I.
Governance and Internal Audit
Strengthening Corporate Governance With Internal Audit
A focus on corporate governance offers internal audit the opportunity to become a more active and strategic team player.
Recent surveys have shown that management and boards of directors are looking for greater contributions from the chief audit
executive (CAE) and internal auditors. Internal auditors can meet the heightened expectations by taking a more holistic view of
corporate governance and aligning internal audit skills and activities to assess, improve, and monitor their organizations’
corporate governance capabilities. The CAE must understand all of the components of corporate governance and how internal
audit can support them
This refers to a system whereby shareholders, creditors and other stakeholders of a corporation ensure that management
enhances the value of the corporation as it competes in an increasingly global marketplace.
The Board of Directors (Board) is primarily responsible for the governance of the corporation. It needs to be structured so that
it provides an independent check on management.
It normally creates an Audit Committee to adequately perform its role. The Audit Committee (AudCom) creates an internal
audit function and appoints a Chief Audit Executive to drive good corporate governance in the organization.
Reviews and approves audit scope and frequency, and the annual internal audit plan.
Receives and reviews reports of both the internal and external auditor.
II. Internal Audit Value Proposition
1. Identification of previously undefined organizational
objectives, policies, goals and procedures
2. Identification of control points that could present areas of
risks.
3. Determination of whether the organization is in
compliance with objectives, policies, directives and
procedures.
4. Identification of problem areas and underlying causes.
5. Identification of potential profit improvement, revenue
enhancement and cost reduction/containment/ opportunities
within the company.
III. The Standards for the Professional Practice of
Internal Auditing (SPPIA)
Delineates the basic principles that represent
the practice of internal auditing as it should be
Provides a framework for performing and
promoting a broad range of value-added internal
audit activities.
Establishes the basis for the evaluation of the
internal audit performance.
Fosters improved organizational processess
and options.
The Standards:
1. Attributes Standard
Purpose, Authority and Responsibility of the Continuing Professional Development
Internal Audit Activity (1000) Quality Assurance and improvement Program
Independence and Objectivity (1100) Quality Program Assessments (1310)
Organizational Independence (1110) External Assessment (1312)
Individual Objectivity Reporting on the Quality Program (1320)
Impairment to Independence or Objectivity Use of "Conducted in Accordance with the
(1130) Standards"
Proficiency and Due Professional Carw (1200) Disclosure of Non-Compliance (1340)
Proficiency (1210)
2. The Performance Standards
Managing the Internal Audit Activity (2000) Engagement Resource Allocation (2230)
Planning (2010) Engagement Work Program (2240)
Communication and Approval (2020) Performing the Engagement (2300)
Resource Management (2030) Identifying Information (2310)
Policies and Procedures (2040) Analysis and Evaluation
Coordination (2050) Recording Information (2330)
Reporting to the Board and Senior Management Engagement Supervision (2340)
2060) Communicating Results (2400)
Nature of Work (2010) Criteria for Communicating (2410)
Risk Management (2110) Errors and Omissions (2421)
Control 2120) Engagement Disclosure of Noncompliance with
Governance 2130) Standards (2430)
Engagement Planning (2200) Discrimanating Results (2440)
Planning Considerations (2201) Monitoring Progress (2500)
Engagement Objectives (2210) Management Acceptance of Risks (2600)
Engagement Scope (2220)
IV. The IIA Code of Ethics
The purpose of the IIA Code of Ethics is to promote an
ethical culture in the profession of internal auditng. This
applies to both individuals and entities.
This extends beyond the definition of Internal auditing
to include:
Principles that are relevant to the profession
and practice of Internal Auditing
Rules of conduct that describe behavior
norms expected of Internal Auditors.
Principles
Integrity
Objectivity
Confidentiality
Competency
Rules of Conduct
Integrity
Objectivity
Confidentiality
Competency
V. Internal Controls and 5 Components
Internal Control is a process, effected by an
entity's board of directors, management and other
personnel, designed to provide reasonable
assurance regarding the achievement of objectives
in the following categories:
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with applicable laws and
regulations.
Controls: Process that promote achievement of
objective by managing risks; enablers
Effective internal control reduces the risk of asset loss, and helps ensure that plan information is complete and accurate,
financial statements are reliable, and the plan's operations are conducted in accordance with the provisions of applicable laws
and regulations. ... Why internal control is important to your plan.
WHAT DOES COSO STAND FOR?
In 1992, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed a model for evaluating
internal controls. This model has been adopted as the generally accepted framework for internal control and is widely
recognized as the definitive standard against which organizations measure the effectiveness of their systems of internal
control.
WHAT IS THE COSO FRAMEWORK?
The COSO model defines internal control as “a process effected by an entity’s board of
directors, management and other personnel designed to provide reasonable assurance
of the achievement of objectives in the following categories:
Operational Effectiveness and Efficiency
Financial Reporting Reliability
Applicable Laws and Regulations Compliance
In an effective internal control system, the following five components work to support
the achievement of an entity’s mission, strategies and related business objectives:
Some but not necessarily all of these five components must be present and functioning
effectively to conduct that internal control over operations is effective.
Control Environment - The Foundation of an Effective Organizational Internal Control System
Sets the tone of the organization - policy statements; code of conduct; walk the talk
Integrity
Ethical values
Competence
Communicates management philosophy - reward good behaviour; punish bad behaviour; empowered /not
empowered
Responsibility/Accountability
Authority
Stucture
Human Resources
People Development
Risk Assessment - enables effective internal control
Control Activities
Information and Communication
Monitoring Activities
