IIA IAP key terms

A function, team, or department that provides independent, objective assurance and consulting services designed to add value and improve an organization's operations, and that evaluates governance, risk management, and control processes.

The IIA's official statement describing internal auditing as an independent, objective assurance and consulting activity that helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluating risk management, control, and governance.

The IIA's set of principles and rules of conduct covering integrity, objectivity, confidentiality, and competency, describing the behavior expected of everyone who provides internal audit services.

The IIA's mandatory requirements for internal auditing, made up of statements of core requirements plus interpretations and glossary terms. They address both the attributes of audit providers and the way engagements are performed.

Ten statements describing the characteristics of an effective internal audit activity, such as integrity, objectivity, alignment with strategy, adequate resourcing, and quality. Conformance with all ten is required by the Standards.

A formal written document approved by the board that defines the internal audit activity's purpose, authority, and responsibility, its position within the organization, and the scope of its work.

The senior individual responsible for managing the internal audit activity, including its charter, resourcing, reporting lines, planning, and quality. The title varies by organization; the role is defined by responsibility, not the label.

Freedom from conditions that threaten the ability of the internal audit activity or the CAE to carry out audit responsibilities without bias or interference, especially regarding reporting lines and access to information.

An unbiased mental attitude that lets internal auditors perform engagements and reach conclusions without compromising quality, so they can believe in their own work and are not swayed by others.

The care and skill expected of a reasonably prudent and competent internal auditor when planning, performing, and reporting on work. It is not a guarantee of error-free results or absolute assurance.

A program covering all aspects of the internal audit activity that assesses whether it conforms with the Standards and the Code of Ethics and whether it is effective, and that identifies opportunities for improvement.

An independent review of the internal audit activity performed by a qualified outside reviewer at least every five years, resulting in an opinion on whether the activity conforms with the Standards.

Objective examination of evidence to provide an independent assessment of governance, risk management, or control processes. The auditor determines the scope, and the output is a conclusion or opinion.

Advisory and related activities performed at the request of a client, such as advice, facilitation, and training. Their nature and scope are agreed with the client, and they generally do not provide assurance.

A plan derived from the organization's risks that sets which engagements the internal audit activity will prioritize, aligning limited resources with the areas of greatest significance to the organization.

The combination of processes and structures used by the board and management to inform, direct, manage, and monitor the organization's activities so that it achieves its objectives.

The highest governing body of an organization, responsible for overseeing management, setting direction and risk appetite, and being accountable to stakeholders. Its form varies by sector and legal structure.

A subgroup of the board, usually made up of independent members, that oversees financial reporting, risk management, and internal and external audit, and that approves the internal audit charter and plan.

The coordinated activities used to identify, assess, prioritize, and respond to uncertainty and its potential effects, so the organization stays within its risk appetite while pursuing its objectives.

The amount and type of risk an organization is willing to accept in order to pursue its objectives, set by the board and usually expressed in broad terms.

The level of risk that remains after management has applied controls and other responses; auditors compare it with the organization's risk appetite when judging whether further action is needed.

A process designed and run by the board, management, and staff to provide reasonable, not absolute, assurance about reliable reporting, effective and efficient operations, and compliance with laws and regulations.

A widely used model describing five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring activities. Organizations use it to design and evaluate control systems.

An IIA model in which operating management owns and manages risk as the first line, risk and compliance functions support and monitor as the second line, and internal audit provides independent assurance as the third line.

The attitudes, values, and behavior that the board and senior management demonstrate and communicate, which shape the organization's ethical climate and its overall control environment.

Dividing responsibilities so that no one person can initiate, authorize, record, and review the same transaction, reducing the chance that errors or fraud go unnoticed.

The coordinated use of assurance work from internal audit, risk and compliance functions, external audit, and other providers so the board receives a complete, non-duplicated view of risk and control.

A document prepared before fieldwork that sets out a specific engagement's objectives, scope, timing, resources, and approach, guiding the auditor through the work to be done.

Clear statements of what a specific engagement is meant to accomplish, such as evaluating controls over a process, which then drive the scope, procedures, and reporting.

The boundaries of an engagement, defining which processes, locations, systems, and time periods will be examined and which are excluded from the review.

A documented list of the procedures and tests to be carried out during an engagement, along with who performs them, so that the work is complete and can be reviewed.

Records of the procedures performed, evidence obtained, and conclusions reached. They must be complete enough to support the engagement results and to let another auditor re-perform the work.

Information gathered through inquiry, observation, inspection, and testing that supports the auditor's conclusions. It must be sufficient in amount and appropriate in relevance and reliability.

A conclusion about a significant issue identified during an engagement, typically described using criteria, condition, cause, and effect, and supported by the evidence gathered.

A suggested action to address the cause of a finding and reduce risk. It should be practical, directed to the level of management able to act, and clearly linked to the finding.

A written communication of the engagement's objectives, scope, findings, conclusions, and recommendations, issued to management and to the board or audit committee.

The process of checking whether management has implemented the agreed corrective actions for reported findings, and reporting the status of those actions to the board or audit committee.

Oversight of staff by the chief audit executive or engagement lead throughout planning, fieldwork, and reporting, ensuring the work meets quality standards and the engagement objectives are met.

The significance of a matter to the people who use the engagement results, judged by its nature and amount, which influences what the auditor reports and how much testing is needed.

Procedures that check whether a control is designed appropriately and operates effectively over the period reviewed, giving the auditor a basis for relying on that control.