Foundations of Internal Auditing
The big picture
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Know the mission (to enhance and protect organizational value by providing risk-based and objective assurance, advice and insight) and the mandatory guidance that binds internal auditors: the Definition of Internal Auditing, the Code of Ethics, the Core Principles, and the Standards (attribute standards about the activity and individuals, performance standards about engagements). Implementation and supplemental guidance are recommended, not mandatory. The charter, approved by the board, defines the activity's purpose, authority and responsibility.
What candidates must understand
- Assurance versus consulting: the same independence and objectivity requirements apply to both, but the outcome of assurance is the auditor's independent conclusion, while consulting produces advice for management.
- Code of Ethics principles: integrity, objectivity, confidentiality and competency, each with supporting rules of conduct.
- The language of the Standards: must is mandatory, should is a presumptive requirement, may is optional.
Traps
Questions blur what internal audit may do and what management must own; internal audit never takes on operational responsibility. Another trap is describing the IIA as a regulator, or confusing the IIA with the internal audit activity of a single organization.
Rule of thumb
Ask who consumes the output. An independent conclusion delivered to the board equals assurance; management acting on advice equals consulting. Internal audit may later provide assurance on that area only if objectivity has not been impaired.