IPPC cheat sheet

The IPPF comprises the Mission, Definition of Internal Auditing, Core Principles, Code of Ethics, Standards (Attribute, Performance, Implementation), and Recommended Guidance (Implementation, Supplemental).

Attribute Standards (1000 series) address the nature of audit entities, purpose, authority, responsibility, independence, objectivity, proficiency, and quality; Performance Standards (2000 series) describe the nature of audit work and the criteria for performance measurement.

The Code of Ethics has four principles: Integrity, Objectivity, Confidentiality, and Competency; rules under each are binding on all internal auditors and the profession.

Mandatory conformance is required with the Core Principles, Code of Ethics, Definition, and Standards; conformance is assessed on a whole, not per-element.

The Definition of Internal Auditing: an independent, objective assurance and consulting activity designed to add value and improve an organization's operations, helping achieve objectives via a systematic, disciplined approach to evaluate and improve risk management, control, and governance.

Core Principles include integrity, objectivity, confidentiality, competency, alignment with strategy, appropriate positioning, adequacy of resources, quality and continuous improvement, effective communication, and risk-based assurance.

Recommended Guidance (Implementation Guides, Supplemental Guides) is non-mandatory; it illustrates practices for implementing Standards and is not a conformance requirement.

Standards use "must" for mandatory requirements and "should" for expected practice unless the auditor documents why an alternative suffices.

COSO Internal Control - Integrated Framework has five components: Control Environment, Risk Assessment, Control Activities, Information & Communication, Monitoring Activities, and 17 principles.

COSO ERM (2017) framework comprises five components and 20 principles: Governance & Culture, Strategy & Objective-Setting, Performance, Review & Revision, Information/Communication/Reporting.

Three lines model: first line (operating management owns and manages risk), second line (risk and compliance functions provide expertise, monitoring, and challenge), third line (internal audit provides independent assurance).

Inherent risk = likelihood × impact before controls; residual risk = risk remaining after controls; risk appetite is the acceptable amount of risk to pursue objectives; risk tolerance is the acceptable variation around appetite.

Control types: preventive (deters errors), detective (identifies errors after occurrence), corrective (remediates), directive (guides behavior); automated vs. manual; key vs. secondary controls.

Segregation of duties separates authorization, custody of assets, recording/reconciliation, and review to reduce fraud and error risk.

Risk-based audit planning prioritizes residual risk, aligns with organizational objectives, and considers risk appetite, tolerance, and emerging risks.

Fraud risk factors (COSO/ISA 240): incentive/pressure, opportunity, rationalization; auditors consider fraud risk in every engagement and assess management override.

Engagement planning includes objectives, scope, criteria, timing, resources, and communication with clients; objectives link to organizational goals and risks.

Audit universe and risk-based plan inform engagement selection; annual plan is approved by the audit committee/board and adjusted for emerging risks.

Engagement risk assessment considers inherent risk, control risk, and detection risk; higher residual risk requires more testing and resources.

Scope defines boundaries: processes, systems, locations, time period; criteria define the standards used to evaluate (e.g., policy, regulation, frameworks).

Engagement work program includes test steps, sample sizes, evidence sources, and expected outcomes; it is approved by engagement supervisor before fieldwork.

Resource planning accounts for auditor competence, independence, and availability; external specialists may be used with documented competence and objectivity.

Communication with management and the audit committee occurs at planning, fieldwork, and reporting phases; significant risks are escalated promptly.

Documentation (working papers) must be sufficient to support conclusions and enable re-performance; retention per policy and legal requirements.

Evidence types: physical, documentary, testimonial, analytical, and electronic; evidence is sufficient (quantity) and appropriate (relevance and reliability).

Reliability hierarchy: auditor's direct observation and inspection > external corroborated evidence > internal documentation > oral representations.

Sampling: statistical (random, systematic, stratified) vs. non-statistical (judgmental, haphazard); sampling risk and non-sampling risk must be assessed.

Analytical procedures compare financial/non-financial data to expectations (ratios, trends, budgets, industry benchmarks); investigate significant variances.

Test of controls determines operating effectiveness; substantive tests (analytical and detail) detect material misstatements.

Walkthroughs trace a transaction end-to-end to confirm understanding of the process and control design; they are not tests of operating effectiveness unless evidence is re-performed.

Confirmation (external) is strong evidence; observation is limited by timing; inquiry alone is insufficient to conclude on control effectiveness.

Data analytics, CAATs, and continuous auditing enable full-population testing; document data integrity, completeness, and validity checks.

Engagement report includes objectives, scope, criteria, methodology, findings (condition, criteria, cause, effect), conclusions, and recommendations.

Findings structure: condition (what is), criteria (what should be), cause (why), effect (impact), and recommendation (corrective action).

Report ratings (e.g., satisfactory, needs improvement, unsatisfactory) should be defined and consistently applied; include management response and action plan with dates.

Report distribution follows policy; consider confidentiality, legal privilege, and regulatory requirements; the chief audit executive approves final report.

Follow-up verifies that management actions are implemented within agreed timelines; unresolved issues are escalated to senior management and the audit committee.

Communication is timely, accurate, objective, clear, concise, constructive, complete, and delivered to appropriate parties.

Significant risk and control issues are communicated to the board/audit committee even if management disagrees; document the disagreement.

Reporting quality is monitored via quality assurance; reports should be actionable and aligned to root cause, not just symptoms.

Objectivity: internal auditors must not subordinate judgment to others, must not audit areas they previously managed within the past 12 months, and must disclose impairments.

Independence is at the organizational level (reporting line, budget, access) and objectivity is at the individual level (attitude and impartiality).

Confidentiality: protect information acquired; do not use for personal benefit or disclose without authority unless legally/ professionally required.

Competency: engage only in services for which auditors have knowledge, skills, and experience; continuous professional development is required.

Conflict of interest, gifts, and personal relationships must be disclosed; auditors decline engagements where independence is impaired.

The chief audit executive reports functionally to the audit committee/board and administratively to senior management to preserve independence.

Ethical decision framework: identify facts, stakeholders, relevant standards, alternatives, consequences, and document the decision.

Whistleblower and non-retaliation policies protect reporting of unethical or illegal conduct; auditors follow organizational and legal reporting channels.

Quality assurance and improvement program (QAIP) covers all aspects of internal audit activity; includes internal assessments and external assessments.

Internal assessments: ongoing monitoring (supervision, checklists, metrics) and periodic self-assessments; results reported to the CAE and audit committee.

External assessment at least once every five years by a qualified, independent assessor or assessment team; may be a full external assessment or self-assessment with independent validation.

Conformance with the IPPF and the Code of Ethics is evaluated; results are disclosed to the board/audit committee and senior management.

Quality metrics include engagement-level reviews, cycle time, budget variance, findings closure rate, and stakeholder satisfaction.

Continuous improvement uses lessons learned, root cause analysis, benchmarking, and training to enhance audit processes.

An "in conformance" opinion requires the QAIP to demonstrate conformance; non-conformance is disclosed with remediation plans.

Supervision and review of working papers by the engagement supervisor ensure quality, accuracy, and adherence to standards.