Ethics, Independence, and Professional Conduct
This domain tests the Code of Ethics principles and the practical judgments that protect objectivity, confidentiality, and the credibility of internal audit.
Core rules and concepts
- The Code's principles are integrity, objectivity, confidentiality, and competency. Due professional care requires the skills and judgment expected for the engagement.
- Independence has two dimensions: organizational independence, supported by functional reporting to the board, and individual independence from the activities audited.
- Objectivity is a state of mind; independence supports it. Both the fact and the appearance of impairment matter.
- Internal auditors must not assume operational responsibility. Assignments in areas they previously managed can impair assurance work until safeguards or a cooling-off period apply.
- Confidentiality permits use of information only for legitimate purposes and only with appropriate authorization.
- Gifts and hospitality should follow policy and be evaluated for appearance, not only value.
Worked example
An auditor helped implement the payroll system six months ago and is now assigned to audit payroll controls. She had operational responsibility, so independence for assurance is impaired. The proper response is to disclose the impairment, reassign the assurance engagement, or limit her role to consulting with safeguards. Simply being careful is not enough.
Traps that cost marks
Treating independence as only organizational; accepting a small vendor gift without disclosure; using confidential data for personal benefit; and assuming only the chief audit executive must be independent.