IIA IAP cheat sheet

Definition: internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations; it helps accomplish objectives by evaluating and improving risk management, control, and governance processes.

The IIA Code of Ethics has four principles - Integrity, Objectivity, Confidentiality, Competency - and applies to individuals and entities that perform internal audit services.

The IPPF groups standards into Attribute Standards (1000–1300: purpose/authority, independence and objectivity, proficiency and due care, quality) and Performance Standards (2000–2600: managing the activity, planning, performing, communicating, monitoring).

Mandatory IPPF elements are the Core Principles, the Code of Ethics, the Standards, and the definition of internal auditing; implementation and supplemental guidance are recommended but not mandatory.

Charter rule: the internal audit charter defines the activity's purpose, authority, and responsibility, is approved by the board, and must be consistent with the Standards.

Reporting lines: the chief audit executive reports functionally to the board (charter, audit plan, reporting, appointment/removal, performance evaluation) and administratively to senior management (budget, human resources, day-to-day operations).

QAIP components: ongoing monitoring, periodic self-assessments, and an external assessment at least once every five years by a qualified, independent assessor or team from outside the organization.

Due professional care means considering the extent of work needed, relative complexity, materiality, and the cost of assurance versus the benefit obtained; it does not imply infallibility.

Objectivity rule: internal auditors must not assess specific operations for which they were previously responsible; objectivity is presumed impaired when providing assurance for an activity the auditor was responsible for within the previous year.

Three Lines Model (IIA, 2020): first-line operational management owns and manages risk; second-line risk, compliance, and control functions provide expertise, support, monitoring, and challenge; third-line internal audit provides independent, objective assurance.

Governance rule: the governing body is ultimately accountable for oversight of strategy, risk, and control; internal audit's independence is anchored in a functional reporting line to that body.

COSO Internal Control - Integrated Framework (2013): five components - control environment, risk assessment, control activities, information and communication, and monitoring activities - supported by 17 principles.

COSO ERM (2017): five components - governance and culture, strategy and objective-setting, performance, review and revision, and information-communication-reporting - supported by 20 principles.

Risk response decision rule: select among avoid, accept, share (transfer), and mitigate (reduce); the chosen response should bring residual risk within the organization's risk appetite.

Inherent risk is the exposure before controls; residual risk is the exposure remaining after controls and responses; control risk is the risk that controls fail to prevent or detect a problem.

Control classification: preventive (approvals, segregation of duties), detective (reconciliations, exception reports), corrective (recovery and remediation), and directive (policies that steer behavior).

Control limitations: internal control provides reasonable, not absolute, assurance because of human error, collusion, management override, and cost-versus-benefit constraints.

Risk assessment steps: identify risks, analyze likelihood and impact, evaluate them against risk criteria, then determine responses; qualitative and quantitative methods may be combined.

Engagement planning sequence: establish objectives, scope, timing, and resources; understand the activity and assess relevant risks; define criteria; then build, document, and approve the work program.

Engagement objectives must address the risks, controls, and governance processes of the area under review; the scope must be sufficient to achieve those objectives, and any limitation is documented and communicated.

Work program rule: it documents the procedures needed to achieve engagement objectives, is approved before work begins, and any change requires documented reasons and approval.

Performing the engagement (2300): internal auditors identify, analyze, evaluate, and document sufficient information to achieve engagement objectives; conclusions must rest on documented evidence.

Engagement records must be complete, accurate, and organized; the chief audit executive controls access and sets retention requirements considering legal and regulatory constraints.

Final communication content (2400): objectives and scope, results including findings, conclusions, and, where appropriate, recommendations and management's action plans.

Significance criteria (2410): communicate risk exposures, control failures, fraud, and noncompliance - especially matters requiring action by senior management or the board.

Monitoring progress (2500): follow up to confirm that agreed management actions were implemented; unaddressed significant risk is escalated to senior management and the board.

Risk acceptance (2600): when management accepts a risk level the chief audit executive judges unacceptable, the matter is communicated to the board for resolution.