Applicable Guidance Flashcards
IIA Mission
- to enhance and protect organizational value by providing risk-based and objective assurance, advice and insight.
- facilitating the achievement of this mission is the IPPF
IPPF Contains 2 guidance; what are they
- Mandatory guidance
2. recommended guidance
Mandatory Guidance; 4 Elements
- Core principles (10)
- Definition
- Standards
- Code of Ethics
Mandatory Guidance; Core Principles
- demonstrate integrity
- demonstrate competence and due professional care
- is objective and free from undue influence (independent)
- aligns with the strategies, objectives, and risk of the organization
- is appropriately positioned and adequately resourced
- demonstrates quality and continuous improvement
- communicates effectively
- provides risk-based assurance
- is insightful, proactive, and future-focused
- promotes organizational improvement
Definition of Internal Auditing
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approached to evaluate and improve the effectiveness of risk management, control, and governance processes.
Code of Ethics
- Integrity, refusal to compromise professional values for personal gain. performance of professional duties in accordance with relevant laws.
- Objectivity, commitment to providing stakeholders with unbiased information. commitment to independence from conflicts of economic or professional interest.
- Confidentiality, refusal to use organization information for personal gain.
- Competency, commitment to acquiring and maintaining an appropriate level of knowledge and skills.
Purpose of the Standards (International Standards for the Professional Practice of Internal Auditing)
- guide adherence with the mandatory elements of the IPPF
- provide a framework for performing and promoting a broad range of value-added internal auditing services
- Establish the basis for the evaluation of internal audit performance
- foster improved organizational processes and operations
Standards; 4 types of Standards
- Attribute Standards, govern the responsibilities, attitudes, and actions of the organization’s internal audit activity and the people who serve as internal auditors.
- Performance Standards, govern the nature of internal auditing and provide quality criteria for evaluating the internal audit function’s performance.
- Interpretations are provided by the IIA to clarify terms and concepts referred to in Attribute or Performance standards.
- Implementation standards, expand upon the individual attribute or performance standards by providing requirements applicable to assurance (.A) or consulting (.C).
Core Principles + Definition = Code of Ethics + Standards
Conformance of the Code of Ethics and Standards demonstrates conformance with all mandatory elements of the IPPF
Recommended Guidance; 2 elements
- Implementation Guidance
2. Supplemental Guidance
Assurance Services
- nature and scope determined by the internal auditor
- 3 parties involved: process owner, internal auditor, the user of the assessment
- assurance services include financial, performance, compliance, system security, and due diligence engagements
Consulting services
- nature and scope subject to agreement with the engagement client
- two parties: internal auditor, engagement client
- services include providing counsel, advice, facilitation, and training
Authority of Internal Audit Activity
A formal charter for the internal audit activity that defines the internal audit activity’s purpose, authority, and responsibility must be adopted. Final approval resides with the board.
Responsibility of Internal Audit Activity
The internal audit activity’s responsibility is to provide the organization with assurance and consulting services that will add value and improve the organization’s operations. Specifically, must evaluate and improve the effectiveness of the organization’s governance, risk management, and control processes.
The primary purpose of the Code of Ethics
promote an ethical culture among professionals who serve others
Secondary purpose of the Code of Ethics
- communicating acceptable values to all members
- establishing objective standards against which individuals can measure their own performance, and
- communicating the organization’s values to outsiders
Aspects of Codes of Ethical Conduct
- The mere existence of a code does not ensure that its principles are followed or that outside organization will believe that it is trustworthy
- can help establish a minimum standard of competence, but impossible to require equality of competence by all members.
- to enhance its effectiveness, the code should provide for disciplinary action for violators.
Integrity
- establishes trust and thus provides the basis for reliance on their judgment
- shall perform work with honesty, diligence, and responsibility
shall observe the law and make disclosures expected by the law and the profession - shall not knowingly be a party to any illegal or engage in acts that are discreditable to the profession of internal auditing or to the organization
4.shall respect and contribute to the legitimate and ethical objectives of the organization
objectivity
- exhibit the highest level of professional objectivity in gathering, evaluating, and communicating information about the activity or process being examined
- shall not participate in any activity or relationship that may impair or presumed to impair their unbiased assessment, avoid conflict of interest
- shall not accept anything that may impair or presumed to impair their professional judgment
- shall disclose all material facts known to them that, if not disclosed, may distort the reporting of activities under review
Confidentiality
- respect the value and ownership of information they receive and do not disclose information without appropriate authority unless there are legal or professional obligation to do so
- shall be prudent in the use and protection of information acquired in the course of their duties
- shall not use the information for any manner that would be contrary to the law or detrimental to the legitimate and ethical objectives of the organization
Competency
- apply the knowledge, skills, and experience needed in the performance of the internal audit services
- shall engage in those services for which they have the necessary knowledge, skills, and experience
- shall perform internal audit services in accordance with the Standards
- shall continually improve their proficiency and the effectiveness and quality of their services
discreditable behaviors
- behavior that may be considered bullying, harassing, or discriminatory
- failing to accept responsibility for making mistakes
- issuing false reports or permitting others to do so
- lying
- making claims about one’s competency in a manner that is deceptive, false, or misleading
- making disparaging comments about the organization, fellow employees, or stakeholders, either in person or via media
- noncompliance with the Standards or the IPPF mandatory guidance
- overlooking illegal activities that the organization may tolerate or condone
- using the CIA designation or other credentials after they have expired or been revoked
Conflict of Interest Policy
should prohibit the transfer of benefits between an employee and those with whom the organization deals
Information Security Policies
issue Information security policies to protect the data acquired, use, and produce and to ensure compliance with the laws and regulations that pertain to the industry and jurisdiction within which they operate
Internal Audit Charter
The purpose, authority, and responsibility of the internal audit activity must be formally defined in the charter, consistent with the mission of internal audit and the mandatory elements of the IPPF, core principles, code of ethics, standards, and definition
Internal Audit Charter
Chief audit executive (CAE), senior management, and the board mutually agree upon:
- internal audit objectives and responsibilities
- expectations for the internal audit activity
- CAE’s functional and administrative reporting lines
- level of authority required of the internal audit activity to perform engagement and fulfill its agreed-upon objectives and responsibilities
Engagement Clients
must be informed of the internal audit activity’s purpose, authority, and responsibility to prevent misunderstandings about internal audit’s access to records and personnel.
Two essential components beyond the code of ethics and Definition of Internal Auditing
- principles that are relevant to the profession and practice of internal auditing
- rules of conduct that described behavior norms expected of internal auditors
