Tóm tắt Luận văn Improving internal audit organization at Baoviet holdings

MINISTRY OF EDUCATION AND TRAINING

MINISTRY OF FINANCE

ACADEMY OF FINANCE

NGUYEN THI PHUONG THAO

IMPROVING INTERNAL AUDIT ORGANIZATION

AT BAOVIET HOLDINGS

Specialized in Accounting

Code no.: 9.34.03.01

DOCTORAL DISSERTATION ABSTRACT

HANOI, 2019

The dissertation is accomplished at:

ACADEMY OF FINANCE

Scientific Supervisor: 1. Assoc.Prof.Dr.PHAM TIEN HUNG

2. Dr. TRAN VAN HONG

Counter Argument 1: .............................................................................

..................................................................................................................

Counter Argument 2:..............................................................................

..................................................................................................................

Counter Argument 3:..............................................................................

..................................................................................................................

The dissertation will be defended at Doctoral Dissertation Assessment

Council for Academic Level

Location:

Time:

After the publication, the thesis will be stored at:

- National Library of Vietnam

- Academy of Finance Library

LIST OF WORKS PUBLISHED BY THE AUTHOR

RELATING TO THE DISSERTATION

1. Nguyen Thi Phuong Thao (2019), Experience of organizing internal

auditing of insurance enterprises in the world and lessons for Vietnam,

Journal of Accounting and Auditing, 3/2019 (186), p.39 – 42.

2. Nguyen Thi Phuong Thao (2019), Characteristics of insurance

enterprises affecting internal audit organizations in enterprises, Journal

of Auditing Studies, 3/2019 (137), p.41 – 45.

3. Nguyen Thi Phuong Thao (2019), Information technology audit in

internal audit at Baoviet Holdings - Situation and solutions, Journal of

Accounting and Auditing,, 6/2019 (189), p.42 – 46.

1

INTRODUCTION

1. The urgency of the research topic

IA (IA) is an important part in the corporate governance structure of most large

companies in the world. The IA was born in the 1960s and developed very strongly in

the 80s of the 20th century in the field of manufacturing and business. Currently, IA is

developing strongly and increasingly going into all areas.

In theory, in recent years, there have been many researches of domestic and

foreign scientists studying the theory of organizing IA in enterprises. However, there

has not been any research focusing on fully and comprehensively the contents of

organizing IA in enterprises in general and insurance sector in particular. In practice,

Baoviet Holdings (BVH) has built an IA department that is an effective support of the

Board of Directors as well as the Executive Board, contributing to support Baoviet

Holdings in achieving its business goals. However, the contents of organizing IA at this

is still not fully and effectively, needing to be completed in a more scientific and

reasonable manner..

Stemming from the requirement to complete in theory and in practice, the research

on the topic "Improving IA organization at Baoviet Holdings" is urgent and

meaningful in theory and practice.

2. Literature review

The author gives an overview of domestic and abroad resaerches related to the

dissertation’s topic in two groups: Domestic and abroad researches on organizing IA in

general; Domestic and abroad researches on specific contents of organizing IA include:

organizing to build up IA charter and organizing IA apparatus in enterprises; organizing

to apply IA’s approaches and techniques in enterprises; organizing to determine the

content of IA in enterprises; organizing IA’s process in enterprises; organizing quality

control for IA in enterprises; organizing IA’s files and working papers in enterprises.

The researches include textbooks, dissertations, topics and articles related to the

dissertation topic, such as: Internal Auditing in Business by Phan Trung Kien (2015) ,

Internal Auditing by Nguyen Phu Giang and Nguyen Truc Le (2015), Modern Internal

Auditing by Brink by Moeller (2009), "Internal Audit Hanbook" by Henning Kagermann

et al. (2008), "Internal Audit: Efficiency through Automation" by David Coderre (2009),

Dissertation "Improving the internal audit organization in Vietnam construction

enterprises" by Phan Trung Kien (2008) , "Improving the internal audit organization in

economic groups" by Nguyen Thi Hong Thuy (2010), "Organizing the internal audit at

Vietnamese financial companies" by Le Thi Thu Ha (2011), "Improving the internal

audit at corporations under Vietnam national coal and mineral industry holding

corporation" by Vu Thuy Ha (2016); researches “A symbiotic relationship: when the

audit committee includes best practices for internal auditing in its charter, both groups

can benefit” by Bailey James (2007), “The European literature review on internal

2

auditing” by Allegrini, M., D'Onza, G., Paape, L., Melville, R. and Sarens, G. (2006);

"The perceived effectiveness of audit committees in the South African public service" by

Van der Nest (2008),“The use of internal audit by Australian companies” by Jenny

Goodwin-Stewart & Pamela Kent (2006), “The internal auditing pocket guide:

Preparing, performing, reporting and follow up” by Russell (2007), “Internal Audit

Quality: Developing a quality assurance and improvement programe”by Sally Anne Pitt

(2014); surveys such as Internal Audit Function in Large Financial Institutions by IIA

Spain (2013), North America Pulse of Internal Audit by IIA (2018), …

Through the liturature review, the author found that these researches have studied

both theory and practice of organizing IA in enterprises. However, up to now, there has

been no complete and comprehensive research on IA organization in enterprises on

specific contents. This is the gap that the dissertation of the author will study to clarify

and show that the dissertation topic is really necessary and topical.

3. Research objectives

The research objectives of the t dissertation include:

+ Research, systematize, clarify and supplement the theory of IA and IA

organization in enterprises combined with research on international experience on

organizing IA in enterprises around the world to draw lessons about organizing IA;

+ Presenting and analyzing the current situation of organizing IA in BVH,

indicating the achieved results, limitations and analyzing the objective and subjective

reasons of the limitations as a basis for proposing solutions to improve the IA

organization at BVH;

+ Research solutions to improve the IA organization at BVH.

4. Research subjects and scope

4.1. Research subjects

The dissertation focuses on researching theoretical issues, surveying and analyzing

practices on IA organization in enterprises, researching practical situations in BVH.

4.2. Research scope

 Content scope:

+ In theory: The dissertation provides general research on the IA and IA

organization in enterprises.

+ In practice: The thesis studies the current situation of IA organization at BVH,

include: organizing to build up IA charter and organizing IA apparatus; organizing to

apply IA’s approaches and techniques; organizing to determine the content of IA;

organizing IA’s process; organizing quality control for IA; organizing IA’s files and

working papers.

 Time scope: The dissertation studies the status of IA organization at Baoviet

Holdings in 2014-current.

3

 Spatial scope: The dissertation researches and assesses the status of IA

organization at BVH and its wholly owned subsidiaries, including: Baoviet Insurance

Corporation, Baoviet Life Corporation and Bao Viet Fund Management Co Ltd.

5. Research questions

The author selected the practical research method on Internal Audit organization at

BVH with questionnaires and depth interviews. The main purpose of the author is to

answer questions:

- What is the rationale for organizing IA in enterprises?

- What is the current status of organizing IA at BVH?

- What are the main causes that limit the role and efficiencyof the IA organization at BVH?

- What is the solution to improve the IA organization at BVH?

6. Research methods

6.1. Methodology

The dissertation is based on the dialectical materialism and historical materialism

of Marxism - Leninism.

6.2. Technical methods

6.2.1. Data collection methods

- The method of document research including the stages of analysis, synthesis,

systematization and generalization of theories as well as practical research works of the

authors in domestic and abroad that have been published on books and magazines on

issues related to IA at insurance.

- Depth interview method was used to consult the leaders of the IA Department,

the IA divisions and internal suditors at BVH.

- Investigation method to study the current status of IA organization in BVH. The

author uses the results of the questionnaire survey to synthesize and analyze the situation of

the IA organization at BVH in terms of organizing to build up IA charter and organizing IA

apparatus; organizing to apply IA’s approaches and techniques; organizing to determine the

content of IA; organizing IA’s process; organizing quality control for IA; organizing IA’s

files and working papers. Since then, giving advantages and limitations as a basis for

proposing solutions and recommendations to complete the IA organization at BVH.

- Case study method is used to analyze some practical working papers IA

organization at BVH. This research method helps in-depth study in some cases, thereby

illustrating and clarifying the interview ideas collected.

6.2.2. Data processing methods

+ The author perform summarizing, classifying and mapping the survey results

from the questionnaire survey submitted for comments received, the results of direct

interviews, research results of audit files at BVH , documents of seminars, synthesis of

domestic and foreign.

4

+ Based on the results of this survey, the author summarizes the results to

compare, analyze and assess the current status of IA organization at BVH, and specify

the outstanding advantages, limitations and causes of limitations as the basis for

making complete solutions.

7. Contributions of the dissertation

In theory: The dissertation has systematized and clarified theoretical issues about

IA and IA organization including: organizing to build up IA charter and organizing IA

apparatus in enterprises; organizing to apply IA’s approaches and techniques in

enterprises; organizing to determine the content of IA in enterprises; organizing IA’s

process in enterprises; organizing quality control for IA in enterprises; organizing IA’s

files and working papers in enterprises.

In practice:

+ The dissertation has described the actual situation of internal audit organization

at Bao Viet Group including organizing to build up IA charter and organizing IA

apparatus; organizing to apply IA’s approaches and techniques; organizing to determine

the content of IA; organizing IA’s process; organizing quality control for IA;

organizing IA’s files and working papers. The dissertation also analyzes and compares

the status of IA organization at BVH with the theory and points out the advantages,

limitations and causes of limitations.

+ On the basis of analyzing the situation and basic theory which have been

systematized and supplemented, the disseertation proposes solutions to improve the

organization of IA at BVH. The solutions proposed by the dissertation are systematic,

practical and feasible. Thereby contributing to improving the quality and efficiency of

organizing IA at BVH.

8. The dissertation structure

In addition to the Introduction, Conclusion, List of References and Appendices,

the structure of the dissertation consists of 3 chapters as follows:

Chapter 1: Rationale for organizing IA in the enterprises

Chapter 2: Actual situation of organizing IA at BVH

Chapter 3: Solutions to improve IA organization at BVH

Chapter 1

RATIONABLE FOR INTERNAL AUDIT ORGANIZATION IN THE

ENTERPRISES

1.1. GENERAL OVERVIEW OF INTERNAL AUDIT IN ENTERPRISES

1.1.1. The concept, functions, roles and principles of internal audit in the enterprise

This section presented and analyzed clearly the concept, function, role and

principles of IA in enterprises (including independence, objectivity, compliance with

laws and regulations, professionalism)

5

1.1.2. Some basic issues of internal audit in enterprises

This section presented and analyzed some basic issues of Internal Audit in enterprises

including IA charter and IA apparatus; IA’s approaches and techniques; the content of IA;

IA’s process; quality control for IA; IA’s files and working papers in enterprises.

1.1.3. Internal audit and risk management in enterprises

This section presented and analyzed the types of risks of enterprises (for example

specific to insurance enterprises) and the relationship between IA and risk management

in enterprises.

1.2. OVERVIEW OF ORGANIZING INTERNAL AUDIT IN ENTERPRISES

1.2.1. Concept of organizing internal audit in the enterprise

After presenting and analyzing the concepts of "organize" in the Vietnamese

Dictionary of the Institute of Linguistics, Wikimedia Open Encyclopedia, Vietnamese

Dictionary, according to Victor Z. Brink and Herbert Witt, the group authors Mason

Carpenter, Talya Bauer, Berrin Erdogan, the group Harold Koontz, Cyril Odonnell and

Heinz Weihrich, from the perspective of management, , the dissertation has given the

concept of organizing IA as follows: "Organizing IA is the process of arranging and

arranging the work in a certain order, assigning and distributing resources of IA

department to ensure the achievement of the goals effectively”The thesis also analyzes

to clarify each element in the concept of organizing IA.

1.2.2. Bases for organizing internal audit in the enterprise

Bases for organizing IA in enterprises include: Standards, regulations on IA and

related legal documents; principles and international practices on IA; The role and

function of IA in enterprises; Requirements of business managers.

1.2.3. Factors affecting internal audit organization in the enterprise

This section presented and analyzed clearly the internal and external factors affecting

the internal audit organization in the enterprise in terms of organizing to build up IA

charter and organizing IA apparatus; organizing to apply IA’s approaches and techniques;

organizing to determine the content of IA; organizing IA’s process; organizing quality

control for IA; organizing IA’s files and working papers. Internal factors include:

characteristics of enterprises; Features of management activities and scale, organizational

structure of enterprises; Awareness of managers and other departments in the enterprise on

IA; IA resources of enterprises. External factors include: International practices on IA in

enterprises; Standards and legal rules on IA in enterprises.

1.3.CONTENTS OF ORGANIZING INTERNAL AUDIT IN ENERPRISES

1.3.1. Organizing to build up internal audit charter and organizing internal

audit apparatus in enterprises

1.3.1.1. Organizing to build up internal audit charter

The Chief of IA discussed with the Executive Board and the BOD/ Audit

6

Committee (AC) to agree on some contents of the IA chater. After discussion and

agreement, the Chief of IA will be responsible for drafting the IA charter and submit it

to the Executive Board, the BOD/ AC for approval.

The IA charter after approval should be made public throughout the enterprise to

raise the awareness of the departments, functional departments and related parties about

the IA.

1.3.1.2. Organizing internal audit apparatus in enterprises

Organizing IA apparatus in enterprises an be considered on the following main

contents: organizing to determine the position and structure of the IA; organizing the

IA personnel and build the relationship of the IA with other divisions in enterprises

(*) Organizing to determine the position and structure of the IA in enterprises

- IA position in enterprises: The IA position depends on the functions and duties

of the IA, which is defined by enterprises, and is consistent with the overall goals of the

enterprise and the goals for each specific activity. The IA position in enterprises

depends on the perceptions of managers that may belong to the BOD/AC, and the

Executive Board.

- IA structure in enterprises: IA structures that can be applied include: centerlized

structure, decenterlized structure and mixed structure.

(*) Organizing the IA personnel in enterprises

Organizing the IA personnel in enterprises includes organizing to select and

appoint Chief of IA and orgazizing the IA personnel resources.

- Organizing to select and appoint Chief of IA

Audit committee consults Control Board, BOD before submitting to the BOD for

approval to appoint the Chief of. Audit committee, Control Board, BOD consider the

selection Chief of IA. After that, Audit Committee submits to the BOD to appoint Chief

of IA.

- Orgazizing the IA personnel resources

Orgazizing the IA personnel resources in enterprises includes organizing to

recruit IA personel; organizing to train IA personel; arranging, supervising,

commending and disciplining works and organizing code of behaviour.

+ Organizing to recruit IA personel

The Chief of IA proposes to recruit the IA personnel, the BOD approves, the HR

department organizes the recruitment in the form of enterprises and coordinates with

the IA department when evaluating the candidates' professional qualifications.

+ Organizing to train IA personel

Participants in the IA training organization may include Chief of IA, IA staff,

training department, BOD or external experts. The training of internal auditor can be

through different methods.

7

+ Organizing to arrange, supervise, commend and discipline works of IA personel

Chief of IA, head of departments, IA seniors are responsible for organizing this

work. The way to implement the reward and disciplinary mechanism may be using the

management by objectives method, KPIs, ... or according to the regular evaluation of

the Chief of IA.

+ Organizing to build up code of IA behaviour in enterprises

Participants in organizing to build up code of IA behaviour in enterprises include

Chief of IA, BOD/Audit Committee (AC) and internal auditors. AC discuss and agree

with BOD, submit code of IA behaviour to BOD for approval..

(*)Organizing to build up the relationship of the IA with other divisions in

enterprises

Enterprises need to build up the relationship of the IA with other divisions in

enterprises include AC, BOD, DN cần tổ chức xây dựng mối quan hệ của KTNB với

các bộ phận trong DN bao gồm UBKT, HĐQT, Excutive Board, other divisions and

external auditor, state audit. To organize this work, the BOD should promulgate

regulations and rules on the coordination between the IA and these departments. At the

same time, the IA and related departments must always be clearly aware of their role in

coordination to carry out their activities well.

1.3.2. Organizing to apply internal audit’s approaches and techniques

1.3.2.1. Organizing to apply internal audit’s approaches in enterprises

The organization of applying the risk-based approach is implemented AC/BOD,

Chief of IA and internal auditor. The BOD/AC specifies in the IA charter, regulation or

policy of the enterprises on the audit approach, building the audit process based on a

risk-based approach. Chief of IA, internal auditor applies the risk-based approach when

performing IA activities.

1.3.2.1. Organizing to apply internal audit’s techniques in enterprises

The determination of the IA techniques applied in each audit is conducted by the

IA senior and the internal auditors assigned to perform the audit. Some techniques

commonly used include: Manual audit techniques (checking, observation, interview,

confirmation, calculation, analytical procedure, etc.) and auditing techniques using IT

applications. The method of determining the IA techniques applied is based on factors

such as the objective of the audit, the risk level of the audit, the IA resources, the IA

document.

1.3.3. Organizing to determine the content of internal audit in enterprises

Organizing to determine the content of IA in enterprises includes organizing to

determine the annual IA contents and IA contents for each IA. Participants in

determining the content of IA comprise Chief of IA and assigned internal auditors.

Bases for defining the content of the annual IA (or each IA) is the IA objectives.

8

1.3.4. Organizing internal audit’s process in enterprises

1.3.4.1. Organizing to build up internal audit plan

(*) Organizing to build up the annual IA plan

The Chief of IA prepares an overall audit plan for the whole year to ensure

consistency with the audit strategy that has been identified, risk-based, focus on

departments and processes that have high risk (based on result of annual risk

assessments). Organizing to build up the annual IA plan includes: Organizing to

identify objectives and subjects of IA; Organizing to draft the annual IA plan;

Organizing to discuss, approve and issue the annual IA plan.

(*) Organizing to build up the IA plan for each audit

Based on the approved annual IA plan, the Chief of IA assigns a team to organize

a detailed plan for each audit or consultant proposed in the annual plan before

conducting the field audit. . Organization of the IA plan for each audit includes

organizing to assess detailed risk, organizing to determine the audit scope, organizing

to build up the audit program, organizing to build up schedule and resource allocation,

organizing to summary and build up audit plan.

1.3.4.2. Organizing to implement internal audit

(*) Organizing a short meeting at the audited entity

Before starting the audit, the IA team should have a short meeting with the audited

entity to discuss the scope, objectives, time of the audit and agree on how to coordinate

the audit team and the entity during the audit..

(*) Organizing to select samples based on a defined sample size

On the basis of the sample size determined at the audit program, the internal

auditors collect information about the sample population and uses the sampling

technique to select audit samples. The auditors can perform sampling based on two

main methods: statistical sampling and non-statistical sampling.

(*) Organizing to implement the audit according to the audit plan and program

Based on the audit program, the IA senior is responsible for managing and

directing the internal auditors to perform the audit work. Internal auditors apply both

manual audit procedures and audit procedures using IT when performing audits.

(*) Organize to record of information and save audit results on working papers

The information collected during the entire IA process must be recorded and

stored in working papers (WPs) to support the conclusions and opinions given by the

IA. The Chief of IA should provide guidance for recording the IA document and is

often presented in the IA process and policy manual.

1.3.4.3. Organizing to summary IA’s result and prepare IA report

(*) Organizing to summary IA’s result and prepare IA report for each audit

9

The IA senior is responsible for organizing to the summary and classify the audit

results, organizing to draft the report of each audit before discussions with related

parties on the audit results. After discussion and agreement, The IA senior updated the

audit report. When preparing the audit report, the IA senior should pay attention to not

only describing detected frauds, but also need to explain the cause, compare the

business process with general practices, from which appropriate solutions and

recommendations. The IA report is submitted to the Chief of IA for approval before

sending and releasing the report.

(*) Organizing to summary IA’s result and prepare annual IA report

Based on the audit results of each IA, the assigned team summarizes and

classifies the annual audit results of the IA department, prepare a draft annual IA report.

The Chief of IA is responsible for reviewing and approving the annual IA report and

reporting to the AC/ BOD and managers of enterprises. Reports can be discussed

directly through meetings, seminars and telegraphs or by sending documents; or the

report may be published in summary or complete form depending on the type of report

and the recipient. For the IA report of each audit, the recipient is the managers of the

audited entity, the BOD/AC, the Executive Board. For the annual internal audit report,

the recipients are the BOD/AC and the Executive.

1.3.4.4. Organizing to follow-up the implementation of recommendations

(*) Organizing to follow-up regularly

The IA Department is responsible for assigning the team to assess the

implementation of the auditors' recommendations. The evaluation team receives the IA

report and organizes to evaluate the implementation of recommendations for the

assigned entities. Organizing to follow-up regularly is carried out according to the

following contents: Organizing to request entities and sections to make reports on the

implementation of recommendations, organizing to inspect of the implementation of

recommendations according to report and inspect the implementation of

recommendations at the audited entities.

(*) Organizing to follow-up preodically

Based on the results of assessing the implementation of recommendations, the IA

team is assigned to summarize the results, prepare a draft report on the implementation

situation. The Chief of IA is responsible for reviewing and approving the draft before

reporting to the AC/BOD and entities’ managers. After the approval of Chief of IA, the

report on the implementation of recommendations is formulated and sent officially.

It should be noted that this is the process when the IA performs the assurance

function, the procedure for the implementation of the advisory function when

performing IA is similar to this procedure but there is no follow-up phase for

recommendation implementation, replaced with supporting to implement

recommendations. Specifically, the process of performing the consulting function

10

includes: Planning, Implementation, Summary of results and preparation of advisory

reports, Support to implement recommendations.

1.3.5. Organizing quality control for internal audit in enterprises

(*) Organizing internal assessments

- Organizing to supervise regularly

Chief of IA is generally responsible for the monitoring of IA activities. The

regular supervision expressed through supervision is carried out at each audit including

the following contents: Organizing the approval of audit programs, audit plans, audit

reports and other arising matters; Reviewing audit documents, Monitoring and

evaluating progress and results of the IA (the most common and effective method in

monitoring audit progress is the Gantt diagram.); Use appropriate measures to evaluate

IA performace.

- Organizing periodic assessments

Periodic self-assessment of IA activities can be conducted through the following

methods: Regularly reviewing and approving internal rules, IA regulations and other

relevant documents, Reviewing annual IA plans based on the risks of enterprises,

Review the documents, files of internal auditors on a sample basis, compare them with

general practices, and consider compliance with mandatory regulations, Reviewing

criteria of evaluating IA activities.

(*) Organizing external assessments

Independent assessments are conducted by independent external experts to assess

the quality and compliance of the IA. There are two methods of conducting

independent assessments: done entirely by a team of independent experts or by the

enterprise itself and with independent certification.

1.3.6. Organizing of internal audit files and working papers in enterprises

The auditing team directly performs the audit will be responsible for archiving

WPs of the audit and under the control of the senior, the Chief of IA. For the general IA

files that involve multiple audits, the Chief of IA is responsible for the control of these

records. Normally, the IA WPs can be divided into groups: permanent files,

administration files, current files, files of computer-assisted audit procedures.

1.4. ORGANIZING INTERNAL AUDIT IN SOME ENTERPRISES IN THE

WORLD, AND LESSONS FOR VIETNAMESE ENTERPRISES

The dissertation presents and analyzes the IA organization status in some major

corporations in the world such as Prudential PLC and Manulife, thereby giving lessons

for Vietnamese enterprises.

CONCLUSION OF CHAPTER 1

In chapter 1, the author systematized, clarified and supplemented the general theory

of organizing IA with different specific contents. The author presented and analyzed on the

11

basis of organizing IA in enterprises, analyzed the factors affecting the IA organization in

the enterprise, presented and analyzed the content of the IA organization in the enterprise,

presented and analyzed in detail about the internal audit organization in enterprises, at the

same time summarized the experience on organizing IA of some enterprises in the world.

The content of chapter 1 has created a theoretical foundation for the author to study the

situation in chapter 2 and propose solutions in chapter 3.

Chapter 2

CURRENT SITUATION OF ORGANIZING INTERNAL AUDIT

AT BAOVIET HOLDINGS

2.1. OVERVIEW OF BAOVIET HOLDINGS AND INTERNAL AUDIT AT

BAOVIET HOLDINGS

2.1.1. Overview of Baoviet Holdings

The dissertation has generalized about the process of formation and development,

business lines and organizational structure, business performance of .

2.1.2. Overview of internal audit at Baoviet Holdings

The dissertation presented and analyzed the concepts, positions, functions and

tasks of the IA at BVH; The relationship between IA and risk management at BVH.

2.2. CHARACTERISTICS OF ORGANIZING AT BAOVIET HOLIDNGS

2.2.1. Basis for organizing internal audit at Baoviet Holdings

The disertations presented and analyzed the bases for organizing internal audit at

the special forces including: standards, regulations on IA and related legal documents;

operating principles and international practices on IA, functions of IA at BVH, the

BVH's business characteristics, the requirements of managers.

2.2.2. Factors affecting internal audit organization at Baoviet Hodings

The dissertation presented and analyzed the factors affecting the IA organization

of BVH. These factors include internal factors (Business operation characteristics of

special equipment, Development strategy of special equipment, characteristics of

organization and management of special equipment, Awareness and expectations of

SCT managers on Internal Audit, Internal Audit resources of SEDC and external

factors include (best practices on Internal Audit in enterprises and standards, legal

regulations on Internal Audit in Enterprises in Vietnam).

2.3. CURRENT SITUATION OF ORGANIZING INTERNAL AUDIT AT

BAOVIET HOLDINGS

Through the survey, direct interview and researching of documents and audit files,

the author summary and analyze current situation of organizing internal audit at

Baoviet Holdings as follow:

12

2.3.1. Organizing to build up internal audit charter and organizing internal

audit apparatus at Baoviet Holdings

2.3.1.1. Organizing to build up internal audit charter at Baoviet Holdings

The IA Department has developed the IA charter, which is reflected in the

Regulation on the organization and operation of IA Department, issued together with

the Decision No. 1039/2015 / QD-HĐQT July 2015 of the BOD of BVH. However,

this regulation does not contain the content of quality control, applicable IA standards

and reporting mechanism. Besides, this regulation has only been updated on the

software "Bao Viet Dictionary" at the parent company of BVH, 100% owned

subsidiaries cannot access this regulation.

2.3.1.2. Organizing internal audit apparatus at Baoviet Holdings

(*) Organizing to determine the position and structure of the IA at BVH

- IA position at BVH

The IA Department is a part of the AC-BOD, established and operating in

accordance with international advanced management practices.

- IA structure at BVH

BVH organizes the structure centralized IA, that is, it only organizes the IA

Department at the Parent Company, not in the subsidiaries. Currently, the IA

Department has 3 divisions, including the non-life insurance division, the life insurance

division and the investment division with 41 internal auditors. (2018).

(*) Organizing the IA personnel at BVH

- Organizing to select and appoint Director of IA and head of divisions

+ Organizing to select and appoint Director of IA: AC will consult the AC and the

Remuneration and Appointment Committee before submitting to the BOD on the

appointment of the Chief of IA. The AC, Control Board, and BOD considered selecting

the Director of the IA Department.

+ Organizing to select and appoint Head of IA divisions: The selection and

appointment of Head of IA divisions is made by the Director of IA. IA department

conducts and submitts to the AC/BOD for approval.

- Organizing the IA personnel resources

+ Organizing to recruit IA personel at BVH: The recruitment organization is

jointly implemented by HR department and IA department, recruiting mainly from

external sources or recruiting excellent employees from the professional departments,

the three priority recruitment requirements are qualification; work experience and

foreign language ability.

+ Organizing to train IA personel at BVH: Human Resource Department,

Training Center, IA Department combine to do training oganization for IA. The internal

auditor is mainly trained on the job and hires outside experts.

13

+ Organizing to arrange, supervise, commend and discipline works of IA

personel: Director of IA, Head of IA divisions, audit manangers, audit seniors do

this work.

+ Organizing to build up code of IA behaviour in enterprises at BVH

Currently, BVH has not developed an IA code of behaviour to ensure raising

the sense of responsibility of the Internal Audit, the prestige of the IA department

in the BVH.

(*)Organizing to build up the relationship of the IA with other divisions at BVH

BVH has issued the Regulation on internal coordination between the IA

deparment and its related parties at BVH and its subsidiaries invested 100% of charter

capital.

2.3.2. Organizing to apply internal audit’s approaches and techniques at BVH

2.3.2.1. Organizing to apply internal audit’s approaches at BVH

BVH has specific provisions on the applied IA approach which is applied and has

developed the IA process according to the risk-based approach. The IA Department has

adopted a risk-based approach when conducting IA.

2.3.2.1. Organizing to apply internal audit’s techniques at BVH

At BVH, the determination of the IA techniques used in each audit is conducted

by IA senior and the IA assigned team to perform the audit at the subsidiaries. The

determination of the techniques applied is based primarily on the objective of the audit.

IA at the BVH mainly used manual auditing techniques, less used IT methods.

2.3.3. Organizing to determine the content of internal audit at BVH

Determining the content of the IA of each division, each field will be discussed

by the Head of IA Divisions with the Director of the IA Department, then the Diretor

of IA will approve and submit to the BOD for approval. Results of direct interviews

with the leaders of the IA divisions and department showed that, BVH maily

conducted an audit to assess the effectiveness and efficiency of internal control

processes and evaluates the effectiveness and effectiveness of activities, financial

statements audits and IT audits are rarely conducted. BVH has not yet implemented

the advisory function, so has not yet organized to determine the content to perform the

advisory function.

2.3.4. Organizing internal audit’s process at BVH

2.3.4.1. Organizing to build up internal audit plan at BVH

(*) Organizing to build up the annual IA plan at BVH

The Director of IA is responsible for preparing the audit plan, focusing on

departments and processes that have high risk (based on result of annual risk

assessments and consider some other factors) . At BVH, each IA division prepares

its own annual audit plan and submit it to the Director for approval, the assigned

14

staffs summarizes the audit plans of the divisions and make an annual audit plan for

the deparment, submits to the IA Director for review and approval before submitting

to the BOD.

The dissertation presents and analyzes the organization of building up annual IA

plan including: Identifying the objectives, objects of the annual IA; organizing to draft

the annual IA plan, organizing to discuss, approve and issue the annual audit plan.

(*) Organizing to build up the IA plan for each audit at BVH

Based on the approved annual IA plan, the Head of IA divisions assign the IA

team to organize to build up a detailed plan for each assurance or advisory audit

proposed in the annual plan before conducting the field audit. Specifically include

organizing to assess risks (inherent risk assessment, identification of internal control

processes and risk reduction activities, residual risk assessment and preparation of risk

assessment report), organizing to identify scope of the audit, organizing to build up the

audit program organizing to build up schedule and resource allocation, organizing to

summary and build up audit plan.

2.3.4.2. Organizing to implement internal audit at BVH

(*) Organizing a short meeting at the audited entity at BVH

IA of BVH regularly holds the opening meeting with the audited entities to

implement internal audits.

(*) Organizing to select samples based on a defined sample size at BVH

On the basis of the sample size determined in the audit program, internal auditors

conduct sampling selection for testing. Internal auditors often use only non-statistical

sampling method.

(*) Organizing to implement the audit according to the audit plan and program at BVH

The audit program rarely has to be corrected because it is not suitable, and all

auditors follow the auditing steps according to the audit program. The most used audit

techniques are interviews and document checks. Audit procedures using IT and other

procedures have not been used much.

(*) Organize to record of information and save audit results on working papers at

BVH

The IA seniors appoint a staff in charge of summarizing the WPs of the internal

auditors in the group and making audit files. This staff is in charge of printing,

submitting to sign general documents and collecting WPs of other internal auditors.

WPs on computers are saved on Lotus Note management software because there is no

audit software.

2.3.4.3. Organizing to summary IA’s result and prepare IA report at BVH

(*) Organizing to summary IA’s result and prepare IA report for each audit at

BVH

15

- Organizing to summary and classify IA’s result for each audit: The IA seniors

are responsible for summarizing, reviewing and classifying the results of the field audit

at the audited entities according to the priority levels..

- Organizing to draft report of each audit: After reaching agreement in the group,

all auditors perform the making of audit reports. Personnel involved in the preparation

of the audit report include the IA team and the IA senior..

- Organizing to dicuss to related parties on audit results: Before publishing and

sending reports, the internal auditors hold a closing meeting with the audited entities.

The composition of the closing meeting is similar to the composition of the opening

meeting and the parts related to the recommendations of the IA.

- Organizing to approve the report for each audit

After updating information discussed with the audited entities, the audit report was

submitted to the Director of IA department for approval.

(*) Organizing to summary IA’s result and prepare annual IA report at BVH

Annually, the Director of IA assigns the internal auditors to collect and classify

the annual IA results. The draft of the annual internal audit report is prepared based on

the summary and classification of annual results and is reviewed and approved by the

Director of IA Department.

(*) Organizing to issue and send IA report

The IA report is sent to the Chairman and members of BOD; General Director of

BVH; Chairman of AC, AC and the audited entities. Each IA report is issued in writing,

the annual audit report is issued in the form of direct communication through the

meeting.

2.3.4.4. Organizing to follow-up the implementation of recommendations at BVH

The follow-up organizations to implement the IA recommendations at BVH

include regular follow-up and periodic follow-up. Specifically, the current situation of

follow-up the implementation of recommendations at BVH is as follows:

(*) Organizing to follow-up regularly at BVH

Organizing to follow-up regularly of the implementation of the IA

recommendations at BVH is done by the follow-up in the office and the auditors

implement recommendations at the audited entities. Specifically, the contents to be

implemented include: organizing to request entities and divisions to make reports on

the implementation of recommendations, organizing to inspect the situation of

implementation of recommendations according to reports and inspect the

implementation of recommendations at the audited entities.

(*) Organizing to follow-up preodically at BVH

According to the results of the survey, every 6 months, the Director of the IA

assigns the auditor to collect and classify the results of the recommendations, prepare a

16

draft report on the implementation of the recommendations. Periodical reports on

implementation of periodical recommendations are communicated directly to related

parties through the meeting, not in writing.

2.3.5. Organizing quality control for internal audit at Baoviet Holdings

(*) Organizing internal assessments at BVH

- Organizing to supervise regularly

Organizing to supervise regularly at BVH mainly consists of regularly approving

the audit plan, program and regularly reviewing reports and related audit documents

and files. Organizing to monitor and evaluate of progress and results of the IA activities

is implemented at a lesser extent. IA at the BVH does not use Gantt diagram to monitor

the progress of the IA.

- Organizing periodic assessments

At BVH, IA do not organize periodic internal assessments.

(*) Organizing external assessments at BVH

At BVH, the IA Department do not organize an independent assessment by a team

of independent experts or by the enterprise itself with independently certified.

2.3.6. Organizing of internal audit files and working papers at Baoviet Holdings

BVH has specific regulations on organizing of IA files and WPs. BVH does not

have a common system to store IT files and documents of IA, each division stores

documents and WPs on computers or Lotus Note management software by itseft.

In addition, through direct interviews and document research, BVH has not

implemented the advisory function when organizing IA..

2.4. EVALUATION OF CURRENT SITUATION OF ORGANIZING

INTERNAL AUDIT IN BAOVIET HOLDINGS

2.4.1. Achievements

In recent years, the IA activities in BVH has achieved a certain number of

achievements, specifically as follows:

+ Firstly, the legal basis of the IA activities at BVH is built quite fully and firmly.

+ Secondly, about organizing to build up IA charter and organzing IA apparatus.

The IA department was established under the AC. This organizational structure ensures

the IA department has certain independence and power with other parts of BVH. BVH

has built IA personnel with good competence and ethical qualities. In addition, BVH

also invested continually in education and training in order to improve the quality of

employees, issued the "Ethical standards of the Ia Department" to guide the ethical

behavior of the IA.

+ Thirdly, regarding organizing to apply IA’s approaches and techniques. BVH

has built the IA based on risk in accordance with international practices.

17

+ Fourthly, on organizing IA’s process. BVH has issued the IA process attached

to the Decision No. 692/2010 / QD-UBKT dated June 7, 2010 of the BVH Audit

Committee.

+ Fifthly, about organizing quality control for IA, the IA department has

conducted regular folow up through supervision performed at each audit from the

planning stage and throughout the audit process.

+ Sixthly, on organizing IA’s files and working papers, BVH has issued regulations

guiding the retention of documents and WPs of IA. At the same time, implementing

physical control activities and restricting the right to access to IA files and WPs.

2.4.2. Limitations and causes of limitations

2.4.2.1. Limitations in organizing internal audit at Baoviet Holdings

Beside the above achievements, the IA activities in BVH also revealed many

limitations, as follow:

(*) Organizing to build up IA charter and organizing IA apparatus at BVH:

- About organizing to build up IA charter at BVH: The IA department built the charter

did not include the content of quality control, applicable internal audit standards and

reporting mechanism. The IA charter of BVH has not been published throughout the Group.

- About organizing IA apparatus at BVH:

+ Regarding IA structure in enterprises, the current 3 divisions structure is no

longer suitable for the coming years. The fact that the Investment auditing division is

currently performing an IT audit will not be appropriate, reducing the effectiveness of

the IT audit.

+ About organizing the IA personnel:

 About IA quantity. The number of internal auditors compared to the total

number of employees of the Group is still low (in 2018, this ratio is: 0.6%).

 About organizing to recruit and train IA personel

The training after recruiting is not really effective and helpful. IA personnel do not

have a deep knowledge of IT, legal knowledge and analytical skills.

 About organizing to arrange, supervise, commend and discipline works of IA

personel. BVH has not used management by objectives method or KPI to evaluate the

operation of IA as a basis for making appropriate reward and discipline regimes.

 About organizing to build up code of IA behaviour. BVH has not built up code

of IA behaviour.

+ About organizing to build up the relationship of the IA with other divisions.

Because the risk management system of BVH, especially in subsidiaries, has not been

completed, the IA Department has not been able to fully utilize information from the

Operating management deparment to serve as the basis for risk assessment, making

annual audit plan.