Internal Audit Fundamentals: Definition, IPPF, Ethics, and Independence
The definition carries the marks
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps the organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Memorize the four load-bearing elements - independence, objectivity, assurance and consulting, value creation - because most scenarios turn on which element is violated.
The IPPF pairs Attribute Standards (characteristics of the activity and the individual auditor: purpose, ethics, independence, objectivity, competence, quality) with Performance Standards (how engagements are planned, performed, communicated, and followed up). The Code of Ethics rests on four principles: integrity, objectivity, confidentiality, and competency. Confidentiality means not disclosing information without authority; it never bars escalation of significant matters to the audit committee.
Independence versus objectivity
Independence is an organizational attribute tied to reporting lines; objectivity is a personal attitude about evidence. Functionally, the chief audit executive reports to the board or audit committee - approving the charter, risk-based plan, and budget, and influencing appointment or removal of the CAE. Reporting administratively to senior management (for example, the CEO) is acceptable. Internal audit differs from external audit in scope, continuity, advisory capacity, and accountability to the audit committee for the whole governance, risk, and control system.
Trap and rule of thumb
Trap: consulting does not automatically impair independence, but designing and implementing controls, or otherwise taking on management responsibilities, does. Rule of thumb: independence is to whom you report; objectivity is how you think about the evidence.