Upgrade to remove ads
Only $35.99/year

Internal Audit Ch. 9

Terms in this set (28)

Internal Audit Charter
A formal written document that defines the internal audit function's purpose, authority, and responsibility. The internal audit charter is subordinate to the audit committee's charter.

Important starting point of managing internal audit
Topics of the Charter
1) Establishment of Internal audit function
2) The goal or objective of audit function
3) Authority granted to department
4) scope of work authorized
5) Organizational Status
6) Acceptable Standards of performance
7) Department's administrative and reporting relationships
8) Responsibility of follow up
9) Approval of Charter by board and senior management
Who is responsible for establishing the charter/mission and plan along with maintaining independence, objectivity, proficiency, and due professional care?
CAE
IIA Standard 1120: "Individual Objectivity"
Internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest
IIA Standard 1130: Impairment to Independence or Objectivity
If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment
IIA Standard 1220: Due Professional Care
internal auditors must apply the care and skill expected of a reasonably prudent and competent internal auditor. Due professional care does not imply infallibility
Who's responsibility is it to ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan?
The CAE
Typical internal audit hierarchy
1. CAE
2. Audit director (usually only big companies)
3. Audit manager
4. senior auditor (in-charge auditor)
5. staff auditor
Right Sizing
important concept in the staffing and scheduling internal audit.

having the right amount of people without wasting resources to achieve audit without putting stress on team for being understaffed
Strategic Sourcing
Supplements the in-house internal audit function through the use of third-party vendor services for the purposes of gaining subject matter expertise for a specific engagement or filling a gap in needed resources to complete the internal audit plan
IIA Standard 2040: Policies and Procedures
The Chief audit executive must establish policies and procedures to guide the internal audit activity
IIA Standard 2050: Coordination
The CAE should share information and coordinate activities with other internal external providers of assurance and consulting services to ensure proper coverage and minimize duplication of efforts
Planning and Budgeting
The CAE must have senior management and the board annually the internal audit plan and budget
IIA Standard 2030: Resource Management
The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan.
CAE Responsibilities while managing personnel
-Prepare Job description
-recruiting
-initial training
-CPE credit
-evaluating performance annually
-counseling professional employees and staff
Issues Addressed in Policy and Procedures
-Department organizational chart
-Job description
-internal audit philosophy and approach
-description of audit tools used
-audit reporting guidelines
-consulting engagement guidelines
-quality control procedures
-relationships with clients
-code of conduct
-travel and expense procedures
-personnel evaluation procedures
IIA 2060-1: Reporting to Senior Management and the Board
CAE must report periodically to senior management and the baord on the internal audit activity's purpose, authority, responsibility, and performance relative to its plan.

-CAE should agree with the board about the frequency and nature of reporting on the internal audit activity's charter
-Senior management and the board make decisions on the appropriate action to be taken regarding significant issues.
-when the CAE thinks senior management has accepted risk the organization would consider unacceptable, the CAE must discuss with senior management
-if the CAE and senior management cannot reach agreement, the CAE must inform the board.
-For financial reporting matters, the CAE should consider telling external auditors
Implementation Guidance 1000
Charters usually include:
-Introduction:
-Authority: says the access power
-Organization and reporting structure:
-Independence and Objectivity:
-Responsibilities:
-Quality Assurance and Improvement:
-Signatures:
Quality Control Review is the responsibility of
the CAE
Quality Assurance and Improvement Program is made up of
Internal Assessment and External Assessment
Internal Assessment
1)Ongoing Internal Assessment
2) Periodic Reviews (done within company)
External Assessment
1) Full external review (preferred)
2) External Assessment: Self-Assessment with independent validation
Practice Advisory 1311-1: Internal Assessments
The CAE is required to develop and implement a QAIP

Ongoing Monitoring: determines whether processes are delivering quality on an engagement-by-engagement basis

Periodic Self-Assessment: if performed within a short time before an external assessment can serve to facilitate and reduce the level of effort and time required to complete an external assessment
Practice Advisory 1312-1: External Assessments
External Assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. The CAE must discuss with the board the form and frequency of external assessment and the qualifications and independence of the external assessor

Qualifications of Assessor:
-competent and certified
-at least 3 years of recent experience in the practice of internal auditing at a senior level

--You can get external review from other internal audit team outside company but you cannot review them. Need at least 3 companies
Practice Advisory 1312-2: External Assessments: Self Assessment with independent validation (SAIV)
CAE can determine SAIV is more practical or beneficial than a full external assessment

Need to see the conformance with definition of internal auditing, code of ethics, and standards
Practice Advisory 1320-1: Reporting results of the quality assurance and improvement program
The CAE must communicate the results of the QAIP to senior management and the board

-Should be done at least annually
-Can have one report (combined external and CAE) or have two separate reports
Practice Advisory 1321-1: Use of "Conforms with the international standards for the professional practice of internal auditing"
The CAE may state that the internal audit activity conforms with the International Standards for the Professional Practice of Internal Auditing only if the results of the QAIP support this statement:

IA conforms with the 3 major mandatory guidance: definition, code of ethics and standards

If internal assessment demonstrate conformance during first five years of an IA activity's existence, and this has been communicated to the board, the CAE may state that the audit activity conforms with the Standards
Practice Advisory 1322-1: Disclosure of Non conformance with the International Standards for the Professional Practice of Internal Auditing (Standards)
When nonconformance with the Definition of Internal Auditing, the Code of Ethics, or the Standards impacts the overall scope or operation of the internal audit activity, the chief audit executive must disclose the nonconformance and the impact to senior management and the board.

typical examples of non-conformance:
-Assigning non-objective auditors
-Failing to consider risk in the prep of the annual audit plan
-undertaking engagements beyond the collective knowledge, skills, and experience of the internal audit activity
Sets with similar terms