IPPC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

IPPF Definition

The International Professional Practices Framework is the conceptual framework that organizes mandatory and recommended guidance for the internal audit profession, including the Standards and Code of Ethics.

Attribute Standards

The 1000-series Standards address the characteristics of organizations and individuals performing internal audit work, covering purpose, authority, independence, objectivity, proficiency, and quality assurance.

Performance Standards

The 2000-series Standards describe the nature of internal audit work and provide quality criteria for measuring performance of internal audit services.

Code of Ethics Principles

Integrity, objectivity, confidentiality, and competency form the four principles of the Code of Ethics; each has specific rules binding on all internal auditors.

Mandatory Guidance

The Core Principles, Definition of Internal Auditing, Code of Ethics, and Standards are mandatory; conformance is required and assessed on the internal audit activity as a whole.

COSO Internal Control

COSO Internal Control - Integrated Framework comprises five components and 17 principles covering control environment, risk assessment, control activities, information and communication, and monitoring activities.

Three Lines Model

The model separates operating management (first line), risk and compliance functions (second line), and internal audit (third line) to clarify risk ownership and independent assurance responsibilities.

Inherent vs Residual Risk

Inherent risk is the risk before controls are applied; residual risk is the risk remaining after controls are implemented and evaluated for effectiveness.

Risk Appetite

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its objectives; tolerance is the acceptable variation around that appetite.

Segregation of Duties

Separating authorization, custody, recording, and review functions reduces the opportunity for error and fraud by preventing one person from controlling an entire transaction.

Control Types

Preventive controls deter errors before occurrence; detective controls identify errors after occurrence; corrective controls remediate; directive controls guide behavior toward desired outcomes.

Engagement Objectives

Objectives state what the engagement will accomplish, aligned to organizational goals and risks; scope defines boundaries and criteria define the standards used for evaluation.

Engagement Risk

Engagement risk is the risk that audit conclusions are inappropriate or that the engagement damages the organization; it considers inherent, control, and detection risk.

Audit Work Program

A work program lists the procedures, sample sizes, evidence sources, and expected outcomes for an engagement; it is approved by the engagement supervisor before fieldwork begins.

Audit Universe

The audit universe is the set of auditable entities, processes, and risks used to develop the risk-based annual audit plan approved by the audit committee.

Sufficient Appropriate Evidence

Evidence must be sufficient in quantity and appropriate in relevance and reliability to support audit conclusions; reliability varies by source and nature.

Sampling Risk

Sampling risk is the probability that conclusions based on a sample differ from conclusions based on the full population; non-sampling risk arises from human error or inappropriate procedures.

Analytical Procedures

Analytical procedures evaluate financial and non-financial data by comparing recorded amounts to expectations such as budgets, trends, ratios, or industry benchmarks, investigating significant variances.

Test of Controls

A test of controls evaluates whether a control operated effectively throughout the period; substantive testing detects material misstatements in amounts and disclosures.

Walkthrough

A walkthrough traces a transaction end-to-end to confirm understanding of process flow and control design; it is not by itself evidence of operating effectiveness.

External Confirmation

External confirmation is direct written or electronic verification from a third party; it is generally more reliable than internal documentation because it originates outside the organization.

Finding Structure

A finding states the condition (what is), criteria (what should be), cause (why it occurred), effect (impact), and recommendation (corrective action).

Report Rating

Report ratings communicate overall engagement conclusions using defined scales such as satisfactory, needs improvement, or unsatisfactory; ratings must be consistently applied.

Follow-Up Process

Follow-up verifies that management implemented agreed corrective actions within timelines; unresolved issues are escalated to senior management and the audit committee.

Report Distribution

Report distribution follows policy and considers confidentiality, legal privilege, and regulatory requirements; the chief audit executive approves the final report.

Objectivity Impairment

Objectivity is impaired when an auditor audits an area they managed within the past 12 months or subordinates judgment to others; impairments must be disclosed.

Organizational Independence

Independence is preserved when the chief audit executive reports functionally to the audit committee and administratively to senior management, with unrestricted access to records and personnel.

Confidentiality Rule

Internal auditors must protect information acquired during engagements, must not use it for personal benefit, and must not disclose it without authority unless legally or professionally required.

Competency Requirement

Internal auditors must possess the knowledge, skills, and experience needed for each engagement and pursue continuing professional development to maintain competence.

QAIP Scope

A quality assurance and improvement program covers all aspects of the internal audit activity, including internal assessments, external assessments, and continuous improvement activities.

External Assessment

An external assessment is conducted at least once every five years by a qualified, independent assessor or team; it may be a full assessment or a self-assessment with independent validation.

Quality Metrics

Quality metrics include engagement-level reviews, cycle time, budget variance, findings closure rate, and stakeholder satisfaction, used to monitor and improve audit performance.