; it helps the public entity achieve its objectives through a systematic and methodical approach, assesses and improves the efficiency and effectiveness of risk management, control and governance processes.” Public internal audit is also organized and carried out in accordance with Law No. 672/2002 on Public Internal Audit, republished, with subsequent amendments and additions.
Public internal auditing requires that the personnel involved in this activity be independent from the internal control mechanisms and from the execution of the operations subject to public internal auditing.
Internal audit specialists perform their duties within an organizational unit dedicated to public internal audit, and public entities with an expenditure budget exceeding 2 billion lei per fiscal year are obliged to set up a consultative body for public internal audit (composed of 5-7 experts).
It is important to note that there are several forms of public internal audit, namely:
- System audit – involves in-depth assessment of management and internal control mechanisms);
- Performance audit – through it the examination of the parameters established for the achievement of goals and duties);
- Regularity audit – concerns the analysis of the financial impact of actions on public resources;
- Information technology audit – involves assessing risks, policies, procedures, operations, operations, applications, data management and infrastructure.
The audit process is carried out at least once every four years, according to annual and multi-annual strategies. Public internal audit findings and recommendations must be implemented, otherwise a detailed written justification must be prepared.
Internal audit in the private sector is, according to the Institute of Internal Auditors (IIA), “an independent, objective assurance and advisory activity designed to add value and improve an organization’s operations. It helps an organization achieve its objectives through a systematic and disciplined approach to evaluating and improving the effectiveness of risk management, control and governance processes.” The legislation applicable to this type of audit is the Companies Act No. 31/1990 republished, as amended and supplemented, the Government Emergency Ordinance No. 75/1999 on the activity of financial audit and the International Standards for the Professional Practice of Internal Auditing issued by the IIA.
With regard to internal audit in the financial sector, it ensures the organization’s compliance with applicable legislation and the optimization of financial processes.
It provides additional assurance to management on the correctness of financial and fiscal operations, thereby helping to reduce the associated risks and improve the overall financial performance of the organization. From the perspective of the relevant incident regulations, the legislation applicable to this type of audit is Government Emergency Ordinance No. 99/2006 on credit institutions and capital adequacy and ASF Regulation No. 1/2019 on the assessment and approval of members of the management structure and persons holding key positions in entities regulated by the ASF.
WHO IS REQUIRED TO HAVE INTERNAL AUDIT IN ROMANIA?
As regards the public sector, as a rule, institutions are obliged to organize a public internal audit department. Therefore, in the public sector, all central and local public entities, national companies/societies, autonomous regions and commercial companies with majority state capital, as provided for in the Administrative Law and Tax Law, are obliged to carry out public internal audit.
As regards private sector entities, they will be required to carry out internal audit if they are among the companies whose securities are admitted to trading on a regulated market. This obligation also exists for joint-stock companies that meet at least two of the following criteria: total assets – more than RON 16 million, net turnover – more than RON 32 million and average number of employees – more than 50.
In the financial sector, credit institutions, insurance/reinsurance companies, financial investment services companies, investment management companies, collective investment undertakings and non-bank financial institutions are obliged to carry out internal audit.
