CIA 2.3: Impairment to Independence and Objectivity Flashcards
According to IPPF, the independence of the internal audit activity is achieved through:
Organizational status and objectivity
True or false? A CAE MUST report to the board
False. CAEs do not HAVE to report to the board, although it is most ideal. Many IAs work in organizations that do not have a board.
What should one do if independence or objectivity is impaired?
If independence or objectivity is impaired in fact or appearance, the details of the impairment must be disclosed to appropriate parties. The nature of the disclosure will depend upon the impairment.
What do impairments to organizational independence and individual objectivity include?
Impairment to organizational independence and individual objectivity may include, but is not limited to, personal conflict of interest; scope limitations; restrictions on access to records, personnel, and properties; and resource limitations, such as funding.
The determination of appropriate parties to which the details of an impairment to independence or objectivity must be disclosed is dependent upon the expectations of the internal audit activity’s and the chief audit executive’s responsibilities to senior management and the board as described in the internal audit charter, as well as the nature of the impairment.
What are some examples the standards give in terms of impairment to organizational independence?
a. The CAE has broader functional responsibility than internal audit and executes an audit of a functional area that is also under the CAE’s oversight.
b. The CAE’s supervisor has broader responsibility than internal audit, and the CAE executes an audit within his or her supervisor’s functional responsibility.
c. The CAE does not have direct communication or interaction with the board.
d. The budget for the internal audit activity is reduced to the point that internal audit cannot fulfill its responsibilities as outlined in the charter.”
What are some examples the standards give in terms of impairment to objectivity?
a. An internal auditor audits an area in which he or she recently worked, such as when an employee transfers into internal audit from a different functional area of the organization and then is assigned to an audit of that function. . . .
b. An internal auditor audits an area where a relative or close friend is employed.
c. An internal auditor assumes, without evidence, that an area being audited has effectively mitigated risks based solely on prior positive audit or personal experiences (e.g., a lack of professional skepticism).
d. An internal auditor modifies the planned approach or results based on the undue influence of another person, often someone senior to the internal auditor, without appropriate justification.”
What determines what parties need to be notified of impairment to independence/objectivity?
“Both the nature of the impairment and board/senior management expectations will determine the appropriate parties to be notified of the impairment and the ideal communication approach.
What should a CAE do if they believe an independence/objectivity impairment is not real?
When the CAE believes the impairment is not real, but recognizes there could be a perception of impairment, the CAE may choose to discuss the concern in engagement planning meetings with the operating management, document the discussion (such as in an audit planning memo), and explain why the concern is without merit. Such a disclosure may also be appropriate for a final engagement report.
What should a CAE do if they believe an independence/objectivity impairment is real?
When the CAE believes the impairment is real and is affecting the ability of internal audit to perform its duties independently and objectively, the CAE is likely to discuss the impairment with the board and senior management and seek their support to resolve the situation.
What should CAE do if an impairment to objectivity/independence is found after an engagement?
When an impairment comes to light after an audit has been executed, and it impacts the reliability (or perceived reliability) of the engagement results, the CAE will discuss it with operating and senior management, as well as the board.”
T or F. The internal auditor’s objectivity is not impaired when the auditor recommends standards of control for systems or reviews procedures before they are implemented.
True
What responsibilities may be perceived as an impairment to objectivity?
These responsibilities include designing, installing, implementing, or drafting procedures for information systems.
The appearance of objectivity cannot be maintained when an internal auditor both (1) designs, installs, implements, or drafts procedures for an information system and (2) audits or reviews that system.
T or F? Can an Internal Auditor perform an engagement in a department he once worked in?
Internal auditors must refrain from assessing specific operations for which they were previously responsible. Objectivity is presumed to be impaired if an auditor provides assurance services for an activity for which the auditor had responsibility within the previous year.
Certain times, CAEs are responsible for departments/functions outside the Internal Audit Activity. How do they maintain independence/objectivity?
he chief audit executive may be asked to take on additional roles and responsibilities outside of internal auditing, such as responsibility for compliance or risk management activities. These roles and responsibilities may impair, or appear to impair, the organizational independence of the internal audit activity or the individual objectivity of the internal auditor. Safeguards are those oversight activities, often undertaken by the board, to address these potential impairments, and may include such activities as periodically evaluating reporting lines and responsibilities and developing alternative processes to obtain assurance related to the areas of additional responsibility.
T or F? Assurance engagements for functions over which the chief audit executive has responsibility must be overseen by a party outside the internal audit activity.
True
