Foundations of Internal Auditing
This domain tests whether you know what internal auditing is, where its authority comes from, and which guidance binds the function. Questions look definitional but turn on precision: mandatory versus recommended guidance, functional versus administrative reporting, and assurance versus consulting work.
Definition and mandatory guidance
- Definition: internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations; it helps achieve objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
- Mandatory IPPF elements: the Core Principles, the Definition of Internal Auditing, the Code of Ethics, and the Standards. Implementation guidance and supplemental guidance support the Standards but are not mandatory.
- Attribute Standards address the organization, the CAE, and the internal audit activity; Performance Standards describe the nature of internal audit work and the criteria for judging its performance.
- The charter defines purpose, authority, and responsibility, fixes the activity's position in the organization, and is approved by the board and reviewed periodically (Standard 1000).
- The CAE reports functionally to the board and administratively to senior management; functional reporting is what preserves organizational independence.
- The Three Lines Model places internal audit outside management, providing independent assurance over first-line operations and second-line risk and compliance.
- Assurance versus consulting: consulting adds value and improves processes without the auditor assuming management responsibility; accepting management duties impairs objectivity later.
Worked example
A CAE's charter is approved by the audit committee, which also approves the annual audit plan and the CAE's salary. The CFO, however, controls the internal audit budget and signs the CAE's annual performance evaluation. The charter is fine; the administrative line is not. Budget approval and evaluation of the CAE are functional matters that belong with the board, so leaving them with the CFO compromises organizational independence even though the reporting line looks correct on paper.
Traps that cost marks
- Treating implementation guidance as mandatory.
- Assuming internal audit must detect all fraud and design controls; it evaluates and recommends.
- Swapping 'should' and 'must'; the Standards use both deliberately.
- Believing COSO or ISO frameworks are IPPF mandatory elements.