10_Introduction to Internal Auditing

Question 1

Relationship External – Internal Auditing:

Using the Work of Internal Auditors: The objectives

Answer 1

The objectives of the external auditor, where the external auditor expects to use the work of the function or to use internal auditors to provide direct assistance, are:

– To determine whether the work of the internal audit function or direct assistance from internal auditors can be used, and if so, in which areas and to what extent

– To determine whether that work is adequate for purposes of the audit

– If using internal auditors to provide direct assistance, to appropriately direct,

supervise and review their work

Question 2

Relationship External – Internal Auditing:

Using the Work of Internal Auditors: external auditors responsibility for the audit (610.11)

Answer 2

– The external auditor has sole responsibility for the audit opinion expressed. That responsibility is not reduced by the external auditor’s use of the work of the internal audit function or internal auditors to provide direct assistance

– Neither the internal audit function nor the internal auditors are independent of the entity as is required of the external auditor in an audit of financial statements

Question 3

Relationship between internal auditing and the external auditor (610.A4)

• Evaluating Internal Auditing

Answer 3

– The external auditor determines whether the work of internal auditing can be used for purposes of the audit (610.15)
Thus, he has to evaluate the following:

• Organizational status and relevant policies and procedures that support the objectivity of the internal auditors
• The level of competence of the internal audit function
• Whether the internal audit function applies a systematic and disciplined approach, including
• quality control

• Determin_ing the nature and extent of work of internal auditing can be used_

– The external auditor considers the nature and scope of the work that has been performed, or is planned to be performed, and its relevance to the external auditor’s overall audit strategy and audit plan (610.17)

Question 4

International Standard on Auditing (ISA) 610: Using the Work of Internal Auditors

Answer 4

• Using the work of internal auditing

– The external auditor discusses the planned use of internal auditing’s work with the function as a basis for coordinating their respective activities (610.21)

– The external auditor obtains an understanding of the nature and extent of audit procedures internal auditing performed and the related findings (610.22)

– The external auditor performs sufficient audit procedures on the work of internal auditing, to determine its adequacy for purposes of the audit, including: (610.23)

• Whether it had been properly planned, performed, supervised, reviewed and documented
• Sufficient appropriate evidence had been obtained
• Conclusions reached are appropriate and reports are consistent with the results

– The nature and extent of the external auditor’s audit procedures shall be responsive to the external auditor’s evaluation of: (610.24)

• The amount of judgment involved
• The assessed risk of material misstatement
• The extent to which the internal auditing’s organizational status and relevant policies and
• procedures support the objectivity of the internal auditors
• The level of competence of the function
• Including reperformance of some work.

Question 5

International Standard on Auditing (ISA) 610: Using the Work of Internal Auditors

Determining whether internal auditors can be used to provide direct assistance for purposes of the audit

Answer 5

– The external auditor may be prohibited by law or regulation from obtaining direct assistance from internal auditors. If so, the following does not apply (610.26)

– If direct assistance is not prohibited, the external auditor evaluates the existence and significance of threats to objectivity and the level of competence of the internal auditors. This includes inquiry of the internal auditors regarding interests and relationships that may create a threat to their objectivity (610.27)

Question 6

International Standard on Auditing (ISA) 610: Using the Work of Internal Auditors

Determining the nature and extent of work that can be assigned to internal auditors providing direct assistance

Answer 6

– In determining the nature and extent of work that may be assigned to internal auditors and the nature, timing and extent of direction, supervision and review that is appropriate in the circumstances, the external auditor considers: (610.29)

• The amount of judgment involved in planning and performing relevant audit procedures and in evaluating the audit evidence gathered
• The assessed risk of material misstatement
• The external auditor’s evaluation of the existence and significance of threats to the

objectivity and level of competence of the internal auditors

Question 7

Limitation of Direct Assistance

Answer 7

• The regulator has several concerns about direct assistance.
• The Federal Audit Oversight Authority (FAOA) made the following comment:

“We still do not support the concept of internal auditors providing direct assistance to the external auditor for the following reasons”:

• Independence cannot be ensured
• Competence and objectivity of internal auditors providing direct assistance are not subject to the same level of regulation
• Management may put pressure on the external auditor to reduce the audit fee

The FINMA has similar concerns (FINMA-RS 2013/3):

• The external auditor is responsible for the audit opinion. The audit opinion is based on the auditors own judgement.
• Disclosure is required in case the auditor relies partly on work performed by internal audit.
• It is not allowed to use the work of internal audit in the same area for two consecutive years.

Question 8

Definition of Internal Auditing

Answer 8

“Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization‘s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.”

Elements of the IIA Definition

• Independence and Objectivity
• Assurance and Consulting Services
• Value Added
• Improvement of the organization’s operations
• Support the achievement of the organization’s objectives
• Governance, risk management, and control processes

Question 9

Explain Independence and Objectivity of internal auditor

Answer 9

The internal audit activity must be independent, and internal auditors must be objective in performing their work.

(IIA-Standard 1100 – Independence and Objectivity)

Independence

– Organizationalposition

– The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities

Objectivity

– Impartial, unbiased attitude of internal auditors

– Avoid any conflict of interest

– The details of an impairment to independence of objectivity must be disclosed to the appropriate parties

Question 10

Organizational Independence

Answer 10

Independence is the freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner. The internal audit activity must be free from interference in determining:

– The scope ofinternalauditing

– Performingwork
– Communicating results

Independence concerns the organization’s structure:

– Thechiefauditexecutivereportstoalevelwithinthe organization that allows the internal audit activity to fulfill its responsibilities, e.g., to the board or the audit committee

– The chief audit executive has direct and unrestricted access to senior management and the board

– This can be achieved through ad ual-reporting relationship

Question 12

Objectivity of Internal Auditors

Answer 12

• Objectivity is an unbiased mental attitude that allows internal auditors to perform engagements in such a manner that they believe in their work product and that no quality compromises are made
• Objectivity requires that internal auditors do not subordinate their judgment on audit matters to others
• Objectivity means that another person with a comparable level of experience would reach the same conclusions as the internal auditor under the same circumstances
• Disclosure of material facts, that might influence the internal auditor’s final communication of engagement results

Question 13

Objectivity of Internal Auditors - conflict of interest

Answer 13

• To ensure an impartial, unbiased attitude, any conflict of interest must be avoided
• Conflict of interest is a situation in which an internal auditor has a competing professional or personal interest
• A conflict of interest can be cause by:

– Incentives

• The internal auditor has an economic interest
• The internal auditor is offered a position in the audited business unit

– Personal relationships

• The internal auditor is related to a close friend with an employee of the audited business unit

– Auditing of own work

Question 14

Internal Audit Services, explain:

• Assurance
• Consulting

Answer 14

Assurance Services

An objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization.

Examples include financial, performance, compliance, system security, and due diligence engagements.

Consulting Services

Advisory and related client service activities, the nature and scope of which are agreed with the client, are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility.

Examples include counsel, advice, facilitation, and training.

Question 15

How does IA add value ?

Answer 15

Add value

– Internal auditors obtain insight into the organization’s activities,

processes and structures

– The knowledge acquired enables internal auditors to identify

operational deficiencies and potential for improvement

– Internal auditors may present effective and useful approaches for

optimization to senior management and the board of directors

– By generating added value, the existence of an internal audit activity is legitimated

Question 16

How does IA improve operations ?

Answer 16

Improvement of Operations

– The capability for continuous operational improvement is a

precondition for the long-term survival of an organization

– Organizations that adapt their operational procedures and structures to the changing environment may gain a competitive advantage

– By evaluating the organization’s processes and procedures and indicating deficiencies and potential for optimization, internal auditing contributes to the continuous advancement of the organization

Question 17

How does IA do “Improvement of Operations “ ?

Answer 17

Improvement of Operations

– The capability for continuous operational improvement is a

precondition for the long-term survival of an organization

– Organizations that adapt their operational procedures and structures to the changing environment may gain a competitive advantage

– By evaluating the organization’s processes and procedures and indicating deficiencies and potential for optimization, internal auditing contributes to the continuous advancement of the organization

Question 18

How does IA Help an organization accomplish its objectives ?

Answer 18

Helps an organization accomplish its objectives

– Operational objectives are derived from the organization’s vision and strategy

– Potential categorization:

• Strategic objectives
• Operational objectives
• Reporting objectives
• Compliance objectives

– The organization’s objectives present indications for internal auditing to determine specific engagement objectives

– Internal auditing must align itself with the organization’s objectives

Question 19

Nature of work of IA according to IIA standard 2100

• governance process
• risk management pr.
• control pr.

Answer 19

Governance processes

– Promotingappropriateethicsandvalues within the organization

– Ensuring effective organizational performance managemen tand accountability

– Communicating risk and control information to appropriatea reas of the organization

– Coordinating the activities of and communicating information among the board, external and internal auditors and management

Risk management processes

– The internal audit activity must evaluate risk exposures relating to the organization’s governance, operations, and information systems regarding **

Control processes

– The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organization’s governance, operations, and information systems regarding the: ***

*** Achievement of the organization’s strategic objectives;

− Reliability and integrity of financial and operational information;

− Effectiveness and efficiency of operations and programs;

− Safeguarding of assets; and

− Compliance with laws, regulations, policies, procedures, and

contracts.

Question 20

International Professional Practices Framework (IPPF)

Answer 20

• Foundation for internal auditing that is issued by the IIA
• Update of the Professional Practices Framework (PPF) from 1999
• Effective since January 1, 2009; Updated 2015
• Two types of guidance:

− Mandatory guidance

• Definition of Internal Auditing
• CorePrinciples
• CodeofEthics
• IIAStandards
• → Members of the IIA and its national representatives (e.g., the IIA Switzerland, IIAS), as well as candidates for and owners of IIA certifications must comply with these parts of the IPPF

− Recommended guidance

• Implementation Guides
• Supplemental Guides

Question 21

Core Principles of Internal Auditing (10)

Answer 21

Core Principles of the Professional Practice of Internal Auditing

1. Demonstrates integrity.
2. Demonstrates competence and due professional care.
3. Is objective and free from undue influence (independent)
4. Aligns with the strategies, objectives, and risks of the organization.
5. Is appropriately positioned and adequately resourced.
6. Demonstrates quality and continuous improvement.
7. Communicates effectively.
8. Provides risk-based assurance.
9. Is insightful, proactive, and future-oriented.
10. Promotes organizational improvement.

Question 22

Mission of IA (IPPF)

Answer 22

To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.

Question 23

Implication of failing any Core Principle of IPPF

Answer 23

Failure to achieve any of the Principles would imply that an internal audit activity was not as effective as it could be in achieving internal audit’s mission

Question 24

Principles of the Code of ethics of IPPF

Answer 24

The Code of Ethics consists of four principles:
– Integrity
The integrity of internal auditors establishes trust
and thus provides the basis for reliance on their judgment
– Objectivity
Internal auditors exhibit the highest level of professional
objectivity in gathering, evaluating, and communicating
information about the activity or process being examined. Internal auditors make a balanced assessment of all the relevant circumstances and are not unduly influenced by their own interests or by others in forming judgments
– Confidentiality
Internal auditors respect the value and ownership of information they receive and do not disclose information without appropriate authority
unless there is a legal or professional obligation to do so
– Competency
Internal auditors apply the knowledge, skills, and experience needed in the performance of internal audit services

Question 25

What are attribute stardards (IPPF)

(needed?)

Answer 25

They describe the characteristics of people and organizations that perform internal audit services

– Purpose, Authority, and Responsibility
– Independence and Objectivity
– Proficiency and Due Professional Care
– Quality Assurance and Improvement Program

Question 26

What are performance standards? (IPPF)

(needed?)

Answer 26

They describe the responsibilities of internal auditing and provide quality criteria to assess the work of an internal audit activity

• Performance standards consist of:
– Managing the Internal Audit Activity
– Nature of Work
– Engagement Planning
– Performing the Engagement
– Communicating Results
– Monitoring Progress
– Communicating the Acceptance of Risk