Internal Audit Standards, Ethics, and Professional Practice
What to know
Candidates should understand the IIA's International Standards for the Professional Practice of Internal Auditing (the IPPF), the Code of Ethics (integrity, objectivity, confidentiality, competency), and the audit lifecycle from engagement planning through reporting and follow-up. Key concepts: independence (reporting lines, freedom from operational responsibility), objectivity (avoiding conflicts, disclosing impairments), due professional care, and the quality assurance and improvement program with internal and external assessments. Know the difference between assurance and consulting engagements, and that the chief audit executive reports functionally to the audit committee.
Traps
Questions test whether an auditor can audit an area they previously managed-generally an objectivity impairment that must be disclosed and managed. Distinguish 'independence' (organizational) from 'objectivity' (individual). Do not confuse internal audit standards with external audit (GAAS) or government auditing standards (GAGAS/Yellow Book), though healthcare auditors often blend them. Another trap: assuming internal audit performs management's corrective action-auditors verify, they do not own remediation.
Rule of thumb
If the auditor designed or operates the control, they cannot objectively assure it. Disclose, reassign, or document compensating safeguards.
Worked example
An auditor who previously served as the coding manager is asked to audit coding. Because they had operational responsibility within the past year, objectivity is impaired. The correct response is to disclose the impairment, have the CAE reassign the engagement, or apply safeguards-not to proceed silently.