CIA 2.1: Independence of Internal Audit Activities Flashcards
Interpretation of Independence:
Interpretation of Standard 1100 (para. 1)
Independence is the freedom from conditions that threaten the ability of the internal audit activity to carry out internal audit responsibilities in an unbiased manner. To achieve the degree of independence necessary to effectively carry out the responsibilities of the internal audit activity, the chief audit executive has direct and unrestricted access to senior management and the board. This can be achieved through a dual-reporting relationship. Threats to independence must be managed at the individual auditor, engagement, functional, and organizational levels.
What separates functional reporting and administrative reporting?
Dual reporting, which allows for independence in Audit
How to achieve independence in reporting to the board?
In this Standard, the reporting level that assures independence is identified in general terms:
Attribute Standard 1110
Organizational Independence
The chief audit executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. The chief audit executive must confirm to the board, at least annually, the organizational independence of the internal audit activity.
Interpretation of Organizational Independence:
Organizational independence is effectively achieved when the chief audit executive reports functionally to the board. Examples of functional reporting to the board involve the board:
- Approving the internal audit charter.
- Approving the risk based internal audit plan.
- Approving the internal audit budget and resource plan.
- Receiving communications from the chief audit executive on the internal audit activity’s performance relative to its plan and other matters.
- Approving decisions regarding the appointment and removal of the chief audit executive.
- Approving the remuneration of the chief audit executive.
- Making appropriate inquiries of management and the chief audit executive to determine whether there are inappropriate scope or resource limitations.
How do you ensure conformance with the Attribute Standard relating to organizational independence?
Further guidance on the dual-reporting relationship is provided in IG 1110, Organizational Independence:
“[T]he CAE works with the board and senior management to determine organizational placement of internal audit, including the CAE’s reporting relationships. To ensure effective organizational independence, the CAE has a direct functional reporting line to the board.”
But the CAE cannot solely determine organizational independence and placement.
“A functional reporting line to the board provides the CAE with direct board access for sensitive matters and enables sufficient organizational status. It ensures that the CAE has unrestricted access to the board, typically the highest level of governance in the organization.”
“Generally, the CAE also has an administrative reporting line to senior management, which further enables the requisite stature and authority of internal audit to fulfill responsibilities.”
“For example, the CAE typically would not report to a controller, accounting manager, or mid-level functional manager.”
“To enhance stature and credibility, The IIA recommends that the CAE report administratively to the chief executive officer (CEO) so that the CAE is clearly in a senior position, with the authority to perform duties unimpeded.”
Conformity with Organizational Independence can be demonstrated, among other means, by:
“[T]he internal audit charter and the audit committee charter, which would describe the audit committee’s oversight duties.”
“The CAE’s job description and performance evaluation[, which] would note reporting relationships and supervisory oversight.”
“[A]n internal audit policy manual that addresses policies like independence and board communication requirements or an organization chart with reporting responsibilities. . . .”
If the CAE has a direct functional reporting relationship with the board…
then the board assumes responsibility for approving the internal audit charter, internal audit plan, internal audit budget and resource plan, evaluation and compensation of the CAE, and appointment and removal of the CAE. Further, the board monitors the ability of internal audit to operate independently and fulfill its charter.”
CAEs will have many opportunities to interact with the board as required by Attribute standard 1111. How so?
For example, the CAE will participate in audit committee and/or full board meetings, generally quarterly, to communicate such things as the proposed internal audit plan, budget, progress, and any challenges. Further, the CAE will have the ability to contact the chair or any member of the board to communicate sensitive matters or issues facing internal audit or the organization. Typically, and at least annually, a private meeting with the board or audit committee and the CAE (without senior management present) is formally conducted to discuss such matters or issues. It is also helpful for the CAE to participate in one-on-one meetings or phone calls periodically with the board or audit committee chair, either prior to scheduled meetings or routinely during the year, to ensure direct and open communication.”
Board meeting minutes will suffice to ensure CAE is communicating with board.
How often should the CAE confirm to the board, its organization independence?
At least annually
What facilitates organizational independence?
The CAE reporting to the board (functionally), and reporting to the CEO (administratively)
Administrative reporting typically involves what?
Budgeting and management accounting
Describe functional reporting
If the matter involves an audit including: Organizational planning, Engagement planning, and Performance, reporting, then it is a functional item
Describe administrative reporting
It involves the day to day activities of running the department including: personnel issues, internal reporting, and internal audit compliance with internal P&Ps
Who is responsible in terms of proficiency?
- “The CAE is responsible for ensuring conformance with [Attribute Standard 1200] by the internal audit activity as a whole.”
- However, “[p]erforming engagements with proficiency and due professional care is the responsibility of every internal auditor.”
