Combinepdf

events or situations to provide
Introduction to reasonable assurance regarding the

achievement of the
Internal Auditing organization's objectives.
CONTROL — Any action taken by
management, the board, and other
The Definition of Internal Auditing parties to
states the fundamental purpose, manage risk and increase the
nature, and scope of internal likelihood that established objectives
auditing. and goals will be
achieved. Management plans,
- Internal auditing is an organizes, and directs the
independent, objective assurance performance of sufficient
and consulting activity designed actions to provide reasonable
to add value and improve an assurance that objectives and goals
organization's operations. It helps will be achieved.
an organization accomplish its CONTROL PROCESSES — The
objectives by bringing a policies, procedures (both manual
systematic, disciplined approach and automated),
to evaluate and improve the and activities that are part of a
effectiveness of risk control framework, designed and
management, control, and operated to ensure
governance processes. that risks are contained within the
level that an organization is willing to
ADD VALUE — The internal audit accept.
activity adds value to the GOVERNANCE — The combination
organization (and its of processes and structures
stakeholders) when it provides implemented by the
objective and relevant assurance, board to inform, direct, manage, and
and contributes to monitor the activities of the
the effectiveness and efficiency of organization toward
governance, risk management, and the achievement of its objectives.
control
processes. Assurance services involve the
RISK MANAGEMENT — A process internal auditor’s objective
to identify, assess, manage, and assessment of
control potential evidence to provide opinions or
conclusions regarding an entity,
operation,
AAPRINCIPLES – Fundamentals of Assurance Services

This study source was downloaded by 100000855388555 from CourseHero.com on 11-09-2022 19:38:00 GMT -06:00
https://www.coursehero.com/file/127430488/AAPRINCPLES-Introduction-to-Internal-Auditingdocxpdf/
function, process, system, or other
subject matters. - When performing consulting
services the internal auditor should
-The nature and scope of an maintain objectivity and not assume
assurance engagement are management responsibility.
determined by
the internal auditor. Internal auditing is conducted in diverse
- Generally, three parties are legal and cultural environments; for
participants in assurance services: organizations that
1.The process owner — The person vary in purpose, size, complexity, and
or group directly involved structure; and by persons within or
with the entity, operation, function, outside the
process, system, or other organization. While differences may
subject matter. affect the practice of internal auditing in
each
2. The internal auditor — the person environment, conformance with The
or group making the IIA’s International Standards for the
assessment. Professional Practice
of Internal Auditing (Standards) is
3. The user — the person or group essential in meeting the responsibilities
using the assessment. of internal auditors
and the internal audit activity.
Consulting services are advisory in
nature and are generally performed at The purpose of the Standards is to:
the 1. Guide adherence with the
specific request of an engagement mandatory elements of the
client. International Professional
- The nature and scope of the Practices Framework.
consulting engagement are subject to 2. Provide a framework for
agreement with the engagement performing and promoting a
client. broad range of value-added
- Consulting services generally internal auditing services.
involve two parties: 3. Establish the basis for the
evaluation of internal audit
1. The Internal Auditor — the performance.
person or group offering the advice. 4. Foster improved organizational
2. The Engagement Client — the processes and operations.
person or group seeking and
receiving the advice.

The Standards are a set of Attribute and Performance
principles-based, mandatory Standards apply to all internal audit
requirements consisting of: services.
● Statements of core requirements for - Implementation Standards

the professional practice of internal expand upon the Attribute and
auditing and Performance Standards
for evaluating the effectiveness of by providing the requirements
performance that are internationally applicable to assurance or
applicable at consulting services.
organizational and individual levels.
● Interpretations clarifying terms or The Standards apply to individual
concepts within the Standards. internal auditors and the internal audit
activity. All internal
The Standards, together with the Code auditors are accountable for
of Ethics, encompass all mandatory conforming with the standards related to
elements of the individual objectivity,
International Professional Practices proficiency, and due professional
Framework; therefore, conformance with care and the standards relevant to the
the Code of performance of their
Ethics and the Standards demonstrates job responsibilities. Chief audit
conformance with all mandatory executives are additionally accountable
elements of the for the internal audit
International Professional Practices activity’s overall conformance with
Framework. the Standards.
The Standards comprise two main Standard 1100 — Independence

categories: and Objectivity
A. Attribute Standards- Address the
attributes of organizations and The internal audit activity must be
individuals performing internal independent, and internal auditors
auditing. must be objective in performing their
B. Performance Standards- Describe work.
the nature of internal auditing and
provide quality criteria against Internal Audit Activity — A
which the performance of these services department, division, team of
can be measured. consultants, or other practitioner(s)
that provide independent, objective
assurance and consulting services

designed to add value and improve responsibilities broader than internal
organization’s operations. audit, such as risk management or
compliance, internal audit is not
Independence — is the freedom from independent of these additional
conditions that threaten the ability of the functions,
internal audit which are also subject to audit.
activity to carry out internal audit - However, the CAE cannot solely
responsibilities in an unbiased manner. determine the organizational
● To achieve the degree of independence
independence necessary to effectively and placement for internal audit; the
carry out the CAE needs help from the board and
responsibilities of the internal audit senior management to address
activity, the chief audit executive has independence effectively. Typically, the
direct and CAE, the board, and senior
unrestricted access to senior management reach a shared
management and the board. understanding of
● This can be achieved through a internal audit’s responsibility, authority,
dual-reporting relationship. and expectations, which lays the
- The internal audit reports both to the groundwork for a discussion on
Board and the CEO. The internal audit independence and organizational
report directly (reportial function) to the placement.
organization’s Board of Directors
through the internal audit committee Standard 1110 – Organizational
(IAC) and at the same time coordinates Independence
(administrative function) with the CEO.
The chief audit executive must report to
● Threats to independence must be a level within the organization that
managed at the individual auditor, allows the
engagement, internal audit activity to fulfill its
functional, and organizational levels. responsibilities. The chief audit
executive must confirm
-For example, when internal audit to the board, at least annually, the
reports within other functions in organizational independence of the
an internal audit activity.
organization, it is not considered
independent of that function, which is Organizational independence is
subject effectively achieved when the chief audit
to audit. Similarly, if the chief audit executive
executive (CAE) has functional

reports functionally to the board. ● Threats to objectivity must be
Examples of functional reporting to the managed at the individual
board involve auditor, engagement, functional,
the board: and organizational levels.
● Approving the internal audit -To implement this standard, the
charter. CAE will want to understand policies
● Approving the risk-based or
internal audit plan. activities within the organization and
● Approving the internal audit within internal audit that could
budget and resource plan. enhance or
● Receiving communications hinder such a mindset.
from the chief audit executive on - For example, many organizations
the internal audit have standard performance
activity’s performance relative to evaluation and
its plan and other matters. compensation policies, as well as
Approving employee conflict of interest policies.
decisions regarding the The
appointment and removal of the CAE will want to understand the
chief audit executive. nature of relevant policies identified
● Approving the remuneration of and
the chief audit executive. consider their potential impact on
● Making appropriate inquiries of internal audit objectivity. Internal
management and the chief audit audit will
executive to often customize these organization
determine whether there are wide policies to address internal
inappropriate scope or resource audit roles
limitations. specifically and may develop other
relevant policies specifically for
Objectivity — is an unbiased mental internal
attitude that allows internal auditors to audit, such as policies pertaining to
perform training requirements.
engagements in such a manner that
they believe in their work product and Standard 1120 – Individual
that no quality compromises are made. Objectivity
● Objectivity requires that internal Internal auditors must have an impartial,

auditors do not subordinate their unbiased attitude and avoid any conflict
judgment on audit matters to of interest.
others.

Conflict of interest is a situation in which status, as well as authority to perform
an internal auditor, who is in a position duties without impediment and to
of trust, has a competing professional or address
personal interest. Such competing difficult issues with other senior leaders.
interests can make it difficult to fulfill his - The IIA recommends that the
or her duties impartially. A conflict of CAE report administratively to the
interest exists even if no unethical or chief executive officer
improper act results. A conflict of interest (CEO), both so that the CAE is clearly a
can create an appearance of impropriety senior position and so that internal audit
that can undermine confidence in the is not
internal auditor, the internal audit activity, positioned within an operation that is
and the profession. A conflict of interest subject to audit.
could impair an individual's ability to - It is also recommended that the
perform his or her duties and CAE not have operational
responsibilities objectively. When responsibilities beyond
assigning internal auditors to specific internal audit, as these other
engagements, the CAE (or delegate) will responsibilities may, themselves, be
consider potential objectivity subject to audit.
impairments and avoid assigning team
members who Standard 1111 – Direct Interaction
may have a conflict, as described with the Board
above.
The chief audit executive must
The CAE has a direct functional communicate and interact directly with
reporting line to the board and an the board.
administrative reporting line to a
member of senior management. If the CAE has a direct functional
reporting relationship with the board,
- The reporting line to the board then the board
provides the CAE with direct assumes responsibility for approving the
board access for sensitive internal audit charter, internal audit plan,
matters and enables sufficient internal audit budget and resource plan,
organizational status. Administrative evaluation and compensation of the
reporting to a CAE, and appointment and removal of
member of senior management also the CAE. Further, the board monitors the
provides the CAE with sufficient ability of internal audit to operate
organizational independently and fulfill its charter.

To reinforce the importance of these independence or objectivity must be
policies and help ensure all internal disclosed is dependent upon the
auditors internalize expectations of
their importance, some CAEs will hold the internal audit activity’s and the chief
routine workshops or training on these audit executive’s responsibilities to
fundamental concepts. Such training senior
sessions will often allow internal auditors management and the board as
to better understand objectivity by described in the internal audit charter, as
considering objectivity-impairing well as the
scenarios and how best to address nature of the impairment.
them. Further, when assigning internal
auditors to specific engagements, the To effectively manage independence
CAE will consider potential objectivity and objectivity, including impairments,
impairments and avoid assigning team many CAEs have an internal audit policy
members who may have a conflict. manual or handbook that describes the
related expectations and requirements.
Standard 1130 – Impairment to In addition to defining independence and
Independence or Objectivity objectivity, such a manual may identify
the specific related standards; describe
If independence or objectivity is the types of situations that could create,
impaired in fact or appearance, the or appear to create, impairments; and
details of the impairment must be specify the expected actions the internal
disclosed to appropriate parties. The auditor should undertake if faced with a
nature of the disclosure will depend potential impairment.
upon the impairment.
Impairment situations generally include
- Impairment to organizational self-interest, self-review, familiarity, bias,
independence and individual or undue influence. These situations can
objectivity may include, but lead to personal conflicts of interest,
is not limited to, personal conflict of scope limitations, resource limitations, or
interest; scope limitations; restrictions on restrictions on access to records,
access personnel, or properties. Internal audit
to records, personnel, and properties; examples of organizational
and resource limitations, such as independence impairments include the
funding. following, which, if in effect, can also
- The determination of appropriate undermine internal auditor objectivity:
parties to which the details of an
impairment to

● The CAE has broader functional effectively mitigated risks based solely
responsibility than internal audit and on a prior positive audit or personal
executes an audit experiences
of a functional area that is also under (e.g., a lack of professional skepticism).
the CAE’s oversight. - An internal auditor modifies the
● The CAE’s supervisor has broader planned approach or results based on
responsibility than internal audit, and the the undue
CAE executes an audit within his or her influence of another person, often
supervisor’s functional responsibility. someone senior to the internal auditor,
● The CAE does not have direct without
communication or interaction with the appropriate justification.
board.
● The budget for the internal audit
activity is reduced to the point that
internal audit cannot fulfill its
responsibilities as outlined in the charter.
(Standard 2020 –Communication and
Approval, provides further guidance on
communicating the impact of resource
limitations.
Examples of objectivity impairments

include:
- An internal auditor audits an area in

which he or she recently worked, such
as when
an employee transfers into internal audit
from a different functional area of the
organization and then is assigned to an
audit of that function.
- An internal auditor audits an area
where a relative or close friend is
employed.
- An internal auditor assumes, without
evidence, that an area being audited
has

Powered by TCPDF (www.tcpdf.org)
PIA-HAU
- People undertake risk
Overview of management activities to identify,
assess, manage, and control
Internal Audit all kinds of events or situations.
These can range from single
Roles projects or narrowly
defined types of risk, e.g. market
An IIA Position Paper titled The risk, to the threats and opportunities
Role of Internal Auditing in facing the
Enterprise-wide Risk Management organization as a whole. The
discusses a range of risk principles presented in this paper
management activities and can be used to guide
indicates which roles an effective the involvement of internal auditing
professional internal audit activity in all forms of risk management but
should and, equally importantly, we are
should not undertake.
particularly interested in enterprise-
The importance to strong corporate wide risk management because
governance of managing risk has this is likely to
been improve an organization’s
increasingly acknowledged. governance processes.
Organizations are under pressure to
identify all the Is a structured, consistent and
business risks they face; social, continuous process across the
ethical and environmental as well as whole
financial and organization for identifying,
operational, and to explain how they assessing, deciding on
manage them to an acceptable level. responses to and reporting
Meanwhile, on opportunities and threats that
the use of enterprise-wide risk affect the achievement of its
management frameworks has objectives.
expanded, as
organizations recognize their
advantages over less coordinated Responsibility for ERM
approaches to risk
management. Internal auditing, in both - The board has overall
its assurance and its consulting roles, responsibility for ensuring that risks
contributes to the management of risk are managed. In practice,
in a variety of ways. the board will delegate the
operation of the risk management
Enterprise-wide Risk Management framework to the

https://www.coursehero.com/file/117483366/FINALSAAPRINCPLES-Overview-of-Internal-Audit-Rolesdocx/
PIA-HAU
management team, who will be internal audit roles described in the
responsible for completing the position paper. Each of these areas is
activities below. There critical to the success of risk
may be a separate function that co- management. The audit committee and
ordinates and project-manages these management will find comfort in
activities and knowing these areas are operating
brings to bear specialist skills and effectively, and if not, will want to
knowledge. understand what the gaps are and the
- Everyone in the organization plays a potential actions to close those gaps.
role in ensuring successful enterprise- services can be measured.
wide risk
management but the primary LIMITED INTERNAL AUDIT ROLE
responsibility for identifying risks and WITH SAFEGUARDS
managing them lies - CAEs should seek opportunities to
with management. perform as many of the consulting
services as possible and formally
The role of internal auditing in ERM communicate the results of those
Internal auditing is an independent, consulting services. Many internal
objective assurance and consulting audit activities have the skills to
activity. Its conduct these activities. Proper
core role with regard to ERM is to safeguards, which typically ensure that
provide objective assurance to the responsibility, accountability, and
board on the
authority rest with management and
effectiveness of risk management.
not the internal audit activity, are not
Indeed, research has shown that
board directors that difficult to put in place. However, it
and internal auditors agree that the is important to ensure that these
two most important ways that internal safeguards are well understood by the
auditing audit committee and management.
provides value to the organization are Consulting roles

in providing objective assurance that - In general, the further to the right of
the major the dial that internal auditing ventures,
business risks are being managed the
appropriately and providing assurance greater are the safeguards that are
that the risk required to ensure that its
management and internal control
independence
framework is operating effectively.
and objectivity are maintained. Some
CORE INTERNAL AUDIT ROLES of the consulting roles that the internal
audit activity may undertake are:
- Internal audit activities should provide
assurance on many, if not all, of the core

PIA-HAU
a. Making available to ● Internal auditing should not manage
management tools and techniques any of the risks on behalf of
used by internal management.
auditing to analyze risks and controls; ● Internal auditing should provide
b. Being a champion for advice, challenge and support to
introducing ERM into the management’s decision making, as
organization, leveraging its opposed to taking risk management
expertise in risk management and decisions themselves.
control and its overall knowledge of
the organization; ROLES INTERNAL AUDITING
c. Providing advice, facilitating SHOULD NOT UNDERTAKE
workshops, coaching the - While there are good reasons why
organization on risk and control the last group of roles should not be
and promoting the development of undertaken by internal auditors, there
a common language, framework may be appropriate times to do so
and understanding; anyway. If the organization has a
d. Acting as the central point for significant need related to risk
coordinating, monitoring and management, and nobody else has the
reporting on risks; and experience to fill that need, it may be
e. Supporting managers as they better if an internal auditor fills that role
work to identify the best way to rather than nobody at all. The auditor’s
mitigate a risk. objectivity will be impaired for a period
of time, and this may impair the
The key factor in deciding whether objectivity of the entire internal audit
consulting services are compatible with activity, but independent assurance
the assurance role is to determine could still be obtained from some other
whether the internal auditor is assuming source (typically an outside specialist),
any which may provide the audit committee
management responsibility. and management with the comfort
they need.
Safeguards
Internal auditing may extend its Definition of terms
involvement in ERM, certain conditions ● Assurance Services: An objective
apply. The conditions are: examination of evidence for the
purpose of
● It should be clear that management providing an independent assessment
remains responsible for risk management. on governance, risk management, and
● The nature of internal auditor’s control
responsibilities should be documented in processes for the organization.
the internal audit charter and approved by Examples may include financial,
the audit committee. performance,

PIA-HAU
compliance, system security, and due Management plans, organizes, and
diligence engagements. directs the performance of sufficient
● Board: A board is an organization’s actions to
governing body, such as a board of provide reasonable assurance that
directors, objectives and goals will be achieved.
supervisory board, head of an agency or ● Enterprise: Any organization
legislative body, board of governors or established to achieve a set of
trustees of a non profit organization, or objectives.
any other designated body of the ● Enterprise-wide risk management
organization, (ERM): A structured, consistent and
including the audit committee to whom continuous
the chief audit executive may functionally process across the whole organization
report. for identifying, assessing, deciding on
● Champion: Someone who supports and responses to and reporting on
defends a person or cause. Therefore, a opportunities and threats that affect the
champion of risk management will achievement of
promote its benefits, educate an its objectives.
organization’s ● Facilitating: Working with a group (or
management and staff in the actions they individual) to make it easier for that
need to take to implement it and will group (or
encourage them and support them in individual) to achieve the objectives
taking those actions. that the group has agreed for the
● Consulting Services: Advisory and meeting or
related client service activities, the nature
and activity. This involves listening,
scope of which are agreed with the client, challenging, observing, questioning
are intended to add value and improve an and supporting the
organization’s governance, risk group and its members. It does not
management, and control processes involve doing the work or taking
without the decisions.
internal auditor assuming management ● Risk: The possibility of an event
responsibility. Examples include counsel, occurring that will have an impact on
advice, facilitation, and training. the achievement
● Control: Any action taken by of objectives. Risk is measured in
management, the board, and other terms of impact and likelihood.
parties to manage ● Risk Appetite: The level of risk that
risk and increase the likelihood that an organization is willing to accept.
established objectives and goals will be ● Risk Management Framework: The
achieved. totality of the structures, methodology,

PIA-HAU
procedures and definitions that an
organization has chosen to use to
implement its risk
management processes.
● Risk Management Processes:
Processes to identify, assess, manage,
and control
potential events or situations, to provide
reasonable assurance regarding the
achievement of the organization’s
objectives.
● Risk Maturity: The extent to which a
robust risk management approach has
been
adopted and applied, as planned, by
management across the organization to
identify,
assess, decide on responses to and
report on opportunities and threats that
affect the
achievement of the organization’s
objectives.
● Risk Responses: The means by which
an organization elects to manage
individual
risks. The main categories are to tolerate
the risk; to treat it by reducing its impact
or
likelihood; to transfer it to another
organization or to terminate the activity
creating it.
Internal controls are one way of treating a
risk.

The Internal Audit internal audit activity to fulfill its
responsibilities
Committee and Charter, d) Independence and objectivity-
Independence and describes its importance in the internal
audit activity and how these will be
Objectivity maintained.
AAPRINCIPLES e) Responsibilities- lay out major areas of
ongoing responsibility, such as scope of
PURPOSE, AUTHORITY, AND assessments, internal audit plan, plan to
RESPONSIBILITY the board for approval, performing
engagements, communicating the
● must be formally defined in an internal
results, providing a written engagement
audit charter, consistent with the
report, and monitoring corrective
Mission of Internal Audit and the
actions taken by management.
mandatory elements of the
f) Quality assurance and improvement-
International Professional Practices
describe the expectations for
Framework
developing, maintaining, evaluating,
● The chief audit executive must
and communicating the results of a
periodically review the internal audit
quality assurance and improvement
charter and present it to senior
program that covers all aspects of the
management and the board for
internal audit activity.
approval
g) Signatures- document agreement
● internal audit charter- formal
among the CAE, a designated board
document that defines the internal
representative, and the individual to
audit activity's purpose, authority, and
whom the CAE reports. This section
responsibility
includes the date, names, and titles of
CONTENTS OF THE CHARTER signatories.
a) Introduction- explain the overall role

and professionalism of the internal RECOGNIZING MANDATORY GUIDANCE
audit activity. Relevant elements of the IN THE INTERNAL AUDIT CHARTER
● The mandatory nature of the Core
IPPF are often cited in the introduction.
Principles for the Professional Practice
b) Authority- specify the internal audit
of Internal Auditing, the Code of Ethics,
activity’s full access to the records,
the Standards, and the Definition of
physical property, and personnel
Internal Auditing must be recognized in
required to perform engagements and
the internal audit charter. The chief
to declare internal auditors’
audit executive should discuss the
accountability for safeguarding assets
Mission of Internal Audit and the
and confidentiality
mandatory elements of the
c) Organization and reporting structure-
International Professional Practices
document the CAE’s reporting structure.
Framework with senior management
The CAE should report functionally to
and the board.
the board and administratively to a level
within the organization that allows the INDEPENDENCE AND OBJECTIVITY
https://www.coursehero.com/file/127430552/AAPRINCIPLES-The-Internal-Audit-Committee-and-Charter-Independence-and-Objectivitydocxpdf/
● The internal audit activity must be ✔ Assurance engagements for
independent, and internal auditors functions over which the chief
must be objective in performing their audit executive has
work responsibility must be overseen
Organizational Independence by a party outside the internal
✔ The chief audit executive must audit activity.
report to a level within the ✔ Internal auditors may provide
organization that allows the consulting services relating to
internal audit activity to fulfill operations for which they had
its responsibilities. The chief previous responsibilities.
audit executive must confirm to ✔ If internal auditors have
the board, at least annually, the potential impairments to
organizational independence of independence or objectivity
the internal audit activity. relating to proposed consulting
Direct Interaction with the Board services, disclosure must be
✔ The chief audit executive must made to the engagement client
communicate and interact prior to accepting the
directly with the board. engagement.
Individual Objectivity THE INTERNAL AUDIT COMMITTEE
✔ The chief audit executive must
communicate and interact ● refers to the governance body that is
directly with the board charged with oversight of the
organization’s audit and control
Impairment to Independence or functions.
Objectivity ● Under the foregoing practice advisory,
the term is also intended to apply to
✔ If independence or objectivity is
other oversight groups with equivalents
impaired in fact or appearance,
and responsibilities such as trustees,
the details of the impairment
legislative bodies, owners of
must be disclosed to
owner-managed entities, internal
appropriate parties. The nature
control committees or full boards of
of the disclosure will depend
directors.
upon the impairment.
✔ Internal auditors must refrain Functions:
from assessing specific
operations for which they were 1. The audit committee engages in an
previously responsible. open, transparent relationship with the
Objectivity is presumed to be chief audit executive (CAE).
impaired if an internal auditor 2. The audit committee reviews and
provides assurance services for approves the internal audit charter
an activity for which the annually.
internal auditor had 3. As a result of discussions with the CAE,
responsibility within the the audit committee has a clear
previous year. understanding of the strengths and
weaknesses of the organization’s
internal control and risk management ● Advocating and promoting the value
systems internal audit professionals add to their
4. The internal audit activity is sufficiently organizations.
resourced with competent, objective ● Providing comprehensive professional
internal audit professionals to carry out educational and development
the internal audit plan, which has been opportunities, standards and other
reviewed and approved by the audit professional practice guidance, and
committee. certification programs.
5. The internal audit activity is empowered ● Researching, disseminating, and
to be independent by its appropriate promoting knowledge concerning
reporting relationships to executive internal auditing and its appropriate
management and the audit committee. role in control, risk management, and
6. The audit committee addresses with the governance to practitioners and
CAE all issues related to internal audit stakeholders.
independence and objectivity. ● Educating practitioners and other
7. The internal audit activity is quality
relevant audiences on best practices in
oriented, and has in place a Quality
internal auditing.
Assurance and Improvement Program
● Bringing together internal auditors from
(QAIP).
all countries to share information and
8. The audit committee regularly
experiences
communicated with the CAE about the
performance and improvement of the
internal audit as a whole.
REPORTING TO SENIOR
9. Internal audit reports are actionable, MANAGEMENT AND THE BOARD
and audit recommendations and/or ● The chief audit executive must report
other improvements are satisfactorily periodically to senior management and
implemented by management. the board on the internal audit activity’s
10. The audit committee meets periodically purpose, authority, responsibility, and
with the CAE without the presence of performance relative to its plan and on
management its conformance with the Code of Ethics
and the Standards. Reporting must also
THE INSTITUTE OF INTERNAL include significant risk and control
AUDITORS issues, including fraud risks, governance
issues, and other matters that require
● is the internal audit profession's global
the attention of senior management
voice, recognized authority,
and/or the board
acknowledged leader, chief advocate,
and principal educator. Generally, Internal Audit Charter
members work in internal auditing, risk
management, governance, internal ● internal audit activity’s
control, information technology audit, purpose, authority, and
education, and security. responsibility must be
formally defined in the
Mission internal audit charter. The
CAE is responsible for
periodically reviewing the
charter and presenting it to the assessments are
senior management and completed. However, the
the board for approval. results of ongoing
Organizational monitoring of the internal
Independence of the audit activity’s
Internal Audit Activity performance, which is part
● must be confirmed to the of the internal assessment
process, must be reported
board annually
at least annually
● In addition, any
Conformance With
interference in determining
the scope of internal the Code of Ethics
auditing, performing work, and Standards
or communicating results — ● “When nonconformance
as well as the implications with the Code of Ethics or
of such interference — the Standards impacts the
must be disclosed to the overall scope or operation
board of the internal audit activity,
● An independent reporting the chief audit executive
relationship is essential to must disclose the
facilitate the CAE’s ability to nonconformance and the
communicate directly with impact to senior
the board management and the
board.”
Results of Audit
● Engagement Disclosure of
Engagements
Nonconformance stipulates
● the information that the information that must
engagement be disclosed when
communications must nonconformance impacts a
contain, the quality of that specific engagement.
information, and the ● In addition, Standard 2060
protocol in the case of calls for the CAE to
errors and omissions or communicate action plans
nonconformance with the to address any significant
Code of Ethics or Standards issues related to
that affects a specific conformance.
engagement Significant Risk and
Quality Assurance Control Issues and
and Improvement Management’s
Program Acceptance of Risk
● lists the requirements of
● A primary purpose of CAE
the CAE’s communication to
reporting is to provide
senior management and
assurance and advice to
the board, including that
senior management and
this reporting must occur as
the board regarding the to review and adjust the internal audit
organization’s governance, plan.
risk management, and
controls
THEORIES
REPORTABLE CONDITIONS
1. A formal document that defines
● as matters coming to an
the internal audit’s purpose,
auditor's attention that
represent significant authority, and responsibility
deficiencies in the design or a. Authority
operation of internal b. Sanction
control that could adversely c. Charter
affect the entity's ability to d. Covenant
initiate, record, process, 2. The freedom from conditions
and report financial data
that threaten the ability of the
consistent with the
internal audit activity to carry
assertions of management
in the financial statements. out internal audit
responsibilities in an unbiased
Communication and Approval manner
- The chief audit executive must a. Self- government
communicate the internal audit b. independence
activity’s plans and resource c. objectivity
requirements, including significant
interim changes, to senior management
d. impairment
and the board for review and approval. 3. An unbiased mental attitude
The chief audit executive must also that allows internal auditors to
communicate the impact of resource perform engagements in such a
limitations. manner that they believe in
- The chief audit executive (CAE) should
their work product and that no
submit annually to senior management
quality compromises are made.
for approval, and to the board for its
information, a summary of the internal a. Independence
audit activity’s work schedule, staffing b. Objectivity
plan, and financial budget.
- The CAE must review significant c. Engagement
changes to the audit plan, related d. Control environment
rationale, and potential impact with the
board and senior management to 4. A specific internal audit
obtain their approval. Regularly assignment, task, or review
scheduled quarterly or semiannual activity, such as an internal
board meetings provide opportunities audit, control self-assessment
review, fraud examination, or
consultancy
a. Independence
b. Objectivity
c. Engagement
d. Control environment
5. Describes a person in a senior
position responsible for
effectively managing the
internal audit activity in
accordance with the internal
audit charter and the Definition
of Internal Auditing, the Code of
Ethics, and the Standards.
a. Chief Audit Executive
b. IPPF
c. Senior Management
d. Board of Directors
The International auditor. Due professional care does not
imply infallibility
Professional Practices
Continuing Professional
Framework Development
AAPRINCIPLES-MODULE 14
● Internal auditors must enhance their
Proficiency and Due knowledge, skills, and other
competencies through continuing
Professional Care professional development.
● Engagements must be performed with ● In order to enhance their competencies
proficiency and due professional care- and continue their professional
Performing engagements with development, internal auditors may
proficiency and due professional care is want to reflect on their job
the responsibility of every internal requirements, including the training
auditor policies and the professional education
● Usually develop proficiency via requirements of their profession,
education, experience, professional organization, industry, and any
development opportunities, and certifications or areas of specialization.
qualifications such as the internal audit
Managing the Internal Audit
profession’s most relevant certification,
the Certified Internal Auditor granted by Activity
The IIA.
● The chief audit executive must
Proficiency effectively manage the internal
● Internal auditors must possess the audit activity to ensure it adds
knowledge, skills, and other value to the organization.
competencies needed to perform their
Internal Audit activity is effectively
individual responsibilities. The internal
managed when:
audit activity collectively must possess
or obtain the knowledge, skills, and - It achieves the purpose and
other competencies needed to perform responsibility included in the internal
its responsibilities. audit charter.
● Proficiency is a collective term that - It conforms with the Standards.
refers to the knowledge, skills, and
other competencies required of internal
- Its individual members conform with
auditors to effectively carry out their the Code of Ethics and the Standards.
professional responsibilities - It considers trends and emerging issues
that could impact the organization.
Due Professional Care
The specific responsibilities of the
● Internal auditors must apply the care Chief Audit Executive in managing
and skill expected of a reasonably the internal audit activity were laid
prudent and competent internal down in IIA Standard 2000 and its
https://www.coursehero.com/file/127430444/AAPRINCIPLES-The-International-Professional-Practices-Frameworkdocxpdf/
related practice advisories as 3. Appreciative Skills often in situations of
follows: ambiguity.
Behavioral Skills Handling oneself well
1. Planning 1. Personal in situations of
Skills challenge, stress,
- The chief audit executive must conflict, time
establish a risk-based plan to pressure, and
determine the priorities of the change.
internal audit activity,
consistent with the Securing outcomes
2. Interpersonal Skills through
organization’s goals.
interpersonal
2. Communication and Approval interactions.
- The chief audit executive must

communicate the internal audit
Securing outcomes
activity’s plans and resource 3. Organizations through the use of
requirements, including Skills organizational
significant interim changes, to
networks
senior management and the
board for review and approval.
The chief audit executive must
also communicate the impact of
resource limitations 4.Policies and Procedures
3. Resource Management - The chief audit executive must

establish policies and
- The chief audit executive must procedures to guide the internal
audit activity.
ensure that internal audit
resources are appropriate, 5.Coordination
sufficient, and effectively
deployed to achieve the - The chief audit executive should
approved plan share information, coordinate
activities, and consider relying
Cognitive Skills Following defined upon the work of other internal
1. Technical routines with some and external assurance and
Skills mastery. consulting service providers to
ensure proper coverage and
Problem minimize duplication of efforts.
2. Analytical identification or task
Skills definition and the 6. Reporting to the board and Senior
structuring of Management
prototype solutions
or performances. - The chief audit executive must
Making complex and report periodically to senior
creative judgments, management and the board on
the internal audit activity’s
purpose, authority, ● Standard 1311 – Internal
responsibility, and performance Assessments- states that the
relative to its plan and on its mandatory internal assessments must
conformance with the Code of include both ongoing monitoring and
Ethics and the Standards. periodic self-assessments.
Reporting must also include
significant risk and control ● Standard 1312 – External
issues, including fraud risks, Assessments- explains the
governance issues, and other requirements for external assessments,
matters that require the including their form and frequency (at
attention of senior least once every five years) as well as the
management and/or the board. qualification and independence
requirements for the external assessor
or assessment team.
External Service Provider and
Organizational Responsibility for ● Standard 1320 – Reporting on the
Internal Auditing Quality Assurance and Improvement
Program- outlines the CAE’s
● When an external service provider responsibilities for communicating the
serves as the internal audit activity, the results of the QAIP to senior
provider must make the organization management and the board.
aware that the organization has the ● Standard 1321 – Use of “Conforms with
responsibility for maintaining an the International Standards for the
effective internal audit activity. Professional Practice of Internal
● Standard 1210.A1- The chief audit Auditing”- indicates that internal audit
executive must obtain competent advice activity may only communicate — in
and assistance if the internal auditors writing or verbally — conformance with
lack the knowledge, skills, or other the Standards if results of the QAIP
competencies needed to perform all or (including internal and external
part of the engagement. assessments) support such a statement.
● Standard 1322 – Disclosure of
● Standard 1300 – Quality Nonconformance requires the CAE- the
Assurance and Improvement external service provider hired to serve
Program- explains that the CAE must as CAE — to disclose to senior
develop and maintain a QAIP that management and the board any
encompasses all aspects of the internal instances where the internal audit
audit activity. activity does not conform with the
Standards or the Code of Ethics and how
● Standard 1310 – Requirements the lack of conformance impacts the
of the Quality Assurance and overall scope or operation of the internal
Improvement Program- stipulates audit activity.
that the QAIP must include both internal
and external assessments.
and relevant audit evidence. The
CAE determines whether
it is essential that the CAE establish
additional work or testing is
a consistent process and set of
needed to obtain sufficient
criteria to determine whether the
evidence to support or increase
internal audit activity may rely on the
the level of reliance desired. If
work of another provider. In this
additional work is needed, the
process, the CAE may:
internal audit activity may retest
● Evaluate objectivity by considering the results of the other provider
whether the provider has, or may
THEORIES
appear to have, any conflicts of
interest and whether they have 1. The chief audit executive must
been disclosed. establish a risk-based plan to
● Consider independence by determine the priorities of the internal
examining the provider’s reporting audit activity, consistent with the
relationships and the impact of organization’s goals.
this arrangement. a. Communication and approval
● Confirm competency by verifying b. Planning
whether the provider’s c. Resource Management
professional experience, d. Policies and procedures
qualifications, certifications, and 2. The chief audit executive must
communicate the internal audit
affiliations are appropriate and
activity’s plans and resource
current. requirements, including significant
● Assess due professional care by interim changes, to senior
examining elements of the management and the board for review
practice the provider applies to and approval.
complete the work (i.e., the a. Communication and approval
provider’s methodology and b. Planning
whether the work was c. Resource Management
appropriately planned, supervised, d. Policies and procedures
documented, and reviewed). 3. The chief audit executive must ensure
● The CAE may also seek to gain that internal audit resources are
an understanding of the scope, appropriate, sufficient, and effectively
objectives, and results of the deployed to achieve the approved
actual work performed to plan.
determine the extent of reliance a. Communication and approval
that may be placed on the b. Planning
provider’s work. The CAE typically c. Resource Management
considers whether the provider’s d. Policies and procedures
findings appear reasonable and
are based on sufficient, reliable,
4. Handling oneself well in situations of
challenge, stress, conflict, time
pressure, and change.
a. Interpersonal skills
b. Organizational skills
c. Personal skills
d. Technical skills
5. The chief audit executive must
establish this to guide the internal
audit activity
a. Communication and approval
b. Planning
c. Resource Management
d. Policies and procedures

Combinepdf

Uploaded by

Copyright:

Available Formats

You might also like

Combinepdf

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Combinepdf

Uploaded by

Copyright:

Available Formats

events or situations to provide

Introduction to reasonable assurance regarding the

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

● Statements of core requirements for - Implementation Standards

The Standards comprise two main Standard 1100 — Independence

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

● Objectivity requires that internal Internal auditors must have an impartial,

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

Examples of objectivity impairments

- An internal auditor audits an area in

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

provides value to the organization are Consulting roles

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

AAPRINCIPLES – Fundamentals of Assurance Services

a) Introduction- explain the overall role

- The chief audit executive must

3. Resource Management - The chief audit executive must

You might also like