Internal Audit Standards
What the standards actually require
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. The IIA's Global Internal Audit Standards rest on five domains: purpose, ethics and professionalism; governance of the internal audit function; managing the function; managing individual engagements; and communicating results. Candidates must separate mandatory requirements (must/shall) from implementation considerations and recommended practices.
Core concepts to know cold:
- A board-approved audit charter defining purpose, authority, scope, and unrestricted access to records and personnel.
- The chief audit executive (CAE) reports functionally to the audit committee (approval of charter, plan, budget, and CAE appointment) and administratively to senior management.
- Independence is organizational; objectivity is the individual auditor's impartial state of mind on each engagement.
- A quality assurance and improvement program combining ongoing supervision, periodic internal assessments, and an external assessment at least every five years.
- Risk-based engagement planning, with scope tied to objectives and criteria, not to a generic checklist.
- Documented findings with condition, criteria, cause, effect, and recommendations, plus follow-up that verifies remediation.
Common traps: equating independence with objectivity; assuming any consulting engagement automatically destroys independence (it does not, but assuming management responsibility does); and treating an audit report as the endpoint rather than follow-up as the true measure of effectiveness.
Worked example: the CAE also serves as compliance officer. Even with the best intentions, she would be auditing work she owns, so independence is impaired. Rule of thumb: if you designed it, operated it, or signed off on it, you cannot audit it.