Definition of Internal Auditing

Definition of Internal Auditing Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. Internal Auditors' Roles INTERNAL AUDITING is grounded in professionalism and efficiency. Today's auditors are much more than financial analysts. From evaluating risks to analyzing operations, it's the internal auditor's job to supply objective analyses, suggestions, and recommendations based on the results of their audits. They are well-disciplined in their craft and subscribe to a professional code of ethics. They are diverse and innovative. They are committed to growing and enhancing their skills. They are continually on the lookout for emerging risks and trends in the profession. They are good thinkers. And to fulfill all their roles effectively, internal auditors must be excellent communicators who listen attentively, speak effectively, and write clearly. Sitting on the right side of management, modern-day internal auditors are consulted on all aspects of the organization and must be prepared for just about anything. It's certainly not easy, but for these skilled and competent professionals, it's all in a day's work. Internal Auditing: Adding Value Across the Board A CHANGING WORLD One does not have to sit in the boardroom or occupy the CEO chair to recognize the rapid-fire changes going on in today corporate environment. The business pages regularly contain reports of mergers, acquisitions, and other organizational restructurings; electronic commerce and other information technology breakthroughs; privacy invasions; and plain old-fashioned frauds. And things are likely to get even more frenetic. The challenges of today changing world introduce great opportunities for management and the board and point to the necessity for competent internal auditing. Especially in these times of constant change, internal auditing is critical to efficient operations, effective internal controls and risk management, strong corporate governance, and in some cases, the very survival of the organization. Click below to learn about internal auditing relationships with management, the board, and the audit committee; and the value that internal auditing brings to strong corporate governance. What is Internal Auditing? Internal auditing is an independent, objective assurance and consulting activity that adds value to and improves an organization operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. The internal auditing process provides assurance to management and the audit committee that risks to the organization are understood and managed appropriately. And it serves as an in-house consultant on many areas of interest. Every organization, regardless of its size, should have some type of internal control system or process. The Institute of Internal Auditors (IIA) believes that an organization is best served by a fully resourced and professionally competent internal auditing staff that provides value-added services critical to efficient and effective organizational management. Internal auditing practitioners are charged with assisting the organization in the effective discharge of responsibilities, promoting the establishment of cost-effective controls, assessing risks, and recommending measures to mitigate those risks. An integral part of the management team, internal auditors furnish top management with analyses, appraisals, counsel, and information on the activities they review, and monitor organizational ethics. Evaluating emerging technologies. Analyzing opportunities. Assessing quality, economy, and efficiency. Providing accurate and timely communication. Such diversity gives internal auditors a broad perspective on the organization. And that, in turn, makes them a valuable resource to executive management and the board of directors in accomplishing overall goals and objectives, as well as strengthening internal control and governance. This might be a lot to ask from one organizational resource, but for internal auditors? it all in a day work. In Partnership with Management When internal auditing is accepted and acknowledged by an organization leaders as a management activity, internal auditors can fulfill their most fundamental role ?helping management and the board achieve their objectives. And competent internal auditing professionals bring to the table objectivity, integrity, expertise in communication, the ability to identify enterprise-wide risks, and the skill to assess the effectiveness of controls put in place by management to mitigate those risks. As partners to management, internal auditors are in a position to help protect the organization against both traditional and emerging risks; provide productive consultation and ideas about how opportunities and vulnerabilities can be balanced; and make valuable recommendations for assessing and strengthening corporate governance. And their broad understanding of the organization and its culture prepares internal auditors for effectively monitoring risks associated with new business lines; mergers, acquisitions, joint ventures, and other partnerships; new systems deployments; restructuring; management estimates, budgets, and forecasts; environmental issues; and regulatory compliance. BellSouth Corporation Chairman and Chief Executive Officer Duane Ackerman clearly recognizes the value internal auditing brings to management. "Because we are in a dynamic environment we got new people, new technology, a new marketplace, new competitors, and a new regulation we need to be very vigilant about the fundamentals of this business," says Ackerman. "And that a role corporate audit plays? the ability to collect information and impart that knowledge on processes as well as control issues and to do it constantly through all of this change. It easy to see how incredibly important that is to the fundamental stability of this business." Of increasing concern to management today are the risks associated with information technology and the control and auditability specifications of new systems. Internal auditors independent review of information systems and other high-tech projects can help ensure a controlled and reliable IT environment. And their consulting services add value to the decision-making process when management must consider the cost and benefit trade-off of IT control implementation. Vital to Governance Internal auditors diverse capabilities bring great value to the board and the audit committee in their corporate governance responsibilities and risk management oversight. It is critical that the chief audit executive (CAE), senior management, and the audit committee have sufficient contact and communication to assure that the parties understand and accept their individual and collective responsibilities for risk management. Today audit committees must deal with complex and diverse issues and ever-increasing responsibilities. It is critical, therefore, that internal auditors apply risk-based audit approaches to the organization internal control system and provide comprehensive reports to the audit committee. The IIA responded to the findings of the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees, stating that, "the receipt of an assessment of internal control is a significant step in improving audit committee effectiveness." Based on personal experience Jacqueline K. Wagner, CIA, General Auditor of the General Motors Corporation and 2000-2001 IIA Chairman, lists three essentials to strong corporate governance: "There is simply no substitute for hiring ethical people from the top all the way down to the bottom of the organization. Secondly, a strong system of internal control including formal, periodic assessments by a competent internal auditing function should be in place to ensure that risks are controlled and mitigated. And third, an audit committee of independent directors should perform ongoing oversight duties." As a part of its oversight responsibilities, the audit committee should: , Review and concur CAE appointment, replacement, reassignment, and dismissal. , Review/approve the internal audit charter and ensure its compatibility with that of the audit committee. , Review the audit plan and any significant changes. , Ensure internal auditor neutrality and objectivity. , Review the internal auditing department budget and staffing. , Encourage internal auditor certification and other professional development. , Meet privately with the CAE. , Receive reports from the CAE on audit findings and information on technological advances and trends. , Review internal auditing compliance with The IIA Standards for the Professional Practice of Internal Auditing. What Works Best An active and knowledgeable audit committee is fundamental to achieving and maintaining an effective control environment. And an atmosphere of mutual trust and respect between the internal audit function and the audit committee is critical to the committee independent oversight role. World-class internal auditing departments at JCPenney Company, Asea Brown Boveri, Ford Motor Company, and BellSouth Corporation offer these tips for building a strong relationship between internal auditing and the audit committee for enhanced corporate governance: , To avoid any significant surprises, there should be straightforward, open, honest, accurate, and timely communication between internal auditing and the audit committee. , Internal auditing should keep the audit committee members up to date on new laws, trends, and other important information and resources so they can effectively discharge their duties. , Internal auditing should provide the audit committee with a plan to address key governance issues. , A corporate governance program should provide a mechanism for business process improvement, integrity standards, training, a "hotline" and their reporting processes, and appropriate compliance review. , Presentations should drive toward discussion of control issues rather than audit findings, and additional material should accompany presentations to provide contextual insight about the control issues under discussion. , In addition to regular audit committee meetings, the chief auditing executive should have periodic meetings with the audit committee chairman and recurring closed sessions with the committee itself to discuss broader issues facing the organization. , Internal auditing should focus on delivering results and implementing preventive actions, rather than simply uncovering problems after the fact. , As suggested by The IIA Research Foundation, internal auditing should perform periodic surveys to determine the specific needs of the audit committee. Internal Auditing: Adding Value Across the Board Competitive pressures demand that today organizations squeeze the most they can from all their resources and as this brochure indicates, the internal auditing process clearly is among the most critical. In addition to their responsibility for assessing and recommending internal controls, internal auditors skills in risk management and their broad-based perspective of the organization uniquely position them as a valuable resource for strong corporate governance. As a result, informed senior managers and boards are relying on internal auditors for advice and counsel for everything from analysis of operations and assessment of risk to recommendations for improved corporate governance. Moreover, internal auditing practitioners are increasingly being challenged to apply their expertise in much broader ways than ever before ?such as evaluating emerging technologies, detecting and deterring fraud, analyzing the effectiveness of policies and procedures, and identifying opportunities to save you and your shareholders money. When it comes to adding value across the board, there no better source than internal auditing. World-class internal audit shops speak out on the importance of internal auditing relationship with the audit committee: Internal audit is the primary resource of the audit committee in carrying out its duties and responsibilities. With those responsibilities increasing and continued pressure from the SEC for financial reporting integrity, a functioning partnership of the audit committee and internal audit is vital. nbsp;BellSouth Corporation Internal auditors should not have to report through layers upon layers of management as this could compromise or dilute recommendations and their effectiveness. Audit services?relationship with the audit committee is critical and contributes to the success of our company. Carolina Power & Light Company Internal audit relationship to the audit committee is important to assure there are no organizational levels below the board of directors that could prevent necessary actions or appropriate decisions from taking place or being made to enhance business opportunities and mitigate risks. Asea Brown Boveri An active and informed audit committee provides the ultimate independent and objective oversight of the corporate control environment, including focus on emerging trends and risks. Internal auditing is the primary agent of the audit committee within the company. Ford Motor Company The relationship affords auditing with some degree of independence from the organization and management. In certain cases, it can be used to ensure management addresses key findings. It is our main vehicle to communicate important issues to the entire board. JCPenney Company Guidance Framework The New Internal Auditing Rarely are demands for professionalism, knowledge, integrity, and leadership more stringent than those placed on today internal auditors. Effective auditors serve as the organization corporate conscience and they champion operational efficiency, internal control, and risk management. They also educate and make recommendations to management, the board of directors, and the audit committee to support the organization in meeting its goals and objectives. The definition for the profession addresses internal audit practitioners varied roles and responsibilities: Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. How does today internal auditor sort through what must be done to ensure the highest quality results and what should be done to achieve long-term effectiveness and professionalism? The professional internal audit practitioner adheres to the guidance set forth in the Code of Ethics and the Standards for the Professional Practice of Internal Auditing, pursues and achieves individual certification, conducts internal assessments, and undergoes independent, external quality reviews to verify compliance. When these practices are followed routinely, they can lead to success for both auditors and the organizations they serve. As the acknowledged leader of internal auditors worldwide, The Institute of Internal Auditors (IIA) is pleased to provide this brochure on professional guidance. Whether you are an internal auditor, a director or audit committee member, an outside stakeholder, an educator, or even a student, this material will help heighten your understanding and appreciation of the internal audit process. More importantly, it will delineate the high standards in place to support practitioners as they diligently work to add value to their organizations. For further information, please visit the Guidance section. A Guidance Framework As business processes have become more sophisticated and complicated, the internal audit profession, too, has evolved. Over the past few years, it became evident that structural enhancements were needed to reflect these changes to the profession and to guide practitioners and those whom they serve. The IIA assembled a group of internationally respected professionals to study the needs of the profession and to formulate a guidance framework for the future. Known as The IIA Guidance Task Force (GTF), this prestigious group gathered and synthesized information garnered from their own experience and from various research studies, surveys, and symposia. The result: The Professional Practices Framework. Based on the definition for the profession and supported by the Code of Ethics, the Framework comprises mandatory, advisory, and practical guidance in the forms of Standards, Practice Advisories, and development and practice aids, respectively. What makes adopting this Framework so critical to the effective practice of internal auditing and why is it so important to stakeholders? Because the scope of work performed by today practitioners is so broad and varied, there is an expanded need for clear and concise guidance that can be readily adopted and followed, regardless of the industry, audit specialty, or sector. The Framework fills this need. It also brings additional value to management, corporate governance entities, investors, and all other stakeholders by prescribing practices that assess and ensure effectiveness throughout the organization. Ethics: Setting The Tone At The Top One of the most important and effective actions executive management can take is setting an ethical tone at the top. When this tone is followed throughout the hiring process, it emphasizes the importance of having honest and ethical employees throughout the organization and minimizes the risks of fraudulent behavior. Ethics are inherent in the internal audit process, from operations to risk management to governance. The tone at the top of the internal audit profession is set by The IIA Code of Ethics. Established to promote an ethical culture throughout the profession, the Code of Ethics not only includes relevant principles and rules of conduct for internal auditors but also presents an enviable benchmark for ethics throughout the organization. In order to comply with the Code of Ethics, internal auditors must demonstrate honesty, diligence, and responsibility; observe the law; and make appropriate disclosures. They must not knowingly be a party to any illegal activity, or engage in acts that are discreditable to the profession or to the organization. And they must respect and contribute to the legitimate and ethical objectives of the organization. In addition, internal auditors must not participate in any activity or relationship that might impair their unbiased assessment or professional judgment or be in conflict with the interests of the organization, and they must make known all material facts that, if not disclosed, might distort their review. At the same time, they must protect information acquired in the course of their duties and never use it in unethical or illegal ways or for personal gain. And finally, they must demonstrate their competency by their knowledge, skill, and experience; continually improve their proficiency, effectiveness, and quality; and perform in accordance with the Standards for the Professional Practice of Internal Auditing. Standards: Mandatory Guidance Because internal audit activities are performed in diverse legal and cultural environments within organizations that vary in purpose, size, and structure, the practice of internal auditing is somewhat different in each environment. However, compliance with The IIA Standards for the Professional Practice of Internal Auditing is essential and mandatory if the responsibilities of internal auditors are to be met. The purpose of the Standards is to delineate basic principles that represent the practice as it should be, provide a framework for performing and promoting a broad range of value-added activities, establish the basis for measuring performance, and fostering improved organizational processes and operations. The Standards comprise Attribute and Performance Standards, which address both organizational and internal auditor characteristics, describe the nature of internal audit activities, and provide quality criteria against which the performance of auditing services can be measured. Specifically, the Attribute Standards focus on the purpose, authority, responsibility, independence, objectivity, proficiency, due professional care, and quality assurance and improvement of the audit activities. The Performance Standards provide guidance on the nature of audit work and planning, conducting, managing, communicating, and reporting throughout the audit activity. These Standards also address areas such as resource and risk management, policies and procedures, control, and governance. Additionally, the Standards include Implementation Standards, which apply to specific types of engagements such as compliance audits, fraud investigations, and control self-assessment projects. Governed by The IIA's Internal Auditing Standards Board (IASB), the Standards for the Professional Practice of Internal Auditing will continue to be a work in process. The IASB issues exposure drafts internationally for public comment and welcomes input and recommendations from practitioners and other interested parties. Comments should be directed to the IASB, in care of The IIA. The Standards in their entirety are available on the The IIA's Web site. Practice Advisories: Advisory Guidance The Framework Practice Advisories have taken the place of the guidelines previously presented in the publication internal auditors heavily relied on and referred to as the "red book." Prepared under the auspices of The IIA Professional Issues Committee (PIC), the Advisories provide solid advice on interpreting and applying the Standards. Although they are not mandatory, the Practice Advisories represent best internal audit practice and are strongly recommended by The IIA. Providing easy-to-follow guidance on implementing Standards regarding such topics as department charters, objectivity, independence, control, assurance, fraud, and assessing, monitoring, and managing risk, the Practice Advisories are designed as a handy tool for internal audit practitioners. While some are applicable to all internal auditors, other Advisories will be developed to meet the needs of specific industries, audit specialties, or geographic areas. Over the coming years, the list of available advisory guidance will steadily grow, and the PIC welcomes suggestions for new Advisories in areas not previously covered. One of the most critical issues organizations face today is the effective management of risk. The auditor role in risk management involves assessing and monitoring the risks that the organization faces, recommending the controls required to mitigate those risks, and evaluating the tradeoffs necessary for the organization to accomplish its strategic and operational objectives. Whether this is put into action as consultancy or internal auditing, the outcome is critical to the well-being of the audit customers, as well as to the entire organization. Extremely customer-focused, the Practice Advisories address these issues and guide internal auditors in more effectively meeting their customers needs. IIA members have access to the Practice Advisories online. Development and Practice Aids: Practical Guidance Fundamental to any good professional guidance is ongoing training and education. This, the largest and most diverse component of the Professional Practices Framework, is called development and practice aids. The development and practice aids comprise a broad range of practical guidance in the form of professional development conferences and seminars, research reports, educational products, and other select products and services related to the professional practice of internal auditing. Developed and/or endorsed by The IIA, these practical tools readily guide auditors through the maze of emerging and evolving internal audit processes and activities and provide best-practice tips and techniques that can be implemented along the way. Authored and/or presented by world-class practitioners, educators, and researchers, these aids dig deep beneath the surface to provide the most current guidance available on internal audit activities, issues, and approaches. Not to be confused with mandatory or advisory guidance, these offerings will be clearly identified as development and practice aids. Professionalism and The Future Providing practitioners with guidance that is mandatory, advisory, and practical, the Professional Practices Framework not only clearly meets the goal set by the Guidance Task Force, but also reflects the new paradigm for the profession. Whether in the form of Standards for the Professional Practice of Internal Auditing, Practice Advisories, or development and practice aids, this guidance supports the new internal audit profession as it continues to grow and perfect its broader consulting, assurance, risk management, and governance roles within the organization.