Audit Standards, Ethics, and Governance
The governance triangle
Internal audit derives its authority from three interlocking documents: the charter (board-approved mandate, scope, and access rights), the audit policy and methodology manual, and the professional standards that govern conduct. The IIA's Global Internal Audit Standards replaced the older IPPF in 2024, but the concepts tested remain stable: independence, objectivity, due professional care, and a quality assurance and improvement program (QAIP) with both internal and external assessments.
Independence versus objectivity
Independence is an organizational attribute tied to reporting lines; objectivity is an individual state of mind. Traps abound here. A chief audit executive who reports administratively to the CEO but functionally to the audit committee is generally acceptable. A CAE who sits on the risk committee as a voting member, or who owns a control, is not. Questions often describe a "harmless" side task-drafting procedures, installing a system, or covering a vacant compliance role-and expect you to identify it as an impairment.
Ethics in practice
Expect scenario questions on conflicts of interest, gifts, confidentiality, and whistleblower handling. The correct answer usually involves disclosure and recusal, not quiet avoidance. Auditors must also weigh whether accepting an engagement conflicts with the code of ethics.
Worked example
An auditor is asked to lead the implementation of a new loan-origination system, then audit it later. Rule of thumb: if you designed or operated it, you cannot assure it. The answer is to decline the operational role, document the impairment, and let the CAE reassign the audit.
Governance expectations
Know the board's role in setting risk appetite, approving the audit plan, and receiving results-and that management, not audit, owns risk and control.