Presentation on Internal Audit Standards

Internal Audit Standards
Includes an update on changes to the ‘International Professional Practices Framework’ (IPPF) and the
‘International Standards or the Professional Practice of Internal Auditing’ effective from 1 January 2017
Prepared by The Institute of Internal Auditors–Australia
© 2020 The Institute of Internal Auditors–Australia

What is the purpose of this presentation?
 Explain why standards are important for professional practice of internal auditing.
 Explain how standards apply to your work.
 The audience for this presentation is:
 Internal Audit personnel.
 Internal Audit service providers.
 Staff from outside Internal Audit who might work on specific internal audit engagements, for example
as guest auditors.
3

What does Internal Audit do?
 Provides independent, unbiased assessment of organisation operations.
 Provides management with information on the effectiveness of risk management, control and governance
processes.
 Acts as a catalyst for improvement in risk management, control and governance.
 Is an adviser that tells management what it needs to know, when it needs to know it.
4

What are Internal Audit’s objectives?
 Review achievement of organisation objectives.
 Assess if decisions are properly authorised.
 Assess reliability and integrity of information.
 Review that assets are safeguarded.
 Assess compliance with laws, regulations, policies and contracts.
 Assess efficiency, effectiveness, economy and ethical conduct of business activities.
 Consider fraud risk scenarios.
 Follow-up previous audits to assess if remedial action has been effectively implemented.
 Look for business improvements and better ways of doing things.
5

Internal Audit vs External Audit
6
External Audit Internal Audit
From outside the organisation Status Employees of the organisation
True and fair view of
Financial Statements
Objective Varies according to the audit
Historical Focus Forward-looking
Shareholders, Board of Directors and
Audit Committee
Reports go to
Management
and Audit Committee
External audit standards Standards Internal audit standards
Mandatory Qualifications Not mandatory

Is Internal Auditing a Profession?
A profession requires:
 A theoretical body of knowledge.
Internal auditing has the International Professional Practices Framework (IPPF).
 Relative independence in decision-making in practice.
Internal Auditors perform their work autonomously by using consistent practices aligned with professional
standards contained in the IPPF.
 Specialised education.
Internal auditing has specialised education and examinations, for example Certified Internal Auditor (CIA)
 A code of ethics for behaviour of its members.
Internal auditing has its own Code of Ethics.
7

2. The International Professional
Practices Framework (IPPF)
8

Who is the Chief Audit Executive (CAE)?
 The top position within the organisation responsible for Internal Audit – normally a person in a senior
position responsible for managing Internal Audit.
 The specific job title of the Chief Audit Executive may vary across organisations.
 Where Internal Audit services are obtained from a service provider, the Chief Audit Executive should be the
person within the organisation responsible for overseeing the Internal Audit service contract and quality of
the services.
9

The IPPF
 The International Professional Practices Framework (IPPF) provides a globally accepted basis for the
operation of Internal Audit.
 It is issued by the Institute of Internal Auditors (IIA).
 When the IPPF is adopted:
 It eliminates the need for local development of standards, thus reducing the cost of regulation.
 It provides an international benchmark for establishing the quality of Internal Audit operations.
 It facilitates trans-national operations by contributing to a uniform regulatory Internal Audit regime
worldwide.
10

The IPPF
 IPPF standards and guidance are the responsibility of the Internal Auditing Standards Board of IIA–Global.
 The Board is comprised of a mix of people from around the world including the IIA, Big 4 firms, US
Government Accountability Office, chartered accountants, external auditors, and practising internal auditors.
 Procedures for the mandatory IPPF provisions require public exposure and formal consideration of
comments received from both IIA members and non-members.
 The standards development process is supervised by an independent body the IPPF Oversight Council of the
IIA–Global which is appointed by the IIA–Global Board of Directors and comprises stakeholder
representatives.
 The IPPF was most recently updated in 2017.
11

The IPPF
 In the IPPF:
 Board means the highest level of governing body in an organisation – the Board of Directors. Can also
mean the Audit Committee where the Board has delegated certain functions.
 The Chief Audit Executive (CAE) is the most senior person responsible for managing Internal Audit.
 ‘Must’ means ‘an unconditional requirement’ of the IPPF (mandatory).
 The Standards were updated with effect from 1 January 2017.
 Audit reports may specify audit work has been “Conducted in conformance with the International
Standards for the Professional Practice of Internal Auditing.”
12

Internal Audit Mission
 “To enhance and protect organisational value by providing risk-based and objective assurance, advice, and
insight.”
Source: International Professional Practices Framework issued by the Institute of Internal Auditors
13

The IPPF – Mandatory Guidance
 Core Principles for the Professional Practice of Internal Auditing.
 Definition of Internal Auditing.
 Code of Ethics.
 International Standards for the Professional Practice of Internal Auditing.
14

Core Principles
1. Demonstrates integrity.
2. Demonstrates competence and due professional care.
3. Is objective and free from undue influence (independent).
4. Aligns with the strategies, objectives, and risks of the organisation.
5. Is appropriately positioned and adequately resourced.
6. Demonstrates quality and continuous improvement.
7. Communicates effectively.
8. Provides risk-based assurance.
9. Is insightful, proactive, and future-focused.
10. Promotes organisational improvement.
15

Definition of Internal Auditing
 “Internal auditing is an independent, objective assurance and consulting activity designed to add value and
improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a
systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and
governance processes.”
 Independent – Freedom to work in an unbiased manner.
 Objective – Unbiased mental attitude with no compromises.
 Assurance – Objective assessment of evidence to provide an independent opinion or conclusion.
 Consulting – Advisory in nature and generally performed at the specific request of a client.
 Add value – Providing objective and relevant assurance, and contributing to effectiveness and efficiency
of governance, risk management and control processes.
 Systematic, disciplined approach – Leads to reliability and trustworthiness, and distinguishes an internal
audit engagement from a casual enquiry.
 Evaluate and improve an improvement focus.
16

Code of Ethics
 States the principles and expectations governing the behaviour of individuals and organisations in the conduct
of internal auditing.
 Describes the minimum requirements for conduct and behaviour expectations – (1) Principles and (2) Rules of
Conduct.
 Code of Ethics principles are:
 Integrity – The integrity of Internal Auditors establishes trust and this provides the basis for reliance on
their judgement.
 Objectivity – Internal Auditors exhibit the highest level of professional objectivity in gathering, evaluating
and communicating information about the activity or process being examined. Internal Auditors make a
balanced assessment of all the relevant circumstances and are not unduly influenced by their own interests
or by others in forming judgements.
 Confidentiality – Internal Auditors respect the value and ownership of information they receive and do not
disclose information without appropriate authority unless there is a legal or professional obligation to do
so.
 Competency – Internal Auditors apply the knowledge, skills and experience needed in the performance of
Internal Audit services.
17

The Standards
 The Standards for internal auditing worldwide are the ‘International Standards for the Professional Practice
of Internal Auditing’ issued by the IIA.
 The Standards are contained in the IPPF.
 There are 11 overarching Standards and 41 underlying Standards.
18

The Standards – overarching and
underlying Standards – example
Overarching standard for Internal Audit quality
 Standard 1300 – Quality Assurance and Improvement Program
Underlying standards for Internal Audit quality
 Standard 1310 – Requirements of the Quality Assurance and Improvement Program
 Standard 1311 – Internal Assessments
 Standard 1312 – External Assessments
 Standard 1320 – Reporting on the Quality Assurance and Improvement Program
 Standard 1321 – Use of “Conforms with the International Standards for the Professional Practice of Internal
Auditing”
 Standard 1322 – Disclosure of Non-conformance
19

The Standards
 Revised Standards implemented in 2001.
 The IPPF and revised Standards released in 2009.
 The IPPF is revised every 2 years (2011, 2013, 2015).
 The Standards were most recently updated with effect from 1 January 2017.
20

Why have Standards?
 Provide the principles that represent the practice of internal auditing as it should be.
 Foster improved Internal Audit process and operations.
 Provide a framework for performing and promoting a range of value-adding Internal Audit activities.
 Establish the basis for evaluation of Internal Audit performance.
21

The Standards
 The Standards are principle-based (not rule-based) and are therefore not prescriptive.
 They provide a framework for performing and promoting Internal Audit work.
 The Standards are mandatory and consist of:
 Statements of basic requirements for internal auditing.
 Requirements that are internationally applicable at organisation and individual levels.
 Interpretations which clarify terms or concepts within the statements.
 Glossary of terms.
22

The Standards
 The Standards are mandatory and comprise:
 Attribute Standards.
 Performance Standards.
 Implementation Standards.
 The Implementation Standards relate to:
 A = Assurance.
 C = Consulting.
23

Attribute Standards
Attribute Standards = Internal Audit foundations.
 1000 – Purpose, Authority and Responsibility
 1100 – Independence and Objectivity
 1200 – Proficiency and Due Professional Care
 1300 – Quality Assurance and Improvement Program
24

Performance Standards
Performance Standards = How Internal Auditors do their work.
 2000 – Managing the Internal Audit Activity
 2100 – Nature of Work
 2200 – Engagement Planning
 2300 – Performing the Engagement
 2400 – Communicating Results
 2500 – Monitoring Progress
 2600 – Communicating the Acceptance of Risks
25

Implementation Standards
Implementation Standards = How Standards apply to assurance and consulting engagements.
 Implementation Standards expand attribute standards and performance standards to prescribe specific
standards applicable to assurance and consulting engagements.
 Numbering is integrated with each standard being expanded upon, for example:
 1210.A1.
 1210.C1.
26

Glossary
 Contains useful definitions, explains terminology, and expands meanings.
 The Glossary is part of the Standards and needs to be read in conjunction with the Standards to gain greater
understanding.
 Contains definitions for:
 Assurance services – An objective examination of evidence for the purpose of providing an independent
assessment on governance, risk management, and control processes for the organisation. Examples
may include financial, performance, compliance, system security, and due diligence engagements.
 Consulting services – Advisory and related client service activities, the nature and scope of which are
agreed with the client, are intended to add value and improve an organisation’s governance, risk
management, and control processes without the Internal Auditor assuming management responsibility.
Examples include counsel, advice, facilitation, and training.
27

Implementation Guidance –
Implementation Guides
 Implementation Guides replace Practice Advisories.
 Contain recommended guidance for conducting Internal Audit activities.
 Assist Internal Auditors to apply the Standards.
 Address approach, methodology and considerations, but not detailed processes and procedures.
 Guidance to assist Internal Auditors in applying the Standards and promoting good practices. Includes
practices relating to:
 International, country, or industry-specific issues.
 Specific types of engagements.
 Legal or regulatory issues.
28

Implementation Guidance –
Practice Guides
 Contains recommended guidance for conducting Internal Audit activities.
 Provides detailed guidance for conducting Internal Audit activities.
 Includes:
 Topical areas.
 Sector-specific issues.
 Processes and procedures.
 Tools and techniques.
 Programs.
 Step-by-step approaches.
 Examples of deliverables.
29

3. Standards Update 2017 –
what’s changed?
30

Standards Update 2017 – what’s changed?
 Introduction to the Standards
Some word changes, plus new:
The Standards, together with the Code of Ethics, encompass mandatory elements of the International
Professional Practices Framework (IPPF); therefore, conformance with the Standards and Code of Ethics
indicates conformance with mandatory elements of the IPPF.
It is necessary to consider the Standards and their interpretations as well as the specific meanings from the
Glossary to understand and apply the Standards correctly.
If the Standards are used in conjunction with standards issued by other authoritative bodies, Internal Audit
communications may also cite the use of other standards, as appropriate. In such a case, if the Internal Audit
activity indicates conformance with the Standards and inconsistencies exist between the Standards and
other standards, Internal Auditors and the Internal Audit activity must conform with the Standards and may
conform with the other standards if they are more restrictive.
31

 Standard 1000 – Purpose, Authority, and Responsibility
The purpose, authority, and responsibility of the Internal Audit activity must be formally defined in an
Internal Audit Charter, consistent with the Core Principles for the Professional Practice of Internal Auditing,
the Definition of Internal Auditing, the Code of Ethics, and the Standards.
The Chief Audit Executive must periodically review the Internal Audit Charter and present it to senior
management and the Board for approval.
32

 Standard 1010 – Recognition of the Core Principles for the Professional Practice of Internal Auditing, the
Definition of Internal Auditing, the Code of Ethics, and the Standards in the Internal Audit Charter.
The mandatory nature of the Core Principles for the Professional Practice of Internal Auditing, Definition of
Internal Auditing, the Code of Ethics, and the Standards must be recognised reflected in the Internal Audit
Charter.
The Chief Audit Executive should discuss the Mission, the Core Principles for the Professional Practice of
Internal Auditing, the Definition of Internal Auditing, the Code of Ethics, and the Standards with senior
management and the Board.
33

 Standard 1110.A1
The Internal Audit activity must be free from interference in determining the scope of internal auditing,
performing work, and communicating results.
The Chief Audit Executive must disclose such interference to the Board and discuss the implications.
34

 New Standard 1112 – Chief Audit Executive Roles beyond Internal Auditing
Where the Chief Audit Executive has or is expected to have roles and/or responsibilities that fall outside of
internal auditing, safeguards must be in place to limit impairments to independence or objectivity.
Interpretation:
The Chief Audit Executive may be asked to take on additional roles and responsibilities outside of internal
auditing, such as responsibility for compliance or risk management activities.
These roles and responsibilities may impair, or appear to impair, the organisational independence of the
Internal Audit activity, or the individual objectivity of the Internal Auditor.
Safeguards are those oversight activities, often undertaken by the Board, to address these potential
impairments, and may include such activities as periodically evaluating reporting lines and responsibilities,
and developing alternative processes to obtain assurance related to the areas of additional responsibility.
35

 New Standard 1130.A3
Internal Audit may provide assurance services where they have previously performed consulting services,
provided the nature of the consulting did not impair objectivity, and provided individual objectivity is
managed when assigning resources to the engagement.
36

 Standard 1210 – Proficiency
Proficiency is a collective term that refers to the knowledge, skills, and other competencies is a collective
term that refers to the professional proficiency required of Internal Auditors to effectively carry out their
professional responsibilities.
It encompasses consideration of current activities, trends, and emerging issues, to enable relevant advice
and recommendations.
Internal Auditors are encouraged to demonstrate their proficiency by obtaining appropriate professional
certifications and qualifications, such as the Certified Internal Auditor designation and other designations
offered by the Institute of Internal Auditors and other appropriate professional organisations.
37

 Standard 1300 – Quality Assurance and Improvement Program
 The Chief Audit Executive must develop and maintain a Quality Assurance and Improvement Program
that covers all aspects of the Internal Audit activity.
Interpretation:
 A Quality Assurance and Improvement Program is designed to enable an evaluation of the Internal Audit
activity’s conformance with the Definition of Internal Auditing and the Standards and an evaluation of
whether Internal Auditors apply the Code of Ethics.
 The program also assesses the efficiency and effectiveness of the Internal Audit activity and identifies
opportunities for improvement.
38

External assessments must be conducted at least once every five years by a qualified, independent assessor
or assessment team from outside the organisation.
The Chief Audit Executive must discuss with the Board:
 The form and frequency of external assessment.
 The qualifications and independence of the external assessor or assessment team, including any
potential conflict of interest.
Interpretation:
External assessments enhance a complete Quality Assurance and Improvement Program and may be
accomplished through can be in the form of a full external assessment, or a self-assessment with independent
external validation.
The external assessor must conclude as to conformance with the Standards; the external assessment may
also include operational or strategic comments.
39

 Standard 1312 – External Assessments continued
A qualified assessor or assessment team demonstrates competence in two areas: the professional practice of
internal auditing and the external assessment process. Competence can be demonstrated through a mixture
of experience and theoretical learning.
Experience gained in organisations of similar size, complexity, sector or industry, and technical issues is more
valuable than less relevant experience.
In the case of an assessment team, not all members of the team need to have all the competencies; it is the
team as a whole that is qualified. The Chief Audit Executive uses professional judgment when assessing
whether an assessor or assessment team demonstrates sufficient competence to be qualified.
An independent assessor or assessment team means not having either an actual or a perceived real or an
apparent conflict of interest and not being a part of, or under the control of, the organisation to which the
Internal Audit activity belongs.
The Chief Audit Executive should encourage board participation in the Quality Assurance and Improvement
Program to reduce perceived or potential conflicts of interest.
40

The Chief Audit Executive must communicate the results of the Quality Assurance and Improvement Program
to senior management and the Board. Disclosure should include:
 The scope and frequency of both the internal and external assessments.
 Conclusions of assessors.
 Corrective action plans.
 The qualifications and independence of the assessor or assessment team, including potential conflicts
of interest.
41

 Standard 1320 – Reporting on the Quality Assurance and Improvement Program continued
Interpretation:
The form, content, and frequency of communicating the results of the quality assurance and improvement
program is established through discussions with senior management and the Board and considers the
responsibilities of the Internal Audit activity and Chief Audit Executive as contained in the Internal Audit
Charter.
To demonstrate conformance with the Definition of Internal Auditing, the Code of Ethics and the Standards,
the results of external and periodic internal assessments are communicated upon completion of such
assessments and the results of ongoing monitoring are communicated at least annually.
The results include the assessor’s or assessment team’s evaluation with respect to the degree of
conformance.
42

Auditing”
The Chief Audit Executive may state that Indicating that the Internal Audit activity conforms with the
International Standards for the Professional Practice of Internal Auditing is appropriate only if the results of
the Quality Assurance and Improvement Program support this such a statement.
Interpretation:
The Internal Audit activity conforms with the Standards when it achieves the outcomes described in the
Definition of Internal Auditing, Code of Ethics and the Standards.
The results of the Quality Assurance and Improvement Program include the results of both internal and
external assessments.
All Internal Audit activities will have the results of internal assessments.
Internal Audit activities in existence for at least five years will also have the results of external assessments.
43

When non-conformance with the Definition of Internal Auditing, the Code of Ethics or the Standards impacts
the overall scope or operation of the Internal Audit activity, the Chief Audit Executive must disclose the non-
conformance and the impact to senior management and the Board.
44

 Standard 2000 – Managing the Internal Audit Activity
The Chief Audit Executive must effectively manage the Internal Audit activity to ensure it adds value to the
organisation.
Interpretation:
The Internal Audit activity is effectively managed when:
 The results of the Internal Audit activity’s work achieve the purpose and responsibility included in the
Internal Audit Charter.
 The Internal Audit activity conforms with the Definition of Internal Auditing and the Standards.
 The individuals who are part of the Internal Audit activity demonstrate conformance with the Code of
Ethics and the Standards.
 The Internal Audit activity considers trends and emerging issues that could impact the effectiveness of
the Internal Audit activity.
The Internal Audit activity adds value to the organisation and its stakeholders when it considers strategies,
objectives, and risks; strives to offer ways to enhance provides objective and relevant assurance, and
contributes to the effectiveness and efficiency of governance, risk management and control processes; and
objectively provides relevant assurance.
45

 Standard 2010 – Planning
The Chief Audit Executive must establish a risk-based plan to determine the priorities of the Internal Audit
activity, consistent with the organisation’s goals.
Change to interpretation:
To develop the risk-based plan, the Chief Audit Executive first considers the risk management framework and
consults with senior management and the Board and then draws conclusions reached from Internal Audit’s
risk assessment.
The Chief Audit Executive is responsible for developing a risk-based plan. The Chief Audit Executive takes into
account the organisation’s risk management framework, including using risk appetite levels set by
management for the different activities or parts of the organisation. If a framework does not exist, the Chief
Audit Executive uses his/her own judgment of risks after consideration of input from senior management and
the Board.
The Chief Audit Executive must review and adjust the plan, as necessary, in response to changes in the
organisation’s business, risks, operations, programs, systems, and controls.
46

 Standard 2050 – Co-ordination and Reliance
The Chief Audit Executive should share information and coordinate activities with other internal and external
providers of assurance and consulting service providers to ensure proper coverage and minimise duplication
of efforts.
New interpretation:
In co-ordinating activities, the Chief Audit Executive may rely on the work of other assurance and consulting
service providers.
A consistent process for the basis of reliance should be established, and the Chief Audit Executive should
consider the competency, objectivity, and due professional care of the assurance and consulting service
providers.
The Chief Audit Executive should also have a clear understanding of the scope, objectives, and results of the
work performed by other providers of assurance and consulting services.
Where reliance is placed on the work of others, the Chief Audit Executive is still accountable and responsible
for ensuring adequate support for conclusions and opinions reached by the Internal Audit activity.
47

 Standard 2060 – Reporting to Senior Management and the Board
The Chief Audit Executive must report periodically to senior management and the Board on the Internal
Audit activity’s purpose, authority, responsibility, and performance relative to its plan, and on its
conformance with the Standards.
Reporting must also include significant risk exposures and control issues, including fraud risks, governance
issues, and other matters needed or requested by that require the attention of senior management and/or
the Board.
48

Change to interpretation:
The frequency and content of reporting are determined collaboratively by the Chief Audit Executive, in
discussion with senior management, and the Board. The frequency and content of reporting and depend on
the importance of the information to be communicated and the urgency of the related actions to be taken by
senior management and/or the Board. The Chief Audit Executive’s reporting and communication to senior
management and the Board must include information about:
 The audit charter.
 Independence of the Internal Audit activity.
 The audit plan and progress against the plan.
 Resource requirements.
 Results of audit activities.
 The level of conformance with the Standards and action plans to address any significant conformance
issues.
 Risk accepted by management that may be unacceptable to the organisation.
These and other Chief Audit Executive communication requirements are referenced throughout the
Standards.
49

 Standard 2070 – External Service Provider and Organisational Responsibility for Internal Auditing
When an external service provider serves as the Internal Audit activity, the provider must make the
organisation aware that the organisation has the responsibility for maintaining an effective Internal Audit
activity.
Interpretation
This responsibility is demonstrated through the Quality Assurance and Improvement Program which assesses
conformance with the Definition of Internal Auditing, the Code of Ethics, and the Standards.
50

 Standard 2100 – Nature of Work
The Internal Audit activity must evaluate and contribute to the improvement of governance, risk
management, and control processes using a systematic, and disciplined, and risk-based approach.
Internal Audit credibility and value are enhanced when auditors are proactive and their evaluations offer
new insights and consider future impact.
51

 Standard 2110 – Governance
The Internal Audit activity must assess and make appropriate recommendations to improve the
organisation’s governance processes for: in its accomplishment of the following objectives:
 Making strategic and operational decisions.
 Overseeing risk management and control.
 Promoting appropriate ethics and values within the organisation.
 Ensuring effective organisational performance management and accountability.
 Communicating risk and control information to appropriate areas of the organisation.
 Co-ordinating the activities of, and communicating information among, the Board, external and Internal
Auditors, other assurance providers, and management.
52

 Standard 2200 – Engagement Planning
Internal Auditors must develop and document a plan for each engagement, including the engagement’s
objectives, scope, timing, and resource allocations.
The plan must consider the organisation’s strategies, objectives, and risks relevant to the engagement.
53

 Standard 2201 – Planning Considerations
In planning the engagement, Internal Auditors must consider:
The strategies and objectives of the activity being reviewed and the means by which the activity controls its
performance.
The significant risks to the activity’s, its objectives, resources, and operations and the means by which the
potential impact of risk is kept to an acceptable level.
The adequacy and effectiveness of the activity’s governance, risk management, and control processes
compared to a relevant framework or model.
The opportunities for making significant improvements to the activity’s governance, risk management, and
control processes.
54

Adequate criteria are needed to evaluate governance, risk management, and controls.
Internal Auditors must ascertain the extent to which management and/or the Board has established
adequate criteria to determine whether objectives and goals have been accomplished.
If adequate, Internal Auditors must use such criteria in their evaluation. If inadequate, Internal Auditors must
work with management and/or the Board to develop appropriate evaluation criteria identify appropriate
evaluation criteria in discussion with management and/or the Board.
New interpretation:
Internal Auditors may leverage different types of evaluation criteria such as:
 Internal criteria (eg policies and procedures of the organisation).
 External criteria (eg laws and regulations imposed by statutory bodies).
 Leading practices criteria (eg industry and professional guidance).
55

 Standard 2230 – Engagement Resource Allocation
Internal Auditors must determine appropriate and sufficient resources to achieve engagement objectives
based on an evaluation of the nature and complexity of each engagement, time constraints, and available
resources.
Interpretation:
Appropriate refers to the mix of knowledge, skills, and other competencies needed to perform the
engagement. Sufficient refers to the quantity of resources needed to accomplish the engagement with due
professional care.
56

 Standard 2330 – Documenting Information
Internal Auditors must document sufficient, reliable, relevant, and useful information to support the
conclusions and engagement results and conclusions.
57

 Standard 2410 – Criteria for Communicating
 Communications must include the engagement’s objectives, and scope, and results. as well as applicable
conclusions, recommendations, and action plans.
58

Final communication of engagement results must include applicable conclusions.
Final communication of engagement results must also include all applicable recommendations and/or action
plans.
Where appropriate, the Internal Auditors’ opinion should be provided. contain the Internal Auditors’ opinion
and/or conclusions. When issued,
An opinion or conclusion must take into account of the expectations of senior management, the Board, and
other stakeholders and must be supported by sufficient, reliable, relevant, and useful information.
59

 Standard 2430 – Use of “Conducted in Conformance with the International Standards for the Professional
Practice of Internal Auditing”
Stating Internal auditors may report that their engagements are “conducted in conformance with the
International Standards for the Professional Practice of Internal Auditing” is appropriate only if the results of
the Quality Assurance and Improvement Program support the statement.
60

 Standard 2431 – Engagement Disclosure of Non-conformance
When non-conformance with the Definition of Internal Auditing, the Code of Ethics or the Standards
impacts a specific engagement, communication of the results must disclose the:
 Principle(s) or rule(s) of conduct of the Code of Ethics or the standard(s) with which full conformance
was not achieved.
 Reason(s) for non-conformance.
 Impact of non-conformance on the engagement and the communicated engagement results.
61

 Standard 2450 – Overall Opinions
When an overall opinion is issued, it must take into account the strategies, objectives, and risks of the
organisation; and the expectations of senior management, the Board, and other stakeholders. The overall
opinion and must be supported by sufficient, reliable, relevant, and useful information.
Interpretation:
The communication will identify include:
 The scope, including the time period to which the opinion pertains.
 Scope limitations.
 Consideration of all related projects, including the reliance on other assurance providers.
 A summary of the information that supports the opinion.
 The risk or control framework or other criteria used as a basis for the overall opinion.
 The overall opinion, judgment, or conclusion reached.
The reasons for an unfavourable overall opinion must be stated.
62

 Glossary – Board
The highest level of governing body charged with the responsibility to direct and/or oversee the activities
and hold senior management of the organisation. Typically, this includes an independent group of directors
accountable (eg a board of directors, a supervisory board, or a board of governors or trustees). If such a
group does not exist, the “board” may refer to the head of the organisation.
“Board” may refer to an audit committee to which the governing body has delegated certain functions.
Although governance arrangements vary among jurisdictions and sectors, typically the Board includes
members who are not part of management and is not solely comprised of members of management.
If a Board does not exist, the word “board” in the Standards refers to a group or person charged with
governance.
Furthermore, “Board” in the Standards may refer to a committee or another body to which the governing
body has delegated certain functions (eg an Audit Committee or Risk Committee).
63

 Glossary – Chief Audit Executive
Chief Audit Executive describes a person in a senior position responsible for effectively managing the
Internal Audit activity in accordance with the Internal Audit Charter, the Definition of Internal Auditing, the
Code of Ethics, and the Standards.
The Chief Audit Executive or others reporting to the Chief Audit Executive will have appropriate professional
certifications and qualifications.
The specific job title and/or role of the Chief Audit Executive may vary across organisations.
64

 Glossary – Core Principles for the Professional Practice of Internal Auditing
The Core Principles for the Professional Practice of Internal Auditing (Core Principles) are the key elements
that describe Internal Audit effectiveness.
The Core Principles underpin the Code of Ethics and the Standards.
65

 Glossary – International Professional Practices Framework
The conceptual framework that organises the authoritative guidance promulgated by the IIA.
Authoritative Guidance is comprised of two categories – (1) mandatory and (2) strongly recommended.
66

Attribute Standard 1000
‘Purpose, Authority and Responsibility’
Overarching Standard
 1000 – Purpose, Authority and Responsibility
The purpose, authority and responsibility of the Internal Audit activity must be formally defined in an Internal
Audit Charter, consistent with the Core Principles for the Professional Practice of Internal Auditing, the
Definition of Internal Auditing, the Code of Ethics and the Standards. The Chief Audit Executive must
periodically review the Internal Audit Charter and present it to senior management and the Board for
approval.
Underlying Standard
 1010 – Recognition of the Core Principles for the Professional Practice of Internal Auditing, the Definition of
Internal Auditing, the Code of Ethics, and the Standards in the Internal Audit Charter.
The mandatory nature of the Core Principles for the Professional Practice of Internal Auditing, Definition of
Internal Auditing, the Code of Ethics, and the Standards must be reflected in the Internal Audit Charter. The
Chief Audit Executive should discuss the Mission, the Core Principles for the Professional Practice of Internal
Auditing, the Definition of Internal Auditing, the Code of Ethics, and the Standards with senior management
and the Board.
68

‘Independence and Objectivity’
 1100 – Independence and Objectivity
The Internal Audit activity must be independent, and Internal Auditors must be objective in performing their
work.
Underlying Standards
 1110 – Organisational Independence
 1111 – Direct Interaction with the Board
 1112 – Chief Audit Executive Roles beyond Internal Auditing
 1120 – Individual Objectivity
 1130 – Impairment to Independence or Objectivity
69

‘Independence and Objectivity’
 Standard 1110 – Organisational Independence
The Chief Audit Executive must report to a level within the organisation that allows the Internal Audit activity
to fulfil its responsibilities. The Chief Audit Executive must confirm to the Board at least annually the
organisational independence of the Internal Audit activity.
 Standard 1111 – Direct Interaction with the Board
The Chief Audit Executive must communicate and interact directly with the Board.
 Standard 1112 – Chief Audit Executive Roles beyond Internal Auditing
When the Chief Audit Executive has or is expected to have roles and/or responsibilities that fall outside of
internal auditing, safeguards must be in place to limit impairments to independence or objectivity.
 Standard 1120 – Individual Objectivity
Internal Auditors must have an impartial, unbiased attitude and avoid any conflict of interest.
 Standard 1130 – Impairment to Independence or Objectivity
If independence or objectivity is impaired in fact or appearance, the details of the impairment must be
disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment.
70

How is Internal Audit independent?
Internal Audit is independent of the
organisation management structure
71
Board of Directors
Chief Executive
Officer
Internal Audit
administrative
reporting
Audit Committee
Functional reporting for
Internal Audit
operations
Chief Audit Executive
Internal Audit
function

‘Proficiency and Due Professional Care’
 1200 – Proficiency and Due Professional Care
Engagements must be performed with proficiency and due professional care.
 1210 – Proficiency
 1220 – Due Professional Care
 1230 – Continuing Professional Development
72

 Standard 1210 – Proficiency
Internal Auditors must possess the knowledge, skills, and other competencies needed to perform their
individual responsibilities. The Internal Audit activity collectively must possess or obtain the knowledge, skills
and other competencies needed to perform its responsibilities.
 Standard 1220 – Due Professional Care
Internal Auditors must apply the care and skill of a reasonably prudent and competent Internal Auditor. Due
professional care does not imply infallibility.
 Standard 1230 – Continuing Professional Development
Internal Auditors must enhance their knowledge, skills and other competencies through continuing
professional development.
73
‘Proficiency and Due Professional Care’

‘Quality Assurance and Improvement Program’
 1300 – Quality Assurance and Improvement Program
The Chief Audit Executive must develop and maintain a Quality Assurance and Improvement Program that
covers all aspects of the Internal Audit activity.
 1310 – Requirements of the Quality Assurance and Improvement Program
 1311 – Internal Assessments
 1312 – External Assessments
 1320 – Reporting on the Quality Assurance and Improvement Program
 1321 – Use of “Conforms with the International Standards for the Professional Practice of Internal Auditing”
 1322 – Disclosure of Non-conformance
74

 Standard 1310 – Requirements of the Quality Assurance and Improvement Program
The Quality Assurance and Improvement Program must include both internal and external assessments.
 Standard 1311 – Internal Assessments
Internal assessments must include:
 Ongoing monitoring of the performance of the Internal Audit activity.
 Periodic self-assessments or assessments by other persons within the organisation with sufficient
knowledge of Internal Audit practices.
External assessments must be conducted at least every 5 years by a qualified, independent assessor or
assessment team from outside the organisation. The Chief Audit Executive must discuss with the Board:
 The form and frequency of external assessment.
 The qualifications and independence of the external assessor or assessment team, including any
potential conflict of interest.
75

The Chief Audit Executive must communicate the results of the Quality Assurance and Improvement Program
to senior management and the Board. Disclosure should include:
 The scope and frequency of both the internal and external assessments.
 Conclusions of assessors.
 Corrective action plans.
 The qualifications and independence of the assessor or assessment team, including potential conflicts of
interest.
Auditing”
Indicating that the Internal Audit activity conforms with the International Standards for the Professional
Practice of Internal Auditing is appropriate only if the results of the Quality Assurance and Improvement
Program support such a statement.
When non-conformance with the Code of Ethics or the Standards impacts the overall scope or operation of
the Internal Audit activity, the Chief Audit Executive must disclose the non-conformance and the impact to
senior management and the Board.
76

Performance Standard 2000
‘Managing the Internal Audit Activity’
 2000 – Managing the Internal Audit Activity
The Chief Audit Executive must effectively manage the Internal Audit activity to ensure it adds value to the
organisation.
 2010 – Planning.
 2020 – Communication and Approval
 2030 – Resource Management
 2040 – Policies and Procedures
 2050 – Co-ordination
 2060 – Reporting to Senior Management and the Board
 2070 – External Service Provider and Organisational Responsibility for Internal Auditing
78

 Standard 2010 – Planning
The Chief Audit Executive must establish a risk-based plan to determine the priorities of the Internal Audit
activity, consistent with the organisation’s goals.
 Standard 2020 – Communication and Approval
The Chief Audit Executive must communicate the Internal Audit activity’s plans and resource requirements,
including significant interim changes, to senior management and the Board for review and approval. The
Chief Audit Executive must also communicate the impact of resource limitations.
 Standard 2030 – Resource Management
The Chief Audit Executive must ensure that Internal Audit resources are appropriate, sufficient, and
effectively deployed to achieve the approved plan.
 Standard 2040 – Policies and Procedures
The Chief Audit Executive must establish policies and procedures to guide the Internal Audit activity.
79

 Standard 2050 – Co-ordination an Reliance
The Chief Audit Executive should share information and co-ordinate activities with other internal and external
assurance and consulting service providers to ensure proper coverage and minimise duplication of efforts.
The Chief Audit Executive must report periodically to senior management and the Board on the Internal Audit
activity’s purpose, authority, responsibility, and performance relative to its plan, and on its conformance with
the Standards. Reporting must also include significant risk and control issues, including fraud risks,
governance issues, and other matters that require the attention of senior management and/or the Board.
 Standard 2070 – External Service Provider and Organisational Responsibility for Internal Auditing
When an external service provider serves as the Internal Audit activity, the provider must make the
organisation aware that the organisation has the responsibility for maintaining effective an Internal Audit
activity.
80

‘Nature of Work’
 2100 – Nature of Work
The Internal Audit activity must evaluate and contribute to the improvement of governance, risk
management, and control processes using a systematic, disciplined, and risk-based approach. Internal Audit
credibility and value are enhanced when auditors are proactive and their evaluations offer new insights and
consider future impact.
 2110 – Governance
 2120 – Risk Management
 2130 – Control
81

 Standard 2110 – Governance
The Internal Audit activity must assess and make appropriate recommendations to improve the
organisation’s governance processes for:
 Making strategic and operational decisions.
 Overseeing risk management and control.
 Promoting appropriate ethics and values within the organisation.
 Ensuring effective organisational performance management and accountability.
 Communicating risk and control information to appropriate areas of the organisation.
 Co-ordinating the activities of, and communicating information among, the Board, external and internal
auditors, other assurance providers, and management.
 Standard 2120 – Risk Management
The Internal Audit activity must evaluate the effectiveness and contribute to the improvement of risk
management processes.
 Standard 2130 – Control
The Internal Audit activity must assist the organisation in maintaining effective controls by evaluating their
effectiveness and efficiency and by promoting continuous improvement.
82

 Governance
 Promote appropriate ethics and values within the organisation.
 Ensure effective organisational performance management and accountability.
 Communicate risk and control information to appropriate areas of the organisation.
 Co-ordinate activities and communicate information among the Board, external auditors, internal
auditors, other assurance providers, and management.
 Risk Management
 Monitor and evaluate the risk management system.
 Identify and evaluate significant exposures to risk.
 Contribute to improvement of risk management.
 Incorporate knowledge gained during consulting engagements into the regular Internal Audit program
of work.
 Control
 Evaluate the effectiveness and efficiency of controls.
 Promote continuous improvement.
 Consider controls in the context of risk assessment.
 Ensure operating and program goals are consistent with those of the organisation.
 Ensure management have established adequate criteria for determining whether objectives have been
achieved.
83

‘Engagement Planning’
 2200 – Engagement Planning
Internal Auditors must develop and document a plan for each engagement, including the engagement’s
objectives, scope, timing and resource allocations. The plan must consider the organisation’s strategies,
objectives, and risks relevant to the engagement.
 2201 – Planning Considerations
 2210 – Engagement Objectives
 2220 – Engagement Scope
 2230 – Engagement Resource Allocation
 2240 – Engagement Work Program
84

 Standard 2201 – Planning Considerations
In planning the engagement, Internal Auditors must consider:
 The strategies and objectives of the activity being reviewed and the means by which it controls its
performance.
 Significant risks to the activity’s objectives, resources, and operations and the means by which the
potential impact of risk is kept to an acceptable level.
 The adequacy and effectiveness of the governance, risk management and control processes compared
to a relevant control framework or model.
 The opportunities for making significant improvements to governance, risk management and control
processes.
85

 Standard 2210 – Engagement Objectives
Objectives must be established for each engagement.
 Standard 2220 – Engagement Scope
The established scope must be sufficient to achieve the objectives of the engagement.
 Standard 2230 – Engagement Resource Allocation
Internal Auditors must determine appropriate and sufficient resources to achieve engagement objectives
based on an evaluation of the nature and complexity of each engagement, time constraints, and available
resources.
 Standard 2240 – Engagement Work Program
Internal Auditors must develop and document work programs that achieve the engagement objectives.
86

‘Performing the Engagement’
 2300 – Performing the Engagement
Internal Auditors must identify, analyse, evaluate and document sufficient information to achieve the
engagement’s objectives.
 2310 – Identifying Information
 2320 – Analysis and Evaluation
 2330 – Documenting Information
 2340 – Engagement Supervision
87

 Standard 2310 – Identifying Information
Internal Auditors must identify sufficient, reliable, relevant and useful information to achieve the
engagement’s objectives.
 Standard 2320 – Analysis and Evaluation
Internal Auditors must base conclusions and engagement results on appropriate analyses and evaluations.
 Standard 2330 – Documenting Information
Internal Auditors must document sufficient, reliable, and useful information to support the engagement
results and conclusions.
 Standard 2340 – Engagement Supervision
Engagements must be properly supervised to ensure objectives are achieved, quality is assured, and staff is
developed.
88

 Standard 2310 – Identifying Information
Information must be:
 Sufficient – Factual, adequate, convincing.
 Reliable – Repeatable, best available.
 Relevant – Support engagement observations.
 Useful – Help the organisation meet its goals.
89

90

‘Communicating Results’
 2400 – Communicating Results
Internal Auditors must communicate the results of engagements.
 2410 – Criteria for Communicating
 2420 – Quality of Communications
 2421 – Errors and Omissions
 2430 – Use of “Conducted in accordance with the International Standards for the Professional Practice of
Internal Auditing”
 2431 – Engagement Disclosure of Non-conformance
 2440 – Disseminating Results
 2450 – Overall Opinions
91

 Standard 2410 – Criteria for Communicating
Communications must include the engagement’s objectives, scope, and results.
 Standard 2420 – Quality of Communication
Communications must be accurate, objective, clear, concise, constructive, complete, and timely.
 Standard 2421 – Errors and Omissions
If a final communication contains a significant error or omission, the Chief Audit Executive must communicate
corrected information to all parties who received the original communication.
 Standard 2430 – Use of “Conducted in Conformance with the International Standards for the Professional
Practice of Internal Auditing”
Stating engagements are “Conducted in conformance with the International Standards for the Professional
Practice of Internal Auditing” is appropriate only if the results of the Quality Assurance and Improvement
Program support the statement.
92

 Standard 2431 – Engagement Disclosure of Non-conformance
When non-conformance with the Code of Ethics or the Standards impacts a specific engagement,
communication of the results must disclose the:
 Principle(s) or rule(s) of conduct of the Code of Ethics or the Standards with which full conformance was
not achieved.
 Reason(s) for non-conformance.
 Impact of non-conformance on the engagement and the communicated engagement results.
 Standard 2440 – Disseminating Results
The Chief Audit Executive must communicate results to the appropriate parties.
 Standard 2450 – Overall Opinions
When an overall opinion is issued, it must take into account the strategies, objectives, and risks of the
organisation; and the expectations of senior management, the Board, and other stakeholders. The overall
opinion must be supported by sufficient, reliable, relevant, and useful information.
93

Communications (reports) should be:
 Accurate.
 Objective.
 Clear.
 Concise.
 Constructive.
 Complete.
 Timely.
Plus “Internal Auditors are encouraged to acknowledge satisfactory performance in engagement
communications.”
94

An observation should contain:
 Condition – What is.
 Criteria – What should be.
 Observation – The difference between ‘what is’ and ‘what should be’.
 Effect – The result (risk or impact).
 Cause – Why the effect occurred.
 Agreed Management Action Plan (MAP) – How to fix the cause.
95

‘Monitoring Progress’
 2500 – Monitoring Progress
The Chief Audit Executive must establish and maintain a system to monitor the disposition of results
communicated to management.
 There are no underlying Standards.
96

‘Communicating the Acceptance of Risks’
 2600 – Communicating the Acceptance of Risks
When the Chief Audit Executive concludes that management has accepted a level of risk that may be
unacceptable to the organisation, the Chief Audit Executive must discuss the matter with senior
management. If the Chief Audit Executive determines that the matter has not been resolved, the Chief Audit
Executive must communicate the matter to the Board.
 There are no underlying Standards.
97

Presentation on Internal Audit Standards

More Related Content

What's hot (20)

Similar to Presentation on Internal Audit Standards (20)

Recently uploaded (20)

Presentation on Internal Audit Standards