Practice Guides

Table of Contents
Supplemental Guidance

Practice Guides
Assessing Organizational Governance in the Private Sector
Assessing the Adequacy of Risk Management Using ISO 31000
Assisting Small Internal Audit Activities in Implementing the International Standards for the Professional
Practice of Internal Auditing
Audit Reports: Communicating Assurance Results
Auditing Anti-bribery and Anti-corruption Programs
Auditing Executive Compensation and Benefits
Auditing External Business Relationships
Auditing Privacy Risks, 2nd Edition
Auditing the Control Environment
Business Continuity Management
Chief Audit Executives—Appointment, Performance, Evaluation, and Termination
Coordinating Risk Management and Assurance
Developing the Internal Audit Strategic Plan
Evaluating Corporate Social Responsibility/Sustainable Development
Evaluating Ethics-related Programs and Activities
Formulating and Expressing Internal Audit Opinions
Independence and Objectivity
Integrated Auditing
Interaction with the Board
Internal Audit and the Second Line of Defense
Internal Auditing and Fraud
Measuring Internal Audit Effectiveness and Efficiency
Quality Assurance and Improvement Program
Reliance by Internal Audit on Other Assurance Providers
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
Talent Management

Practice Guides—Public Sector

Assessing Organizational Governance in the Public Sector
Creating an Internal Audit Competency Process for the Public Sector
 – Practice Guide

Assessing Organizational
Governance in
the Private Sector

July 2012
 IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Table of Contents

Executive Summary......................................................................................... 1

Introduction.................................................................................................... 2

Understanding the Context of and

Defining Organizational Governance................................................................ 3

The Role of Internal Audit in Providing

Assurance and Consulting Services................................................................ 4

Identifying and Analyzing Relevant Governance

Processes/Practices and the Assessment Criteria to Use............................... 4

Developing the Periodic Plan for Auditing Governance..................................... 7

Planning and Completing Governance Engagements..................................... 10

Considerations by Specific Governance Activity............................................ 17

Appendix — Board Risks, Control Objectives, Pratices................................. 22

Authors and Reviewers................................................................................. 26

www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Executive Summary The Role of Internal Audit in Providing Assur-

ance and Consulting Services
In today’s political and business environment, there is The internal audit charter should state that the scope
increasing focus on governance, risk management, and of work includes all governance activities and process-
control. Strong governance systems are needed to better es. This does not mean, however, that internal audi-
ensure that organizations will meet their objectives and tors are required to perform audits of all governance
stakeholder expectations. Stakeholders expect boards1 activities and processes. There are several roles inter-
and management to accept responsibility and implement nal audit can play in assessing and contributing to the
appropriate governance practices. The board is the focal improvement of organizational governance practices.
point for governance practices and in fulfilling its over- Although internal audit can play various roles, this
sight responsibilities will look to the internal audit activity Practice Guide deals only with providing formal as-
to provide it with assessments on the organization’s gov- sessments of organizational governance.
ernance practices. This Practice Guide provides the chief
audit executive (CAE) specifically in the private sector Identifying and Analyzing Relevant Governance
with direction on how to assess and make appropriate rec- Processes/Practices and the Assessment Criteria
ommendations for improving governance processes. to Use
There is no “one size fits all” governance model.
This Practice Guide includes the following sections and
Governance structures and practices should be in-
an appendix:
dividually tailored to the organization. There may be
legal and regulatory requirements, mandatory and
Understanding the Context of and Defining
optional practices prescribed by country governance
Organizational Governance
codes, various organizations promoting governance
Organizational governance involves the set of relation- principles, and practices common to the environ-
ships among the organization’s stakeholders, board, ments that the organization and its peers operate in.
and organizational management. Guidance on IT governance is provided because of
the reliance most organizations place on IT and the
There are a number of authoritative definitions put pervasive governance practices that should span the
forth by professional groups, regulators, academia, technology spectrum.
et al. These definitions are all very similar. The one
used in this practice guide comes from The Institute Developing the Periodic Plan for Auditing
of Internal Auditors’ International Standards for the Governance
Professional Practice of Internal Auditing (Standards).
The range of activities, depth of review, and time peri-
Regardless of the governance definition used, there
od to include in the assessment should be established
are common themes that are included in this section.
and agreed on with the board. All governance activi-
ties, both board and nonboard, should be considered.

1
The term board is used in this guidance as defined in the Standards glossary: “A board is an organization’s governing body, such as a board of directors, supervisory board, head of an
1

agency or legislative body, board of governors or trustees of a nonprofit organization, or any other designated body of the organization, including the audit committee to whom the
chief audit executive may functionally report.”

www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
In the process of setting the scope, the CAE will as-
sess the relative risk of governance processes, evalu-
ate the audit approach — assurance vs. consulting —
and identify the various stakeholder expectations in
setting the assessment objectives.
In developing a periodic program of governance
audits, CAEs will need to consider how many audits
to do and how governance assessments are woven into
nongovernance-specific audits, a reliance that may be
placed on other organization functions, external audit,
and governance over IT.
Planning and Completing the Governance
Engagements
Individual engagements flow from the annual program
of audits. At the engagement level, staffing the proj-
ect with the right skills competencies and experience
is critical. Because many organizations are subject to
regulations addressing required governance practices,
the CAE should forge a strong working relationship
with and involve the organization’s general counsel
(internal or external).
Considerations by Specific Governance Activity
With the variety of organizational operating environ-
ments globally, this Practice Guide provides aspects
of important governance processes the internal audi-
tor in the private sector should consider while devel-
oping his/her audit program(s). There is specific guid-
ance to consider in facilitating board assessments and
evaluating the organization’s strategy process, ethical
environment, risk management process, compliance
function, monitoring activities, and IT governance.
Appendix — Board Activities/Processes
and Risks
The overall objective of organizational governance is
to inform, direct, manage, and monitor an organiza-
tion’s activities toward achievement of its objectives.
2 / www.globaliia.org/standards-guidance
On behalf of the organization’s key stakeholders, the
board is the focal point for ensuring effective gover-
nance. The board faces risks to achieving effective
governance. However, there are a number of practices
that when implemented effectively will mitigate the
risks they face.
Introduction
The internal audit activity helps an organization achieve
its objectives by bringing a systematic and disciplined
approach to evaluating and improving the effectiveness
of governance, risk management, and control processes.
This practice guide discusses important areas for consid-
eration in assessing the organization’s governance prac-
tices. By their very nature, practice guides provide infor-
mation on how to conduct internal audit activities. This
Practice Guide should be used in conjunction with the
Standards and practice advisories in the International Pro-
fessional Practices Framework (IPPF), specifically Stan-
dard 2110: Governance and Practice Advisories, 2110.1:
Governance: Definition; 2110.2: Governance: Relation-
ship with Risk and Control; and 2110.3: Governance:
Assessments. In addition, due to the relationships
between governance, risk management, and control, the
Standards addressing those specific governance activities
(Standard 2120: Risk Management and Standard 2130:
Control), along with supporting practice advisories and
practice guides, should be referenced.
The type of organization, its size, complexity, and
geographic location(s) will drive the shape of the gover-
nance requirements and practices. For that reason, this
Practice Guide will provide guidance on how to assess
organizational governance in the private sector. This
Practice Guide will not provide a framework or audit
program, as those are best designed specifically for the
organization in the environment in which it operates.
The organization’s board has responsibility for the gover-
nance system. The CEO owns the governance processes

Assessing Organizational Governance in the Private Sector
within the organization (non-board processes). Many gov-
ernance practices are performed by the board and execu-
tive management, which makes assessment a sensitive
matter. An effective internal audit activity that is inde-
pendent, objective, and capable, uses sound assurance
processes and practices, and conforms to the Standards
is qualified to audit the governance process and provide
assurance to the board and management on governance
effectiveness.
1.0 Understanding the Context of and
Defining Organizational Governance
Organizational governance involves the set of relation-
ships among the organization’s stakeholders, board, and
organization management. These relationships are framed
by rules and requirements and provide the structure
through which the objectives of the organization are set,
the strategies to achieve those objectives are defined, op-
erating plans are prepared, performance is monitored, and
information is communicated transparently among the
parties.
The term governance has a range of definitions depending
on a variety of environmental, structural, and cultural cir-
cumstances and legal frameworks. The Standards define
governance as: “The combination of processes and struc-
tures implemented by the board to inform, direct, man-
age, and monitor the activities of the organization toward
the achievement of its objectives.”
Globally, there are a variety of governance models that
have been published by other organizations, including le-
gal and regulatory bodies. For example, the Organisation
for Economic Co-operation and Development (OECD)
defines governance as “a set of relationships between a
company’s management, its board, its shareholders, and
other stakeholders. Corporate governance provides the
structure through which the objectives of the company
are set and the means of attaining those objectives and
monitoring performance are determined.” The Australian
Securities Exchange Corporate Governance Council de-
IPPF – Practice Guide
fines governance as “the system by which companies are
directed and managed. It influences how the objectives
of the company are set and achieved, how risk is moni-
tored and assessed, and how performance is optimized.”
In most instances, there is an indication that governance
is a process or system and is not static. What distinguishes
the approach in the Standards is the specific emphasis on
the board and its governance activities.
The frameworks and requirements for governance vary ac-
cording to organization type and regulatory jurisdictions.
Examples include publicly traded companies, not-for-
profit organizations, associations, government or quasi-
government entities, agencies, academic institutions, pri-
vate companies, commissions, and stock exchanges.
The board is the focal point for effective organizational
governance. It is the link between the stakeholders and
the organization’s executive management. To be effec-
tive, the board should be independent, engaged, and
committed. The board bears primary responsibility for
the governance of its organization. The board establishes,
maintains, and monitors standards and policies for ethics,
business practices, and compliance that span the organi-
zation. The board directs and provides oversight of the ex-
ecutive leader and senior management in setting strategic
objectives, establishing appropriate risk levels, instituting
effective control systems, tracking performance, and pro-
viding transparent, complete, clear, and timely communi-
cation to stakeholders.
Other board responsibilities include setting the organi-
zation’s strategic objectives and providing the leadership
to put them into effect, supervising the management of
the business, and reporting to the stockholders on their
stewardship. The board’s actions are subject to laws, reg-
ulations, and the needs of the stakeholders. The board
typically delegates significant authority for the day-to-day
operations to an executive leader (CEO) and his/her ex-
ecutive officer team.
www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
The organization’s executive leadership and senior man-
agement are accountable to the board. The CEO is ul-
timately responsible for implementing the organization’s
governance system. The CEO sets the “tone at the top”
for the integrity, ethics, and conduct that will contribute
to an effective governance environment. He/she imparts
this tone to his/her executive leadership team, which in
turn cascades organizationwide. The CEO and executive
management should do more than just “talk the talk.”
They are on the organization’s stage and should “walk
the walk” to ensure that a positive governance culture
exists throughout the enterprise. In addition, executive
leadership and senior management should ensure that
governance policies, procedures, and programs exist
and are followed, and that there is compliance with the
appropriate laws, regulations, and codes.
The starting point for internal audit in providing assurance
is to gain an understanding of the context within which its
organization operates, identify the key stakeholders and their
requirements, and determine how the organization defines
governance. The CAE should work with the board and the
executive management team, as appropriate, to determine
how governance should be defined for audit purposes.
2.0 The Role of Internal Audit in Providing
Assurance and Consulting Services
The internal audit charter should state that the scope of
work includes all governance activities and processes.
This does not mean, however, that internal auditors are
required to perform audits of all governance activities and
processes. There are a number of roles internal audit can
play in assessing and contributing to the improvement of
organizational governance practices.
• Provide advice on ways to improve the organization’s
governance practices if they are not mature.
• Contribute to the organization’s governance structure
through internal audits, even if not focused on gover-
nance as an audit topic.
4 / www.globaliia.org/standards-guidance
• Act as facilitators, assisting the board in self-assess-
ments of governance practices.
• Observe and formally assess governance, risk, and
control structural design and operational effective-
ness while not being directly responsible, if posi-
tioned properly within the organization and staffed
with capable professionals.
The appropriate role for internal audit and the resource
commitment to each of these approaches will depend
largely on the maturity of the organization’s governance
structures and the organization’s size and complexity. The
CAE should discuss and reach an agreement with the
board on internal audit’s role in assessing organizational
governance.
Although internal audit can play various roles, this Prac-
tice Guide deals only with providing formal assessments
of organizational governance. The various ways to assess
organizational governance are discussed in Section 4,
Developing the Periodic Plan for Auditing Governance.
Recognizing that there could be sensitivities to assess-
ing and reporting on some board- and executive-level
governance activities, board-level sponsorship for the
assessments should be obtained as part of this periodic
audit planning process.
3.0 Identifying and Analyzing Relevant
Governance Processes/Practices and the
Assessment Criteria to Use
The next phase in providing formal assessments of organi-
zational governance is to identify all relevant governance
processes/practices. This is followed by reviewing the pro-
cesses to identify process objectives and related risks. The
next step in this phase is to establish assessment criteria
and, finally, validate the understanding obtained with the
board and organization’s executive management. As you
perform these steps, you may find that the governance
process documentation is not adequate. If this condition
exists, it should be reported to the board as an initial op-
portunity to strengthen governance practices.

Assessing Organizational Governance in the Private Sector
3.1 Sources for Governance Processes/Practices
Governance practices should be tailored to comply with
mandatory requirements and best fit the organization’s
risk profile.
The legal jurisdictions in which the organization operates
promulgate those laws and regulations deemed to be in
the best interest of good governance. These tend to form
the minimum requirements. Examples are the U.S. For-
eign Corrupt Practices Act (FCPA), Security Laws, and
the U.S. Sarbanes–Oxley Act of 2002; Ontario, Canada,
Bill 198; Canada’s Competitions Act; the German Corpo-
rate Governance Code; the Australian Corporate Report-
ing and Disclosure Law – CLERP9; France’s Financial
Security Law; Italy’s L262/2005; South Africa’s Compa-
nies Act 2008; and South Africa’s King III Report.
The legal and regulatory requirements that apply to your
organization should be used in conjunction with appli-
cable requirements stemming from self-regulated organi-
zations (SRO). An SRO is an organization having certain
limited regulatory authority over its members. It can be a
market mechanism or industry or profession specific. One
of the largest global types of SROs is a stock exchange.
Stock exchanges include in their regulations specific gov-
ernance practices that listed companies should adhere to.
There are more than 50 major stock exchanges.
The Articles of Association, or similar documents (e.g.,
Acts and Regulations for some government organizations),
establish and define the purpose of the organization. By-
laws, policies, or operating agreements also may be cre-
ated. The latter are rules for conduct of the organization.
They are the “game plan” on how the organization is to be
run and operated. Bylaws, policies, and operating agree-
ments also set out the rights and powers of the stakehold-
ers, board members, and officers within the organization.
OECD Countries:
2
Australia, Austria, Belgium, Canada, Chile, The Czech Republic, Denmark, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Japan, Korea, Luxembourg, Mexico,
Netherlands, New Zealand, Norway, Poland, Portugal, The Slovak Republic, Slovenia, Spain, Sweden, Switzerland, Turkey, the United Kingdom, and the United States. The Council
of the European Commission also takes part in the work of OECD.
IPPF – Practice Guide
These are, in effect, a contract among members, and
should be formally adopted and/or amended. The bylaws
should be reviewed regularly.
Generally speaking, an organizational governance code is
a set of principles, standards, and/or preferred practices
that are promulgated by an influential body relating to
governance of the organization. These codes can be man-
datory, strongly recommended, or optional. Some codes
are linked to stock exchange listing requirements.
The OECD2 has published a set of governance principles
that while non-binding provide common elements of good
governance practices and guidance on implementation.
The principles tend to focus on publicly traded corpora-
tions but are useful in comparing and improving gover-
nance practices in any organization.
Other sources useful in identifying governance practices
include the customs, behaviors, and stakeholder expecta-
tions that exist in the organization’s operating environment.
3.2 Review the Documented Governance Processes
Concurrent with identifying the governance requirements
from Section 3.1, internal audit should obtain and review
the governance documentation that exists. Keeping in
mind that there is no “one-size-fits-all” governance frame-
work or model, the actual governance processes and ac-
tivities will vary. By design, the organization’s governance
processes should respond to the requirements identified
in the preceding section.
To further ensure that all governance processes and
activities have been considered, the following is provided
as a generic yet comprehensive list of governance pro-
cesses that should be evident in the organization’s formal
and informal governance practices. Governance practices
www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
are grouped at the board level and within the organization
(non-board). Together, they form the governance umbrella
over the organization’s operations.
Board Governance Practices
• Board and committee structure, charters, roles and
responsibilities, processes, and reporting.
• Board and committee activities — calendars, meet-
ing agendas, meeting papers, minutes and reports of
meetings, follow-up actions, and self-assessments of
board and committee governance practices.
• Board composition, including selection, induction,
ongoing education and training, remuneration, and
protection of board members.
• Board and committee oversight including objective
setting, strategies, structures, operating plans and
budgets, capital acquisition and allocation, CEO,
enterprise risk management (ERM), ethics and
integrity, delegated authorities, performance mea-
surement and results, compensation and rewards,
policies and procedures, compliance, decision
making, stakeholder communication such as
financial reporting and disclosures, reputation,
unpredictable events, and other organizational
governance practices.
• Assurance practices, including external financial,
regulatory, and internal audit.
• Additional practices generally retained by the board,
which may include:
– Selecting, monitoring, evaluating, compensating,
and retaining the CEO and other key members of
senior management.
– Providing strategic guidance to the CEO and
senior management.
– Reviewing and approving objectives and impor-
tant organizational plans and actions.
– Making decisions on major transactions (trans-
formational transactions) before submission to
stakeholders for approval.
6 / www.globaliia.org/standards-guidance
– Reviewing and approving major changes in ac-
counting and auditing principles and practices.
– Declaring dividends and approving share repur-
chase programs.
– Resolving cross-organizational issues.
Organization Governance Practices
• Setting objectives.
• Developing strategies, operating plans and bud-
gets, organizational structures, and management
committees.
• Assignment of authority and responsibilities organi-
zation-wide.
• Defining behaviors, codes of ethics, and conduct
including conflict of interest, fair dealing, protection
and proper use of assets, insider dealings, violation
reporting (hot lines), and disciplinary actions.
• ERM to include internal control, fraud risk manage-
ment, and IT governance.
• Compliance with laws, regulations, and codes both
mandatory and optional where adopted.
• Monitoring and performance measurement.
• Ensuring effectiveness of assurance providers within
the organization (particularly operational manage-
ment that serves as the first line of defense for a
sound system of internal controls and enterprise-
wide activities like risk management and compliance
that serve as a second line of defense).
• Communication up, down, and across the organization.
• Processes that ensure effective communication with
shareholders and stakeholders.
• Capital acquisition and allocation.
• Capabilities — people selection, development, reten-
tion, and succession planning.
• Transformational transactions.
• Cross-organization issues.
• Organization responsibility and sustainability.

Assessing Organizational Governance in the Private Sector
• Evaluation and rewards, both salary and incentive
compensation.
• Organizational processes for assessing performance
and independence of external auditors, including the
nature and extent of non-audit services obtained.
Internal audit is itself a key governance activity. Its ef-
fectiveness in providing assurance to stakeholders is criti-
cal to effective governance. The board should look to the
CAE for periodic reports on the internal audit activity’s
quality assurance and improvement program and ensure
that the program provides for an independent assessment
at least every five years as per Standard 1312: External
Assesments. The CAE should ensure that the reports of
independent assessors are provided to the board. In addi-
tion, the board will draw its own conclusions on the ef-
fectiveness of the internal audit activity.
3.3 Establish the Assessment Criteria
Laws, regulations, and, potentially, governance codes pro-
vide the basis for the organization’s mandatory governance
practices. There also are qualitative aspects of an organi-
zation’s governance practices that should be made a part
of the assessment criteria. One assessment tool that may
be considered is a governance maturity model. There are
governance maturity models available; however, we do not
provide one here because the governance attributes and
criteria will vary depending on the organization’s context.
To develop an organization-specific maturity model, the
CAE should review any available models for the organiza-
tion’s country and industry and take into consideration the
governance documents and issues specific to the organiza-
tion. A draft maturity model should then be discussed and
agreed on with senior management and the board.
Once finalized, a maturity model can be used to evalu-
ate and improve the organization’s governance structures,
processes, and arrangements either taken as a whole or
by individual governance process — ERM, compliance,
internal audit, and so on — particularly, when some gov-
ernance processes may have greater desired maturity than
IPPF – Practice Guide
others. Use of maturity models also provides a good facili-
ty for tracking improvement progress. The maturity model
will provide the methodology for establishing the criteria
needed to provide relevant and reliable information on the
existing governance process effectiveness. In addition, it
can be used for benchmarking practices that the board
would expect to have as a minimum acceptable level.
3.4 Validate Understanding and Agree on the
Assessment Criteria
The board and board-level committees have responsibility
for board-level governance practices and oversight respon-
sibility for the governance practices within the organiza-
tion. The CEO has overall responsibility for governance
practices within the organization and may delegate certain
governance responsibilities to others in the organization.
Internal audit should map the governance responsibilities
to those responsible for their design and operating effec-
tiveness.
After completing Sections 3.1, 3.2, and 3.3, internal audit
should validate its understandings with the governance
process owners, senior management, and the CEO. In-
ternal audit should conclude this phase of the assessment
process by further validating its understanding of the gov-
ernance practices with the board and related committees.
The assessment criteria should be agreed to as well.
4.0 Developing the Periodic Plan for
Auditing Governance
The definition of governance in the Standards emphasiz-
es the board and its governance activities. This includes
evaluating board effectiveness. It also includes providing
the board with timely and relevant information regarding
the governance process, including the non-board activi-
ties through which governance is realized. 
In addition, as discussed in Practice Advisory 2110-2, the
relationships among governance, risk management, and
internal controls should be considered:
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
•  Effective governance activities consider risk when
setting strategy. Conversely, risk management relies
on effective governance (e.g., tone at the top, risk ap-
petite and tolerance, risk culture, and the oversight
of risk management).
• Effective governance relies on internal controls and
communication to the board on the effectiveness of
those controls.
• Control and risk also are related, as control is defined
as “any action taken by management, the board, and
other parties to manage risk and increase the likeli-
hood that established goals will be achieved.”
Due to these interrelationships and depending on the
nature of the organization’s governance structures and
processes, the most appropriate way to audit governance
might be one or a combination of the following:
• Audits of specific governance practices such as those
listed in Section 3.2: Review the Documented Gov-
ernance Processes.
• A single audit including all processes that focus spe-
cifically on governance.
– This approach might be practical only in small
organizations or as a high-level review to deter-
mine whether additional processes are needed
and whether the existing processes, taken togeth-
er, give the board all the information it needs to
fulfill its governance responsibilities.
• Including governance in audits that focus more di-
rectly on business operations or support activities.
– In this approach, a component of those audits
would include the interface of the governance
processes with those operations and activities.
Governance audit work at the operations and
support activity level will provide detailed infor-
mation to internal audit on how well governance
practices are understood and practiced through-
out the organization. Over time and if desired by
8 / www.globaliia.org/standards-guidance
the board, the internal audit activity may be able
to provide assessments on the state of governance
within the organization as a whole, using this
work as a basis for that opinion.
The CAE should discuss and agree with the board on
which approach or combination of approaches will be
most effective for the organization, taking into account
the considerations that follow in this section.
To implement the selected approach, the CAE should
review the audit universe and modify it as necessary to
ensure that governance processes and structures are in-
cluded.
If the decision is to audit specific governance processes,
these processes should be identified and included as au-
ditable entities in the audit universe.
If the decision is to perform a single audit including all
processes that focus specifically on governance, this will
become an auditable entity.
If the decision is to include governance in audits that fo-
cus more directly on business operations or support activi-
ties, modifying the audit universe will be more difficult.
Ideally, the CAE will identify the governance processes
and structures within each auditable entity and include
them when assessing risk for each entity. This might not
be feasible, though, because identifying those processes
and structures might be a major project in itself. In this
case, it might be more practical to require the audit teams
to identify and evaluate those processes and structures
during the audits they perform. A certain amount of time
will have to be added to each audit for this additional work.
After some period of time — perhaps a year — enough
will be known about the organization’s governance that
identifying governance processes and structures in enti-
ties not yet audited will not be a major project.
With the universe defined, a risk-based approach should
be employed to identify the audits to be carried out over

Assessing Organizational Governance in the Private Sector
the planning horizon. The audit activity should ensure
that there is a balance of units selected for review in the
three areas of interest to internal audit due to their in-
terrelation — governance, risk management, and control.
Doing so allows the audit activity to take into consider-
ation the holistic organic view of governance and its ef-
fects on risk management practices and internal controls
and vice versa. At the organizational level, board input
should be obtained on the level of relative risk of each of
the governance processes such that the highest risk orga-
nization governance processes are included in the internal
audit plans. Many boards categorize organizational risks
into strategic, operational, financial, and compliance.
Risk-savvy boards expand the categories to include intan-
gibles such as assets, reputation, social responsibility, and
unpredictable events. The CAE should work with the or-
ganization’s risk management professionals in listing pos-
sibilities for discussion with the board.
The CAE should also determine the board’s expectations
for internal audit’s governance assessment deliverables.
For example, does the board want an overall opinion on
the effectiveness of all governance practices, an overall
opinion on those governance practices that exist within
the organization, opinions of the effectiveness of specific
elements, or reports with recommendations for improve-
ment that do not include an opinion? The board might
prefer assessments based on a maturity model, with the
maturity of each governance attribute measured against
specific criteria. The board can then compare the actual
and desired levels of maturity for each attribute, identify
strengths and gaps, and get a more complete and bal-
anced picture of the ethical climate than an audit opin-
ion provides.
Some of the planned audits may be sensitive. It is im-
portant that the audit plan is reviewed with the board in
detail and its sponsorship be clearly established.
While this section deals primarily with governance activi-
ties within the organization, some leading internal audit
IPPF – Practice Guide
activities also give assurance on board governance activi-
ties. The appendix includes risk considerations for a num-
ber of these activities.
4.1 Risk Assessment
As stated above, the CAE should use a risk-based ap-
proach in defining the scope of the governance assess-
ment or assessments. It is important to consider the na-
ture of the organization (i.e., publicly traded and privately
held, large and small, local and global, for profit and not-
for-profit, simple and complex, highly regulated and non-
regulated) and the context within which it operates. The
risks to achievement of organizational objectives for which
comprehensive governance processes should be in place
will be greatest in large, complex, highly regulated organi-
zations and organizations in multiple jurisdictions.
4.2 Special Circumstances
The key elements in developing the audit plan are appli-
cable for all types of organizations. Special circumstances
may exist for some organizations. The CAE should review
organization bylaws, articles, board and board committee
charters, and the organization’s operating environment,
and discuss any special circumstances with the board. The
board’s insights from these discussions will help frame the
overall audit plan. Special considerations may apply in
certain non-profit and government contractor activities.
4.3 Reliance on Other Assurance Providers
Special consideration should be given relative to gover-
nance audits including coordination with the external
auditors.
During the planning process, the CAE should determine
what reliance internal audit can place on other assurance
providers. Internal assurance providers include functions
such as risk management, compliance, quality assurance,
environmental auditors, health and safety auditors, and
government performance auditors. The criteria for reli-
ance include:
www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
• Organizational independence.
• Individual objectivity.
• Competence (e.g., technical knowledge, experience,
professional or industry certification, and continuing
professional development).
• Documentation of work.
• Engagement supervision.
• Quality of written reports delivered to management.
• Issues and action plans identified.
• Communication of results to the appropriate level of
the organization.
• Issue closure process.
• Issue closure escalation process to appropriate level
in organization.
• Risk-based considerations in the annual planning
process.
To confirm reliance, internal audit might:
• Review some of the assurance provider engagement
work.
• Reperform a sample of the work.
• Perform one or more combined assessments with the
assurance provider.
The annual plans prepared by other assurance providers
where reliance is anticipated should be provided to internal
audit early in the audit planning cycle. The plans should
include scope, objectives, and timing and locations/areas
to be assessed. Ideally, these plans should be risk based us-
ing a common language — the one internal audit employs.
Copies of relevant reports from these assurance provider
reviews should be provided to internal audit.
Boards of organizations with mature governance practic-
es are beginning to ask for more and better coordination
and integration of the assurance services. Internal audit
should be instrumental in forming an integrated or com-
bined internal assurance provider process.
10 / www.globaliia.org/standards-guidance
External assurance providers such as external auditors,
third-party assurance providers, and regulatory examiners
will provide the board, executive management, and stake-
holders additional comfort on aspects of the organization’s
performance. In establishing the governance assessment
approach, the CAE should consider the nature, scope,
and timing of external assurance providers’ work. Practice
Advisory 2050-1: Coordination and The IIA’s Practice
Guide, Reliance by Internal Audit on Other Assurance
Providers, provides guidance on coordinating work with
external auditors.
4.4 Communicating Activities among the Board and
External and Internal Auditors
Key communication points occur during the annual plan-
ning process, providing status on plan completion, report-
ing of results, and follow-ups on management improve-
ment actions. The CAE should have practices in place
with the board and the external auditors to facilitate these
communications. Form, content, and timing (scheduling)
should be established in advance generally using a 12- to
15-month window.
Communication is a two-way street. The CAE should set
internal audit expectations with the board and external
auditors to ensure receipt of relevant information that
would guide and shape internal audit governance assess-
ment work.
5.0 Planning and Completing Governance
Engagements
How an organization designs and practices effective gov-
ernance will vary. Therefore, establishing objectives and
criteria upon which to base the assessment is difficult.
There are common themes, but there are often no com-
mon practices. As a result, assessing the adequacy of gov-
ernance activities will require significant judgment by the
auditor. For each engagement, the assessment should in-
clude an evaluation of the design of the process or activ-
ity and include sufficient testing to draw a conclusion on
operating effectiveness.

Assessing Organizational Governance in the Private Sector
Some specific areas to consider at the engagement level
include:
• Process objectives — goals, purpose, and objectives
of the process or activities within the scope of the
engagement.
• Risks — risks that exist to achievement of those
goals and objectives identified in setting strategy.
• Structures — structures (organizational units,
processes, policies, and procedures) that support
achievement of objectives and are documented, com-
municated, and understood.
• Accountabilities — clearly defined roles, responsi-
bilities, and accountabilities.
• Required legal and regulatory requirements confor-
mance.
• People — adequate staffing, training, and development.
• Communicating results.
• Monitoring improvement action progress.
5.1 Planning
Setting the Engagement Objectives
Engagement objectives reflect the purpose for perform-
ing the engagement and the deliverables that are to come
from the work. Simply stated, engagement objectives state
what the audit will provide. While the objectives should
have been developed during the periodic audit planning
process, the objectives should be formally established and
communicated in an engagement memo or Terms of Ref-
erence. These objectives can be stated in a variety of ways
depending on the nature and scope of the assurance en-
gagement. Regardless of the wording used, the objectives
should clearly state the specific assurance to be provided.
Examples include:
• Assess compliance with required governance activities.
• Evaluate risk management activities at the subsidiary
level.
IPPF – Practice Guide
• Provide assurance on how well the organization’s
strategies have been communicated and adopted
organization-wide.
• Evaluate the design, implementation, and effective-
ness of the organization’s ethics program and related
activities.
• Assess how well authorities have been delegated,
acknowledged, and followed throughout the
organization.
Identifying Governance Activity (Process) Objectives
and Analyzing Associated Risks
Governance activity or process objectives are important to
understand and will enable the internal auditor to identify
and analyze the associated risks and controls. The overall
objective of organizational governance is to enhance orga-
nizational value and ensure proper management account-
ability and communication to its key stakeholders.
For each specific governance activity or process, there
may be different types of objectives. Generally, objectives
can be categorized as: strategic, operational, compliance,
and reporting. These are described in The Committee of
Sponsoring Organizations of the Treadway Commission’s
(COSO’s) Enterprise Risk Management–Integrated Frame-
work and can provide useful guidance in identifying and
understanding relevant objectives for the specific gover-
nance activity or process to be reviewed.
Section 3 introduces general governance practices
grouped at the board level and within the organization. To-
gether these activities constitute the governance umbrella
over the organization’s operations. The appendix provides
examples of governance activity objectives and risks at the
board level while Section 6 provides similar information
for the key governance processes within the organization.
Legal Involvement
Oftentimes the internal auditor will be challenged to in-
terpret application of laws and regulations. Except for
www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

those with law degrees, internal auditors generally do not
have the legal background to adequately interpret the
more complex legal implications affecting organizational
governance. When faced with this situation, the CAE
or supervisor of the engagement should involve the legal
department or the organization’s legal counsel in providing
the necessary legal advice. When the area of audit focus
is assessment of the organization’s legal activity, the CAE
should consider use of outside counsel. The CAE should
obtain agreement from the board on this.
Engagement Staffing
The nature of the engagement — scope and objectives —
will shape the knowledge, skills, competencies, and expe-
rience needed to successfully c�omplete the engagement.
The CAE should identify the knowledge, skills, compe-
tencies, and experience needed for the engagement and
assign staff that best fits these requirements. Where im-
portant gaps exist, the CAE should consider just-in-time
training, guest auditors, or a consultant to fill the gaps.
The audit plan should include the program of audits to be
completed, the timing of those audits, and the resources
needed. CAEs are often challenged with limitations or con-
straints on resources. Governance audits are high profile,
and staffing them often requires individuals with advanced
knowledge, skills, competencies, and experience. When
using a third-party source for staffing, the CAE should en-
sure that the staff is both independent and objective.
5.2 Performing the engagement
Sources of Evidence
In providing assurance, internal auditors normally use a
two-step approach: review the design and test the oper-
ating effectiveness of key activities. The internal auditor
should gather sufficient, relevant, and reliable informa-
tion in carrying out the work and formulating conclusions
and recommendations. There are a number of sources to
consider in gathering the evidence.

Attribute Evidence to Consider

Role of the Board • Legal documents establishing the organization (Articles of “formation,” bylaws, etc.).
• Legal and regulatory requirements with which the board should comply (acts, statutes, rules, etc.).
• Briefing papers including pre-meeting materials and presentations.
• Meeting minutes and actions taken.
• Charters including those of any committees of the board.
• Board member profiles.
• Self-assessments.
• Regulatory actions/sanctions.
• Orientation and training materials.
• External reports to include independent auditors, regulators, rating agencies, etc. (for the organization’s
“watchdogs”).
• News sources for any relevant press regarding the organization.

12 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Attribute Evidence to Consider

Values, Culture, • Ethics and integrity policy – adopted, communicated, affirmation, training.
Philosophy • Mission, vision, values established and communicated.
• Whistleblower hotline established, communicated, level of awareness and use, organization response.
• Organization personnel surveys confirming individual awareness and understanding.
• Organization personnel surveys confirming executive/leadership displays a values culture and philosophy.
• New employee training and orientation includes values, culture, and philosophy.
• Communication/training exists on ethics and values in “gray areas.”

Structures, • Articles of formation (incorporation), bylaws, operating agreements, etc.

Arrangements • Policies that include: purpose, roles and responsibilities, audience, scope, definitions, authorities, effective
(includes legal dates, implementation dates and procedures, authorities and administration, measurement and validation (to
documents, policies, name a few topics that should be included).
standards, charters,
etc.) • Standards that articulate the ”to what level” of performance is to be expected (i.e., zero defects or tolerance,
Six-Sigma.
• Mandatory governance requirements adopted with appropriate structures and incumbents in place at C-suite
level.
• Detailed process and accountability in place to keep current on governance requirements.
• Governance committee charters that include purpose, scope authority, roles and responsibilities, and
membership and are published, widely known and readily accessible, periodically reviewed and updated as
necessary.
• Governance committee meeting minutes, actions taken, and reporting.
• Examples of governance committees that larger organizations may have include governance, strategy, risk,
audit, control, compliance, disclosure, finance, and IT governance/risk.
• For larger and more complex organizations, governance structures and organization charts that cascade
throughout the organization fully staffed with clear reporting relationships.
• Details on governance processes where there is shared accountability, particularly in organizations that use
matrix management.
• Process details for addressing or approving deviations to policies, standards, and procedures.

Process, Procedures, • Documentation that identifies all organizational activities, operations, departments, functions, and/or
Process Management processes.
(level below • Documented maps for each process showing inputs, activities, tasks, steps in the process, and outputs.
organization-wide Mapping also should include such references as objectives, customer conditions of satisfaction, ownership,
structures) procedures to update when necessary, and procedures to make available to those with the need.
• Documentation for all aspects of transformational transactions and existing process change management.

www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Attribute Evidence to Consider

Goals, Objectives, • Current list of organization’s goals, objectives, standards, and strategies.
Strategies, Plans, Risk, • Communication protocols.
Controls
• Details on alignment throughout organization.
• Process to update and re-communicate.
• Evidence of board approval from meeting minutes or correspondence directly from the board.
• Details showing the allocation of resources to execute strategies approved by the board.
• Documented responsibility for strategy implementation.
• Risk policy and procedures approved by the board that include: risk process, risk universe with common risk
descriptions, risk tolerance levels, risk assessment and reporting process, and risk ownership.
• Details of function/department/unit/individual goals and objectives and their alignment to the organizational
ones.
• Performance or reward systems that encourage personnel to achieve organizational goals that are aligned
with stakeholder expectations.

People, Capabilities,
Accountabilities,
Behaviors, Training,
Education,
• Job descriptions for all organization personnel that contain position description, responsibilities, authorities,
reporting relationships, and education.
• Development program/process that applies to all personnel.
• Leadership development program/process.
• Individual training records that include skills assessments, development plans, and training completed.
• Organization-wide training on ethics, integrity, and values.
• Succession plans.
• Personnel surveys that provide insights into how people view the organization’s commitment to people, their
capabilities, accountabilities, behaviors, training, and education.
• Detailed, board-approved delegated authorities, personnel acknowledgement, periodically reviewed,
validations, and remediation process where authorities are breached.

14 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Attribute Evidence to Consider

Metrics, Measurement, • Documented organizational performance measurement system that illustrates the system and includes
Monitoring (Oversight) description of required information, the form of the reports, reporting periods and due dates, safeguards that
ensure accuracy, and completeness.
• Copies of actual reports.
• Personnel and customer surveys: processes, questions, frequency, audiences, results, responses, and status
on improvement actions.
• Monitoring systems over and above performance measurement systems that should specify what and when to
monitor, responsibility, results, and improvement action plans and status.
• Details on assurance mechanisms that would include: charters, scope, plans, reports, etc.
• Benchmarking process and results.
• Due diligence evidence/documentation on assessment of third-party governance practices.
• External reports with comparisons to relevant internal reports covering governance practices.

Communicate, Inform, • External reporting process documentation that evidences legal involvement.
Transparency • Details on mandatory/required reporting to external parties.
• External reports along with documentation evidencing conformance to established procedures.
• Disclosure committee charter, roles, responsibilities, meeting minutes.
• Internal communication systems up, down, and across the organization.
• Surveys/survey questions and results regarding personnel perceptions on quality of information and
communication.
• Information and communication security/privacy policies, procedures.
• Information “asset” management process/program.
• Feedback from recipients on quality of communication.

Results, Stakeholder • Financial reports both external and internal.

Expectations, • Regulatory actions.
Compliance, Objectives
• Internal measurement results such as balanced scorecards.
• Civil actions.
• Organization news and blogs — what others are saying about the organization.
• Analysis, particularly external, comparing actual results to objectives and expectations, both short and longer
term.

Automation • IT governance/risk/control program and processes.

(Where applicable) • Defined information security policies, procedures, and practices.

www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
Workpaper Documentation
Because of the sensitivity of some governance audit work,
there may be a need for special handling of access and stor-
age of related audit workpapers. Audit workpapers are the
property of the organization. The files are under the control
of the internal audit activity and are accessible only to au-
thorized personnel. Management review may be granted to
substantiate or explain audit findings or to use audit docu-
mentation for other business purposes. Where the audit
work is completed at the request of the organization’s legal
counsel, the access and storage of the workpapers may re-
quire legal direction. Regardless, the CAE should approve
all requests for access to audit workpapers.
5.3 Communicating Outcomes and Results
Internal audit should communicate engagement out-
comes and results. Agreement should be reached with
the organization’s board and executive management on
dissemination of all governance-related reports. General
counsel’s advice should be obtained on the communica-
tion of results and retention of related workpapers.
Communicating results should be consistent with
Standard 2400: Communicating Results and the related
practice advisories and practice guides.
The CAE may be asked to facilitate self-assessments of
the board or its committees. The results, including ac-
tion plans, if any, should be documented so the board can
monitor progress. The method for documenting and com-
municating results will be at the discretion of the board.
Options range from a written report to a brief slide pre-
sentation.
Assessments of some management governance activities
might have legally sensitive results. This possibility should
be considered before the assessment begins. It might be
prudent to work with the organization’s general counsel
and do the assessment and related reporting under legal
privilege.
16 / www.globaliia.org/standards-guidance
If the assessment yields legally or politically sensitive re-
sults that were not anticipated, reporting may be formal
or informal. Consideration should be given as to which
method will get corrective action taken without resulting
in unintended negative repercussions. Even if reporting is
informal, internal audit must follow the Standards in com-
municating the audit results and in monitoring improve-
ment action progress.
5.4 Monitoring Improvement Action Progress
The CAE should establish a system to monitor the prog-
ress on improvement actions communicated to manage-
ment and the board. Due to the importance of governance
activities and board and CEO responsibilities for effective
governance, the system should be rigorous. The system
should include:
• The timeframe within which the improvement action
will be completed, including key milestone dates.
• Ongoing evaluation of governance activity owners’
responses.
• Internal audit validation or follow-up audit of the
improvement action.
• An escalation process for unsatisfactory response to
include the assumption of risk for delayed or incom-
plete improvement action.
5.5 Engagement Administration
Supervision/Quality
Governance audits are high profile and carry with them
higher audit risk. The CAE should ensure that these en-
gagements are adequately staffed, properly supervised,
and subject to the internal audit quality assurance and
improvement process.
If the internal audit activity is to have a key role in as-
sessing governance, its overall effectiveness in providing
assurance to stakeholders is critical. The board should
look to the CAE for periodic reports on the internal audit

Assessing Organizational Governance in the Private Sector
activity’s quality assurance and improvement program and
ensure that the program provides for an independent as-
sessment at least every five years. The CAE should ensure
that these reports are provided. In addition, the board will
draw its own conclusions on the effectiveness of the in-
ternal audit activity.
6.0 Considerations by Specific Governance
Activity
6.1 Board
The board should be satisfied that there is an effective
governance system in place. To that end, it should en-
sure that it is fulfilling all of its governance responsibili-
ties, the right governance processes are in place within
the organization and operating effectively, and transparent
communications exist between the organization and its
stakeholders. The board should discuss the state of the or-
ganization’s governance system. It should seek input from
the three levels of assurance providers — operating or line
management, enterprise-wide functions, and indepen-
dent activities such as internal audit — and use external
assurance providers to validate the three levels’ represen-
tations and opinions. The board should sponsor periodic
evaluations and continuous improvement of governance
practices. This can be done through self-assessments and
obtaining assistance from the organization’s internal audit
activity and external assurance service providers. A highly
competent and a well-positioned internal audit activity
can assist with a board’s self-assessment and can provide
reliable assurance on the organization’s internal gover-
nance practices.
The exact role of the board is determined by the powers,
duties, and responsibilities delegated to it or conferred
upon it by applicable law and are typically specified in
the organization’s articles, bylaws, charters, or rules (or
other similar documents). Usually, the organization’s legal
documents specify the number of members of the board,
how they are to be chosen, the frequency and mode of
meeting, and how decisions are to be made. The bylaws
IPPF – Practice Guide
primarily contain what is prescribed in legislation. The
organization’s legal documents further specify the roles
and responsibilities of the board, senior management, and
other corporate bodies and functions.
6.2 Strategy
Strategic planning is an organization’s process of defining
its strategies for achieving its goals and objectives, and
making decisions on allocating its resources to pursue its
strategies, including its capital and people. Simply put,
strategic planning outlines where an organization is going
over the next few years and how it is going to get there.
Strategies can exist at different levels in an organization.
It starts at the overall organizational level and cascades
down through the organization.
Organization Strategy — At the highest level, it is
concerned with the overall purpose and scope of the
organization to meet stakeholder expectations. This is
the most critical level since it is heavily influenced
by stakeholder investment and acts to guide strategic
decision-making throughout the organization.
Subsidiary Strategies — These strategies are con-
cerned more with how the organization will suc-
cessfully operate in a particular “market.” It involves
strategic decisions about choice of products, meeting
needs of customers, gaining competitive advantage,
and exploiting or creating new opportunities.
Operational Strategy — At the operating level, these
strategies are focused on how each activity or func-
tion of the organization will deliver the organization
and subsidiary strategies. Operational strategies are
much more detailed and key in on resources, process-
es, people, etc. All discrete activities and/or functions
should have operational strategies.
www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
What are some conditions of satisfaction that can be used
in evaluating strategies? Strategies should:
• Be developed through a disciplined process and sup-
ported by the best available information.
• Be commonly understood by organizational person-
nel.
• Serve as a platform for all major decisions.
• Enhance stakeholder value.
• Align with other strategies, top-down and across the
organization.
• Be clearly reflected in objectives, structures, and
operations at all levels.
• Enable alignment of measurement and rewards.
• Eliminate redundancies.
• Be documented.
• Manage/maintain risks within risk tolerance limits.
• Allow risk expectations to be well understood by
stakeholders, regulators, rating agencies, and capital
markets.
The assurance that internal audit provides should align
to the above conditions of satisfaction. The assessment is
generally not intended to directly question the strategies
themselves, but rather the strategic planning process and
how well the strategies have been communicated through
the organization and adopted at the various levels.
6.3 Enterprise Risk Management
Generally, the board will delegate the operation of the
risk management process to the organization’s executive
leadership team. Structures may vary depending on the
size, complexity, and maturity of the organization and its
commitment to risk management. For example, in a small
organization with risk-conscious managers and a high de-
gree of communication about risks, there may be no need
for a formal structure. In a large organization the struc-
ture may consist of a single individual — chief risk officer
18 / www.globaliia.org/standards-guidance
(CRO) — or a CRO with a staff that owns the process
and coordinates and project manages risk management
activities. Some organizations have assigned specific risk
management activities to internal audit. The IIA issued a
position paper in 2009 on “The Role of Internal Auditing
in Enterprise-wide Risk Management.” This position pa-
per provides guidance on permitted roles, roles that may
be appropriate with safeguards, and prohibited roles. Of
great importance is ownership of risks. Regardless of the
roles internal audit may play, it should not own any risks
other than the internal audit risk.
There are several risk management frameworks or stan-
dards to choose from in establishing the criteria upon
which to base the assessment. Two of the most widely
used are ISO 31000, Risk Management — Principles and
Guidelines and COSO’s Enterprise Risk Management–
Integrated Framework.
For guidance on assessing risk management, see the The
IIA’s Practice Guide, Assessing the Adequacy of Risk
Management Using ISO 31000. This practice guide pres-
ents three potential approaches:
• Process elements — are all the elements of a sound
risk management process in place?
• Key principles — does the risk management process
satisfy a minimum set of principles?
• Maturity model — how mature are the elements of
the risk management process? This Practice Guide
includes a basic risk maturity model.
The internal auditor should look at the qualitative aspects
of risk management, as well as the formal processes. For
example, the quality of the risk policy or risk universe is as
important as having one.
6.4 Ethics
Senior management members have primary responsibil-
ity for promoting strong ethics. Most important though is
the tone at the top they set by their actions and informal

Assessing Organizational Governance in the Private Sector
communications. These actions include their own behav-
ior and how they respond when key employees (e.g., other
executives or “the best salesman”) behave unethically. Op-
erating managers set the tone in their own areas, which
may or may not be consistent with that of the organization
as a whole.
Ethical standards in areas such as gift giving are differ-
ent in some countries than others. Global organizations
should decide whether and how much to adapt their glob-
al standards to the local culture and make this clear to all
concerned.
Internal audit should promote ethical behavior and may
play a formal role such as chief ethics officer, compliance
officer, or member of an ethics council, as long as such a
role does not compromise internal audit’s independence.
Standard 2110.A1 states: “The internal audit activity must
evaluate the design, implementation, and effectiveness of
the organization’s ethics-related objectives, programs, and
activities.” Evaluating the design might require develop-
ing and agreeing with management on criteria, perhaps by
research and benchmarking similar programs. Evaluating
the implementation will be similar to doing so for other
activities. Evaluating the effectiveness (i.e., whether they
are having the desired effect) requires an evaluation of the
ethical climate itself.
Evaluating the ethical climate is sensitive and can be
highly subjective. To succeed, internal auditors should:
• Get sponsorship and agreement on the evaluation
methods from the board and/or senior management.
To the extent possible, get buy-in from those who
might be subject to criticism as a result of the review.
• Consider using a maturity model for the evaluation,
because no ethical climate is completely good or bad.
• Consider using self-assessment methods such as sur-
veys or workshops, in which employees evaluate the
IPPF – Practice Guide
climate they work within and the ethical behavior of
management and/or other employees. Whenever pos-
sible, validate the results of these methods with more
tangible evidence. If they cannot be validated, make
this clear in reporting, and work with management to
determine the reasons for employees’ perception of
the climate.
Like other governance activities, ethics can be assessed as
part of a comprehensive review of governance or as a stand-
alone project that contributes to the overall governance
assessment, or it can be integrated into audits that focus
more directly on business operations or support activities.
6.5 Compliance
Compliance and ethics are closely related and are some-
times evaluated together. The preceding section on ethics
applies to compliance as well. This section presents ad-
ditional considerations.
The term compliance, particularly when referring to a
compliance function, normally refers to compliance with
laws and regulations, rather than compliance with internal
policies and procedures. Internal auditors should consider
the need for technical assistance — for example, from the
organization’s legal department or an outside third party
— when evaluating legal and regulatory compliance.
The compliance function, if one exists, might be the sub-
ject of an audit. The scope, however, should go beyond
the activities of the function itself. The effectiveness of
the function is determined by the awareness of and com-
mitment to compliance by employees whose work could
be noncompliant. If the CAE is responsible for the com-
pliance function, this audit should be outsourced to an
external provider.
If there is no designated compliance function, internal au-
ditors should determine and assess the methods by which
the organization fosters compliance knowledge and com-
mitment in its employees.
www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
6.6 Organizational Accountability
The organization’s board and management derive their
authorities from the organization’s key stakeholders. Ac-
countability is imperative to make executive management
and staff answerable for their behavior and responsive to
the organization’s key stakeholders. This may be achieved
differently in different countries or political structures,
depending on the history, cultural milieu, and value sys-
tems involved. The mechanisms employed may vary from
audit covenants at one level; to broadly elected legisla-
tures or more narrowly conceived consultative commit-
tees at another.
Accountability also means establishing criteria to mea-
sure the performance of board and management, as well
as oversight mechanisms to ensure that the standards are
met. The litmus test is the process by which the stake-
holders can act to address inappropriate actions and re-
ward exemplary performance. This can be a very sensitive
area for internal audit to touch upon and underscores the
importance of sponsorship.
When assessing accountability, internal audit should
consider:
• The organization’s legal or legislative appointment,
legal structures, and applicable laws and regulations.
• Formal and comprehensive “delegated authorities”
and “powers reserved.”
• Documented acknowledgement by key personnel of
their accountabilities.
• Processes to monitor accountabilities and corrective
actions taken when accountabilities are not met.
6.7 Monitoring
There are a number of different monitoring and mea-
surement systems in use today. Regardless of the nature,
size, type, form, or specialization, organizations tend to
be interested in the same general aspects of performance:
20 / www.globaliia.org/standards-guidance
financial, customer, internal business operations, employ-
ee, leadership, and society and shareholder/stakeholder
satisfaction.
By definition, the purpose of monitoring is to provide the
board and management with early indications of progress
being made in achieving the organization’s objectives.
Monitoring enables and assists the board and management
in making timely decisions. Also, monitoring provides the
means for holding people accountable and enables the or-
ganization to continually improve performance.
Monitoring should be based on an analysis and prioritiza-
tion of the risks to achieving organizational objectives and
the means by which those risks are mitigated. The moni-
toring process level risks to consider may include:
• Relevance.
• Reliability.
• Adaptability to address new or changing risks.
• Accuracy.
• Objectivity.
• Completeness.
• Cost effectiveness.
• Timeliness.
• Usefulness.
• Communication and reporting content.
6.8 IT Governance
The Standards Glossary provides the following definition
of IT governance: “Consists of leadership, organizational
structures, and processes that ensure the enterprise’s [IT]
supports the organization’s strategies and objectives.”
IT governance is an extension of the organization’s gover-
nance. As with all governance, there is no one-size-fits-all
solution. Effective IT governance should be a cohesive and
integrated process aligned with the business, compatible
 IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

with the management decision-making style and culture,

and perceived by business management as providing value.
The board has oversight responsibility for IT governance.
The CAE should ensure that these governance practices
are included in the annual program of audits.

There are several widely recognized IT governance frame-

works that may be used in establishing the criteria for as-
sessing the part of governance related to IT. These include:

ISO 38500 – Corporate Governance of Information Technol-

ogy. This international standard is applicable to all types
and sizes of organizations. It is built around six principles:
Responsibility, Strategy, Acquisition, Performance, Confor-
mance, and Human Behavior.

COBIT 5 – Control Objectives for Information and Related

Technology. The fifth edition focuses on governance activi-
ties that operate at the board and executive level. It is orga-
nized in three domains aligned with ISO 38500: evaluate,
direct, and monitor.

Global Technology Audit Guides (GTAGs) are Internation-

al Professional Practices Framework Practice Guides that
provide detailed guidance for conducting internal audit ac-
tivities. The GTAGs are written in very clear, concise, easy
to understand business language. They provide guidance
for the more detailed parts of an IT governance review.

www.globaliia.org/standards-guidance / 21
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Appendix — Board Risks, Control Objectives, Practices

The overall objective of organizational governance is to inform, direct, manage, and monitor an organization’s activities
toward achievement of its objectives. On behalf of the organization’s key stakeholders, the board is the focal point for
ensuring effective governance.

Following are examples of risks that can be encountered by boards and controls objectives and practices that can be used
to manage them.

Risks/Events Control Objectives Practices

Board members do not have the
required organization, industry,
technical, IT, or other knowledge and
experience.
To fulfill the board’s role and
responsibilities in a complete,
accurate, and timely manner.
There is a sufficient number of outside,
independent members of the board as required
by organization need and applicable laws.
The sufficient number of members and expertise
needed for the board is defined in formal,
specific criteria.

Practices are in place to ensure the right mix of

expertise, skills, and diversity is represented on
the board at all times.

Backgrounds of potential board members are

thoroughly reviewed and validated.

Term limits are strictly enforced to ensure

a regular infusion of new individuals who
bring needed competencies, provide fresh
thinking, and keep governance connected to the
stakeholders.

Members do not understand the role or An orientation and on-boarding and continuous
responsibilities of the board. training is conducted to ensure all members
understand their role and responsibilities.

Failure of board members to The board charter, policies, roles and

adequately fulfill their roles and responsibilities, and procedures are documented
responsibilities. and made readily available.
• Updates are made timely.
• Changes are adequately communicated.

Board members periodically visit the

organization and meet with key leaders.

22 / www.globaliia.org/standards-guidance

Risks/Events
Failure of the board to meet legal
requirements.
Failure of individual board members to
exercise proper due diligence.
Assessing Organizational Governance in the Private Sector
Control Objectives
To meet legal requirements of the
board.
To ensure all board policies,
procedures, and legal requirements
are followed.
IPPF – Practice Guide
Practices
All legal requirements are identified,
communicated and made readily available to
board members.
• Requirements are continuousLY monitored.
• Updates are communicated timely and
adequately.
A parliamentarian is assigned to monitor and
advise on board processes and procedures and
legal requirements.
An agenda is followed and minutes are kept for
all meetings.
Action Dockets or similar methods are used to
track assignments and deadlines.
Calendars are maintained to keep board
members informed of meetings and important
deadlines.
Individual evaluations and board assessments
are conducted at least annually to identify
improvements and necessary member
terminations.
www.globaliia.org/standards-guidance / 23
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector
Risks/Events
Insufficient challenge and skeptical
inquiry is provided by board members.
Unknown or unanticipated
vulnerabilities.
24 / www.globaliia.org/standards-guidance
Control Objectives
To ensure all board members
concerns are identified and
addressed.
To ensure board members
understand the risks to the
organization’s objectives and
the related vulnerabilities of the
organization.
Practices
Robert’s Rules of Order procedures are followed
in all board meetings.
Sufficient time is allocated in all agendas for
open discussion and debate.
The chairman of the board position is held by
an outside, independent member with extensive
experience on other boards.
This is considered a best practice and is
mandated by law in some jurisdictions because
such a person is less likely to be influenced by
relationships with, and the personal interests
of, management, and may be more effective in
challenging executive management actions.
The board regularly interacts with the internal
auditors and the external auditors, at times
outside the presence of management, to ensure
they are allowed to carry out their mandate in an
unrestricted manner.
There are a sufficient number of nonexecutive
directors on the board and attending board
meetings.
Risk assessments conducted by the
organization’s chief risk officer (if one exists),
management, internal audit, or external parties
(e.g. external auditors, regulators, rating
agencies) are provided to board members as
they become available.
Board members conduct their own risk
assessments at least annually to include
scanning the environment for unanticipated
events that may be harmful to the organization’s
reputation.

Risks/Events
Decisions are made or actions taken
based on unreliable, incomplete, or
untimely information.
Failure to meet stakeholder
expectations.
Failure to properly inform key
stakeholders.
Organizational governance structures/
processes/practices are ineffective or
lack sustainability.
Assessing Organizational Governance in the Private Sector
Control Objectives
To ensure the board has reliable,
complete, and timely information.
To ensure primary stakeholder needs
are known by all board members.
To ensure that all mandatory
and optional information is
communicated accurately and
timely to key stakeholders (includes
regulatory agencies).
Ensure an appropriate
organizational governance
framework is in place and operating
effectively.
IPPF – Practice Guide
Practices
All necessary information (e.g., background,
financial impact, risks, and benefits) is provided
to board members in a consistent format with
sufficient time for thorough review before
decisions are made.
Sufficient time is allowed for debate prior to
decisions.
Primary stakeholders are identified and allowed
to vote on board membership.
Surveys are conducted to identify primary
stakeholder needs on a periodic basis.
Primary stakeholders are allowed to attend
meetings and ask questions at appropriate times
during the meeting.
Board reviews and approves all information,
reports, and filings prior to release of information
to key stakeholders.
Board oversight and monitoring of key
organizational activities such as objective
setting, strategies, structures, operating plans
and budgets, operating performance, and
results.
A succession planning process exists for the
organization’s CEO and other key leadership
positions.
Board review and approval of organization
code of conduct, ethical culture, policies, and
procedures.
www.globaliia.org/standards-guidance / 25
IPPF – Practice Guide
Assessing Organizational Governance in the Private Sector

Authors and Reviewers

Authors:
Dean Bahrman, CIA
Amipal Manchanda
James Roth, Ph.D., CIA, CCSA, CRMA
Maria Mendes, CIA, CCSA

Reviewers:
Steven Jameson, CIA, CFSA, CCSA, CRMA, CPA, CFE, CBA, CGMA
James Rose, CIA, CRMA, CPA, CISA, CISSP

26 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120606
 IPPF – Practice Guide

Assessing the
Adequacy of
Risk Management
Using ISO 31000

December 2010
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

Table of Contents

Executive Summary...................................................................................... 1

Introduction ................................................................................................. 1

Risk Management in the Organization........................................................ 2

Internal Auditing and Risk Management..................................................... 5

Internal Audit Review of Risk Management................................................ 6

Obtaining Audit Evidence............................................................................. 8

Assurance of the Risk Management Process............................................. 9

Assessing the Quality of

Risk Management Documentation............................................................. 13

Authors ...................................................................................................... 14

Reviewers & Contributors.......................................................................... 14

www.theiia.org/guidance / B

Executive Summary
Many organizations are moving to adopt consistent and
holistic approaches to risk management and recognize that
risk management is a management process that should be
fully integrated with the management of the organization.
It applies at all levels of the organization — enterprise level,
function level, and business-unit level.
The risk management framework must be designed to suit
the organization: its internal and external environment. For
risk management to be effective, the framework in any or-
ganization, regardless of size or purpose, should contain
certain essential elements. This guide details three ap-
proaches to assurance of the risk management process: a
Process Elements approach; an approach based on Princi-
ples of Risk Management; and a Maturity Model approach.
The assurance process that is used should be tailored to the
organization’s needs.
Internal auditors should have a means of measuring the
effectiveness of risk management in an organization. This
can be achieved by the examination of criteria that reflect
aspects of the risk management process. The criteria used
must be relevant, reliable, understandable, and complete.
The aggregate of the observations should allow the audi-
tor to form a conclusion on the organization’s level of risk
management maturity.
The quality of an organization’s risk management process
should improve with time. Implementing effective risk
management — true ERM — often takes several years. One
of the key criteria that internal auditors should consider is
whether there is a suitable framework in place to advance
a corporate and systematic approach to risk management.
This practice guide uses ISO 31000 as a basis for the risk
management framework. Other frameworks may be used to
1
This is consistent with the International Organization for Standardization’s (ISO’s) definition of risk management, which is “coordinated activities to direct and control an organization
with regard to risk.” (ISO Guide 73:2009 Definition 2.1)
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
perform the risk assessment. This guidance does not imply im-
plicit or explicit endorsement of this or any other framework.
Introduction
Over the last few years, the importance of managing risk
as part of strong corporate governance has been increas-
ingly acknowledged. Organizations are under pressure to
identify the significant business risks they face — social,
ethical, and environmental as well as strategic, financial,
and operational — and to explain how they manage them.
The use of enterprise-wide risk management frameworks
has expanded as organizations recognize the advantages of
coordinated approaches to risk management.
Risk management is defined in the Glossary of the Inter-
national Standards for the Professional Practice of Inter-
nal Auditing (Standards) as “a process to identify, assess,
manage, and control potential events or situations to pro-
vide reasonable assurance regarding the achievement of
the organization’s objectives.”1 A comprehensive risk man-
agement framework provides an end-to-end link between
objectives, strategy, execution of strategy, risks, controls,
and assurance across all levels in the organization.
Enterprise risk management (ERM) — or more properly
enterprise-wide risk management — is a term in common
use. The Committee of Sponsoring Organizations of the
Treadway Commission (COSO) defines it as “a process,
effected by an entity’s board of directors, management
and other personnel, applied in strategy setting and across
the enterprise, designed to identify potential events that
may affect the entity, and manage risk to be within its risk
appetite, to provide reasonable assurance regarding the
achievement of entity objectives.”
ISO 31000 (Section 4.1) states that the success of risk
management “will depend on the effectiveness of the
www.theiia.org/guidance / 1

management framework providing the foundations and
arrangements that will embed it throughout the organiza-
tion at all levels.”2� A risk management framework refers
to the components and organization of risk management
within an entity.
Standard 2120 states “the internal audit activity must
evaluate the effectiveness and contribute to the improve-
ment of risk management processes.” It continues with
the following interpretation.
“Interpretation: Determining whether risk management pro‑
cesses are effective is a judgment resulting from the internal
auditor’s assessment that:
• Organizational objectives support and align with the
organization’s mission;
• Significant risks are identified and assessed;
• Appropriate risk responses are selected that align risks
with the organization’s risk appetite; and
• Relevant risk information is captured and commu‑
nicated in a timely manner across the organization,
enabling staff, management, and the board to carry out
their responsibilities.
The internal audit activity may gather the information to
support this assessment during multiple engagements. The
results of these engagements, when viewed together, provide
an understanding of the organization’s risk management pro‑
cesses and their effectiveness.
Risk management processes are monitored through ongoing
management activities, separate evaluations, or both.”
The starting point for improving an organization’s approach
to risk management should be a gap analysis that takes
stock and evaluates what processes and systems are pres-
ent now. If any of the essential parts are missing, it is high-
ly unlikely that risk management will become effective.
Internal auditors have an important role to play in assessing
2
© ISO. This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the
International Organization for Standardization (ISO). No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI. Copies of this standard may be purchased from  ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org
3
Ibid.
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
and improving risk management in their organizations, and
assessing the organization’s risk management activities is a
critical component in that effort.
This practice guide uses the structure and some of the ter-
minology of ISO 31000. While ISO 31000 is not designed
as a basis for certification, its concepts and structures form
a basis for assessing any risk management process. The ISO
31000 framework is not the only risk management frame-
work in common use, and this guidance does not imply any
endorsement of this particular framework.
Risk Management in the
Organization
Governance
The ISO 31000 Risk Management Standard provides
guidance for the framework of risk management appli-
cable for organizations of any size. ISO 31000 defines
a risk management framework as a “set of components
that provide the foundations and organizational arrange-
ments for designing, implementing, monitoring, reviewing
and continually improving risk management throughout
the organization.”3� The risk management framework, re-
gardless of the level of formality, is inherently embedded
in an organization’s overall strategic and operational poli-
cies and practices. Organizational arrangements include
plans, relationships, accountabilities, resources, process-
es, and activities. The diagram on page 3 (Figure 1) shows
a conceptual model that can be used for analysis of these
arrangements.
The internal auditor should assess whether the frame-
work takes into consideration and defines risk manage-
ment responsibilities and the risk management strategy,
and whether the elements of the framework allow for the
building of a risk-smart workforce and environment while
still allowing for responsible risk-taking and innovation.
www.theiia.org/guidance / 2
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

Mandate
and
commitment

Design of
framework for
managing risk
Continual
improvement Implementing
of the risk
framework management
Monitoring and
review of the
framework

Figure 1 Framework for Managing Risk (ISO 31000)

Responsibilities for Risk Management
The International Organization for Standardization (ISO)
defines risk attitude as an “organization’s approach to as-
sess and eventually pursue, retain, take or turn away from
risk.”4� Management is responsible for setting the organi-
zational attitude regarding risk and the board is respon-
sible for determining whether the risk attitude is aligned
with the best interests of shareholders.
Boards provide governance oversight of ERM and should
understand key elements of ERM, ask management about
risks, and concur on certain management decisions.
Stakeholders should be given sufficient information to un-
derstand the risk attitude of management and the board,
in order to invest in accordance with their tolerances for
potential variation in performance. Organizations com-
municate levels of risk through quarterly and annual re-
ports, press releases, investor calls, etc.
The board has overall responsibility for ensuring that risks
are managed and that there is an adequate risk manage-
ment system in place. In practice, the board will delegate
the operation of the risk management framework to the
management team. There may be a separate function
with specialized skills and knowledge that coordinates
and project-manages these activities, but everyone in the
organization plays a role in ensuring successful enterprise-
wide risk management, and the primary responsibility for
identifying and managing risks lies with management.
Monitoring and Assurance
The application of ERM changes over time. The risk
attitude can change due to internal or external factors,
once-effective risk responses may become irrelevant, and
control activities may become less effective or no lon-
ger be performed. Changes can be brought about by the
arrival of new personnel, changes in entity structure, or

© ISO. This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the Inter-
4

national Organization for Standardization (ISO). No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI. Copies of this standard may be purchased from ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org

www.theiia.org/guidance / 3

introduction of new processes. Furthermore, entity objec-
tives, as well the nature of potential events or conditions
that may affect the achievement of those objectives, will
change. Accordingly, management needs to determine
whether the ERM components continue to be relevant
and able to address new risks.
A critical element of a sound risk management system is
monitoring to ensure it is performing as intended. Moni-
toring can be done in two ways: through ongoing activi-
ties or separate evaluations. This combination of ongo-
ing monitoring and separate evaluations will ensure that
ERM maintains its effectiveness over time.
ERM processes incorporate periodic evaluation of risks
and risk ratings. The greater the degree and effectiveness
of ongoing monitoring, the less the need there may be for
separate evaluations. The frequency of separate evalua-
tions necessary for management to have reasonable as-
surance about the effectiveness of ERM is a matter of
management’s judgment. In making that determination,
consideration is given to the nature and degree of chang-
es, the competence and experience of the people imple-
menting risk responses and related controls, the nature
and significance to the business of the risks that are being
managed and the results of the ongoing monitoring.
Ongoing monitoring is built into the normal, recurring op-
erating activities of an entity. It can be more effective than
separate evaluations, because it is performed on a real-
time basis, reacting dynamically to changing conditions,
and is ingrained in the entity. Problems will often be iden-
tified most quickly by ongoing monitoring processes since
separate evaluations take place after the fact. Some enti-
ties with sound ongoing monitoring activities will none-
theless conduct a separate evaluation of ERM, or portions
thereof. The perceived level of objectivity is greater for
separate evaluations than for self-monitoring.
An entity that perceives a need for frequent separate
evaluations should focus on ways to enhance its ongoing
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
monitoring activities and, thereby, to emphasize “building
in” rather than “adding on” monitoring activities.
The need for assurance arises from the governance pro-
cesses of an organization. Its origin is in the stewardship
relationship between the board of an organization and
its stakeholders. This stewardship relationship positions
boards to establish processes to both delegate and limit
power to pursue the organization’s strategy and direction
in a way that enhances the prospects for the organization’s
long-term success. Assurance processes allow the board
to monitor the exercise of that power.
The internal audit activity will normally provide assur-
ance over the entire risk management process, including
risk management activities (both their design and operat-
ing effectiveness), management of those risks classified
as “key” (including the effectiveness of the controls and
other responses to them), verification of the rigor and reli-
ability of risk assessments, and reporting of the risk and
control status.
With responsibility for monitoring and assurance activities
traditionally being shared among various parties, includ-
ing line management, internal auditing, risk management
specialists, and the compliance function, it is important
that assurance activities be coordinated to ensure re-
sources are used in the most efficient and effective way. It
is common for organizations to have a number of separate
groups performing different risk management advisory,
compliance, and assurance functions independently of
one another. Without effective coordination and report-
ing, work can be duplicated or key risks may be missed or
misjudged.
The chief audit executive (CAE) is directed by Standard
2050 to coordinate activity with other assurance provid-
ers. The use of an assurance map can help achieve this,
offering an effective tool to manage and communicate this
coordination. Practice Advisory 2050-2 provides more in-
formation regarding Assurance Maps.
www.theiia.org/guidance / 4

Internal Auditing and Risk
Management
Standard 2100 states that “the internal audit activity
must evaluate and contribute to the improvement of gov-
ernance, risk management, and control processes using a
systematic and disciplined approach.” The internal audit
activity often has a role providing independent and objec-
tive assurance to the organization’s board regarding the
effectiveness of an organization’s ERM activities. This
helps ensure key business risks are being managed appro-
priately and the organization’s system of internal controls
is operating effectively and efficiently.
Risk management is a management process that pro-
motes the cost-effective achievement of organizational
objectives; assurance provides reliable information about
the achievements of risk management activity. Assurance
and risk management are complementary processes.
In support of the risk management process, internal au-
diting and other independent assurance providers would
assess whether:
• The risk management process has been applied
appropriately and all elements of the process are
suitable and sufficient.
• The risk management process is in keeping with the
strategic needs and intent of the organization.
• All significant risks have been identified and are be-
ing treated.
• Controls are being correctly designed in keeping
with the objectives of the risk management process.
• Critical controls are adequate and effective.
• Review by line management and other nonaudit
assurance activities are effective at maintaining and
improving controls.
• Risk treatment plans are being executed.
• There is appropriate and as-reported progress in the
risk management plan.
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
In support of the assurance process, the risk management
process will:
• Establish an organization-specific, documented risk
management framework.
• Provide a structured analysis of the risks of the
organization recording:
m The organizational objective(s) and their
associated risks.
m Potential exposures and assessments of current
risk.
m The organizational position responsible for
managing each risk.
m The key control systems established to manage
each risk.
It is not uncommon for the internal audit activity of an
organization to work in close cooperation with the risk
management function. Some organizations do not have a
formal risk management function and, in this case, inter-
nal auditing often provides more extensive risk manage-
ment consulting services to the organization. Internal au-
diting may provide risk management consulting, provided
certain conditions apply:
• It should be clear that management remains re-
sponsible for risk management. Whenever internal
auditing consults with the management team to set
up or improve risk management processes, its plan
of work should include a clear strategy and timeline
for migrating the responsibility for these activities to
members of management.
• Internal auditing cannot give objective assurance
on any part of the risk management framework for
which it is responsible. Such assurance should be
provided by other suitably qualified parties.
• The nature of such services provided to the organi-
zation should be documented in the internal audit
charter and be consistent with other internal audit
responsibilities.
www.theiia.org/guidance / 5
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

• Any consulting advice or challenge to (or support Although such advisory and consulting activities can be a
of) management’s decision-making does not involve valuable part of an audit plan, the scope of this Practice
internal auditing making risk management decisions Guide focuses on the assurance activities described on
themselves. the left side of the fan. Such activities can be categorized
The IIA Position Paper “The Role of Internal Auditing in in three primary types:
Enterprise-wide Risk Management” includes the follow- • Assurance on the risk management process itself.
ing diagram that illustrates a range of ERM activities and • Assurance on significant risks and management as-
indicates which roles an effective professional internal au- sertions.
dit function should and should not undertake.
• Follow-up of risk treatment plan status.

Internal Audit Review of Risk Assurance on the Risk Management Process

Management Assurance on the risk management process itself can be
performed to provide reasonable assurance to senior man-
For higher risk areas where management has acknowl- agement and the board that an organization’s risk manage-
edged the need to improve controls, there may be an op- ment program is effectively designed, documented, and
portunity for internal auditing to add value to the organi- operating to achieve its objectives. Potential questions
zation through consulting activities. The middle third of that such assurance should be designed to answer could
audit activities in Figure 2 above represent advisory and include:
consulting activities, delivered at the entity or business • Does the risk management program have adequate
unit/departmental level, in a manner that should maintain commitment from organization management, includ-
internal auditing’s independence and objectivity. ing adequate stature and resources in relation to
M framework
Consolidated rep
Coord

ERM

l
Coa

ova
e nt o f
inatin
c

r
app
hing

developing the ER

hm
g ERM
Fac

te
oard

eti
man

tablis
o
ilit

r ting on r isks

p
ap
ati

b
age

activi
ng

for

isk
i ng e s

s
Re

me
i de

se
r
te gy
v

the
ties

es
ie w

nt i n
nti

ro c
pi o n

stra

g
i ng

fic

ttin

tp
ati
the

r e sp

en

E va
M aintaining and

Cham

s
Se
ERM

isk
on

l ua
m

nr
ge
an

o nd
an

tin o
na
ag

g
nce
i ng
d

the
ma
i ng
em

e va

r ur a
e lo p

e po
en

isk

ass
l ua

to r
to

r tin
gr

E va e nt
D ev
tio
fk

go es
sin
isk s

luat m o ns
ey

fk age
no

i ng r e sp
po

ey
r is

r isk n
Im

isk
fr

r is Ma on r
ks

man
isk

ks
age ns
isio
s

me nt p de c
Giving roce i ng ehalf
assur sse s T ak ent’s b
ance t m
hat r is
on m anage
ks are co
r sp o ns e s
rectly
evalua r isk r e
ted me nting
Giving assurance I m pl e r isk management
o n the r isk manag
ement process A ccountability for

Core internal audit roles Legitimate internal audit Roles internal audit
in regard to ERM roles with safeguards should not undertake

Figure 2 – Internal Audit Role in ERM

www.theiia.org/guidance / 6

risks, and is it an appropriate part of organizational
processes and decision-making?
• Are the risk management framework design and risk
evaluation criteria appropriate for the internal and
external context (environment) of the organization?
• Is there adequate definition and communication of
requirements, risk evaluation criteria, and account-
ability for the development, implementation, and
maintenance of the risk management framework and
specific risk area evaluations?
• Is the risk attitude established at the proper level in
the governance structure of the organization?
• Are internal communication and reporting mecha-
nisms adequate to ensure that key outcomes of the
risk management activities are communicated appro-
priately within the organization (balancing transpar-
ency with sensitivity)?
• Do reports to stakeholders adequately reflect the
organization’s attitude to and treatment of risks?
• Are external communication and reporting mecha-
nisms adequate to comply with relevant legal,
regulatory, corporate governance, and disclosure
requirements?
• Do adequate performance measures and reporting
exist to monitor the design and effectiveness of the
risk management framework?
• Are risk evaluation criteria, appetites, responses, and
escalation/reporting requirements consistently ap-
plied in practice across the organization? Are people
with the appropriate knowledge responsible for risk
identification? Is the current state of risk identifica-
tion adequate?
• Are the risk framework and related processes and
controls modified as business conditions and organi-
zational needs change?
• Are people with the appropriate knowledge respon-
sible for risk analysis, evaluation, and treatment/
response? Are these activities adequately reviewed
and approved?
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
• Are risk treatment plans and status monitored and
adequately communicated with appropriate levels of
management and the board?
Assurance on Significant Risks and
Management Assertions
During all other assurance work where the scope relates
to higher potential exposures identified in an organiza-
tion’s risk management process, audit procedures and
communications should be designed to evaluate manage-
ment’s assertions on the effectiveness of controls in bring-
ing risk within an organization’s risk tolerance threshold.
Reports to management (and the board) can describe the
potential exposure and management’s assessment of cur-
rent risks (with the implied value of the controls in place)
together with the audit evaluation of the risk ratings. Any
differences should be fed into management’s risk man-
agement process for consideration.
The cumulative effect over time of such assurance activi-
ties over specific risk areas in a risk-based audit plan will
provide assurance not only over those specific risk areas,
but serve as assurance of the effectiveness of the overall
risk management process.
Follow-up of Risk Treatment Plan Status
For risk treatment or control remediation plans relating to
higher potential exposures, especially where plans are rel-
atively longer in duration, it may be appropriate to moni-
tor performance against the plan. At a minimum, such
monitoring should be designed to provide management
with an assessment of progress against milestones and
validate risk treatment plan status reports to the board.
In addition, such monitoring can assess the plan struc-
ture, resources, accountabilities, project management,
etc. and provide recommendations and considerations to
enhance the likelihood of plan success.
www.theiia.org/guidance / 7

Obtaining Audit Evidence
In audits of the risk management process of an organiza-
tion, Practice Advisory 2120-1, Assessing the Adequacy of
Risk Management Processes, paragraph 8, states:
“Internal auditors need to obtain sufficient and appropri-
ate evidence to determine that the key objectives of the
risk management processes are being met to form an
opinion on the adequacy of risk management processes.
In gathering such evidence, the internal auditor might
consider the following audit procedures:
• Research and review current developments, trends,
industry information related to the business conduct-
ed by the organization, and other appropriate sources
of information to determine risks and exposures
that may affect the organization and related control
Different techniques can be used to obtain audit evi-
procedures used to address, monitor, and reassess
dence, including:
those risks.
• Review corporate policies and board minutes to
determine the organization’s business strategies, risk
management philosophy and methodology, appetite
for risk, and acceptance of risks.
• Review previous risk evaluation reports issued by
management, internal auditors, external auditors,
and any other sources.
• Conduct interviews with line and senior manage-
ment to determine business unit objectives, related
risks, and management’s risk mitigation and control
monitoring activities.
• Assimilate information to independently evaluate the
effectiveness of risk mitigation, monitoring, and com-
munication of risks and associated control activities.
• Assess the appropriateness of reporting lines for risk
monitoring activities.
• Review the adequacy and timeliness of reporting on
risk management results.
• Review the completeness of management’s risk
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
analysis and actions taken to remedy issues raised by
risk management processes.
• Determine the effectiveness of management’s self-as-
sessment processes through observations, direct tests
of control and monitoring procedures, testing the
accuracy of information used in monitoring activities,
and other appropriate techniques.
• Review risk-related issues that may indicate weak-
ness in risk management practices and, as appro-
priate, discuss with senior management and the
board. If the auditor believes that management has
accepted a level of risk that is inconsistent with the
organization’s risk management strategy and policies,
or that is deemed unacceptable to the organization,
refer to Standard 2600 and related guidance for ad-
ditional direction.”
• Observations — for example, by being present when
risk management is carried out at the different levels
of the organization from the board and all the way
down to individual departments, programs, projects,
and the employees.
• Interviews.
• Document reviews — for example, agendas,
supporting documents and minutes from board,
executive, or other senior management commit-
tees, strategic plans, and supporting documents for
resourcing decisions.
• Results from previous audits.
• Reliance on the work of others.
• Analytical techniques — for example, root cause
analysis of detected faults.
• Process mapping.
• Statistical analysis — for example, analysis of the
types of incident or “near misses.”
• Risk model review and assessment.
www.theiia.org/guidance / 8

• Surveys.
• Analysis of control self-assessment.
Often, a combination of different audit techniques will
be used to gather sufficient information and evidence
to reach a conclusion. The auditor selects the most
appropriate procedure for the audit objective of the
assignment. The auditor also assesses whether sufficient
resources and skills are available to perform all the work
required to provide sufficient support for an opinion. The
auditor considers whether it might be prudent to decline
to express the opinion or to qualify the opinion by exclud-
ing certain areas or risks from the scope of the opinion if
sufficient resources or skills are not available.
The requirement for evidence will vary depending on
the kind of opinion the auditor wishes to render. Posi-
tive assurance provides the highest level of assurance
and normally also requires the most evidence to sup-
port the opinion. Such an opinion implies not only, for
example, whether controls/risk mitigation processes are
adequate and effective, but also that sufficient evidence
was gathered to be reasonably certain that evidence to the
contrary, if it exists, would have been identified.
Negative assurance does not provide as much assur-
ance and therefore normally does not require as much
audit evidence. When rendering negative assurance, the
auditor, for example, states that based on the work done,
nothing came to the auditor’s attention. By rendering
such an opinion, the auditor takes no responsibility for
the sufficiency of the audit scope and procedures to find
all significant concerns or issues. Such an opinion is gen-
erally considered less valuable than positive assurance.
More extensive guidance on opinions can be found in
the Practice Guide “Formulating and Expressing Internal
Audit Opinions.”
These approaches are quoted from HB158:2010 Delivering assurance based on ISO 31000:2009 Risk management — Principles and guidelines, A joint publication of Standards
5
Australia, IIA-Australia, and the IIA Research Foundation. HB158 provides a more extensive discussion of these and other issues.
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
Audit conclusions should be factual, objective, and
backed by sufficient audit evidence. Sufficiency implies
the audit evidence is factual, adequate, and convincing so
that a prudent, informed person would reach the same
conclusions as the auditor. Audit evidence must be
appropriately documented and organized.
The audit activity must not unknowingly provide any level
of false assurance (reference PA 2120-2: Managing the
Risk of the Internal Audit Activity, paragraph 8). “False
assurance” is a level of confidence or assurance based on
perceptions or assumptions rather than fact. In many
cases, the mere fact that the internal audit activity
is involved in a matter may create some level of false
assurance. The scope of internal audit activity involve-
ment may be misunderstood and, consequently, false
assurance may result.
Assurance of the Risk
Management Process
A governing body should be able to determine the extent
to which the risk management process in its organization
meets the needs of the organization and has adopted gen-
erally accepted good practice. Risk management is a criti-
cal component of the system of internal control, so defi-
cient risk management processes are an indicator that the
organization’s system of internal control may be deficient.
It is important that an organization obtains assurance
on its risk management process. This assurance must ac-
commodate the possibility that the internal auditor might
not be functionally independent of the risk management
function. In this case, assurance may be sought from an
external party.
Three forms of assurance process that may be used in
assessing a risk management process are outlined below:5�
www.theiia.org/guidance / 9

• Process elements approach
• Key principles approach
• Maturity model approach
While each form is self-contained, they each offer a differ-
ent perspective on the effectiveness of a risk management
process in an organization. Often, the adoption of more
than one approach can yield the most informative and use-
ful results. The risk management process should be ap-
propriately tailored to the organization, its size, culture ob-
jectives, and risk profile. Therefore, the assurance process
also needs to be tailored to the organization’s needs.
The results of any desk-based review must be validated
by examining whether the risk management framework is
operating effectively in practice. This means that this type
of assurance activity should not be conducted in isolation
and should always accompany or involve normal control-
based assurance that determines whether:
• Risks are being effectively identified and appropri-
ately analyzed.
• There is adequate and appropriate risk treatment and
control.
• There is effective monitoring and review by manage-
ment to detect changes in risks and controls.
Process Element Approach
This approach checks whether each element of the risk
management process is in place. It is essential to validate
management’s expressions of intent through sufficient
audit evidence to substantiate that the element is being
satisfied in practice. Management representation alone
would rarely be sufficient. ISO 31000 identifies seven
components of the risk management process:
• Element 1 – Communication: Sound risk manage-
ment requires structured and ongoing communica-
© ISO. This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the
6
International Organization for Standardization (ISO). No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI. Copies of this standard may be purchased from  ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org.
Ibid.
7
IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000
tion and consultation with those who are affected by
the operations of the organization or activity.
• Element 2 – Setting the Context: The external en-
vironment (political, social, etc.) and internal envi-
ronment (objectives, strategies, structures, ethics,
discipline, etc.) of the organization or activity must
be understood before the full range of risks can be
identified.
• Element 3 – Risk Identification: Identifying the risks
should be a formal, structured process that considers
sources of risk, areas of impact, and potential events
and their causes and consequences.
• Element 4 – Risk Analysis: The organization should
use a formal technique to consider the consequence
and likelihood of each risk.
• Element 5 – Risk Evaluation: The organization
should have a mechanism to rank the relative impor-
tance of each risk so that a treatment priority can be
established.
• Element 6 – Risk Treatment: Sound risk manage-
ment requires rational decisions about risk treat-
ment. Classically, such treatment is to avoid the
activity from which the risk arises, share the risk,
manage the risk by the application of controls, or ac-
cept the risk and take no further action.
• Element 7 – Monitor and Review: Monitoring
includes checking the progress of treatment plans,
monitoring controls and their effectiveness, ensuring
that proscribed activities are avoided, and checking
that the environment has not changed in a way that
affects the risks.
Key Principles Approach
This approach is based on the concept that to be fully
effective, any risk management process must satisfy a
minimum set of principles or characteristics. ISO 31000
www.theiia.org/guidance / 10
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

includes a section (Clause 4) on these principles. An au-
dit based on these principles would assess to what extent
they are true for the risk management process in an orga-
nization:
• Risk management creates and protects value.6�
This implies the application of the most rigorous risk
management when the value at stake is highest. It
also suggests that a range of techniques applicable at
various levels of exposure should be available in the
organization.
• Risk management is an integral part of organi-
zational processes.7� Risk management should not
be seen as an add-on task.
• Risk management is part of decision-making.8
� The more important the decision, the more explicit
this association should be.
• Risk management explicitly addresses uncer-
tainty.9 � Risk assessments would be expected to
document areas of uncertainty and consider how
best to address the uncertainty identified.
• Risk management is systematic, structured,
and timely.10 �
• Risk management is based on the best avail-
able information.11 Obtaining information can be
expensive and the process should provide guidance
on what constitutes sufficient information.
• Risk management is tailored.12� It is not an out-
of-the-box process and must match the operations of
the organization.
• Risk management takes human and cultural
factors into account.13� The processes must be
appropriate to the competence and culture of those
who must use them.
• Risk management is transparent and inclusive.14
There should be appropriate and timely involvement
of stakeholders.
• Risk management is dynamic, iterative, and
responsive to change.15 � The process should be
regularly reviewed and respond to changes in the
organization and its environment so that it remains
relevant.
• Risk management facilitates continual im-
provement and enhancement of the organiza-
tion.16 � Risk management should mature along with
other organizational processes.
Maturity Model Approach
The maturity model approach builds on the assertion that
the quality of an organization’s risk management process
should improve with time. Immature systems of risk man-
agement yield very little return for the investment that has
been made and often operate as a compliance overhead or
an imposition, more concerned with the reporting of risks
than with their effective treatment. Effective risk manage-
ment processes are developed over time, with additional
value being provided at each step in the maturation pro-
cess. This approach provides an assessment of where the
organization’s risk management process lies on the matu-
rity curve, so that the board and management can assess
whether it meets the current needs of the organization
and is maturing as expected.
A key aspect of the Maturity Model approach is the link-
ing of risk management performance and progress in the

8
© ISO.  This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the Inter-
national Organization for Standardization (ISO).  No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI.  Copies of this standard may be purchased from  ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org.
9
Ibid.
10
Ibid.
11
Ibid.
12
Ibid.
13
Ibid.
14
Ibid.
15
Ibid.
16
Ibid. www.theiia.org/guidance / 11
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

execution of a risk management plan to a performance
measurement and management system. The outputs from
such a system can be presented to senior management and
the board as evidence of improvement in risk management.
The components for such a system normally consist of:
• A protocol of performance standards, considering
current approaches to risk management and antici-
pating future strategic needs. Performance standards
are normally supported by a list of more detailed
performance requirements that enable measurement
of any improvement in performance.
• A guide to how the standards and sub-requirements
can be satisfied in practice.
• A means of measuring actual performance against
each standard and sub-requirement.
• A means of recording and reporting performance and
improvements in performance.
• The periodic independent verification of manage-
ment’s assessment.
Clause 4 of ISO 31000 contains a list of practical and
important “principles” that should be the starting point
for any maturity evaluation. These principles address not
only “does the process element or system exist” but also “is it
effective and relevant for your organisation” and “does it add
value.” In fact, the first principle is that risk management
must add value.
Actual performance against each performance standard
is assessed using some system of maturity measurement
that gives credit for intent, but full scores can only be ob-
tained by the complete implementation and practical ap-
plication of the standard. A possible system for measuring
maturity (based on the original idea of Capability Matu-
rity Models developed by the Carnegie Mellon University)
is shown below.

Measure None Very Little Some Good Complete

Meaning Very little or no Only limited Limited compliance Management Absolute compliance
compliance with the compliance with the with element state- completely with the element
requirement in any requirement. ment. Certainly agree subscribes to the statement — in intent
way. Management with the intent, but intent, but there is and in practice — at
supports the intent, limited compliance in partially complete all times and in all
but compliance in practice. compliance in places.
practice is poor. practice.

Figure 3 ‑ Maturity Model – source HB158

www.theiia.org/guidance / 12
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

Assessing the Quality of Risk • Necessary infrastructure for communicating risk

information is in place.
Management Documentation • There are common definitions.
The extent of documentation of an entity’s ERM will vary • There are guidelines for the creation, deletion, and
with the entity’s size and complexity. Larger organizations sharing of risk information.
usually have written policy manuals, formal organization • There are adequate resources assigned.
charts, written job descriptions, operating instructions,
• Technology is cost efficient and used where
information system flowcharts, and so forth. Smaller, less
appropriate.
complex organizations typically have considerably less doc-
umentation. • A proactive approach is taken for monitoring.
• Risk information is part of the planning process.
Many aspects of ERM may be informal and undocument-
• Risk information is integrated with performance
ed and yet can be regularly performed and highly effec-
information.
tive. These activities may be tested in the same ways as
documented activities. The fact that elements of ERM are
These considerations and any decisions made to imple-
not documented does not necessarily mean that it is not
ment activities/processes should be documented. Such
effective or cannot be evaluated. An appropriate level of
documentation may be useful if the statement is subse-
documentation, however, usually makes monitoring more
quently challenged.
efficient. It is helpful in other respects too. It facilitates
employees’ understanding of how the process works and
their particular roles, and makes it easier to make modifica-
tions when necessary.

In deciding to document the evaluation process itself, the

internal auditor will usually draw on existing documenta-
tion of the entity’s ERM processes. Existing documentation
will typically be supplemented with additional documents
prepared by the auditor, including evidence of the tests and
analyses performed in the assessment process. The nature
and extent of documentation normally is more substantive
when statements about ERM are made to other parties.

When management intends to make a statement to exter-

nal parties regarding ERM effectiveness, it should consider
developing and retaining documentation to support the
statement. The internal auditor should consider whether:
• A strategy for managing risk information from all
sources is in place.

www.theiia.org/guidance / 13
 IPPF – Practice Guide
Assessing the Adequacy of
Risk Management Using ISO 31000

Authors
Andrew MacLeod, CIA

Patricia A. MacDonald

Benito Ybarra, CIA

Trygve Sorlie, CIA, CCSA

Brian Foster, CIA

Teis Stokka, CIA

Reviewers and Contributors

Douglas J. Anderson, CIA

Steven E. Jameson, CIA, CCSA, CFSA

James A. Rose, III, CIA

www.theiia.org/guidance / 14
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools The copyright of this position paper is held by The
and techniques, programs, and step-by-step ap- IIA. For permission to reproduce, please contact
proaches, as well as examples of deliverables. The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s Internation-
al Professional Practices Framework. As part of
the Strongly Recommended category of guidance,
compliance is not mandatory, but it is strongly
recommended, and the guidance is endorsed by
The IIA through formal review and approval pro-
cesses. For other authoritative guidance materials
provided by The IIA, please visit our website at
www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 IPPF – Practice Guide

Assisting Small
Internal Audit Activities
In Implementing the
International Standards for
the Professional Practice
of Internal Auditing
APRIL 2011
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Table of Contents

Executive Summary . ..........................................................................................................................3

Introduction........................................................................................................................................4

Definition of a Small Internal Audit Activity ......................................................................................6

Key Challenges Faced by Small Internal Audit Activities in Implementing IIA Standards . ...................6

Guidance for Implementing the Standards .........................................................................................8

Conforming With Standard 1000 – Purpose, Authority and Responsibility .........................................8

Conforming With Standard 1100 – Independence and Objectivity . ....................................................9

Conforming With Standard 1200 – Proficiency and Due Professional Care ......................................11

Conforming With Standard 1300 – Quality Assurance/Improvement Program .................................13

Conforming With Standard 2000 – Managing the Internal Audit Activity..........................................15

Conforming With Standard 2100 – Nature of Work . ........................................................................17

Conforming With Standard 2200 – Engagement Planning ...............................................................18

Conforming with Standard 2300 – Performing the Engagement.......................................................20

Conforming with Standard 2400 – Communicating Results . ...........................................................22

Conforming with Standard 2500 – Monitoring Progress ..................................................................24

Conforming with Standard 2600 – Management’s Acceptance of Risk ............................................25

Reliance on the Work of Small Audit Activities by External Auditors .................................................26

Appendix A – Template to Facilitate Determination of Gaps in Conformance with the Standards.......29

www.theiia.org/guidance / B

Executive Summary
The International Professional Practices Framework
(IPPF) and underlying International Standards for the
Professional Practice of Internal Auditing (Standards) pro-
vide the chief audit executive (CAE) and internal audit
leadership a framework and related guidance to use in
evaluating and ensuring the effectiveness of the internal
audit activity. The Standards also provide internal audit-
ing’s stakeholders a basis for evaluating the activity’s ef-
fectiveness. The Standards are applicable to all internal
audit departments regardless of size, level of resources,
complexity, or objective and scope.
This practice guide provides a working definition of the
term small internal audit activity. The guide acknowledges
the challenges that CAEs and audit leadership in small
audit activities may face in implementing the Standards,
provides suggestions for meeting those challenges, and
discusses the benefits of using the Standards. Many of
the challenges discussed in this guide are not unique to
small audit activities; larger activities may face many of
the same challenges. However, these challenges are more
frequently encountered and more difficult to overcome in
small audit activities.
Although the CAE of a small internal audit activity is re-
sponsible for ensuring implementation of all Standards,
the degree of challenge for conformance to each stan-
dard may vary among small activities. The chart in the
Introduction provides a visual summary of the degree of
challenge that the CAE may face in conforming to the
Standards. The chart is based on informal discussions
with small audit groups and also amongst the members
of The IIA’s committees. Although conformance with the
Standards may pose challenges, it is possible with the de-
velopment of appropriate strategy and planning. The Stan-
dards are principles-based and are meant to be applicable
to internal audit activities of all sizes.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
The CAE of a small audit activity should assess the cur-
rent level of conformance to each standard to determine
gaps in conformance to the overall Standards. (A template
is provided in Appendix A.) Upon identification of gaps,
the CAE should develop a plan to fully conform to the
Standards based on guidance in this practice guide and
other IPPF guidance. It is important for the CAE to in-
corporate elements of the Standards into the internal audit
activity’s vision, mission, and charter. Further, it is critical
that the CAE clearly communicates the activity’s vision,
mission, and charter to key stakeholders.
Introduction
The IIA is pleased to present this practice guide to assist
small internal audit activities in implementing the Inter-
national Standards for the Professional Practice of Internal
Auditing (Standards).
The scope of work performed by today’s practitioners is
broad and varied. There is a heightened need for concise
guidance that can be adopted and followed readily, regard-
less of the industry, audit specialty, or sector. The IIA’s
International Professional Practices Framework (IPPF)
provides practical guidance in the form of Standards,
Practice Advisories, Practice Guides, and Position Papers.
Within the IPPF is mandatory guidance and strongly rec-
ommended guidance. This practice guide is intended to
serve as strongly recommended guidance for use primarily
by small internal audit activities.
This practice guide provides specific examples and lead-
ing practices, relevant to the CAE and audit management
of small internal audit activities, on how to best approach
implementation of the Standards.
www.theiia.org/guidance / 1
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

The guide provides information in the following format:

IIA Standard Definition of each standard

Challenges Likely challenges small internal audit activities face in conforming to The IIA’s Standards.

Guidance Recommended guidance on conforming to The IIA’s Standards.

Small internal audit activities should conform to all IIA standards. Appendix A provides a template for mapping, including
a list of the Standards.

Standard # Standards Title Degree of Challenge

1000 Purpose, Authority, and Responsibility L

1100 Independence and Objectivity H

1200 Proficiency and Due Professional Care M

1300 Quality Assurance / Improvement Program H

2000 Managing the Internal Audit Activity H

2100 Nature of work M

2200 Engagement Planning H

2300 Performing the Engagement H

2400 Communicating Results M

2500 Monitoring Progress M

2600 Management’s Acceptance of Risks M

Indications of likely degree of challenge:

Green – Low degree of challenge
Amber – Medium degree of challenge
Red – High degree of challenge

www.theiia.org/guidance / 2

Definition of a Small Internal
Audit Activity
The views of internal audit practitioners globally vary on
the criteria for defining an internal audit activity as small.
The criteria are affected by the characteristics of the in-
ternal audit activity — role and purpose, maturity, country
and culture, and the global or local nature of the organiza-
tion in which it operates.
For purposes of this guide, several common elements have
been considered as being related to a small audit activity.
Typically, a small internal audit activity will have one or
more of these characteristics:
• One to five auditors.
• Productive internal audit hours below 7,500 a year.
• Limited level of co-sourcing or out-sourcing.
Being small does not equate to being ineffective or under
resourced. In many circumstances, a small internal audit
activity is appropriately structured for the size and risks
attributable to the business it serves.
However, smaller audit activities may have challenges not
typically faced by larger audit activities that have greater
economies of scale.
Key Challenges Faced by
Small Internal Audit Activities in
Implementing IIA Standards
Adequacy of Resources
Limited resources impact the small internal audit activ-
ity’s ability to conform to many IIA Standards. For ex-
ample, the Quality Assurance and Improvement Program
standard that requires internal assessments periodically
and external assessments at least every five years may be
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
difficult to achieve due to inability to fund an external
assessment. Additionally, large investments in innova-
tion or automation for the internal audit activity may not
be permissible within constrained budgets. For each of
the following standards, suggestions are provided to as-
sist the CAE in achieving conformance, despite potential
limitations.
Retention of Qualified Staff or Subject
Matter Experts
Small internal audit activities may have difficulty attract-
ing, hiring, or engaging subject matter specialists (i.e.,
specialists to execute audits that relate to the complex
risks facing the organization). For example, technology au-
dits and audits of specialized industries may be more dif-
ficult to staff adequately if budget constraints are present
or the necessary expertise to perform these audits does
not reside within the department. For the CAE and audit
leadership, recruitment and retention of qualified staff or
specialists is critical as small audit activities often lack the
traditional hierarchies of management staff and attractive
compensation packages associated with larger audit ac-
tivities. Conversely, a small activity may attract more expe-
rienced auditors who would welcome the opportunity to
work with less hierarchy and/or the ability to make more
direct contributions to the audit group.
Independence
Small audit activities also may have challenges with inde-
pendence and objectivity due to the reporting structure
of the activity, newness of the activity, closer associations
with management, weaker organizational governance, and
the existence of additional responsibilities outside of the
core activity.
www.theiia.org/guidance / 3

Guidance for Implementing
the Standards
Conforming With Standard 1000 –
Purpose, Authority and Responsibility
Standard:
The purpose, authority, and responsibility of the internal
audit activity must be formally defined in an internal audit
charter, consistent with the Definition of Internal Audit-
ing, the Code of Ethics, and the Standards. The CAE must
periodically review the internal audit charter and present
it to senior management and the board for approval.1
Challenge:
Degree of Challenge
Conformance with this Standard is not dependent upon
the size of the audit activity and should present no unique
challenges for the small audit activity.
Guidance:
The CAE should discuss the requirement for a charter
with the board and appropriate senior management, thor-
oughly explaining the purpose of the internal audit char-
ter and the benefits provided to the organization from the
charter’s adoption. It is important for the CAE to incor-
porate elements of the Standards into the internal audit
activity’s vision, mission, and charter. Further, it is critical
that the CAE clearly communicate the activity’s vision,
mission, and charter to key stakeholders. The CAE must
periodically (e.g., annually) review and assess the contents
of the charter, and the policies and procedures, to ensure
the content is relevant and continues to add value to the
organization. These reviews must be communicated to the
board and senior management. The board should annually
review and approve the charter. The CAE should maintain
1
For purposes of this Practice Guide, the Interpretations to the Standards, and often the layers of Standards beyond the top one in a category, are not included. The reader is referred to the
full Standards to understand fully the requirements and meanings of each of the Standards, including their introduction, interpretations and glossary.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
documentation of all communications with the board and
senior management pertaining to the internal audit activ-
ity’s charter, policies, and procedures.
Conforming With Standard 1100 –
Independence and Objectivity
Standard:
The internal audit activity must be independent, and in-
ternal auditors must be objective in performing their work.
Challenge:
Degree of Challenge HIGH
Difficulties with reporting levels and organizational struc-
ture are not unique to small internal audit activities. How-
LOW
ever, individual independence and objectivity of auditors
in a small activity, and particularly within a smaller orga-
nization, can be challenged as these auditors may be giv-
en operational responsibility for other activities, such as
records management, compliance activities, IT security,
investor relations, risk management, or other finance and
accounting activities. Additionally, auditors in a smaller
organization often establish closer relationships with other
members of the management team, creating the percep-
tion that a conflict of interest may be present. The depart-
ment’s organizational reporting structure may also impair
its independence or objectivity, depending on the nature
of the reporting relationships. For example, the CAE may
not functionally report to the board or to a member of the
executive team. Instead, the CAE may report to an indi-
vidual who performs, or who has direct responsibility for,
areas that are the subject of audits.
Guidance:
It is imperative that the CAE maintain open communica-
tion with the board and senior management concerning
the importance of auditor independence and objectivity.
www.theiia.org/guidance / 4

The difficulties involved with auditing those areas over
which auditors may have been given operational responsi-
bility should be fully explained. The CAE should present
various alternatives for how those areas might be audited,
including the use of external resources. For example, with
sufficient resources in the internal audit function, only
those auditors who are not directly responsible for the op-
erational area or an outside service provider could perform
the audit, and the results could be communicated to both
the CAE and another member of management external
to the function. If this solution is not practical, then the
impairments and other auditing alternatives should be in-
cluded in the CAE’s risk assessment for the audit plan,
and discussed with the board and senior management.
In organizations where close working relationships are an
expectation, the work of the internal audit function should
always be performed with objectivity and independence in
mind. The CAE or audit leadership should clearly com-
municate to the board and senior management engage-
ment scope and basis for conclusions. The CAE and other
auditors should continue to reinforce the importance of
auditor independence and objectivity (at the organization
or engagement level).
Overall, the CAE should discuss these challenges, as well
as the challenges resulting from organizational reporting
structures, with the board and appropriate level of senior
management. Such communication should be made in
conjunction with establishing the audit plan and more fre-
quently if warranted based on engagements performed or
to be performed. However, the CAE should use caution to
ensure that such communications are not perceived as ex-
cuses or impediments to performing certain audits. When
issuing a report where independence or objectivity could
not be achieved satisfactorily, the CAE has the obligation
to disclose this fact in the audit report including reason(s)
and related impact.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
Conforming With Standard 1200 –
Proficiency and Due Professional Care
Standard:
Engagements must be performed with proficiency and
due professional care.
Challenge:
Degree of Challenge MEDIUM
The challenges faced in conforming to this series of Stan-
dards are compounded in a small internal audit activity with
limited resources as the activity may not be able to hire the
personnel or third-party specialists required to perform the
work (due to budget limitations) or may not be able to in-
vest in training for current staff to gain these skills.
Guidance:
When striving to perform engagements proficiently and
with due professional care, the emphasis is on deploying
qualified resources. Although supervision of engagements
is expected, the CAE should seek auditors with sufficient
experience who may not require extensive supervision.
Additionally, the CAE could also ensure that those audi-
tors with limited experience are performing engagements
commensurate with their experience. Overall, the CAE
should seek resources with experience and knowledge
that are complementary to the skills necessary to execute
the audit plan.
The CAE may need to determine if an internal, external,
or mixed staffing model would best serve the needs of the
internal audit activity and the organization. Opportunities
to leverage other organizational resources may exist. Such
opportunities could allow internal auditing to guide and
supervise the efforts of nonaudit staff members who have
the relevant knowledge and objectivity to perform specific
engagements. In many cases, the nature of engagements
to be performed may imply the need to engage specialists
within or external to the organization.
www.theiia.org/guidance / 5

In addition, the CAE may consider:
• Using a formal process that is well-organized and
documented.
• Seeking guidance from peers.
• Using reference materials such as books, audit
programs, internal control questionnaires (ICQs),
templates, regulatory guides and manuals, etc.
When training resources — either time or funds — are
limited, the internal audit activity should leverage training
that is provided free of cost or low cost (e.g., Web-based
training, local IIA training). The CAE also should ensure
that training attended by one member of the audit activity
is discussed with other members of the activity. The CAE
should maximize the use of the services and resources of
local professional associations and organizations. Oppor-
tunities also may exist to partner with functional groups
within the organization or other internal audit activities in
securing training of mutual interest at competitive rates.
The CAE also may consider reaching out to CAEs of larg-
er internal audit activities in the local area to explore joint
training and to their external auditors to explore technical
accounting/controls training.
Conforming With Standard 1300 —
Quality Assurance/Improvement Program
Standard:
The CAE must develop and maintain a quality assurance
and improvement program that covers all aspects of the
internal audit activity.
1310 - The quality assurance and improvement program
must include both internal and external assessments.
1321 - The CAE may state that the internal audit activity
conforms with the International Standards for the Profes-
sional Practice of Internal Auditing only if the results of
the quality assurance and improvement program support
this statement.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
Challenge:
Degree of Challenge HIGH
Financial resources may limit the ability to perform an ex-
ternal or internal quality assessment (QA) in accordance
with the Standards. The performance of an internal QA
also may be challenging due to time and staff constraints
and lack of suitable independent reviewers.
Guidance:
When scheduling internal assessments, small internal au-
dit activities may need to consider greater involvement of
those with suitable knowledge of internal audit practice.
CAEs oversee such assessments; however, individuals
performing these assessments may also include resources
within the organization who have prior audit experience
or who are specifically trained to perform QAs. Quality
should be integrated into the audit process. For example,
audit review should be embedded as a part of each au-
dit and obtaining feedback from stakeholders through
surveys or documented discussions should be part of the
audit routine. The annual review of audit templates, etc.
also may be part of the internal assessment and improve-
ment program.
The format and length of such assessments should facili-
tate review and completion. The better defined the expec-
tations for components of the internal audit activity, the
extent of documentation, etc., the easier it will be to clear-
ly measure performance against these expectations. Use
of checklists outlining these defined expectations simpli-
fies this internal assessment process. Checklists and tools
available from The IIA’s Quality Assurance Manual sup-
port the timely and cost-effective completion of these as-
sessments.
For the small internal audit activity, internal self-as-
sessments should be performed at least annually. More
frequent self-assessments are encouraged as permissible
by organization or department constraints. These internal
www.theiia.org/guidance / 6

assessments should be documented to help facilitate the
external assessment.
External assessments must be conducted at least once
every five years by a qualified, independent reviewer or
review team from outside the organization. The small in-
ternal audit activity may use external peer organization
reviews to satisfy the above standard. To facilitate such
reviews, the CAE can engage other internal audit activi-
ties of similar size or of similarly sized organizations to
participate in such reviews. Organizations also can coor-
dinate with local IIA chapters/institutes to identify partic-
ipants. For example, four similar-sized organizations may
perform external assessment of each other in a manner
that no two organizations review each other. Arranging
this type of bartered peer review enables the small audit
activity to reduce third-party assessments fees, though
there will be opportunity costs of use of company staff.
The CAE will need to consider the qualifications and in-
dependence of the peer reviewer and appropriateness of
review frequency. Another option for external assessment
is a self-assessment with external validation by an inde-
pendent firm. This is a means to lower the cost.
Finally, the CAE must communicate the results of the
quality assurance and improvement program to senior
management and the board.
Conforming With Standard 2000 –
Managing the Internal Audit Activity
Standard:
The CAE must effectively manage the internal audit
activity to ensure it adds value to the organization. The
interpretation of this standard further provides that the
internal audit activity is effectively managed when:
• The results of the internal audit activity’s work
achieve the purpose and responsibility included in
the internal audit charter.
• The internal audit activity conforms with the
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
Definition of Internal Auditing and the Standards.
• The individuals who are part of the internal audit
activity demonstrate conformance with the Code of
Ethics and the Standards.
Challenge:
Degree of Challenge HIGH
The CAE of a small internal audit activity could have dif-
ficulty demonstrating that the activity adds value to the
organization if the priorities of the department differ from
management’s perspective. If internal auditing’s mission
is focused on auditing the effectiveness of the control en-
vironment, while senior management or the board views
cost recovery efforts to be a better value-added activity,
then conflict can arise.
In addition, if the internal audit activity is overworked,
or is frequently called on to perform ad hoc engagements
at the request of management, the internal audit charter
may not be fulfilled. In this case, internal auditing risks
becoming just another support function within the orga-
nization, and the objectivity and purpose of the activity
can be compromised.
Guidance:
Toward the attainment of the organization’s objectives, it
is important that the internal audit charter clearly sets
forth the mission of the department and that the charter
is endorsed by senior management and approved by the
board. The CAE should invest the appropriate time need-
ed to educate the stakeholders on the purpose of internal
auditing and the value that can accrue to the organization
when governance, risk management and controls are ap-
propriately designed and operating effectively.
The CAE should periodically solicit feedback from key
stakeholders to ensure the activity continues to per-
form value-added audits and that the audit plan remains
aligned with the strategic objectives and key risks facing
www.theiia.org/guidance / 7

the organization (due to proximity with the stakeholder, it
may be easier to solicit feedback in a small internal audit
activity environment). If the internal audit activity’s mis-
sion is aligned with the organization’s strategic objectives,
it is likely that this standard will be met.
Elements of a well-managed function such as risk-based
planning, timely and effective communication to key
stakeholders, well-established policies and procedures,
and effective coordination with other assurance providers
are the same for large and small audit organizations. The
level of formality of these elements varies based on the
needs of the organization and the size of internal auditing.
The factors that resulted in the need for a small internal
audit activity are likely the same factors that allow for less
formality in the method of conformance with the Stan-
dards. The CAE should continue to focus on a risk-based
audit plan that can be supported by available resources.
Also, appropriate communication should be made to the
stakeholders regarding those audit areas that cannot be
accomplished due to resource limitations.
Conforming With Standard 2100 –
Nature of Work
Standard:
The internal audit activity must evaluate and contribute
to the improvement of governance, risk management, and
control processes using a systematic and disciplined ap-
proach.
Challenge:
Degree of Challenge MEDIUM
If the small internal audit activity is operating within a
small organization, the governance, risk, and control pro-
cesses may still be evolving. Internal auditing may be one
of the groups with the skill sets to perform these func-
tions or may have responsibility for many of the functions
supporting governance, risk, and control. Furthermore,
controls may not be adequately designed or may not
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
operate as intended, increasing the risk of the organization
failing to achieve success.
If the small audit activity is operating within a larger or
more established organization, the governance, risk man-
agement, and control processes may be more mature. In
this case, the challenge could shift to ensuring that the
roles and responsibilities of internal auditing are clearly
communicated to avoid duplication of effort among these
processes or gaps in assigning ownership for the processes.
The limited size of the audit activity may make it difficult
for internal auditing to cover all mandated areas in the
2100 section of the Standards.
Guidance:
Whether the small internal audit activity is operating
within a small or large organization, internal auditing is
expected to contribute to the improvement of governance,
risk management, and control processes simply through
the completion of its work.
A clear definition of the roles and responsibilities of the
board, management, and internal auditing with respect to
governance, risk, and control processes would help to en-
sure the appropriate attention and resources are assigned
to those areas. The CAE may include a few questions on
key issues and internal audit roles for discussion with the
audit committee, documenting the response. It is impor-
tant for the internal audit activity to remain focused on
evaluating the effectiveness of these areas, however, as
management remains responsible for designing and im-
plementing effective governance, risk management, and
control processes. The CAE should ensure that consult-
ing engagement objectives are consistent with the overall
values and goals of the organization.
The internal audit activity should use its risk-based audit
approach to ensure adequate focus on all areas mandated
by the Standards. The depth, frequency, and nature of au-
dit work should be modified based on the risk of the area
and available level of resources.
www.theiia.org/guidance / 8
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Conforming With Standard 2200 – onset of an engagement and are specific to underly-
Engagement Planning ing issues triggering it.
Standard: • Defining engagement scope — Identifies techni-
Internal auditors must develop and document a plan for cal requirements, objectives, risks, processes, and
each engagement, including the engagement’s objectives, transactions to be examined. This component also
scope, timing, and resource allocations. considers the nature and extent of testing required.
• Defining engagement audience — Identifies how,
Challenge: when, and to whom engagement results will be
communicated. This includes reporting subsequent
Degree of Challenge HIGH
changes that affect the timing or reporting of en-
gagement results.
A key component of planning is the performance of a
These three components should drive many of the factors
preliminary assessment of the risks relevant to the area
that are considered at the planning stage such as:
under review. Applicable engagement objectives should
reflect the results of the preliminary risk assessment. The
• Engagement duration and key due dates.
ability to perform such an assessment may be impacted
by the skill level of the staff/specialist and time available • Engagement staffing.
to appropriately assess such risks. Additional challenges • Extent of documentation (e.g., for use in recurring
may lie in the degree to which engagement planning is engagements).
formalized and documented.
Engagement scope should specifically consider relevant
risks. To allow small audit activities to gather meaning-
Guidance:
ful information about engagement-specific risks, internal
The CAE should develop planning considerations in the
auditing should leverage the following related to the areas
form of checklists for common engagement types. Clas-
under audit, if available:
sification of engagements on the basis of criteria such as
risk or complexity, number of planned hours, level of staff
• Management’s own risk self-assessments or ques-
assigned to the engagement, and intended audit report
tionnaires for the engagement area.
users/audience may better define degree of formality, de-
tail, and duration of engagement planning. Classification • Management’s related process narratives or flow-
of engagements also may drive who may perform related charts.
planning. • Management’s related internal reporting.
• Information regarding management’s risk tolerances
Three key components of the planning process are:
or appetite (could include SWOT analysis and/or
results of external consulting activities).
• Defining engagement objectives — Identifies the
purpose of the engagement and includes a prelimi- • Internal auditing’s independent risk inventory.
nary assessment of risk. For planned engagements, • Internal auditing’s evaluation of historic internal or
the objectives are aligned with those initially identi- external audit findings.
fied during the risk assessment process and are often
• Internal auditing’s review of prior internal audit
driven by the internal audit plan. For unplanned
reports or working papers.
engagements, the objectives are established at the

www.theiia.org/guidance / 9

• Management surveys that may provide insights.
• Review of the organization’s strategic plan, budget,
regulatory filings, internal management communica-
tions, independent consideration of market/inherent
risks by internal auditing, etc.
• Review of regulatory compliance programs
(e.g., US Sarbanes-Oxley Act) and results where
applicable.
• Others.
The higher the associated risk of an engagement, the
greater the formality and documentation needed to sup-
port engagement planning.
Additionally, development of work program templates
by engagement type will lessen the time staff needs to
complete engagements and will also ensure that engage-
ment objectives are appropriately incorporated into the
work performed. The CAE should revisit such templates
at least annually to ensure that work required is relevant
and appropriate in the context of the audit plan. The CAE
should specifically ensure that sampling methods and req-
uisite analysis supporting engagement execution and con-
clusion are approved before the engagement begins. The
most experienced auditors should lead the completion of
the most complex work programs where possible.
Conforming with Standard 2300 –
Performing the Engagement
Standard:
Internal auditors must identify, analyze, evaluate, and
document sufficient information to achieve the engage-
ment’s objectives.
2340 - Engagements must be properly supervised to en-
sure objectives are achieved, quality is assured, and staff
is developed.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
Challenge:
Degree of Challenge HIGH
The CAE may not be able to supervise all engagements
as he or she may be performing some engagements in ad-
dition to supervising. Additionally, many smaller activities
using manual workpapers may be challenged by the need
to maintain evidence of engagement supervision. Time to
develop staff and related supervisory skills may be lim-
ited. An additional challenge may be that the CAE is so
involved in the engagement that it does not receive suf-
ficient independent review.
The small audit activity also may lack the quantity
and quality of experienced auditors needed to easily iden-
tify sufficient, reliable, relevant, and useful information
to achieve the engagement’s objectives. Additionally,
workload and related challenges may limit staff ’s ability to
base engagement conclusions upon appropriate analy-
ses and evaluations of information during engagement
performance.
Guidance:
Engagement Performance and Review
CAEs are encouraged to take a more involved role in
high-risk or complex engagements performed by internal
auditing.
For complex engagements, the CAE may need to be en-
gaged and oversee the progress of the engagement at rou-
tine intervals or if possible at key stages of engagement
completion. However, within such engagements, it is pos-
sible that more experienced audit staff can review areas of
lower risk and complexity under the CAE’s supervision.
For engagements performed by the CAE that are of lower
risk, review of the CAE’s work by experienced audit staff
within the function may be suitable provided such review
is documented. For complex engagements performed by
www.theiia.org/guidance / 10

the CAE, peer reviews are recommended. The review may
be performed by others in the organization with suitable
audit or alternate professional backgrounds in subject ar-
eas of the audit conducted. However, such reviews are
recommended to be structured and performed so as to not
impair the independence and objectivity of the function.
Additionally, it is recommended that expectations for au-
dit evidence — including types of evidence and related
analysis — to support conclusions be set at the onset of
the engagement. These expectations should be set by the
CAE for complex engagements or by experienced staff
within the function for less complex engagements. The
quality of information gathered or analysis prepared to
support audit conclusions should be evaluated with the
guidance provided for Standard 2340.
Use of experienced staff within the audit function to re-
view the work of less experienced staff may be acceptable
for lower risk and less complex engagements. Within such
engagements, key elements may still warrant CAE review
and consideration; however, such elements are expected
to be a smaller subset of executed engagements. Key ele-
ments of the engagement at minimum should include a
listing of findings and recommendations.
In the context of the above guidance, it is recommended
that the CAE or those assigned to engagement supervi-
sion sign off on engagement working papers to document
evidence of their review. Additionally, it is recommended
that these individuals indicate when such reviews were
performed. Such reviews must be performed timely. The
timeframe will be defined by the nature and purpose of
audits performed and should be established by the CAE
consistent with Standard 2200.
Conforming with Standard 2400 –
Communicating Results
Standard:
Internal auditors must communicate the results of
engagements.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
Challenge:
Degree of Challenge MEDIUM
A small internal audit activity may face challenges in es-
tablishing criteria for issuing communications as required
by Standard 2410. Activities operating with few resources
may find it difficult to issue formal audit reports for each
engagement performed. These activities also may have
limited written guidance for their staff regarding when
such reports must be issued. Challenges also may exist in
context of standards 2420 and 2440, where small inter-
nal audit activities may lack the experienced or sufficient
resources to produce communications that are accurate,
objective, concise, constructive, complete, and timely.
Although engagement communications must conform
to IPPF Standards of Quality, the ability to provide such
communications timely may pose greater challenges for
the small audit activity. Absence of formalized policies to
guide the review and drafting of such communications
may further limit the function’s ability to produce the ap-
plicable communications timely to the appropriate parties.
Additional challenges include maintaining consistency in
evaluating results, assigning levels of importance and pri-
ority, and ensuring timely response on draft reports issued.
Guidance:
To better use the time and limited resources at internal
auditing’s disposal, establishment of engagement specific
reporting should be defined as part of engagement plan-
ning. The Standards should be specifically considered at
the engagement planning stage so that the nature of com-
munication is understood during the execution phase.
The CAE should refer to the Practice Advisories for the
Standards 2420 and 2440 and specifically consider the
following actions to provide quality communications:
Develop guidance for staff on how to draft meaningful
and concise communication.
www.theiia.org/guidance / 11
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Establish department practices to ensure that experi- Guidance:

enced auditors have a common understanding of the re-
quirements of the communication as driven by the CAE
and organization-specific requirements. These practices
should include expected content and format of commu-
nications, guidance regarding to whom the communica-
tions should be addressed, and whether others outside
the function should be consulted before finalization and
release.
CAEs for small internal audit activities should consider
a strategy to prioritize the findings on which to follow-up
(in cases where audit findings are risk ranked or rated, the
same prioritization may be followed). As part of the pro-
cess the CAE should require management representation
that the matter has been addressed appropriately, before
any further audit work. General guidance on prioritization
appears below:

Establish key criteria that must be met by each communi-

Prioritized Audit
cation before being authorized for release by the CAE. It Follow-up
Recommendations Comments
is advised that the CAE establish such criteria in conjunc- Strategy
(Ratings)
tion with the more experienced auditors. This will ensure
that key criteria are agreed upon before the drafting of Internal auditing
such communications and should in turn reduce the time should review and
Validation agree to the reme-
needed for the CAE or designate to review and release
High Risk/Priority by Internal diation plan and
such communications. It is imperative that such criteria Auditing validate its results
not contradict the overall intent of Standard 2400 and re-
at completion.
lated underlying standards.
Internal auditing
Conforming with Standard 2500 – should rely on vali-
dation by business
Monitoring Progress
Medium Self-assess- process owner.
Standard: Risk/Priority ment Remediation plan
The CAE must establish and maintain a system to monitor should be vali-
the disposition of results communicated to management. dated during the
subsequent audit.

Challenge: Internal auditing

should rely on vali-
Degree of Challenge MEDIUM dation by business
Self-assess- process owner
Low Risk/Priority
The challenges faced in conforming to this standard are ment and may consider
validation in the
not unique to small audit activities but are certainly com-
subsequent audit.
pounded in an audit activity with limited resources. Time-
ly follow-up with management regarding agreed upon re-
mediation plans for internal audit findings may be difficult In addition, internal auditing can request firm commit-
to work in if the department work plan does not schedule ments from management when discussing recommenda-
time to accomplish this objective. tions at the end of the audit period (status could be in-
cluded in board reporting). These commitments can serve
as a basis for scheduling follow-up time for high-risk or
high-priority matters. A good productivity tool is a spread-

www.theiia.org/guidance / 12

sheet that lists open issues, owners, due date, a brief sum-
mary of matter, and current status. A better tool could be
an intranet Web-based solution found in many small orga-
nizations that the internal audit activity could use.
Conforming with Standard 2600 –
Management’s Acceptance of Risk
Standard:
When the CAE believes that senior management has ac-
cepted a level of residual risk that may be unacceptable to
the organization, the CAE must discuss the matter with
senior management. If the decision regarding residual risk
is not resolved, the CAE must report the matter to the
board for resolution.
Challenge:
Degree of Challenge MEDIUM
As stated in the Standards, CAEs may have challenges
with maintaining independence and objectivity as audi-
tors and/or the CAE are given operational responsibilities.
In some cases, the CAE might be part of the management
team that has defined the acceptable level of risk. Also, if
internal auditing does not report high enough in the orga-
nization, or if the CAE does not hold a high level of status
by title or level of responsibility, his or her voice on the
acceptable level of risk may not be heard by the manage-
ment team.
Guidance:
The CAE for a small audit activity may consider including
sections in the internal audit charter to describe the reso-
lution process in cases where management disagrees with
internal auditing’s recommendation or acceptable level of
risk. The resolution process should include escalation of
disagreement with management to the board when neces-
sary. In cases where the internal audit charter does not in-
clude any resolution process, the CAE should inform the
board of such matters. In either case, the communication
should be documented.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
The CAE should also review The IIA’s Position Paper
on The Role of Internal Audit in Enterprise-wide Risk
Management. The paper addresses the roles that internal
auditing should not undertake and those that should be
taken with appropriate safeguards.
Reliance on the Work of
Small Audit Activities by
External Auditors
Small internal audit activities are often requested, or di-
rected by their charter, to provide direct assistance to the
external auditors to reduce the cost of the external audit.
The ability of external auditors to rely upon the work of
internal auditing may be limited in circumstances giving
rise to one or all of these conditions:
• Limited independence of the activity based on cur-
rent reporting lines.
• Lack of experience or qualifications within the activ-
ity, this includes inadequate training.
• Limited scope of work of the activity that may not
cover the full scope of the external audit.
Limited independence of the function.
• Although some CAEs may report to the chief execu-
tive officer or the chief financial officer, the formal-
ization of functional reporting to the board may not
have been established. In such cases, documentation
and justification of the internal audit activity’s cur-
rent reporting structure may provide some support
for the external auditor to consider partial or full
reliance on the work of internal auditing.
• Alternatively, in such cases, a small internal audit activ-
ity could work with the external auditor to highlight
how the current reporting structure could be modified
to allow the external auditor to leverage the work of the
function, which in turn may provide greater savings in
external audit completion time and related fees.
www.theiia.org/guidance / 13

• For select audits, small internal audit activities may
want to consider concurrent audit execution with the
external auditors. In such cases, although audit evi-
dence may be jointly evaluated, internal auditing may
lead documentation of audit work. This approach still
may allow partial usage of the audit activity’s work by
the external auditor.
Lack of experience or qualifications within
the function.
• Requirements of staff to attain IIA or equivalent
certifications for internal audit staff may not be met in
light of funding constraints. Staffing the function with
individuals that hold such designations will reduce
future expenditures in this regard.
• Leveraging opportunities to seek group training
amongst other local small internal audit activities may
reduce overall expenditures and provide opportunities
for the staff to obtain continuing professional educa-
tion.
• Retention of evidence supporting completion of train-
ing by the audit staff may provide the external auditor
greater comfort regarding the competency levels of the
activity.
• Formalized review of workpaper documentation by an
individual or individuals with appropriate qualifica-
tions and/or experience might compensate for resourc-
es within the audit activity that might otherwise be
deemed inexperienced or unqualified.
IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards
Limited scope of work of the activity that may
not cover the full scope of the external audit.
• External audit requirements for sampling and nature
and extent of procedures may not correspond to that of
the internal audit activity.
• The Standards encourage collaboration with external
auditing and such collaboration may include discus-
sion of external audit sampling and scoping parame-
ters. Such discussions in advance of audit plan devel-
opment and execution may allow for greater reliance
on the work of internal auditing.
• Sharing the support and basis for the current internal
audit plan, including risks addressed, with the exter-
nal auditor may result in the potential revision of its
planned work.
• For areas of the external audit plan not addressed
by the internal audit plan, consideration should be
given to using suitable noninternal audit organiza-
tion resources to perform additional work under the
supervision of the CAE. Such opportunities should be
discussed with the external auditor and management
and considered in the context of potential time and
cost savings for the external audit.
www.theiia.org/guidance / 14
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Authors:
Princy Jain, CIA, CCSA

Kiko Harvey

Rita Thakkar, CIA

Robert W. Cates, CIA

Reviewers and Contributors:

Maria Mendes, CIA, CCSA

Takeshi Shimizu, CIA, CCSA

Douglas J. Anderson, CIA

James Rose, CIA

Steven E. Jameson, CIA, CCSA, CFSA

www.theiia.org/guidance / 15
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Appendix A –
Template to Facilitate Determination of Gaps in Conformance with
the Standards
Standard # Standard Title Current Status�

1000 Purpose, Authority, and Responsibility

Recognition of the Definition of Internal Auditing, the Code of Ethics, and the
1010
Standards in the Internal Audit Charter

1100 Independence and Objectivity

1110 Organizational Independence

1120 Individual Objectivity

1130 Impairments to Independence or Objectivity

1200 Proficiency and Due Professional Care

1210 Proficiency

1220 Due Professional Care

1230 Continuing Professional Development

1300 Quality Assurance / Improvement Program

Quality Program Assessments(This standard includes 1311–Internal Assessments

1310
and 1312–External Assessments)

1320 Reporting on the Quality Program

1321 Use of “Conducted in Accordance with the Standards”

1322 Disclosure of Nonconformance

† The internal audit activity should self-assess current status on a scale of 1-5 (where 1 is the lowest conformance and 5 being highest conformance). In cases where conformance status is
towards the lower end, the CAE should establish a plan to enhance it.

www.theiia.org/guidance / 16
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Standard # Standard Title Current Status�

2000 Managing the Internal Audit Activity

2010 Planning

2020 Communication and Approval

2030 Resource Management

2040 Policies and Procedures

2050 Coordination

2060 Reporting to the Board and Senior Management

2070 External Service Provider and Organizational Responsibility for Internal Auditing

2100 Nature of work

2110 Governance

2120 Risk Management

2130 Control

2200 Engagement Planning

2201 Planning Considerations

2210 Engagement Objectives

2220 Engagement Scope

2230 Engagement Resource Allocation

2240 Engagement Work Program

2300 Performing the Engagement

2310 Identifying Information

2320 Analysis and Evaluation

2330 Recording Information

2340 Engagement Supervision

2400 Communicating Results

2410 Criteria for Communicating

www.theiia.org/guidance / 17
 IPPF – Practice Guide
Assisting Small Internal Audit Activities
in Implementing the Standards

Standard # Standard Title Current Status�

2420 Quality of Communications

2421 Errors and Omissions

Use of “Conducted in Conformance with the International Standards for the Profes-
2430
sional Practice of Internal Auditing”

2431 Engagement Disclosures of Nonconformance

2440 Disseminating Results

2450 Overall Opinions

2500 Monitoring Progress

2600 Management’s Acceptance of Risks

www.theiia.org/guidance / 18
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools The copyright of this position paper is held by The
and techniques, programs, and step-by-step ap- IIA. For permission to reproduce, please contact
proaches, as well as examples of deliverables. The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s Internation-
al Professional Practices Framework. As part of
the Strongly Recommended category of guidance,
compliance is not mandatory, but it is strongly
recommended, and the guidance is endorsed by
The IIA through formal review and approval pro-
cesses. For other authoritative guidance materials
provided by The IIA, please visit our website at
www.theiia.org/guidance.

Global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
Audit Reports
Communicating Assurance
Engagement Results
 Practice Guide / Audit Reports

Table of Contents
Executive Summary ...................................................................................................................3
Introduction ................................................................................................................................5
Business Significance, Challenges, and Opportunities ...................................................5
Audit Report General Guidelines ...............................................................................................6
Understanding the Stakeholders/Users of Internal Audit Reports ...................................6
Report Content and Structure .........................................................................................7
Report Issuance ..............................................................................................................8
Writing Style Considerations ......................................................................................... 10
The Executive Summary .......................................................................................................... 11
Introduction and Scope of the Internal Audit Engagement ............................................ 12
Internal Audit Engagement Conclusions ....................................................................... 12
Summary of Significant Observations ............................................................................ 12
Repeat Observations from Previous Audits ................................................................... 12
Audit Report Elements ............................................................................................................. 13
Objectives and Scope .................................................................................................... 14
Observations .................................................................................................................. 14
Recommendations ......................................................................................................... 19
Management Action Plans ............................................................................................. 20
Report Review Process ............................................................................................................ 22
Communicating Results ........................................................................................................... 23
Presenting Engagement Results – Types of Communication ........................................ 23
Follow-up Actions Planned by Internal Audit ........................................................................... 24
Appendix A: Key IIA Standards ................................................................................................27
Appendix B: Glossary ............................................................................................................... 31
Appendix C: Audit Report Template ........................................................................................ 33
Appendix D: Audit Report Examples ....................................................................................... 35
Authors/Contributors ................................................................................................................ 44

2
 Practice Guide / Audit Reports

Executive Summary

As the demand for internal audit value shifts from a retrospective view to a forward-looking
perspective, internal auditors are expected to adapt with innovative methods to assess and
communicate internal audit results. Communicating engagement results effectively provides
management the opportunity to take corrective actions in a timely manner.

Timely and proficient communication of internal audit results can increase the effectiveness of
governance and risk management, provide opportunities for process improvements, and
influence positive change. This practice guide focuses specifically on communicating internal
audit results through written reports, and provides guidance on how to:

• Identify the key components of an effective internal audit report or presentation.

• Create and organize an effective written internal audit report.

• Present internal audit engagement results to relevant stakeholders.

• Develop a follow-up process to monitor and report corrective actions taken by

management.

Engagement results may be communicated through a formal presentation or exit interview,

rather than a traditional written internal audit report. The method to communicate results may
vary based on the organizational structure, type of internal audit, and related
recommendations. However, the information communicated should still contain the key
concepts included in this guidance. Guidelines for communicating engagement results should
be established with the board, and senior management.

Through this guidance, the internal auditor will come to consider that:

• Stakeholders have diverse needs. Written reports may be structured for multiple types
of recipients, or more than one type of report may be needed based on stakeholders’
needs

• Effective internal audit communication needs to be accurate, objective, clear, concise,

constructive, complete and timely to be relevant.

3
 Practice Guide / Audit Reports

• The internal audit report must include the objectives, scope, and results of the
engagement.

• Management’s action plans must be included, as they are often the most referenced
segment of the report over time. Ensuring that the tone and expected completion of the
response is in line with the significance and urgency of the issue is important.

• It is important to conduct a thorough review of the content to validate factual accuracy,

completeness of reporting, and ensure the engagement results and conclusions are
supported by sufficient, reliable, relevant, and useful information.

• A concise executive summary may highlight good practices observed during the
engagement and any steps taken by management to improve governance, risk
management, and internal controls (refer to Standard 2410.A2). It is also important to
include straightforward, topical issue descriptions that could be adapted for a senior
management or board presentation as needed.

• The distribution of the report must be validated and approved by the chief audit
executive to ensure it is directed to the intended recipients and disseminated to the
appropriate parties who can ensure that the results are given due consideration.

4
 Practice Guide / Audit Reports

Introduction

Internal auditors must communicate the results of engagements (Standard 2400:

Communicating Results). However, the format, content, and timing of such communications
may vary by organization and engagement type. Agreeing to a communication plan with
stakeholders during engagement planning will help establish how, when, and with whom
interim and final results will be communicated. Written internal audit reports provide a formal
means of notifying senior management, the board, and other stakeholders of audit
observations, related risks, and areas for improvement. Many internal audit activities
communicate engagement results via internal audit reports, which include the engagement's
objectives, scope, applicable conclusions, recommendations, and management’s action plans.
This guidance specifically focuses on communicating assurance engagement results in a
written internal audit report format.

Business Significance, Challenges, and Opportunities

A well-written audit report provides senior management, the board, and other stakeholders a
better understanding of the audited activity’s governance, risk management, and control
processes. It also provides an opportunity to point out the means by which potential impact of
significant risk is kept to an acceptable level and/or acknowledge the engagement client’s
satisfactory performance. In addition, a well-written audit report presents an opportunity to
market the internal audit activity by showcasing internal auditors’ in-depth knowledge of the
organization’s business processes and internal audit’s willingness to partner with management
and provide recommendations for improvement.

Outdated, inaccurate, and poor quality audit reports can discredit the importance of the work
performed by the internal audit activity. When drafting the audit report, internal auditors should
be careful to avoid these potential pitfalls:

• Significant errors and omissions.

• Language that is too technical or filled with too much jargon.

• Observations and recommendations that are not well-formulated.

• Failing to acknowledge satisfactory performance.

5
 Practice Guide / Audit Reports

• Omitting or not explaining the scope limitations.

• Issuing late reports or issuing them to inappropriate parties.

These pitfalls can be avoided through careful preparation and review of the audit report before
it is issued. This practice guide takes into consideration the business significance, challenges,
and opportunities of drafting the audit report.

Audit Report General Guidelines

Understanding the Stakeholders / Users of Internal Audit Reports

Internal audit reports should consider the diversity of the report recipients and their individual
information needs. Report recipients may vary based on the organizational structure, type of
audit, and related recommendations. The CAE should establish guidelines for report
distribution with the board and senior management (such as the chief executive officer (CEO),
chief financial officer (CFO), legal counsel, etc.). Internal audit reports are typically distributed
to the following stakeholders:

• Process owners and management.

• Senior management.
• The board.
• Other stakeholders as deemed necessary (such as external auditors).

According to Standard 2440 – Disseminating Results, “The chief audit executive must
communicate results to the appropriate parties.” A standard distribution list often exists and
should be adjusted based on the particular internal audit engagement. Recipients may include
managers who have direct responsibility for the audited activity and individuals with authority to
take action on internal audit’s recommendations. The CAE (or designee) may coordinate with
management to determine an appropriate distribution list so that due consideration is given to
the results. The final engagement communication and decision to whom and how to
disseminate is ultimately the CAE’s responsibility.

Internal audit reports are confidential documents and distribution should be on a need-to-know
basis. Condensed versions of reports may be created if certain information is to be shared with

6
 Practice Guide / Audit Reports

other entities/units in the organization. Different formats may be created, depending on the
recipient (e.g., the board may receive an executive summary rather than the entire detailed
report).

Also, depending on the industry — such as within the public sector — reports may be publicly
available. In regard to distributing internal audit reports outside of the organization, Standard
2440.A2 states, “If not otherwise mandated by legal, statutory, or regulatory requirements,
prior to releasing results to parties outside the organization the chief audit executive must:
assess the potential risk to the organization; consult with senior management and/or legal
counsel as appropriate; and control dissemination by restricting the use of the results.”

Report Content and Structure

The style and format of written internal audit reports varies across organizations. The internal
audit report structure could be consistent with the organization’s communication templates and
practices, reflect the organization’s culture, and/or incorporate suggestions from senior
management and the board.

According to Standard 2420 – Quality of Communications, “Communications must be

accurate, objective, clear, concise, constructive, complete, and timely.” The content and level
of detail should be determined by the needs of the audience. As such, some organizations
may deem it appropriate to utilize different formats/versions that are customized for the
audience. Consider these questions about the audience(s) when customizing reports:

• Who are the most important readers of the report?

• How much do they know about the audited activity?
• How do they plan to use the report?
• How do the identified issues impact the reader?

The structure of a report often includes the following components:

1) Audit report title.

2) Objective (purpose of engagement).
3) Scope (audited activities, nature and extent of work, scope limitations).
4) Background (brief synopsis of the activity being audited or an explanation of the
process).

7
 Practice Guide / Audit Reports

5) Recognition (positive aspects of area or activity audited or appreciation of

cooperation).
6) Engagement rating (ranking, outcome [i.e., satisfactory, marginal, unsatisfactory,
pass, fail]).
7) Conclusions (summary opinion/assessment of the engagement, often highlighting
critical observations).
8) Observations (also referred to as findings) — each observation should be listed in
order of significance (grouped by activity if applicable) and often include:
a. A title and reference.
b. Criticality rating (measure of risk significance [i.e., high, medium, low, critical,
significant]).
c. Statement of facts (condition, criteria, cause, effect/risk), which can be
substantiated with relevant examples, data, analytics, tables, or charts.
d. Audit recommendations (corrective action to mitigate the risk identified in the
observation).
e. Management’s action plans (corrective action, activity owner, and target date
for completion).
9) Distribution list.

The use of Standard 2430 – Conducted in Conformance with the International

Standards for the Professional Practice of Internal Auditing may be indicated only if
supported by the results of the quality assurance and improvement program.

An audit report template is provided in Appendix C and simplified audit report examples are
provided in Appendix D.

Report Issuance
Engagement results should be communicated according to the agreed communication plan.
Timely communication allows management to take appropriate corrective action. The
appropriate timing of issuing written reports may depend on several factors:

8
 Practice Guide / Audit Reports

• Audit engagement type.

o For regular audit engagements, such as those reflected in the annual internal
audit plan, the CAE establishes the issuance timetable in accordance with
defined policies and procedures. To ensure timely communication of
engagement results and execution of internal audit plans, a good practice is to
issue the draft report within a few days of the exit meetings and the final written
report within two weeks of the draft.
o For special engagements, such as those requested by management outside of
the internal audit plan to address an urgent issue, the issuance of the report
ordinarily takes priority over regular engagements. This is essential to effectively
and efficiently address higher risk situations.
o For complex, lengthy internal audit engagements with multiple audited activities
(such as branches or units with many departments), interim reports or status
updates could be issued upon completion of each audited activity for immediate
consideration of observations and applicable corrective action.

• Interim communication considerations.

o For high-risk observations, it is prudent and typical for the CAE to verbally
discuss items well in advance of the formal written report. In addition to the
verbal discussion, the CAE may also authorize the issuance of an interim report
to management so that action plans can be implemented immediately, prior to
the issuance of the final written report.
o For medium-risk observations, an interim report could be drafted for
management for more timely actions. The final written report could also be
issued following the procedure for regular internal audit engagements on
medium-risk observations.
o For low-risk observations, other alternatives could be considered, such as
verbally reporting the observations to responsible management or issuing a
separate memo to management.

9
 Practice Guide / Audit Reports

• Report recipient.
o As stated previously, ongoing communication (verbal and/or written) should
occur throughout the internal audit engagement with the activity process owners
and management. In addition to interim reports, internal auditors may consider
having management review a draft of observations and recommendations. This
practice helps build a partnership with the organization and reduces engagement
observation errors, misunderstandings, and disagreements.
o Frequency and type of communication to the board varies by organization. Final
written internal audit reports or executive summaries may be provided to the
board at the conclusion of all internal audit engagements. Alternatively, a status
update highlighting recent internal audit results can be scheduled at regular
intervals (e.g., quarterly) or issued on an ad hoc basis. These reports usually
contain the most significant internal audit observations (the executive summary
of the audit report is often sufficient), audit conclusion, and progress of
management’s follow-up.
o Reports to external auditors, other stakeholders, and/or external parties, such as
regulators, can be issued as needed. For example, external auditors and/or
external parties might require a summary of internal audit engagements
completed within a specified time period. Also, government and public sector
internal audit reports may be public record based on the organization’s
geographic location and/or industry and may require a different approach.

The written internal audit report should be issued in a timely manner after the conclusion of the
internal audit engagement and should not contain any surprises.

Writing Style Considerations

When drafting the internal audit report, readers’ needs should be considered. The results
should be presented in an organized way, such as placing observations in chronological order,
by significance, or grouping by topic, cause, or effect/risk. To achieve this, wording that is
simple and relatively free of technical jargon should be used, and sentences should be short
and to the point. Charts, graphs, diagrams, tables, illustrations, and other graphics help to
highlight key messages. The tone of the report should be constructive, not adversarial.

10
 Practice Guide / Audit Reports

The writing style should follow the organization’s protocols for written communications.
Additional guidance can be found in Internal Auditing: Assurance and Advisory Services1,
Sawyer’s Guide for Internal Auditors2, and Clarity, Impact, Speed: Delivering Audit Reports
That Matter.3

The Executive Summary

The stakeholders’ desire to continue reading a report often depends on the impression of the
executive summary, which is designed to provide a clear and concise overview of the
engagement results and efficiently deliver critical information with a persuasive, well-
substantiated key message to stakeholders.

The executive summary generally highlights good practices observed during the audit and any
significant steps taken by management in improving the governance, risk management, and
internal controls of the organization. The summary should not contain technical jargon and
internal audit methodologies. Such information could be referenced in the detailed report if
needed by the reader to obtain a more in-depth understanding of the information presented.
The key components of an executive summary generally include:

• Introduction, objectives, scope, and engagement results.

• Conclusions for the audited activity/processes.
• A summary of significant observations or key messages.
• Concerns encountered with management, relating to establishing corrective actions,
deadlines, and/or situations where the CAE concludes that management has accepted
a level of risk that may be unacceptable to the organization.

1
Kurt F. Reding, et al. Third Edition, p. 14-26
2
The Institute of Internal Auditors Research Foundation (IIARF), vol. 2, pp. 238-277, 2012
3
Sally F. Cutler, The IIARF Handbook Series, 2011

11
 Practice Guide / Audit Reports

Introduction and Scope of the Internal Audit Engagement

The introduction provides basic information about the entity, activity, or process audited. The
scope may indicate the period covered, the type of internal audit being conducted (i.e.,
assurance engagement, advisory/consulting engagement, or follow-up audit), specific risks,
relevant systems, and/or the departments or functions assessed.

Internal Audit Engagement Conclusions

According to Standard 2410.A1, “Final communication of engagement results must include
applicable conclusions, as well as applicable recommendations and/or action plans. Where
appropriate, the internal auditors’ opinion should be provided. An opinion must take into
account the expectations of senior management, the board, and other stakeholders and must
be supported by sufficient, reliable, relevant, and useful information.” Internal auditors’
conclusion of the condition of the audited activity/process helps the reader understand the
significance of the observations. The financial impact caused by the internal control
weaknesses and irregularities also can be used to convey the significance of the observations.
Guidance on internal audit opinions is provided in The IIA Practice Guide “Formulating and
Expressing Internal Audit Opinions.”

Summary of Significant Observations

The executive summary generally contains significant observations or key messages from the
internal audit report and may also include concerns encountered with management relating to
establishing corrective actions. It is often beneficial to include a dashboard that lists the
findings in the form of a table, depicting the number of observations/recommendations per
audited activity, according to their importance.

The key observations can be summarized in a positive manner (focus toward enhancement) or
a negative manner (focus toward weaknesses). Internal audit is encouraged to acknowledge
satisfactory performance when applicable and to show the trend (positive or negative)
compared to prior audits of the same activity.

Repeat Observations from Previous Audits

The executive summary may include repeat observations from a previous audit. Additionally,
information on action plans from previous audits that have not been completed, or have

12
 Practice Guide / Audit Reports

implementation dates that have expired, may also be included. In such cases, it is beneficial to
include historical information on the repeat observations and management’s action plans.

Audit Report Elements

Figure 1 illustrates the process flow of audit report elements.

Figure 1: Information flow of audit report elements.

13
 Practice Guide / Audit Reports

Objectives and Scope

The objectives and scope in the internal audit report should be consistent with the approved
engagement plan. This section typically describes the audit purpose, risks, scope, and scope
limitation, if any. An example is illustrated in Exhibit A, below.

Standard 2410 – Criteria for Communicating states “Communications must include the
engagement's objectives, scope and results.”

Exhibit A: Example of Objectives and Scope

Objectives and Scope

The objective of our audit was to ensure adequate procedures and processes are in
place to properly account for Sportsplex revenue and that all required reports were
submitted by the contractor to the Parks and Recreation management.

This audit included the Sportsplex owned by the City and managed via contractor
through management agreements with the City.

It did not include transactions and activities in other departments or centers under the
Parks and Recreation management (scope limitation).

The audit covered revenue from Calendar Year 2015. Our fieldwork concluded on
February 15, 2016.

Observations
Observations (also referred to as findings), recommendations, and management’s action plans
(responses) make up the core of the written internal audit report. These components enhance
communication between internal auditors and stakeholders, and are linked together as
illustrated in Figure 2, on page 15. The starting point used to develop the observation is
“condition.” The goal is to develop a condition-based and a root cause-based
recommendation/management action plan.

14
 Practice Guide / Audit Reports

Figure 2: Observation, recommendation, and management action plan.

Root cause-based action plans are ideal, as they mitigate the underlying cause of the condition
that triggered the observation. Internal auditors must understand the meaning of condition,
cause, and root cause, as well as related effects and recommendations to develop root cause-
based recommendations. This concept is illustrated in Figure 3, on page 16.

15
 Practice Guide / Audit Reports

Figure 3: Examples of condition, effect, cause, root cause, and recommendation.

Observations include the condition, criteria, cause, effect, and rating. Observations should be
written in such a way that the appropriate party understands and accepts internal audit’s
assessment of the risk, as well as its impact on organizational objectives. Observations should
be supported with evidence, brief and organized, and explain in simple language how the
condition compared to a set of criteria. Recommendations, explained in the next section,
should provide a practical, feasible solution to mitigate the risks identified in the observations,
thereby eliciting a positive response from the engagement client.

16
 Practice Guide / Audit Reports

Observations include the following elements:

• Condition: Factual evidence identified during the course of the engagement (what does
exist). Condition is the key issue the internal auditor considers, and it can be
measurable or observable.
• Criteria: Standards, measures, or expectations used in making an evaluation and/or
verification of an observation (what should exist). Criteria are used to compare and
evaluate the existing condition(s) and can be written policies, procedures, laws,
regulations, and/or guidelines. Criteria can also be established organizational practices,
expectations based on the design of the control, and even common sense procedures
that may not be formally documented and may require internal auditors’ professional
judgment for their evaluation.

Internal auditors must define the suitable criteria, or the benchmark against which the
audited activity will be assessed (refer to Standard 2210.A3 for additional guidance).
Choosing the appropriate criteria enables the internal auditor to reach suitable
conclusions and consequently provide meaningful assurance to senior management
and the board. Examples of appropriate criteria may include:

• Internal (e.g., policies and procedures).

• External (e.g., laws and regulatory requirements).
• Leading practices (e.g., industry best practices, professional guidance, key
performance measures).

To define criteria suitable for the internal audit, it is important to take into consideration
the engagement objectives, which are established by internal audit, based on a risk
assessment of the activity under review (refer to Standard 2210 – Engagement
Objectives).

17
 Practice Guide / Audit Reports

• Cause: Underlying reason for the difference between the criteria and condition (why the
difference exists). It answers the questions “what allows the condition to exist?” and
“why did the condition occur?” It is essential that internal audit work with management to
identify the root cause of the gap.

Merely fixing the issue does not address what caused the issue to exist and does not
improve the overall governance, risk, and control environment. Finding and
appropriately addressing the root cause will reduce (and optimally eliminate) the future
recurrence of the condition.

• Effect: Risk or exposure encountered because the condition is not consistent with the
criteria (the consequence of the difference). In determining the degree of risk or
exposure, internal auditors consider the effect that the engagement observations may
have on the organization’s operations and/or financial reporting process. Effects can be
existing or potential.
o Existing (real) effects are factual and seen as a result of the condition.
o Potential effects are exposures where no real effect has yet occurred or been
found.

In addition to the internal auditors’ observations and recommendations, the identified

risks should be documented in the audit report, along with the impact, to provide clarity
of the issue to the engagement client and stakeholders.

• Rating: Component of the conclusion. It can be an effective communication tool for

delivering the significance of each observation and could assist management with
prioritizing their action plans, and internal auditors with prioritizing follow-up.
Consideration of the individual observation ratings within the report generally impacts
the overall engagement conclusion (as mentioned above in the section entitled “Internal
Audit Engagement Conclusions”). When ratings are used, rating criteria should be
clearly defined and consistently applied across all internal audit reports for assurance
engagements.

For an example of communicating observations, see Exhibit B, on page 19.

18
 Practice Guide / Audit Reports

Exhibit B: Example of Observations

# 1: Revenue Under-reported
Rating: Low
Observation
The 2015 annual report of revenue generated at the Sportsplex did not include
concession revenue and revenue from a partnership, RUSH Soccer, totaling
$242,890. Per the management agreements with the contractor, the contractor is
required to submit an itemized report setting forth the amount of all gross revenue
received by the contractor (Manager) for the previous calendar year and to be
certified by the chief financial officer or chief executive officer of the contractor as to
the accuracy thereof. The itemized report is to include concessions and any other
revenue received by the contractor. As revenues were far from the revenue sharing
threshold levels ($850,000 for the Sportsplex), the revenue reporting process was
rather informal and sense of accuracy was not high. Therefore, the annual report of
revenue was incomplete and under-reported for the calendar year.
The management agreement requires concessions to be reported using the largest of
25% of actual concession revenue or the projected concession revenue.

Recommendations
Recommendations are internal auditors’ suggestions for correcting conditions, and identifying
the cause to prevent recurrence (or the creation of new conditions). Recommendations provide
an efficient and effective way to address the gaps identified between condition and criteria.
Recommendations are divided into two categories — a combination of condition and root-
cause based recommendations may be appropriate, depending upon the particular
observation.

• Condition-based recommendations: Provide an interim solution for correcting the

current condition (e.g., removing inappropriate access).
• Cause-based recommendations: Actions needed to prevent the condition/observation
from occurring again. Root cause-based recommendations are typically longer-term

19
 Practice Guide / Audit Reports

solutions and may involve more time (e.g., creating and implementing an access review
policy).

While many internal audit activities include recommendations in the draft report,
recommendations may be changed to agreed action if aligned with management’s action
plans. For an example of communicating recommendations, see Exhibit C, below.

Exhibit C: Example of Recommendations

Recommendation
Parks and Recreation management should:
1.1 Develop a template for the contractor to use for submitting the annual itemized
revenue report that would include all revenue, especially concessions and
sponsorships.
1.2 Review the annual itemized revenue report submitted by the contractor to
ensure completeness and reasonableness of amounts reported. Any
discrepancies should be immediately resolved with the contractor.

Management Action Plans

In accordance with Standard 2410.A1, recommendations and/or action plans must be included
in the final communication of engagement results. Actions that were initiated by management
during the internal audit engagement, but before the issuance of the written report, can be
acknowledged in the final engagement communication.

Action plans arising from internal auditors’ recommendations have the potential to transform
business processes and help the organization meet its goals. Action plans are effective when
designed and executed in a way that addresses the root cause. Validation with the
engagement client of the action plan(s) is important to assure issues are effectively and
efficiently addressed, while maintaining alignment with the organization’s objectives. Although
internal auditors may be experts in governance, risk management, and internal controls, they

20
 Practice Guide / Audit Reports

cannot assume managerial responsibility for the action plans, or claim to understand the
business better than the engagement client.

A good practice is to create a preliminary draft report (also referred to as an audit

memorandum, observation worksheet, or audit comment referral) as a tool for communicating
with senior and line management to enhance the engagement process. It could include a draft
of the condition, criteria, cause, effect, and recommendations. Such a report can assist in
starting a constructive discussion for finding reasonable solutions (agreed actions), even at
early stages of the internal audit engagement. If the conditions are critical, management may
be able to address the conditions before other areas of the organization are impacted.

Working collaboratively with the internal auditors, management provides action plans based on
internal audit’s observations and recommendations, including:

• Agreed action: The actions that will be taken by management to correct the current
condition and causes, thereby preventing future reoccurrence. Generally,
management’s action plans correlate with internal audit’s recommendations. If
management disagrees with the observation or facts identified by internal audit, further
details can be provided to reach agreement or a sound explanation should be provided
by management for discussion and resolution.
• Responsible personnel: Identifies the person or group responsible for the action. This
may be the activity/process owner, manager, or senior management.
• Due date for action plan: Target date for completing the action plan. The CAE should
ensure the proposed timeline is appropriate based on the level of risk.

If the CAE encounters concerns with management when establishing corrective actions and
deadlines and is unable to resolve the concerns after escalation to senior management, it is
appropriate to discuss the concerns and resolution with the board. These concerns might
pertain to the sufficiency of management’s action plan, the deadline for action, or the
classification or description of the observation. An example of communicating management’s
action plans is shown in Exhibit D, on page 22.

21
 Practice Guide / Audit Reports

Exhibit D: Example of Management’s Action Plans

Action Plan
1.1 A template has been developed and communicated to the contractor requiring
its use to submit revenue reports including all revenue.

1.2 The Director of Parks and Recreation will review annually all revenue reports
submitted by the contractor.
Responsible Personnel
Director of Parks and Recreation
Due Date
April 15, 2016

Report Review Process

As noted in Standard 2440 – Disseminating Results, the CAE is responsible for reviewing and
approving the final engagement communication before issuance. This is an important step to
assure work was performed properly and recommendations align with the organization’s
business objectives.

The CAE reviews and approves the final engagement communication before issuance and
decides to whom and how it will be disseminated so results are given due consideration.
Although the review process will vary depending on the size of the internal audit activity, the
CAE (or designee) should establish a review process for validating report observations.
Depending on the size of the internal audit staff, the review process may include the following
steps:

22
 Practice Guide / Audit Reports

• Review engagement records to ensure:

o The work performed is consistent with the audit scope, engagement objectives,
and Standards (when claiming conformance).
o Observations and recommendations are clearly stated and supported by
sufficient, reliable, relevant, and useful evidence.
• Draft the internal audit report with cooperation from the internal audit team.
• Validate the draft report and forward to the CAE (or designee) for review.
• The CAE (or designee) reviews the draft report and returns the report to the internal
audit team if there are issues requiring clarification.
• The CAE (or designee) authorizes communication of observations to management for
feedback before issuance of the final written internal audit report.
• Upon review and agreement with management’s action plans and target completion
dates, the CAE (or designee) authorizes issuance of the final written internal audit
report.
• The CAE retains overall responsibility for the final engagement communication, even
when delegating review responsibilities.

Communicating Results

An integral and important part of the internal audit engagement is the presentation of the work
performed and the derived results. Consequently, careful preparation is required as the final
audit engagement communication exhibits the work of internal auditors to senior management,
the board, and other stakeholders, and can also be used as a reference for future assurance
and/or consulting engagements. As noted in Standard 2440.A1, “The chief audit executive is
responsible for communicating the final results to parties who can ensure the results are given
due consideration.”

Presenting Engagement Results – Types of Communication

There are Standards requirements regarding communicating results (refer to: Standard 2410 –
Criteria for Communicating, and Standard 2420 – Quality of Communications). However, there
is no definitive model required for the presentation of internal audit engagement results and/or

23
 Practice Guide / Audit Reports

written audit reports. Organizations use many varying formats; but, general guidelines are
applicable for most presentations and reports. Such presentations and/or reports should:

• Ensure the engagement’s objectives, scope, and results are included.

• Be clear, concise, and easy to read and/or understand.
• Contain accurate and complete information that is presented objectively, constructively,
and timely.
• Ensure conclusions and engagement results are supported by sufficient, reliable,
relevant, and useful information based on appropriate analyses and evaluations.
• Link the objective of the work performed with the organization’s strategic objectives.
• Identify and analyze the root cause of the issues to support the recommendations and
actions plans that enhance the business (when applicable).

The means by which final internal audit engagement results and reports are distributed can
also vary; however, they are generally sent through secure email transmission. Oral
presentations in particular during discussion of the observations and recommendations with
the engagement client’s management, are generally presented with the use of hard copy or
printouts.

An audit report template is provided in Appendix C and simplified audit report examples are
provided in Appendix D.

Follow-up Actions Planned by Internal Audit

According to Standard 2500 – Monitoring Progress, “The chief audit executive must establish
and maintain a system to monitor the disposition of results communicated to management.” If
agreed-upon action plans are not acted on by management, there is little value of the internal
audit engagement’s results to the organization. In accordance with Standard 2500.A1, the
chief audit executive must have a monitoring process in place to validate action plans are

24
 Practice Guide / Audit Reports

implemented effectively or confirm that senior management has accepted the risk of not taking
action.

The follow-up on the action plan is performed by the internal audit activity. A best practice is to
create a tracking spreadsheet or system, including the audit observation, action plan,
responsible personnel, and target completion dates. As corrective actions are completed, the
audit observation is closed; an aging analysis is generated for all opened and past due
observations; and communication takes place with management as needed. The tracking and
aging analysis is also a good tool to share with senior management and the board.

Follow-up activities can be performed at specific time intervals, or on an ongoing basis. When
performed at specific time intervals, the CAE may schedule specific assignments in the annual
internal audit plan to perform a follow-up for incomplete or expired action plans from the
previous year(s). When follow-up activities are performed on an ongoing basis, the follow-up
process is usually performed monthly or quarterly and consists of three elements: collecting
information; verifying the completion of the action plan; and reporting results to the
engagement client, senior management, and periodically to the board (under certain
circumstances, reporting to regulators may be required as well).

• Collecting information: Internal auditors charged with the follow-up process must
collect information from management regarding the status of action plans (i.e., those
action plans that are completed, those that are in process, and those that are not yet
implemented — partially or in total — and those that are overdue).
• Verifying completion of action plans: For action plans reported by management as
implemented, internal auditors should verify that the observations and associated risks
originally raised are appropriately mitigated. Verification may be performed for all
completed action plans or on a selective basis, depending on the risk significance.
o In cases where management determines certain action plans are no longer
necessary, the CAE must discuss the matter with senior management. The CAE
must communicate to the board if the matter is not resolved (refer to Standard
2600 – Communicating the Acceptance of Risks).

25
 Practice Guide / Audit Reports

There are several tools in the market that facilitate the follow-up process, allowing internal
audit to utilize workflow from risk assessment, to report delivery, to action plan follow-up. As an
example, workflow could allow the sending of automatic emails when an action plan is nearing
its target completion date. Internal auditors should not lose focus that the main objective of the
follow-up process is to validate that the agreed-upon actions have been implemented and are
working effectively.

26
 Practice Guide / Audit Reports

Appendix A: Key IIA Standards

The International Professional Practices Framework (IPPF) outlines the following International
Standards for the Professional Practice of Internal Auditing pertaining to communicating audit
results.

IIA Standard 2210: Engagement Objectives

Objectives must be established for each engagement.

2210.A3: Adequate criteria are needed to evaluate governance, risk management, and
controls. Internal auditors must ascertain the extent to which management and/or the board
has established adequate criteria to determine whether objectives and goals have been
accomplished. If adequate, internal auditors must use such criteria in their evaluation. If
inadequate, internal auditors must identify appropriate evaluation criteria through discussion
with management and/or the board.

Interpretation

Types of criteria may include:

 Internal (e.g., policies and procedures of the organization).

 External (e.g., laws and regulations imposed by statutory bodies).

 Leading practices (e.g., industry and professional guidance).

IIA Standard 2400: Communicating Results

Internal auditors must communicate the results of engagements.

IIA Standard 2410: Criteria for Communicating

Communications must include the engagement's objectives, scope, and results.

2410.A1: Final communication of engagement results must include applicable conclusions, as

well as applicable recommendations and/or action plans. Where appropriate, the internal
auditors’ opinion should be provided. An opinion must take into account the expectations of
senior management, the board, and other stakeholders and must be supported by sufficient,
reliable, relevant, and useful information.

27
 Practice Guide / Audit Reports

Interpretation

Opinions at the engagement level may be ratings, conclusions, or other descriptions of the
results. Such an engagement may be in relation to controls around a specific process, risk, or
business unit. The formulation of such opinions requires collaboration of the engagement
results and their significance.

2410.A2: Internal auditors are encouraged to acknowledge satisfactory performance in

engagement communications.

IIA Standard 2420: Quality of Communications

Communications must be accurate, objective, clear, concise, constructive, complete, and

timely.

Interpretation

Accurate communications are free from errors and distortions and are faithful to the underlying
facts. Objective communications are fair, impartial, and unbiased and are the result of a fair-
minded and balanced assessment of all relevant facts and circumstances. Clear
communications are easily understood and logical, avoiding unnecessary technical language
and providing all significant and relevant information. Concise communications are to the point
and avoid unnecessary elaboration, superfluous detail, redundancy, and wordiness.
Constructive communications are helpful to the engagement client and the organization and
lead to improvements where needed. Complete communications lack nothing that is essential
to the target audience and include all significant and relevant information and observations to
support recommendations and conclusions. Timely communications are opportune and
expedient, depending on the significance of the issue, allowing management to take
appropriate corrective action.

IIA Standard 2430: Use of “Conducted in Conformance with the International Standards
for the Professional Practice of Internal Auditing”

Indicating that engagements are “conducted in conformance with the International Standards
for the Professional Practice of Internal Auditing” is appropriate only if supported by the results
of the quality assurance and improvement program.

28
 Practice Guide / Audit Reports

IIA Standard 2440: Disseminating Results

The chief audit executive must communicate results to the appropriate parties.

Interpretation

The chief audit executive is responsible for reviewing and approving the final engagement
communication before issuance and for deciding to whom and how it will be disseminated.
When the chief audit executive delegates these duties, he or she retains overall responsibility.

2440.A1: The chief audit executive is responsible for communicating the final results to parties
who can ensure that the results are given due consideration.

2440.A2: If not otherwise mandated by legal, statutory, or regulatory requirements, prior to

releasing results to parties outside the organization, the chief audit executive must:

• Assess the potential risk to the organization.

• Consult with senior management and/or legal counsel as appropriate.

• Control dissemination by restricting the use of the results.

IIA Standard 2500: Monitoring Progress

The chief audit executive must establish and maintain a system to monitor the disposition of
results communicated to management.

2500.A1: The chief audit executive must establish a follow-up process to monitor and ensure
that management actions have been effectively implemented or that senior management has
accepted the risk of not taking action.

IIA Standard 2600: Communicating the Acceptance of Risks

When the chief audit executive concludes that management has accepted a level of risk that
may be unacceptable to the organization, the chief audit executive must discuss the matter
with senior management. If the chief audit executive determines that the matter has not been
resolved, the chief audit executive must communicate the matter to the board.

29
 Practice Guide / Audit Reports

Interpretation

The identification of risk accepted by management may be observed through an assurance or

consulting engagement, monitoring progress on actions taken by management as a result of
prior engagements, or other means. It is not the responsibility of the chief audit executive to
resolve the risk.

30
 Practice Guide / Audit Reports

Appendix B: Glossary4
Assurance services

An objective examination of evidence for the purpose of providing an independent assessment

on governance, risk management, and control processes for the organization. Examples may
include financial, performance, compliance, system security, and due diligence engagements.

Board

The highest level of governing body (e.g. a board of directors, a supervisory board, or a board
of governors or trustees) charged with the responsibility to direct and/or oversee the
organization’s activities and hold senior management accountable. Although governance
arrangements vary among jurisdictions and sectors, typically the board includes members who
are not part of management. If a board does not exist, the word “board” in the Standards refers
to a group or person charged with governance of the organization. Furthermore, “board” in the
Standards may refer to a committee or another body to which the governing body has
delegated certain functions (e.g., an audit committee).

Chief Audit Executive (CAE)

Chief audit executive describes the role of a person in a senior position responsible for
effectively managing the internal audit activity in accordance with the internal audit charter and
the mandatory elements of the International Professional Practices Framework. The CAE or
others reporting to the CAE will have appropriate professional certifications and qualifications.
The specific job title and/or responsibilities of the CAE may vary across organizations.

Consulting services

Advisory and related client service activities, the nature and scope of which are agreed with
the client, are intended to add value and improve the organization’s governance, risk
management, and control processes without the internal auditor assuming management
responsibility. Examples include counsel, advice, facilitation, and training.

4
https://global.theiia.org/certification/Public Documents/Glossary.pdf

31
 Practice Guide / Audit Reports

Engagement

A specific internal audit assignment, task, or review activity, such as internal audit, control self-
assessment review, fraud examination, or consultancy. An engagement may include multiple
tasks or activities designed to accomplish a specific set of related objectives.

Engagement objectives

Broad statements developed by internal auditors that define intended engagement

accomplishments.

Engagement opinion

The rating, conclusion, and/or other description of results of an individual internal audit
engagement, relating to those aspects within the objectives and scope of the engagement.

Internal audit activity

A department, division, team of consultants, or other practitioner(s) that provides independent,

objective assurance and consulting services designed to add value and improve an
organization’s operations. The internal audit activity helps an organization accomplish its
objectives by bringing a systematic, disciplined approach to evaluate and improve the
effectiveness of governance, risk management, and control processes.

Risk

The possibility of an event occurring that will have an impact on the achievement of objectives.
Risk is measured in terms of impact and likelihood.

32
 Practice Guide / Audit Reports

Appendix C: Audit Report Template

Executive Summary
Objectives:
Specific objectives of the internal audit engagement which relate to the engagement client’s objectives.

Scope:
Scope of the engagement in relation to the objectives as mentioned above. Scope and objectives
should be in line with the relevant standards.

Background:
Background information pertinent to the activity under review.

Conclusion:
A summary of outcomes of the engagement as well as a conclusion on the audit objectives.

Internal Audit Opinion:

An audit opinion on the risk and control environment of the process under review.

Management Response:
A detailed action plan will be developed by management to address the engagement observations.

33
 Practice Guide / Audit Reports

Details of the Review

1. OBSERVATION NAME (Risk Impact)

Description of observation, i.e., current situation within the process being

Description
reviewed and explanation of the standards against which the observation is
measured (Condition, Criteria)

State the underlying reason for the difference between the criteria and
Cause
condition

Identify the risks or exposure due to the condition not being consistent with
Effect/Risk
the criteria

Corrective action required to address the gap between the criteria and
Recommendation /
condition
Agreed Action
Person responsible for the action
Responsible Person
Target date for completing the action
Due Date

2. OBSERVATION NAME (Risk Impact)

Description of observation, i.e., current situation within the process being

Description
reviewed and explanation of the standards against which the observation is
measured (Condition, Criteria)

State the underlying reason for the difference between the criteria and
Cause
condition

Identify the risks or exposure due to the condition not being consistent with
Effect/Risk
the criteria

Corrective action required to address the gap between the criteria and
Recommendation /
condition
Agreed Action
Person responsible for the action
Responsible Person
Target date for completing the action
Due Date

34
 Practice Guide / Audit Reports

Appendix D: Audit Report Examples

On the following pages are two simplified audit report examples that show how audit report
components could be included in a written internal audit report:

• The first example is of an audit report for City Parks and Recreation Department.

• The second example is an audit report for ABC Unlimited.

35
 Office of the City Auditor
Audit of Sportsplex Contract
Practice Guide / Audit Reports

Purpose

The purpose of this audit was to ensure compliance of the contractor with the Sportsplex contract terms
with a focus on payments due from the Contractor to the City. This audit was requested by department
management through the annual risk assessment process performed by the City Auditor’s Office.
 
Objectives and Scope

The objective of our audit was to ensure adequate procedures and processes are in place to properly
account for Sportsplex revenue and that all required reports were submitted by the contractor to the
Parks and Recreation management.

This audit included the Sportsplex owned by the City and managed via contractor through management
agreements with the City.

The scope did not include transactions and activities in other departments or centers under the Parks
and Recreation management (scope limitation).

The audit covered revenue from Calendar Year 2015. Our fieldwork concluded on February 15, 2016.
 
Acknowledgements

We would like to thank the management and staff of the Parks and Recreation Department and the
management of Hometown Sports Management for their courteous and prompt assistance during our
audit.

Conclusion

Overall, based on the results of our audit, the contractor, Hometown Sports Management, has complied
with the terms of the Management Agreement with the City over the Sportsplex. We do note the
revenue reporting process can be enhanced to improve accountability by implementing our
recommendations related to the reporting all revenue and the submission of required management
reports to the City.

Background

In April 2009, the City executed two contracts (Management Agreements) with Hometown Sports
Management (HSM), LLC for a 16-year lease term to 2025. HSM is responsible for the supervision,
management, and routine maintenance and repairs of the facilities and parking lots. HSM is also
responsible to conduct at least 35 events per calendar year at each facility. Parks and Recreation
provides the agreement administration and management. Among the terms of the contracts is the
requirement that HSM will share 5% of annual gross revenue above $850,000 for the Sportsplex with
the City.

36
 Office of the City Auditor
Audit of Sportsplex Contract
Practice Guide / Audit Reports

Observations and Recommendations

# 1: Revenue Under-reported
Rating: Low
Observation
The 2015 annual report of revenue generated at the Sportsplex did not include concession revenue and
revenue from a partnership, RUSH Soccer, totaling $242,890. Per the management agreements with
the contractor, the contractor is required to submit an itemized report setting forth the amount of all
gross revenue received by the contractor (Manager) for the previous calendar year and to be certified
by the chief financial officer or chief executive officer of the contractor as to the accuracy thereof. The
itemized report is to include concessions and any other revenue received by the contractor. As
revenues were far from the revenue sharing threshold levels ($850,000 for the Sportsplex), the revenue
reporting process was rather informal and sense of accuracy was not high. Therefore, the annual report
of revenue was incomplete and under-reported for the calendar year.
The management agreement requires concessions to be reported using the largest of 25% of actual
concession revenue or the projected concession revenue.
Recommendation
Parks and Recreation management should:
1.1 Develop a template for the contractor to use for submitting the annual itemized revenue report
that would include all revenue, especially concessions and sponsorships.
1.2 Review the annual itemized revenue report submitted by the contractor to ensure completeness
and reasonableness of amounts reported. Any discrepancies should be immediately resolved with
the contractor.
Action Plan
1.3 A template has been developed and communicated to the contractor requiring its use to submit
revenue reports including all revenue.

1.4 The Director of Parks and Recreation will review annually all revenue reports submitted by the
contractor.
Responsible Personnel
Director of Parks and Recreation
Due Date

April 15, 2016

37
 Office of the City Auditor
Audit of Sportsplex Contract
Practice Guide / Audit Reports

# 2: Reported Revenue does not meet Projected Revenue

Rating: Low
Observation
The revenue during the 2015 calendar year did not meet the projected revenue stated in the
management agreements with the contractor. The contractor stated that the combination of the
downturn in the economy and the departure of the City’s baseball team were some key factors
impacting revenues. As a result, revenue realized fell short of the revenue sharing threshold.

Recommendation
Parks and Recreation management should:
2.1 Continue to work with the contractor to ensure the Sportsplex facility realizes maximum revenue
potential.

Action Plan
2.1 A process is being developed to provide insight to how the contractor is being managed. A report
will be created to submit to the Director of Parks and Recreation for quarterly review.

Responsible Personnel
Director of Parks and Recreation

Due Date

April 15, 2016

38
 Practice Guide / Audit Reports
ABC Unlimited Internal Audit
Internal Audit report
29 April 2016
Treasury Function Audit

Objectives and Scope

The audit covered the treasury function of ABC Unlimited. The scope included evaluating the following
processes: electronic bank account access administration, bank account reconciliation, bank and
general ledger accounts monitoring and reporting, daily borrowing requirements, and credit line
availability.

Process / assessment Treasury Function – Red

Background

The treasury function experienced an unusually high turn-over rate in FY2015. Treasury management
was not fully staffed which created a lack of segregation of duties.

Opinion

The audit was rated Red due to significant issues identified with the contract management process.

Additional opportunities for improvement were noted in management of bank account access and the
monthly bank reconciliation process.

We would like to thank management for its positive attitude and the support we received during our
work.

Summary of observations

Ref Title Criticality

A.1 Insufficient Contract Management Process Critical
A.2 Bank Account Access Controls Lacking Significant
A.3 Inadequate Bank Reconciliation Process Significant

Response

Francis Financial and Miguel Money should provide an update by 30 May 2016. The “Latest update” of
the response section should be completed for this purpose.

39
 Practice Guide / Audit Reports
ABC Unlimited Internal Audit
Internal Audit report
29 April 2016
Treasury Function Audit

OBSERVATIONS, RECOMMENDATIONS AND MANAGEMENT RESPONSE

Reference (A.1) Insufficient Contract Management Process

Criticality Critical
Observation
Formal documentation regarding the contract expiration tracking and renewal process, as
well as ABC Unlimited’s responsibilities with regard to this process, could not be provided at
the time of this audit.

While the credit line contract appears to have been renewed at the expiration of the
previous term, should those currently involved in the renewal process be unavailable for
future renewals, access to the company’s credit line through the bank could be at risk.

Recommendation
Management should formally document the process for tracking the credit line contract
expiration and renewal process through use of Standard Operating Procedure (SOP)
documents.

Appropriate personnel should be tasked with tracking contract expiration, coordinating

internal contract renewal processes, and maintaining and archiving documentation as
necessary. Additionally, it is recommended that SOPs be reviewed and updated at least
annually.

Planned action
In CY2017, the Company will be updating its Strategic Plan, which will be the catalyst and
framework for developing our strategic financial plan, which will define, among other things,
target capital structure, sources of capital, funding requirements over the next three years,
and the like. On this basis we will then engage the bank in advance (typically one year
ahead) of the expiration of our current facility, to begin planning for the marketing and
execution of our new facility.

Responsible Francis Financial, CFO

Target date 01 December 2016

Latest update

40
 Practice Guide / Audit Reports
ABC Unlimited Internal Audit
Internal Audit report
29 April 2016
Treasury Function Audit

Reference (A.2) Bank Account Access Controls Lacking

Criticality Significant
Observation
Control deficiencies were identified related to bank account access as follows:
Terminations of employment and position transfers for users with bank account access are
not communicated to bank account security administrators as 20.9% (9 out of 43) of users
with bank account access were terminated or transferred without adjustments being made
to their account access privileges. A user was also given access to generate reports for a
bank account the user had no business reason to access.
Additionally, it is not currently the practice of ABC Unlimited to recover the bank access
account tokens upon termination of employment or transfer to a new position. This
combination of factors could result in unauthorized access to company accounts as
terminated associates or associates transferring to new positions retain both the system
login credentials and bank access token required to access company accounts.
While the accounts where terminated or transferred associates retained access were not
accounts where company funds could be directly funneled outside the organization, those
with access could process unauthorized fund pulls from customer accounts. This could
result in losing customer accounts and reduced customer confidence in the organization.

Recommendation
Management should establish a process where Treasury is notified immediately when
associates with bank account access are terminated or transferred to new positions within
the organization. This will help reduce the risk of unauthorized account access and will aid
Treasury in maintaining bank access entitlements.
A review of the bank access entitlements of all users should be performed annually.

Planned action
Management agrees there needs to be greater communication between Treasury, Credit
and Human Resources to ensure that all employees with banking access are current
employees with roles in the AR/Credit area. Treasury will establish a one over one (preparer
and approver) control process to review current users on a quarterly basis and will establish
a practice of turning over their token ID to their supervisor at their respective location.

Responsible Miguel Money, Controller

Target date 30 June 2016

Latest update

41
 Practice Guide / Audit Reports
ABC Unlimited Internal Audit
Internal Audit report
29 April 2016
Treasury Function Audit

Reference (A.3) Inadequate Bank Reconciliation Process

Criticality Significant
Observation
Monthly reconciliations were not being completed regularly and completely.

Upon review of the bank account reconciliations, the following issues were noted:

• 75% (12 of the 16) reconciliations did not contain the date the reconciliation was
completed.
• 19% (3 of the 16) reconciliations contained only a screen print of account balances
but were not reconciled against bank data.
• 81% (13 of the 16) reconciliations were not reconciled one or more months within
the current fiscal year.
• 31% (5 of the 16) reconciliations contained unreconciled balances aged greater than
30 days.

By not completing monthly reconciliations regularly, inaccuracies, errors, fraud, or other

issues may go undetected.

It was also noted that the Manager Treasury Operations performs many of the
organization’s bank account reconciliations. Proper segregation includes separation of
custody, recording, and reconciliation responsibilities. As the Manager Treasury Operations
is the administrator for the organization’s bank accounts with direct access to company
funds, duties are not adequately segregated within the Treasury function (both custody and
reconciliation responsibilities).

Recommendation
Management should ensure reconciliations are performed each month and that reconciling
items are resolved within 30 days of being identified. This will help ensure that bank and
account accuracy is properly maintained.
The responsibilities of custody and reconciliation of company funds must be segregated.
This can be achieved by giving the bank account reconciliation responsibilities to an
associate without bank account access. Segregating these responsibilities will help ensure
that fraud risk is better controlled within the organization.

Planned action
Management agrees that monthly bank reconciliations as well as the resolution of any
outstanding issues are important in fraud prevention. A project is currently in process for the

42
 Practice Guide / Audit Reports
ABC Unlimited Internal Audit
Internal Audit report
29 April 2016
Treasury Function Audit

cash deposit accounts to better establish procedures and processes to ensure that the daily
cash applications result in a more timely and seamless reconciliation.
Management realizes the importance of segregation of duties in regard to the Manager of
Treasury reconciling accounts as well as having administrative rights over accounts.
However, given the number of people in the department with three of the four employees
being cash application employees, it is difficult to have true segregation of duties but more
of a preparer/reviewer process. Management recommends documenting the reconciliation
process and will train employees to perform reconciliations on the deposit accounts only. All
reconciliations will have a final review process performed and signed off and dated by the
Director of Financial Shared Services , as well as having all reconciling items and disputes
resolved within 30 - 45 business days after the end of the month.

Responsible Miguel Money, Controller

Target date 15 July 2016

Latest update

Staffing and timing

ABC Unlimited Audit Team:

Closing presentation: The closing presentation was held on 15 April 2016.

Distribution

Board members:
External auditors:
Francis Financial, CFO
Miguel Money, Controller
Susie Smarty, CAE

43
 Practice Guide / Audit Reports

Authors/Contributors

Listed in alphabetical order:

Brad Ames, CRMA

Fabiano Castello, CIA, CCSA, CRMA
Despoina Chatzaga, CIA, CCSA, CFSA
Caroline M. Glynn, CIA
Judy Grobler, CIA, CRMA
Sara Lademan, CIA
Takuya Morita, CIA
Ranjit Singh, CRMA

44
 Practice Guide / Audit Reports

About The IIA

The Institute of Internal Auditors (The IIA) is the internal audit profession’s most widely recognized advocate, educator,
and provider of standards, guidance, and certifications. Established in 1941, The IIA today serves more than 185,000
members from more than 170 countries and territories. The association’s global headquarters are in Altamonte
Springs, Fla. For more information, visit www.globaliia.org or www.theiia.org.

About Supplemental Guidance

Supplemental Guidance is part of The IIA’s International Professional Practices Framework (IPPF) and provides
additional recommended (non-mandatory) guidance for conducting internal audit activities. While supporting the
Standards, Supplemental Guidance is not intended to directly link to achievement of conformance with the Standards.
It is intended instead to address topical areas, as well as sector-specific issues, and it includes detailed processes and
procedures. This guidance is endorsed by The IIA through formal review and approval processes.

Practice Guides
Practice Guides are a type of Supplemental Guidance that provide detailed guidance for conducting internal
audit activities. They include detailed processes and procedures, such as tools and techniques, programs,
and step-by-step approaches, as well as examples of deliverables. As part of the IPPF Guidance,
conformance with Practice Guides is recommended (non-mandatory). Practice Guides are endorsed by The
IIA through formal review and approval processes.

A Global Technologies Audit Guide (GTAG) is a type of Practice Guide that is written in straightforward
business language to address a timely issue related to information technology management, control, or
security.

For other authoritative guidance materials provided by The IIA, please visit our website at
www.globaliia.org/standards-guidance or www.theiia.org/guidance.

Disclaimer
The IIA publishes this document for informational and educational purposes and is not intended to provide definitive
answers to specific individual circumstances. As such, is only intended to be used as a guide. The IIA recommends
that you always seek independent expert advice relating directly to any specific situation. The IIA accepts no
responsibility for anyone placing sole reliance on this guidance.

Copyright
Copyright ® 2016 The Institute of Internal Auditors.
For permission to reproduce, please contact guidance@theiia.org.

October 16

45
 – Practice Guide

AUDITING
››

ANTI-BRIBERY AND
››

›› ANTI-CORRUPTION PROGRAMS
››

JUNE 2014
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Table of Contents

Executive Summary..................................................................................................................1

Introduction.............................................................................................................................1

Global Landscape....................................................................................................................3

Effective Anti-bribery and Anti-corruption Programs and the Role of Internal Audit.................5

Risks, Red Flags, and Audit Activities....................................................................................11

Appendix 1: Comparison of Legislation in Select Countries....................................................17

Appendix 2: Internal Controls: Update Based on COSO Elements...........................................18

Appendix 3: Sample Audit Procedures....................................................................................18

Appendix 4: References..........................................................................................................20

www.globaliia.org/standards-guidance / iii

Auditing Anti-bribery and Anti-corruption Programs
Executive Summary
Increasing globalization, legal complexities, and the po-
tential for serious financial and reputational harm have
made the risks of bribery and corruption, and audits of
anti-bribery and anti-corruption programs, top corporate
issues. Auditing anti-bribery and anti-corruption programs
requires a team of auditors with collective skills, knowl-
edge, and expertise in compliance, fraud, investigations,
regulatory affairs, IT, finance, culture, and ethics.
On the global front, the U.S. Foreign Corrupt Practices
Act (FCPA) and the U.K. Bribery Act are examples of
strict legal regulations, each with far-reaching interna-
tional implications. And evolving anti-bribery and anti-
corruption legislation in China, Hong Kong, India, and
other countries (see page 17) is further complicating the
matter. Private and public sector organizations are in-
creasing awareness of bribery and corruption exposures
and fighting back through international accords, regional
conventions, best practice guides, and information on per-
ceptions and instances of bribery and corruption.
Anti-bribery and anti-corruption legislation has led to
the development of organizational anti-bribery and anti-
corruption programs with well-defined components,
including tone at the top/governance structure, risk as-
sessment (including third-party due diligence), policies
and procedures, communication and training, monitoring
and auditing, reports and investigations, enforcement and
sanctions, and reviews and updates. Internal auditors in
organizations with formal anti-bribery and anti-corruption
programs have the opportunity to assess the effectiveness
of each component and how all of the components work
together to deter, curtail and detect bribery and corrup-
tion.
Internal auditors in organizations with non-existent or in-
formal anti-bribery and anti-corruption programs have the
opportunity to help their organizations establish a baseline
by identifying and investigating red flags in high-risk areas
IPPF – Practice Guide
such as third-party relationships, gifts and entertainment,
political contributions, and procurement. Audit observa-
tions in these and other areas can be leveraged by the or-
ganization to prioritize its anti-bribery and anti-corruption
initiatives as input to developing and sustaining a formal
anti-bribery and anti-corruption program.
Auditing anti-bribery and anti-corruption programs re-
quires varying levels of collaboration and information
sharing with other governance functions such as regula-
tory compliance, external auditors, investigators, and the
governing board. Before getting started, the chief audit ex-
ecutive (CAE) or lead internal auditor should consult with
the organization’s general counsel or legal representative
to gain a full understanding of potential legal implications
of the audit scope, fieldwork, and findings.
Introduction
In 2009, The IIA released Internal Auditing and Fraud,
a practice guide designed to increase internal auditors’
awareness of fraud and provide guidance on how to ad-
dress fraud risks on internal audit engagements. As de-
scribed in the practice guide, corruption is one of several
common fraud schemes and bribery is a form of corrup-
tion. This practice guide complements Internal Auditing
and Fraud by providing specific guidance for assessing the
effectiveness of an organization’s system of internal con-
trol for bribery and corruption. Other related IIA guidance
includes the following Practice Guides: Reliance by In-
ternal Audit on Other Assurance Providers and Auditing
the Control Environment. As well, the IIA’s Audit Execu-
tive Center has published a Knowledge Briefing entitled
Internal Auditing and the Foreign Corrupt Practices Act
(membership required).
Business Significance
Organizations that ignore the potential impacts of bribery
and corruption do so with peril. Regardless of the country,
industry, or type of organization, global reach brings global
www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

risk. Each region, government, and project has unique
complexities, variables, and opportunities for bribery and
corruption. However, risks have traditionally been greater
for organizations in certain geographies and industries.
Related Risks
Bribery and corruption put businesses and governments
at risk worldwide and affect organizations, private indi-
viduals, and officials. Bribery and corruption are found
in private and public sector transactions and in dealings
between the two. In fact, bribery and corruption have be-
come major issues in the public sector and are especially
worrisome when associated with government appoint-
ments. Bribery and corruption expose organizations to
risks in achieving operations, reporting, and compliance
objectives, and may result in:
• Stifled market competition.
• The impediment of economic growth.
• Barriers to improved standards of living.
• Compromised product quality.
• Higher prices.
• Diminished trust.
• Discouragement of foreign direct investment.
Related IIA Standards
The International Professional Practices Framework
(IPPF) outlines the following International Standards for
the Professional Practice of Internal Auditing (Standards)
pertaining to fraud (inclusive of bribery and corruption).
Standard 1200: Proficiency and Due
Professional Care
1210.A2 – Internal auditors must have sufficient knowl-
edge to evaluate the risk of fraud and the manner in which
it is managed by the organization, but are not expected to
have the expertise of a person whose primary responsibil-
ity is detecting and investigating fraud.
Standard 1220: Due Professional Care
1220.A1 – Internal auditors must exercise due profes-
sional care by considering the:
• Extent of work needed to achieve the engagement’s
objectives;
• Relative complexity, materiality, or significance of
matters to which assurance procedures are applied;
• Adequacy and effectiveness of governance, risk
management, and control processes;
• Probability of significant errors, fraud, or noncompli-
ance; and
• Cost of assurance in relation to potential benefits.
Standard 2060: Reporting to Senior
Management and the Board
The chief audit executive must report periodically to se-
nior management and the board on the internal audit ac-
tivity’s purpose, authority, responsibility, and performance
relative to its plan. Reporting must also include significant
risk exposures and control issues, including fraud risks,
governance issues, and other matters needed or requested
by senior management and the board.
Standard 2120: Risk Management
2120.A2 – The internal audit activity must evaluate the
potential for the occurrence of fraud and how the organi-
zation manages fraud risk.
Standard 2210: Engagement Objectives
2210.A2 – Internal auditors must consider the probability
of significant errors, fraud, noncompliance, and other ex-
posures when developing the engagement objectives.

2 / www.globaliia.org/standards-guidance

Auditing Anti-bribery and Anti-corruption Programs
Definitions of Key Concepts
Board — the highest level of governing body charged with
the responsibility to direct and/or oversee the activities
and management of the organization. Typically, this in-
cludes an independent group of directors (e.g., a board of
directors, a supervisory board, or a board of governors or
trustees). If such a group does not exist, the “board” may
refer to the head of the organization. “Board” may refer
to an audit committee to which the governing body has
delegated certain functions (Standards).
Bribery — the offering, giving, receiving, or soliciting
of anything of value to influence an outcome (Practice
Guide, Internal Auditing and Fraud).
Control — any action taken by management, the board,
and other parties to manage risk and increase likelihood
that established objectives and goals will be achieved.
Management plans, organizes, and directs the perfor-
mance of sufficient actions to provide reasonable assur-
ance that objectives and goals will be achieved (Standards).
Corruption — the misuse of entrusted power for private
gain (Practice Guide, Internal Auditing and Fraud).
Fraud — any illegal act characterized by deceit, conceal-
ment, or violation of trust. These acts are not dependent
upon the threat of violence or physical force. Frauds are
perpetrated by parties and organizations to obtain money,
property, or services; to avoid payment or loss of services;
or to secure personal or business advantage (Standards).
Red Flag1 — a warning sign; a sign that there is a problem
that should be noticed or dealt with (Merriam-Webster.
com).
Risk — the possibility of an event occurring that will have
an impact on the achievement of objectives. Risk is mea-
sured in terms of impact and likelihood (Standards).
By permission. From Merriam-Webster’s Collegiate® Dictionary, 11th Edition
1
©2014 by Merriam-Webster, Inc. (www.Merriam-Webster.com).
IPPF – Practice Guide
Global Landscape
Private and public sector organizations worldwide are re-
sponding to the risks of bribery and corruption. Responses
include:
• International accords, where member countries em-
brace an agreed upon system of principles with the
intent to enact them into law. The United Nations
Convention against Corruption and The United
Nations Declaration against Corruption and Bribery
in International Commercial Transactions are two
examples.
• National laws.
• Codes of best practices.
• Regional conventions where recognized agencies,
usually in regions with bribery and corruption prob-
lems, issue statements of intent.
• Public and private sector policy statements.
• Non-profit organizations that catalog instances of
abuse, best practices, and government efforts to
combat bribery and corruption.
Legislation
Many developed countries have enacted legislation to
curb bribery and corruption. Other nations are consider-
ing new legislation or are in the process of adopting or
updating current law. Appendix 1 provides comparative
legislative highlights for select countries.
Several laws fundamentally affect how individuals work
and many have international impacts. Two of the strict-
est legal regulations designed to combat bribery and
corruption include the FCPA and the U.K. Bribery Act.
Transparency International (www.transparency.org) also
provides an overview of bribery and corruption legislation
and emerging changes.
www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs
U.S. Foreign Corrupt Practices Act (FCPA)
The FCPA prohibits U.S. persons and businesses from
making payments to foreign government officials or politi-
cians to influence business dealings. The FCPA also in-
cludes accounting rules that require transparency through
appropriate accounting records, and works in tandem
with anti-bribery provisions.
The IIA Audit Executive Center Knowledge Briefing, In-
ternal Auditing and the Foreign Corrupt Practices Act,
provides direction on aspects of the law and highlights
best practices for CAEs and boards in assessing FCPA
risks. Some of these best practices include:
• Internal auditors making sure controls are properly
designed, well established, and documented.
• Assessing FCPA risk areas by evaluating policies and
procedures.
• Organizationwide compliance initiatives to develop
policies and procedures that identify corrupt prac-
tices.
• Board members ensuring that the organization’s
code of conduct and policies outline the steps
needed to achieve FCPA compliance.
U.K. Bribery Act 2010
The U.K. Bribery Act provides prosecutors and courts
with a strong framework to address bribery in the U.K. and
abroad. It is considered wider in scope than the FCPA be-
cause it generally applies to the private and public sector.
Compared with the FCPA, the U.K. Bribery Act defines
bribery more broadly and applies a liability standard for
failing to prevent payment of bribes to “associated per-
sons.”
The U.K. Bribery Act defines bribery as the receiving or
offering/giving of any benefit by or to any public servant or
officeholder or to a director or employee of a private orga-
nization to induce that person to give improper assistance
4 / www.globaliia.org/standards-guidance
in breach of his or her duty to the government or organi-
zation that has employed or appointed the individual. An
occasion where such assistance might be sought would
be in relation to the award of an export contract where a
bribe might be used to influence the tendering process.
The U.K. Bribery Act covers bribes paid to individuals
who, although not holding an appointment in a relevant
organization or national government, are nevertheless able
to exert influence over such an appointee by reason of
some personal, business, or other relationship. It also cov-
ers bribes paid in advance as an inducement to a person to
act inappropriately or retrospectively pursuant to a previ-
ous promise, understanding, or agreement.
The act creates offenses for:
• Bribery.
• The act of being bribed.
• Bribing foreign public officials.
• Failure of a commercial organization to prevent brib-
ery on its behalf.
These actions are illegal in or outside the U.K. if the
bribe was paid by anyone associated with a U.K. organi-
zation.
Other Legislation and Anti-bribery and Anti-
corruption Measures
Anti-bribery and anti-corruption laws and initiatives exist
worldwide, but it is widely recognized that better laws,
codes of practice, and enhanced enforcement actions are
still needed. The following references provide information
about the global scope of anti-bribery and anti-corruption
measures (as of June 2013).
• Transparency International (www.transparency.org)
• The Organisation for Economic Co-operation and
Development (OECD) Anti-Bribery Convention
(1999) (www.oecd.org)

Auditing Anti-bribery and Anti-corruption Programs
• OECD — Country Reports on the Implementa-
tion of the OECD Anti-Bribery Convention and the
1997 Revised Recommendation (www.oecd.org)
• United Nations — Working Group on the Review of
Implementation (www.unodc.org)
• United Nations — Global Compact (www.unglobal-
compact.org)
• World Bank — Department of Institutional Integrity
(www.worldbank.org)
• World Bank Institute — Governance and Anti-Cor-
ruption (www.worldbank.org)
• World Economic Forum — Partnering against Cor-
ruption Forum (www.weforum.org)
• The African Union Convention on Preventing and
Combating Corruption (July 2003)
• The United Nations Convention against Corruption
(entered into force in December 2005)
• China — Anti-corruption measures (including the
Criminal Law and the Anti-unfair Competition Law
and Interim Regulations on prohibiting business
bribery)
• Hong Kong — The Prevention of Bribery Ordinance
(POBO)
• India — The Prevention of Corruption Act 1988
(PCA)
• Indonesia — Various laws including the Good
Governance Law, Eradication of Criminal Acts of
Corruption, Commission for the Eradication of Cor-
ruption (KPK Law), and the Corruption Tribunal
(Corruption Tribunal Law)
• Japan — Several laws such as the National Public
Service Ethics Act and the Political Ethics Law
• Singapore — The Prevention of Corruption Act
(PCA); the Penal Code; and the Corruption, Drug
Trafficking, and Other Serious Crimes (Confiscation
of Benefits) Act (CDSA)
IPPF – Practice Guide
Effective Anti-bribery and
Anti-corruption Programs and
the Role of Internal Audit
A comprehensive anti-bribery and anti-corruption program
should include entity-level, process-level, and transac-
tion-level controls. The hallmark components of effective
anti-bribery and anti-corruption programs include tone at
the top, governance structure, risk assessment, policies
and procedures, training and communication, monitoring
and auditing, investigations and reports, enforcement and
sanctions, and reviews and updates. Internal audit’s role
in anti-bribery and anti-corruption programs will depend
on the organization’s governance structure. Internal au-
dit’s level of involvement should be recommended by the
CAE and approved by the board. Internal audit can play a
significant reinforcing role in the importance of anti-brib-
ery and anti-corruption programs.
Internal audit should assess the effectiveness of anti-
bribery and anti-corruption programs to help anticipate
the risk, and identify the existence of potential and actual
incidents. Two different, but complementary, approaches
that may be used exclusively or in conjunction with each
other include:
• Auditing each component of the anti-bribery and
anti-corruption program.
• Incorporating an assessment of anti-bribery and an-
ti-corruption measures in all audits, as appropriate.
In this approach, bribery and corruption risks should
be incorporated into the risk assessment and scop-
ing process of each audit. For example, a financial
audit may include a review of cash transactions and
a vendor management office audit might include a
review of third-party due diligence practices. Each
audit may:
›› Include procedures to assess bribery and corrup-
tion risks.
www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

›› Evaluate bribery and corruption scenarios. Internal Audit’s Role

›› Evaluate the control environment and anti-bribery Internal audit should understand the attitude and tol-
and anti-corruption programs in that audit area. erance of the board and executive management toward
›› Link the scope of an area’s audit procedures to its bribery and corruption risks, assess whether that attitude
assessed risk. is sufficiently restrictive, and validate that this attitude
has been adequately communicated throughout the or-
Both approaches should utilize data analytics to look for
ganization. As such, internal audit should scrutinize the
red flags and obtain other audit evidence related to anti-
governance structure and the monitoring and oversight
bribery and anti-corruption programs1. Internal auditors
responsibilities related to anti-bribery and anti-corruption
emphasizing an established program approach may find
programs.
the guidance in this section particularly useful. Internal
auditors favoring an “all audits” approach may want to fo-
Sample Review Questions
cus on the next section, (Pg. 11) Risks, Red Flags, and Au-
diting Activities. However, both sections will likely prove For sample review questions and related guidance on au-
beneficial, regardless of approach. diting tone at the top and governance structure, see the
following IIA publications:
Tone at the Top/Governance Structure
• Practice Guide, Auditing the Control Environment.
Component Overview
• Practice Guide, Evaluating Ethics-related Programs
Effective risk mitigation starts with a strong tone at the top, and Activities.
setting the foundation for an overall compliance framework.
The tone at the top is the ethical environment fostered by • Practice Guide, Internal Auditing and Fraud.
organizational leadership and the single most important • Tone at the Top newsletters:
factor in determining the organization’s resistance to brib- ›› All Hands on Deck: Partnering to Fight Fraud
ery and corruption. No system of controls can provide abso- (December 2013).
lute assurance against the commission of bribery or corrup-
tion. The board should, however, require the organization ›› Shining a Light on Corruption (August 2012).
to develop comprehensive anti-bribery and anti-corruption
programs. Risk Assessment
Component Overview
Although each organization may have different methods for
A comprehensive risk assessment identifies and analyzes
establishing the right tone, a good starting point is to issue
bribery and corruption risks throughout the organization,
a code of conduct and an anti-bribery and anti-corruption
including all locations and types of business. The risk as-
policy endorsed by the board of directors. Once the board
sessment is a precondition for establishing the remaining
has clearly committed to a strong policy, the best approach
components of the anti-bribery and anti-corruption pro-
is zero tolerance and full compliance with anti-bribery and
gram. It is critically important to review present and poten-
anti-corruption laws. This is not just ethically right; there
tial bribery and corruption risks, and to develop mitigating
also is increased pressure for compliance from legislative
controls.
bodies and nongovernmental organizations.

Global Technology Audit Guide (GTAG®) 16: Data Analysis Technologies

1

6 / www.globaliia.org/standards-guidance

Auditing Anti-bribery and Anti-corruption Programs
Internal Audit’s Role
Internal audit should understand all aspects of manage-
ment’s existing anti-bribery and anti-corruption program
before performing risk assessments. And internal audit
should evaluate the inherent bribery and corruption risks
as part of its comprehensive risk assessment. As well, the
audit plan for assessing the effectiveness of anti-bribery
and anti-corruption programs should be risk based.
Sample Review Questions
1. Does the organization use business intelligence re-
sources to identify bribery and corruption risks when
exploring business opportunities in established and
emerging markets?
2. Does the organization regularly conduct due dili-
gence on third-party providers?
3. Does the organization’s due diligence process meet
regulatory requirements for scope and thoroughness?
4. Are third-party agreement approvals in place?
5. Is there a history of lawsuits, fines, and penalties
related to bribery and corruption?
Policies and Procedures
Component Overview
The organization’s anti-bribery and anti-corruption stan-
dards should be clearly defined in well-documented poli-
cies. Detailed underlying procedures should explain how
employees, business partners, and third parties should
behave, and clearly specify what behavior is unacceptable
and noncompliant. Policies and procedures establish con-
straints and define and embed an organization’s attitudes
and practices on fraud, bribery, and corruption. The poli-
cies and procedures should include protocols for third-
party dealings, payment processing, expense reporting,
and training. To safeguard against employee self-dealing,
best practice policies also address conduct outside of the
job and conflicts of interest.
IPPF – Practice Guide
Internal Audit’s Role
Internal audit should sample test whether policies and
procedures:
• Are documented appropriately.
• Are approved by appropriate management.
• Comply with applicable laws and regulations.
• Are implemented effectively.
Sample Review Questions
1. Do the anti-bribery and anti-corruption program
standards comply with applicable laws and regula-
tions?
2. Do policies and procedures address gifts and enter-
tainment, meals and travel, charitable donations,
and facilitation payments?
Communication and Training
Component Overview
Effective anti-bribery and anti-corruption programs re-
quire careful and continuous communication and training
programs, updated to align with changing regulations and
evolving country norms. General training regarding what
constitutes bribery and corruption, how it harms the or-
ganization, and how to report it should be provided to all
members of the organization. In addition, customized train-
ing should be provided by function or job responsibility to
address specific bribery and corruption risks.
As an extension of training and communication, self-cer-
tification programs may further reduce risk. Various levels
of management periodically certify that they have not paid
bribes and have no knowledge of other employees or service
providers having done so.
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Internal Audit’s Role 5. Do employees periodically certify that they are

Internal audit should share information and work with
other functions such as fraud investigation, legal coun-
sel, compliance, and external audit. For example, South
Africa’s King Code of Governance makes this explicit by
stating that the board should ensure there is an effective
risk-based internal audit function that can be a source of
information about instances of fraud, bribery and corrup-
tion, unethical behavior, and other irregularities. Also, in
some countries, information on irregularities and illegal
acts is required to be exchanged with external auditors
and/or a competent regulatory agency.
Some internal audit groups also play a key role in train-
ing employees in anti-bribery and anti-corruption policies.
When visiting other geographical locations, internal au-
ditors may arrange meetings with employees to commu-
nicate the organization’s anti-bribery and anti-corruption
message. Internal audit also may collaborate with legal
and ethics teams on training and anti-bribery and anti-
corruption audits. During anti-bribery and anti-corruption
training sessions, trainers should reference the FCPA,
the U.K. Bribery Act, Professional Guidance for Internal
Auditors on the U.K. Bribery Act 2010 (published by the
Chartered Institute of Internal Auditors), and other rel-
evant legislation and guidance. Internal audit must con-
sider, however, whether their training and/or communica-
tion activities could impair their objectivity in any manner.
Sample Review Questions
1. Is the organization aware of its exposure to global
bribery and corruption risks?
2. Is anti-bribery and anti-corruption training manda-
tory for all employees?
3. Do employees fully understand the organization’s
principal anti-bribery and anti-corruption policies?
compliant with anti-bribery and anti-corruption stan-
dards, and attest that they have no knowledge of any
incidence of bribery or corruption?
Monitoring and Auditing
Component Overview
Continuous monitoring activities and individual audits
should be performed to:
• Ensure the effectiveness of anti-bribery and anti-
corruption programs.
• Lower time to detection.
• Support continuous improvement and follow
through on corrective action plans.
Monitoring and auditing documentation also may provide
evidence that the organization was proactive prior to the
discovery of misconduct.
Internal Audit’s Role
There can be a gap between the perception of bribery
and corruption risks on the ground, where an event would
likely occur, and the more distant view at the board level.
This is especially true if effective risk assessments, analy-
ses, and communication are lacking. Organizations should
establish effective monitoring systems that provide senior
executives and the board with periodic updates. However,
internal audit’s monitoring activities should not supplant
management’s monitoring role.
Sample Review Questions
1. Does the organization have a formal process for
monitoring the effectiveness of its anti-bribery and
anti-corruption programs?
2. Is this process established to ensure objectivity?

4. Is training and communication tailored to the geo- 3. Is this process implemented properly?
graphical region, function, and job responsibility?

8 / www.globaliia.org/standards-guidance

Auditing Anti-bribery and Anti-corruption Programs
Investigations and Reports
Component Overview
Individuals at all levels should have support for resolving
ethical dilemmas and making appropriate decisions. An
accessible, anonymous whistleblower hotline for report-
ing suspected wrongdoing and seeking advice is crucial.
Where local law permits, organizations also should offer
a means to confidentially and/or anonymously report sus-
pected bribery or corruption.
It is the responsibility of the board to ensure that the or-
ganization has an effective process for confidential inves-
tigation. A consistent investigative process including pro-
tocols for gathering and evaluating information, assessing
potential wrongdoing, and administering penalties, may
help mitigate loss and manage risk.
Investigators should have the authority and skills to evalu-
ate allegations and take appropriate action. If an in-depth
investigation is deemed appropriate, investigators should
first secure approvals, as needed, from senior manage-
ment, directors, legal counsel, and other appropriate
oversight bodies. In certain circumstances it also may be
necessary to make public disclosures to law enforcement,
regulators, shareholders, the media, or others; however,
this should only be done by those individuals deemed au-
thorized to do so on behalf of the organization.
Internal Audit’s Role
Investigations
The role of internal audit in investigating bribery and cor-
ruption allegations depends on internal audit’s resources
and the organization’s governance structure. Consider-
ation should be given to the unit’s fraud, forensic, and IT
skills. Some organizations may require bribery and corrup-
tion investigations to be conducted under the supervision
of, and in coordination with, a special board committee,
regulatory body, the legal department, or other group.
The suspicion, discovery, and investigation of bribery and
corruption are sensitive matters. Internal auditors need
IPPF – Practice Guide
to understand the cultural and legal landscape of the op-
erational jurisdiction involved, and be thoroughly familiar
with local protocols for investigating and reporting. Inter-
nal audit also should collaborate with the board and senior
management to establish protocols for reporting suspect-
ed or actual incidents of bribery and corruption.
The need for an investigation may surface during the
course of an audit. If audit evidence indicates possible
irregularities, the internal auditor should:
• Follow the reporting protocol and refer the matter
to the investigation group. If internal audit suspects
that management is involved in the irregularity, it
should find the appropriate party to whom it can
report.
• Perform and document adequate actions to support
the audit findings, conclusions, and recommenda-
tions.
If audit evidence points to an illegal act, the internal audi-
tor should seek legal advice directly or recommend that
management do so. Internal audit should work with ap-
propriate personnel, such as the fraud investigation unit,
and management (if possible, at a level above the parties
involved in the act) to determine whether an irregularity
or illegal act has occurred and gauge its effect.
Sample Review Questions
1. What controls are in place to respond to bribery and
corruption matters before they become significant
issues?
2. Does the organization have formal, defined process-
es and protocols for investigating alleged bribery or
corruption?
3. Do the persons responsible for investigations have
the requisite skills, experience, objectivity, and orga-
nizational independence?
www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs
4. Does the organization have defined protocols for
reporting alleged or confirmed bribery or corruption
to the board or other authority?
Reports
According to Standard 2060, the CAE must report peri-
odically to senior management and the board on internal
audit’s performance. These reports must cover significant
risk exposures and control issues, including those relat-
ed to fraud and governance. Reports also should include
bribery and corruption risks and exposures, potential vio-
lations, and estimated impact.
There may be resistance to reporting bribery and corrup-
tion to the board. Management and legal counsel may
downplay the wrongdoing or may ask the internal audi-
tor to delay reporting until corrective actions are taken.
The internal auditor should clearly understand the board’s
communication requirements regarding bribery and cor-
ruption, including escalation, information type, and fre-
quency. According to IIA Standards, if in the CAE’s judg-
ment there is significant unmitigated risk, those risks
are to be communicated to management and then to the
board. In most organizations, the board will direct the in-
ternal auditor to report concerns in full and without delay.
External reporting may be a legal or regulatory obligation
of management, the individuals who detected the irregu-
larities, or both. Notwithstanding this external-facing re-
sponsibility, the internal auditor’s duty of confidentiality to
the organization and professional ethics generally require
reporting the matter internally before doing so externally.
However, in certain circumstances, the internal auditor
may be required to disclose an irregularity or illegal act.
These circumstances could include compliance with legal
or regulatory requirements.
When external reporting is required, the report should
generally be approved by legal counsel prior to external
release. It also should be reviewed with audit client man-
10 / www.globaliia.org/standards-guidance
agement and the board, unless applicable regulations or
specific circumstances of the audit dictate otherwise. In
the public sector, some legal jurisdictions grant citizens
the right to access any and all organization documents.
The IIA’s Practice Guide, Internal Auditing and Fraud,
describes typical roles and responsibilities for fraud pre-
vention and detection. The same roles apply to anti-brib-
ery and anti-corruption. For example:
• Fraud investigators usually are responsible for the
detection and investigation of fraud and the recovery
of assets. They also perform a role in fraud and cor-
ruption prevention.
• The fraud investigation unit and internal audit
should work closely together and be aware of each
other’s findings. Fraud investigators often also work
closely with legal counsel to bring legal action
against perpetrators. The lead investigator usually
determines the resources needed for the investiga-
tion and staffs the team accordingly. Internal audit
can help in areas such as data analysis.
• Laws of the jurisdiction often govern the role of in-
house legal counsel. House counsel generally acts
in the best interest of the organization and also is
required to preserve attorney-client privilege.
• When auditing financial statements, external audi-
tors have a responsibility to comply with profession-
al standards and to determine if there is reasonable
assurance that the financial statements are free of
material misstatement. If there are evident misstate-
ments, the external auditors must ascertain whether
they were caused by error or fraud.
• When external auditors find evidence of irregulari-
ties and illegal acts, professional standards typically
require that the matter be brought to the attention
of an appropriate level of management. If senior
management is involved, the report normally goes

Auditing Anti-bribery and Anti-corruption Programs
directly to those charged with oversight governance
(e.g., the board or audit committee).
• Employees can report suspicions of irregularities
and illegal acts to an employee hotline, internal
audit, or a member of management. To deter and
detect fraud and abuse, many experts believe an ap-
propriately monitored employee hotline is the single
most cost-effective tool for detecting irregularities
and illegal acts.
Enforcement and Sanctions
Component Overview
Terminable bribery and corruption offenses should be
clearly identified, and related sanctions should be explicit.
Internal Audit’s Role
There should be a defined process that includes multiple
organizational disciplines to evaluate cases of bribery or
corruption and implement sanctions according to a formal
policy.
Sample Review Questions
1. Do employees and third-party providers (e.g., agents,
sales consultants, distributors, and vendors) comply
with the code of business conduct regarding bribery
and corruption?
2. Do employees understand how anti-bribery and anti-
corruption program violations impact salary, promo-
tion, and continued employment?
3. Are cases of bribery or corruption evaluated objec-
tively and sanctions consistently implemented in
accordance with policy?
IPPF – Practice Guide
Review and Updates
Anti-bribery and anti-corruption programs require on-
going monitoring of legal mandates. All components of
these programs should be updated as necessary to ensure
alignment with changing regulations and evolving coun-
try norms across all jurisdictions the organization operates
within.
Risks, Red Flags, and Audit
Activities
Risks
Corruption and bribery expose organizations to a broad
range of risks to achieving established operations, report-
ing, and compliance objectives. Organizations should as-
sess the likelihood, impact, and vulnerability of each iden-
tified risk. It should be noted that the impact of bribery
and corruption on reputational risk may be severe even
when financial impact is minimal — materiality may be
irrelevant or secondary. Comprehensive controls are need-
ed to combat bribery and corruption risks. The develop-
ment of effective controls requires in-depth knowledge of
an organization’s internal and external operations.
Risk Areas
Most bribery and corruption involves cash payments, hos-
pitality, gifts, travel, and employment. However, other in-
ducements also come into play across many different areas
of the organization. High-risk areas for bribery and corrup-
tion include geography and industry; hiring/employment;
third-party/vendor management; gifts, entertainment, and
political contributions; procurement; sales; finance; IT;
upper management; and government relations.
www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs
Geography and Industry
Risk Area Overview
Some countries or jurisdictions where organizations op-
erate in cash-based economies have a higher incidence
of bribery and corruption. The local regulatory environ-
ment also impacts risks. Similarly, certain industries (e.g.,
construction/infrastructure) are more susceptible to brib-
ery and corruption. It also is important to consider the
respective industries of business partners and third-party
relationships.
Through globalization, joint ventures, and partnerships,
organizations may set up operations in parts of the world
where the ethical environment differs from that of the
home country or where the culture includes acts that
would be considered bribery as an acceptable way to facil-
itate business. Risks may be compounded if anti-bribery
and anti-corruption policies are not clear, detailed, trans-
lated into local languages, and relevant to regional busi-
ness practices.
Red Flags
• Operations in countries with a reputation for higher
risk of bribery or corruption.
• Activities with industries or specific organization’s
that have a reputation for a higher risk of bribery or
corruption.
Internal Audit Activities
Where a culture of bribery and corruption exists, internal
auditors of the parent organization should evaluate each
situation, including those under joint venture/partnership,
and discuss dilemmas with the board.
When senior management does not support a bribery pol-
icy and the organization is operating in a culture where
bribery and corruption are common, the line between
what is and is not acceptable is likely to be blurred. The
internal auditor should evaluate acts and actions against
12 / www.globaliia.org/standards-guidance
the organization’s policy regardless of the apparent per-
missiveness of a particular environment.
Hiring/Employment
Risk Area Overview
The hiring process, including candidate background
checks, is an important consideration for potential bribery
and corruption. This is especially true in cases of mergers
and acquisitions.
Red Flags
• Hiring employees with a history of wrongdoing.
• Phantom employees.
Internal Audit Activities
• Review effectiveness of policies and practices for
confirming that personnel considered for employ-
ment in bribery-vulnerable roles do not have a his-
tory of wrongdoing.
• Confirm existence of employees in the country/loca-
tion.
• Verify validity of employees.
Third-party/Vendor Management
Risk Area Overview
Relationships with vendors, agents, lobbyists, contract
employees, consultants, and other intermediaries can be
exploited by bribery schemes and often are at the heart of
corruption. Third parties that engage in bribery and cor-
ruption expose the organization to compliance, financial,
and reputational risks. See the section on procurement for
additional related guidance.
Red Flags
• Unproductive or suspicious interviews with employ-
ees, agents, and contractors.
• Close personal or familial relationships between
employees and vendors.

Auditing Anti-bribery and Anti-corruption Programs
• Lack of competitive bid processes for vendors or
customers.
• Use of agents or third parties to pay bribes.
Internal Audit Activities
• Review agent and other third-party selection and
screening processes and due diligence practices.
• Review practices for staying current on third-party
ownership and merger and acquisition activity.
• Review policies for hiring and retaining agents and
contractors and training them in anti-bribery and
anti-corruption programs.
• Ensure that contracts specify the expectation of
compliance with the code of conduct and anti-brib-
ery and anti-corruption regulations.
• Review contracts to ensure the existence of right-to-
audit clauses.
• Review expenses reimbursed to third parties. Inter-
view third-party employees.
• Evaluate use of agents and other third parties, con-
sidering reasonableness and necessity (i.e., whether
it is reasonable to use the third party chosen for the
specific task).
Gifts, Entertainment, and Political
Contributions
Risk Area Overview
Travel, entertainment, and gifts given or received by the
organization or the organization’s employees can be meth-
ods of bribery.
Red Flags
• Excessive travel and entertainment expenses, espe-
cially for entertaining government officials.
• Frequent or excessive entertainment and gifts
provided to customers, suppliers, or government of-
ficials.
IPPF – Practice Guide
• Frequent or excessive charitable and political dona-
tions.
• Inadequate or vague gift/hospitality/entertainment
policies and/or guidelines.
Internal Audit Activities
• Review appropriateness of entertainment and gift
policies.
• Review payments related to travel, entertainment,
and gifts.
• Review approvals required for giving gifts.
• Perform keyword searches on travel and expense
reports for inappropriate travel/gifts.
• Review compliance with the charitable donations
policy.
• Review payments to charitable and political organi-
zations.
• Consider relationships between charities and other
parties (e.g., government officials and organization
management).
• Confirm charities are bona fide organizations.
Procurement
Risk Area Overview
Procurement of high-value goods and services can be a
common area for corruption.
Red Flags
• The existence of fictitious suppliers.
• Inappropriate acceptance of gifts, money, or enter-
tainment expense payments in return for preferen-
tial treatment to providers bidding for goods and
services.
• Conflicts of interest among members of assessment
panels (for large procurements) and vendors submit-
ting the bids, including vendors related to govern-
ment officials.
www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs
• Purchasing in installments with the same supplier
(i.e., provider) to avoid the organization’s authoriza-
tion levels and spending limits (structuring).
• Extending contracts for excessive periods of time
without “testing the market” for better terms.
• Making a high-value purchase with a unique or
exclusive supplier.
• Purchasing goods inconsistent with business needs,
including overpaying for services and products.
• Inadequate spend data and vendor data or inconsis-
tent data across procurement related systems.
• Use of sole-sourced vendors not properly vetted,
including low compliance with corporate preferred
buying guidelines.
• Inappropriate vendor creation and management and
multiple appearances of the same vendor within the
master file.
• Duplicate payments.
• Limited segregation of duties involving payments,
credits, and reconciliation of vendors and suppliers.
Internal Audit Activities
• Review controls over supplier selection and vendor
setup.
• Review vendor setup in the payment system.
• Review the competitive bid process.
• Test that goods and services are real and at market
prices.
• Conduct supplier visits and interview suppliers.
• Validate vendor addresses.
• Validate vendor companies via publicly available
records.
Sales
Risk Area Overview
Bribery is one way certain sales contracts can be obtained.
14 / www.globaliia.org/standards-guidance
Red Flags
• Providing gifts, money, or entertainment to make a
deal, increase sales, or otherwise gain advantage.
• Inadequate policy or guidelines detailing acceptable
gifts, hospitality, and entertainment expenses.
• Making a deal with suppliers to fix prices or award a
sale or contract.
• New or recurring sales or long-term contracts with
the same government entity without proper bidding
and negotiations.
Internal Audit Activities
• Review sales function expense reports and compli-
ance with related policies and procedures.
• Review appropriateness of entertainment and gift
policies, and related training and attendance records
for sales personnel.
• Review sales contract and agreement approvals,
terms, and conditions.
• Review compliance with government contract and
agreement guidelines.
Finance
Risk Area Overview
Most bribery involves disbursement of cash and the re-
cording of that disbursement in the financial records.
Red Flags
• Payments of cash to facilitate deals and transactions.
• Lack of supporting documentation for cash transac-
tions.
• Lack of appropriate segregation of duties for control
of cash, non-routine payments, or other transac-
tions.
• Lack of, or poor supporting documentation for,
expense reports.
• Cash used to pay bribes.

Auditing Anti-bribery and Anti-corruption Programs
• The existence of off-balance-sheet bank accounts.
• Credit notes and rebates used as a method to pay
bribes.
• Bookkeeping records insufficient to identify bribery
schemes.
• Increasing or frequent write-offs of accounts receiv-
able.
Internal Audit Activities
• Review end-to-end expense processing for check/
wire/EFT, petty cash, employee payroll, and employ-
ee expense reimbursement.
• Review controls to establish bank accounts and
signature authorities.
• Review bank reconciliation controls and perfor-
mance of monthly reconciliations.
• Review controls over petty cash.
• Review travel and entertainment payments and
reimbursements, as these are common methods of
bribery.
• Review financial information, detailed accounts,
bank accounts, and payment records to identify any
off-balance-sheet accounts usable for bribery pur-
poses.
• Review controls and test transactions related to
credit notes and rebates.
• Confirm that the nature and amount of credit notes
and rebates are consistent with business practices.
• Review accounting policies and practices to assess
regulatory compliance.
• Reconcile balances between subledger and general
ledger.
• Evaluate accounts to determine if parallel books are
maintained in certain countries to disguise illegal or
irregular transactions.
IPPF – Practice Guide
IT
Risk Area Overview
The IT control environment is a crucial area, especially
with regard to access controls and segregation of duties
for cash, and detection of unusual transactions.
Red Flags
• Limited segregation of duties involving payments,
credits, and reconciliation of vendors and suppliers.
• Any procurement red flags related to the procure-
ment or acquisition of IT infrastructure (see section
on procurement).
Internal Audit Activities
• Review and test IT access controls related to vendor
management, accounts payable, and accounts re-
ceivable.
• Test transaction level controls for segregation of du-
ties.
• Review the vendor master file for additions, dele-
tions, and changes.
• See related section on procurement.
Upper Management
Risk Area Overview
Upper management has a pervasive impact on the risk of
bribery or corruption through the culture it helps foster
and its own activities.
Red Flags
• Complacency by management or the board toward
bribery and corruption risk.
• Inordinate attention to specific investigations by the
management, who may be involved.
• Lack of a clear anti-bribery or anti-corruption policy.
• Lack of an objective process to investigate suspected
cases of bribery or corruption.
www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Internal Audit Activities Government Relations

• The internal auditor may be unsure how to handle Risk Area Overview
bribery and corruption issues involving executives in
In certain countries, significant interactions with govern-
the organization. Even just reporting such instances
ment agencies may pose higher risk or compliance costs.
to the organization or board can be a challenge. The
CAE may want to consult the general counsel. Red Flags
• If the CEO is not involved in these matters and the • Frequent government permit granting.
reporting line between the CEO and the CAE is
• Close personal relationships between employees
effective, there may not be any reporting difficulty.
and government personnel.
However, if the CEO may have been involved, spe-
cial care is required. • A historical record of government fines or penalties.
• The CAE should communicate the matter to inde- • Use of agents or third parties to develop business
pendent personnel such as board or audit commit- relationships in foreign countries.
tee members and the lead independent director. In • Inappropriate payments to government agencies.
certain jurisdictions it may be necessary to report to
• Events sponsored for public servants including trav-
the applicable regulatory agency. If senior executives
el, expense reimbursement, or entertainment (taking
are involved, the bribery or corruption that occurred
advantage of the function directly or indirectly).
should be considered substantial to reputational
risk, even if the infraction is relatively small or in- • High level of political contributions.
volves immaterial transactions. • Use of middlemen or consultants to facilitate fast
›› Some countries have set up governmental agen- track processing with government agencies or to get
cies for such reporting in the public sector. In- business.
ternal auditors in the public sector should report • Offers of gifts or favors to government employees
matters to such agencies, as required. and officials.
• If the senior executives are engaged in bribery or Internal Audit Activities
condone an inappropriate culture, internal audit will
need strong support from independent directors to • Review payments made to government agencies.
improve the organizational environment. • Review use of third parties for such payments.
• The organization may not have an anti-bribery • Validate original receipts and related amounts for
policy, or it may operate in a bribery-tolerant envi- government payments.
ronment. If so, the CAE should discuss the situa- • Review high-risk activities such as customs clear-
tion with the board to arrive at an appropriate course ance and granting of permits.
of action.
›› In some situations, organizations do not condone
bribery but seek to operate in countries where
such activities are prone to occur. Such practices
may result in facilitation payments and, therefore,
the CAE should discuss the associated risks with
legal counsel, the board or audit committee, and
senior management.

16 / www.globaliia.org/standards-guidance

Appendix 1: Comparison of Legislation in Select Countries
Following is a summary comparison of legislation in select countries (as of December 2012).
PROVISIONS
Bribery of foreign public
officials
Private-to-private bribery
Receipt of bribe
Intent
Facilitation payments
allowed
Promotional expenses
allowed
Extraterritorial application
Third parties
Failure to keep accurate
books and records
Criminal penalties
Perceived level of
enforcement
√ indicates section applies
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs
UNITED KINGDOM UNITED STATES (FCPA) AUSTRALIA (BRIBERY OF PEOPLE’S REPUBLIC OF
(BRIBERY ACT) FOREIGN OFFICIALS/SE- CHINA (PRC)
CRET COMMISSION)
√ √ √ √
√ √ √
√ √
Intent is required for sec- √ √ √
tion 1 and 2 offenses. No
“corrupt” or “improper”
intent is required for the
FPB offense.
√ √
√ √ √ √
√ √
√ √ √ √
Covered by other √ √ √
legislation.
√ √ √ √
Uncertain, as Act is new High and growing High and growing High and growing
www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs
Appendix 2: Internal
Controls: Update Based on
COSO Elements
COSO-recommended examples of anti-bribery and anti-
corruption controls include:
• Corporate ethics and anti-corruption and anti-brib-
ery policies.
• Provisions for compliance with anti-bribery regula-
tions included in contracts with third parties.
• Anti-fraud and anti-corruption training provided to
employees.
• A whistleblower program.
• Requiring employees to record events where they
had contact with government officials, political
parties/officials, or political candidates and their
families.
• Enforcement of delegation-of-authority limits.
• Procurement policies and procedures and periodic
compliance reviews.
• Political contributions approved by the board of
directors.
• User access and segregation of incompatible duties
controls.
Appendix 3: Sample Audit
Procedures
1. Discuss whether the audit should be conducted
under attorney-client privilege with the legal depart-
ment.
2. Through inquiry with the board of directors and
executive management, obtain an understanding of
those groups’ role in anti-bribery and anti-corruption
18 / www.globaliia.org/standards-guidance
matters and their awareness of related policies and
procedures and internal audit’s role therein.
3. Evaluate the control environment/entity-level con-
trols established by management.
4. Through inquiry with management, obtain an under-
standing of:
• Anti-bribery and anti-corruption policies and proce-
dures.
• Third-party due diligence process.
• Third-party agreement approval process.
• End-to-end expense processing for check/wire/EFT,
petty cash, employee payroll, and employee expense
reimbursement.
• Gift policies and procedures review process.
• Meals and entertainment policies and procedures
review process.
• Related roles and responsibilities, segregation of
duties, documentation requirements, predetermined
thresholds, and delegation of authority.
• Donation policies and procedures review process.
• Process for review of payment facilitation policies
and procedures.
5. On a sample basis, test policies and procedures over
the items stated in item 4 above and verify that:
• Policies and procedures were documented appropri-
ately.
• Policies and procedures were approved by appropri-
ate management.
• Policies and procedures were communicated to
staff.
• Policies and procedures are in compliance with
FCPA regulations.
6. Review and test the following, as applicable:

Auditing Anti-bribery and Anti-corruption Programs
• Tone at the top/Governance structure
›› Leadership and support of the board, the CEO,
and senior executives.
›› Consistent communication, support, and enforce-
ment of program to establish credibility.
›› Anti- bribery and anti-corruption program with
an organizational structure and formal decision-
making processes.
›› Whistleblower hotlines, employee help lines, and
topical guidance to support employees in chal-
lenging situations.
›› Regular exception reports to the CEO and the
board.
• Risk assessment
›› Use cross-functional teams (e.g., business unit,
finance, internal audit, compliance, legal) to
establish credibility and consistency.
›› Identify risk factors, schemes, and scenarios at a
business-process level.
›› Assess the likelihood and impact of risks.
›› Tailor assessment to local incentives, pressures,
opportunities, and attitudes.
›› Evaluate and prioritize key risks.
• Program design and control activities
›› Focus on design and implementation of controls
for key risks identified in the risk assessment.
›› Typical policies and controls to consider:
– Facilitation payments.
– Gifts, hospitality, and entertainment.
– Use of agents and other intermediaries.
– Political and charitable contributions.
– Acquisition due diligence.
– Joint ventures or similar relationships.
– Recordkeeping requirements.
IPPF – Practice Guide
– Investigation and sanction procedures.
– Use of third parties and related controls.
– Training programs for employees and ven-
dors.
›› Ensure controls contemplate risks of override,
circumvention, and collusion.
›› Tailor controls to local environment and business
models.
• Monitoring
›› Design monitoring and auditing procedures
around risk factors and indicators.
›› Periodically evaluate program effectiveness by
performing internal audits.
›› Survey employees’ understanding of the program.
›› Constantly incorporate monitoring results into the
program design.
• Response and remediation
›› Establish formal process for initiating, tracking,
investigating, resolving, and documenting allega-
tions.
›› Identify and remedy control weaknesses that led
to corrupt activities.
›› Consistently enforce sanctions across organiza-
tional units and levels.
›› Monitor communications regarding anti-bribery
and anti-corruption compliance received by the
board of directors and executive management.
7. Based on additional information gained, determine
whether any additional test procedures should be
designed and performed. If an investigation is re-
quired, seek guidance from a specialist.
www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Appendix 4: References The authors consulted Fraud and Corruption — Preven-

Following are references that would be useful to internal
auditors in understanding the bribery and corruption sce-
nario and building an appropriate strategy.
• Transparency International
tion and Detection, by Nigel Iyer and Martin Samociuk,
when writing parts of this practice guide.
Authors
• Princy Jain, CIA, CCSA, CRMA

• The Organisation for Economic Co-operation and • Richard Schmidt, CIA

Development (OECD) and OECD’s Anti-bribery • Andrew Macleod, CIA, CRMA
Convention (1999) • Teis Stokka, CIA, CRMA
• United Nations Convention against Corruption • Carlos Renato, CIA, CCSA
• United Nations Declaration against Corruption and • Takeshi Shimizu, CIA, CCSA, CRMA
Bribery in International Commercial Transactions
• Andy Robertson
• The African Union Convention on Preventing and
Combating Corruption
• The King Code of Governance for South Africa Reviewers
• The U.S. Federal Sentencing Guidelines • Douglas J. Anderson, CIA, CRMA
• A Resource Guide to the U.S. Foreign Corrupt • Steve Jameson, CIA, CFSA, CCSA, CRMA
Practices Act (by the Criminal Division of the U.S.
• David Zechnich, CIA, CRMA
Department of Justice and the Enforcement Division
of the U.S. Securities and Exchange Commission) • Stephen Linden
• The IIA’s Audit Executive Center 2010 Knowledge
Briefing, Internal Auditing and the Foreign Corrupt
Practices Act
• The Chartered Institute of Internal Auditors’ Profes-
sional Guidance for Internal Auditors on the U.K.
Bribery Act 2010
• Transparency International’s 2010 U.K. Bribery Act
Adequate Procedure (guidance on good practice
procedures for corporate anti-bribery programs)
• IIA Practice Guide, Evaluating Ethics-related Pro-
grams and Activities
• IIA Practice Guide, Coordinating Risk Management
and Assurance
• The IIA’s Global Technology Audit Guide (GTAG®)
16: Data Analysis Technologies

20 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2014 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

GLOBAL HEADQUARTERS T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

140590
 IPPF – Practice Guide

Auditing Executive
Compensation
and Benefits
April 2010
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

Table of Contents
Introduction................................................................................................................. 1

Executive Summary..................................................................................................... 1

Definition and Structure.............................................................................................. 1

Risks .......................................................................................................................... 2

Employment Market Risk . .................................................................................. 2

Compliance Risk ................................................................................................ 2

Financial Reporting Risk .................................................................................... 2

Reputation Risk ................................................................................................. 3

Operating Risk ................................................................................................... 3

External Business Relationships ........................................................................ 3

Audit Approach ........................................................................................................... 3

Auditing Board Compensation and Benefits........................................................ 4

Auditing External Business Relationships .......................................................... 5

Audit Considerations .................................................................................................. 5

Access to Information ........................................................................................ 5

Privilege ............................................................................................................. 5

Skills and Knowledge ......................................................................................... 5

Audit Program Development ....................................................................................... 6

Board of Directors and Committees ................................................................... 6

Management ...................................................................................................... 8

External Business Relationships ...................................................................... 10

Appendix A – Types of Executive Compensation and Benefits .................................. 12

www.theiia.org/guidance / B

Introduction
Executive compensation and benefits (ECB) programs
have risks that require effective board governance (direc-
tion and oversight) and management (development, mon-
itoring, and administration) processes. Internal auditors
have an important role in providing assurance that ap-
propriate and effective controls are in place around ECB
programs.
Auditing the structure and operation of ECB programs is
a legitimate and appropriate role for internal auditing. If a
risk assessment indicates a review is warranted, the chief
audit executive (CAE) should add ECB to the audit plan,
which the board will review and approve. Internal audit-
ing will choose the audit approach and design risk-based
audit procedures.
This practice guide is not intended to address all the con-
siderations necessary for performing an audit of ECB.
It provides discussions relating to such an audit and in-
cludes several considerations that may be relevant to an
organization’s business activities or risk profile.
The International Professional Practices Framework’s
(IPPF’s) International Standards for the Professional Prac-
tice of Internal Auditing (Standards) include attribute and
performance standards pertaining to activities of internal
audit, including audits of ECB programs. This practice
guide assumes conformance with the standards for all au-
dit work and discusses how the execution of such audit
work could be performed.
Executive Summary
Strong governance systems are needed for ECB pro-
grams, as management often is in the position of both de-
signing and recommending its own compensation. There
1
External business relationships include suppliers, customers, and partners. For more guidance, refer to the IIA Practice Guide “Auditing External Business Relationships.”
2
A board is a governing body, such as a board of directors, supervisory board, head of an agency or legislative body, board of governors or trustees or a non-profit organization, or any other
designated body of the organization. For this guide, board may also refer to committees of the board.
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
are several specific risks internal auditors should consid-
er, including employment market, compliance, financial
reporting, reputation, operating, and external business
relationship risks. ECB programs also are subject to fraud
risk.
Due to the sensitive nature of this area, internal auditing
must have an appropriate audit approach and access to
the necessary information. While there can be obstacles
to obtaining this information, internal audit needs to
proceed in accordance with its charter.
The audit scope could include a focus on the board, man-
agement, and extended business relationships.1 There are
a number of unique aspects in audits of each of these
areas of focus which should be considered before per-
forming audit work.
Definition and Structure
Compensation and benefits are the aggregate of various
payments, reimbursements, and personal use of assets
that are a benefit to the employee and a cost to the organi-
zation. The cost can be direct costs for the benefits, or in-
cremental costs, such as administration. The components
of ECB vary among organizations; significant differences
may exist among organization types (publicly or privately
held, government, not-for profit, etc.) sizes, and locations.
Components of ECB include salary, bonuses, perquisites
(fringe benefits), equities, and some reimbursable busi-
ness expenses. For additional discussion and examples,
refer to Appendix A.
Boards2 review and approve compensation strategies to
attract and retain appropriate leadership for the organi-
zation, while managing stakeholder expectations for cost
management and alignment of compensation with the or-
ganization’s performance.
www.theiia.org/guidance / 1
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

Management is often in the position of designing and rec- • It fails to design controls.
ommending its own compensation programs, as well as • The processes for gathering and reporting regulatory
board compensation programs. Strong board governance required ECB data is not reliable (accurate, com-
systems are needed to manage the inherent conflict of in- plete, timely, etc.).
terest and potential for collusion.
• Management intentionally or unwittingly designs
processes that fail to apply regulations appropriately,
Many organizations outsource compensation and benefit
such as employment benefits, income tax regula-
services, such as pensions, medical and insurance ben-
tions, or accounting standards.
efits, financial and tax planning services, recruitment, and
outplacement. Some may outsource processing functions, The organization may fail to comply with its policies and
such as payroll and accounting. Outsourcing adds ad- procedures if:
ditional complexity and risk over monitoring of controls • Executives make illegal or unethical decisions to gen-
and creates a challenge when trying to understand the full erate more personal benefits than those approved.
spectrum of controls in place.
• The board fails to act responsibly in meeting its
governance role.
Risks • The organization may fail to comply with contractual
ECB exposes organizations to several risks. The board and or other legal obligations if:
management have ultimate responsibility for assessing • It does not generate sufficient resources to pay
and managing these risks. for agreed-upon severance and post-retirement
benefits, or if such resources are not appropriately
The CAE should understand and assess these risks to de- safeguarded.
termine the need for an audit and for planning, scoping, • Processes are not designed to manage customer
and resourcing. Some of the risks identified herein may or joint venture billing requirements. For ex-
cover more than one risk category, and many are also eth- ample, some contracts may stipulate what types
ics/fraud risks.3 or percentages of compensation and benefits are
chargeable, and such terms and conditions may
Employment Market Risk differ among customers and partners.
If the ECB is not competitive in the employment market,
the organization may fail to attract or retain individuals Financial Reporting Risk
with the necessary and desired qualifications to fill key The organization may:
roles. The organization could fail to achieve its goals and
objectives due to weak leadership. • Misclassify or hide over-generous, illegal, or unethi-
cal ECB, which could also lead to failure to disclose
Compliance Risk (compliance risk).
The organization may fail to comply with laws and regula- • Misclassify or misreport financial or operating data
tions if: to create the illusion that goals were reached (to
qualify for bonus payments or to improve/retain the
• It does not know or understand the applicable laws market value of equities, for example).
and regulations. • Report incorrect valuations or inappropriate es-
For more information, refer to the IIA publication “Managing the Business Risk of Fraud, a Practical Guide.” The document also discusses governance and audit procedures relevant to
3

this topic.

www.theiia.org/guidance / 2

timates and accruals due to poor accounting and
disclosure controls.
Reputation Risk
The organization may:
• Create internal morale issues if executives are eli-
gible for inequitable or unreasonable ECB.
• Fail to effectively develop, communicate, and de-
fend the ECB strategies, exposing the organization
to challenges by shareholders, employees, media,
government, and other stakeholders. Stakeholders
value transparency and organizations that accept
accountability for their decisions. An organization’s
reputation can be negatively impacted if stakeholders
perceive the ECB programs are rewarding failure or
socially unacceptable behavior, especially when the
organization is government funded or not-for-profit.
The organization should screen its strategies and
communications periodically to consider social and
economic factors.
Operating Risk
The organization may:
• Introduce a high opportunity for error or fraud
through the design of complex ECB programs. ECB
programs may have high inherent risk where they
involve many systems and departments, in-house and
third party administrators, and/or are highly regu-
lated. A complex legal structure in the organization is
often associated with a more complex EC structure
which increases inherent risk of error.
• Fail to design appropriate governance processes and
internal controls, resulting in inadequate feedback
and oversight to improve processes, inadequate
controls over inherent conflicts of interest in board
compensation and executive compensation, or pres-
sures leading to management override of controls.
• Fail to achieve its goals and objectives if the ECB is
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
poorly designed and fails to motivate executives.
• Fail to optimize costs (and meet shareholder expec-
tations) if the ECB is not linked to organizational
performance, both short and long term. However,
linking excessive portions of compensation to per-
formance may encourage fraud or other illegal or
unethical behavior. An excessive portion of com-
pensation linked to short-term performance targets
increases this risk.
• Fail to optimize costs if the full financial impact is
not considered when developing ECB strategies. For
example, some benefits may be attractive to execu-
tives but may not be deductible expenses when
calculating the organization’s income taxes, or may
not be recoverable as part of ‘overhead rates’ from
customers. Increases to ECB in response to tight
employment markets may also not be removable
once market conditions improve.
• Encourage behavior that is inconsistent with the in-
terests of relevant stakeholders (e.g., bonus practices
may reward excessive risk taking or, alternatively,
create a culture that does not innovate).
External Business Relationships
The organization may fail to:
• Adequately provide for control requirements in
contracts with outsourced service providers, such as
those that process payroll, pensions, etc.
• Monitor controls over information administered by
outsourced service providers.
Audit Approach
The CAE’s decision to perform an audit, the approach,
scope, and sample size, should be based on a risk assess-
ment of the subject, including the inherent risk of the pro-
cesses and potential consequences.
www.theiia.org/guidance / 3

Internal auditing should determine whether ECB will
be scoped as one audit or a series of audits. The audit(s)
could be further refined into reviews at subsidiary or divi-
sion levels; reviews of board compensation and benefits
and executive compensation and benefits; and reviews of
processes administered by the organization and those ad-
ministered by outsourced service providers.
If internal auditing typically conducts audits of depart-
ments rather than processes or subjects, proposing an
ECB audit would be different from the usual approach
because it crosses departments and requires the coopera-
tion of many department heads. The CAE could choose
to break down the subject into departments, such as hu-
man resources (HR), payroll, legal, accounts payable,
etc., so that each audit would cover the issues required
to ultimately form an opinion at the macro level.4 Audit
recommendations may also require the involvement of
many departments and, if significant, may require CEO
acceptance. The CAE should anticipate challenges and
consider this deviation from the norm in the audit plan.
There might be some concern from members of manage-
ment or the board if internal auditing will be evaluating
board governance of ECB and it has never audited board
processes before. However, board governance is a signifi-
cant control factor in ECB and usually is included in the
audit scope. The CAE may choose to conduct two audits,
one of the board processes and one of management pro-
cesses, before forming an opinion. Another approach is to
review the board processes as a consulting engagement
rather than as an audit.
Generally, an audit of ECB is a subset of the employee
compensation and benefit programs audit and is not a
comprehensive audit of all the systems used to admin-
ister and account for ECB. This guide assumes that the
payroll, accounts payable, banking, etc. functions are risk
For more information on forming opinions, refer to the IIA Practice Guide “Formulating and Expressing Internal Audit Opinions.”
4
The results of those audits may impact the reliability of the data used in an audit of ECB.
5
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
assessed and subject to separate audits.5 Internal auditing
should consider the results of these audits when planning
the ECB audit program. If these functions are not audited
independently, additional testing may need to be done, in-
cluding testing of relevant general information technology
(IT) and application controls.
In some organizations, the board or management requests
that internal auditing conduct specific tests on ECB re-
lated issues, such as an annual audit of executive expense
accounts. With the knowledge gained from a risk assess-
ment or ECB audit, the CAE could consider approaching
the board with a plan that would replace the annual audit
with a higher risk process, expand on the audit, or rotate
two or three key processes, to optimize risk assurance and
audit resources
The CAE also could approach an evaluation of ECB as a
consulting engagement, e.g., as a proactive review of ECB
to identify whether there are any issues that may be con-
trol weaknesses, embarrassing, or controversial. Because
ECB issues are often sensitive and developed at a senior
level, facilitating a control self-assessment by manage-
ment is not an optimum approach.
Auditing Board Compensation and Benefits
Management may develop recommendations for board
compensation and benefit programs, creating an oppor-
tunity for collusion or conflict of interest in board com-
pensation. The CAE determines whether to include board
compensation and benefits in the audit scope, and wheth-
er to test for board member use of assets and receipt of
payments. This determination should be consistent with
the charter of the internal audit activity. If the audit scope
includes the board, audit tests could include board mem-
ber names wherever the considerations included in the
Audit Program Development section of this guide men-
tion “executives and their families.”
www.theiia.org/guidance / 4

If management applies pressure to internal auditing re-
garding the audit work program and results, the CAE can
seek support from the board.
Auditing External Business Relationships
If internal auditing has never audited external business
relationships, and the risk assessment indicates that an
audit is warranted, the CAE needs to determine whether
the organization has the right to audit under the contract
and ensure that an appropriate audit reporting process is
developed.6
Audit Considerations
Executive and board compensation is often subject to
public disclosure requirements, accounting standards,
and external auditing. This should be factored into the
nature of work performed. For example, the external audi-
tors may have reviewed the completeness and accuracy of
reported benefits but not reviewed the controls for ensur-
ing appropriateness of those benefits.
If the board has not approved an audit of ECB as part of
the annual audit plan, the CAE should obtain such ap-
provals and buy-in to the scope before beginning. This
action provides the CAE with the support necessary for
such a sensitive topic and reduces impediments to the au-
dit process.
Access to Information
If there is no internal audit charter, or if the charter is not
clear about access to records, facilities, and personnel, the
CAE could use some of the risk, control, and governance
factors identified in this guidance to convince the board
and management of the value of such an audit and to gain
cooperation regarding full access.7 The CAE may request
that the chairman of the board and the CEO issue a mem-
orandum to the relevant board members and department
heads stating their support for the audit and encouraging
cooperation from all parties.
For more information, refer to IIA guidance “Auditing External Business Relationships.”
6
Refer to the International Professional Practices Framework Standards and Practice Advisories relating to key elements of an internal audit charter to effectively establish or modify a
7
charter for your organization.
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
Regardless of executive and board support, auditors may
encounter some resistance from personnel in the HR or
payroll functions. Part of their responsibility is to ensure
confidentiality and they may try to restrict the auditors.
Their level of concern is usually greater when dealing with
information about executives or pending program changes
that have not yet been approved or announced. Auditors
need not be intimidated or frustrated by this issue, rath-
er they should be aware of, and respect, these concerns,
while still getting the job done. Auditors can help these
personnel understand the internal audit activity, the scope
of access, the auditor’s professionalism, and how the in-
formation will be used and protected. Being responsive
to concerns may help reduce conflict and may require
being innovative in the audit approach or practices. For
example, the audit team might use senior level staff, such
as audit managers, to perform some of the more sensitive
tests, such as review of board materials.
Privilege
In some countries, certain organizations have the right to
invoke privileged communication between the organiza-
tion and its legal counsel. Management or the board might
invoke this right, and the CAE may be directed to conduct
the audit and communicate results in conformance with
legal requirements. To comply, the CAE must understand
how legal privilege applies to the organization and to in-
ternal audit work.
The CAE should consider the liability risk associated with
the audit, such as when an audit is initiated in conjunc-
tion with a fraud investigation. The CAE should consult
with legal counsel before beginning such an audit, as this
situation may be cause for invoking privilege.
Skills and Knowledge
Due to the sensitive nature of ECB, and the senior level
personnel involved, auditors should be discreet, tactful,
and confident. Generally a more experienced, senior-level
auditor is part of the team.
www.theiia.org/guidance / 5
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

ECB transactions in most organizations are recorded in • Is there enough information provided, with
electronic systems applications. Extracting and analyzing enough time to deliberate and ask questions be-
data and crosschecking between databases usually require fore making decisions? Is the information com-
the audit team to have IT skills and to use computer-as- plete and accurate?
sisted audit techniques. • Are the board members qualified, and do they
have independent,8 qualified advisers to help
Audit Program Development them make appropriate ECB decisions?
• Is the board seeing the full scope of ECB, or just
This section includes various concepts, potential tests,
a few elements (such as base salary and annual
and questions to help auditors create an audit program. It
cash incentive awards, without considering long-
is not a comprehensive list, nor should all of these consid-
term equity awards)?
erations be tested. As always, the risk assessment should
lead to development of an appropriate program. • Is the information system used for gathering and
summarizing information reliable?
Board of Directors and Committees • Are the organization’s programs benchmarked?
A critical board role related to ECB is to balance the in- Are the appropriate industries/competitors select-
terests of shareholders (risk management and fiduciary ed for benchmarking? Is benchmarking causing
responsibility) with those of management (who desire to unintended consequences such as a bidding war
be paid well commensurate with work performed). The or “competition of egos”?
board needs to approve a strategy that balances short- and
• Does the board understand the organization’s
long-term goals and attracts, retains, and motivates people
required disclosures and disclosure controls, and
to achieve those goals in an ethical culture. The board
does it approve disclosure of ECB?
is also responsible for managing the other ECB risks rel-
evant to the organization and managing the expectations • Does the board review and approve all relevant
of other stakeholders. aspects of the pension, profit sharing, and simi-
lar funds (e.g., fund managers, fund investment
The conflict of interest risk in ECB warrants board re- strategies, audits, disclosures, and valuations)?
sponsibility for risk assessment, approval, and monitoring. • Does the board receive and discuss results of
Most organizations use a board committee — the com- ECB audits by regulators or customers? Is the
pensation or HR committee — to perform this role. Many board reacting appropriately to such information?
organizations structure such a committee to be indepen-
dent from management, with the right to retain outside • Is there evidence of approvals for new ECB
advisers (legal or subject matter experts) to assist in evalu- programs and for material changes? Are board
ating strategies and programs. approvals made in compliance with bylaws and
granted authorities?
When designing audit procedures appropriate for the or- • How are board compensation and benefits de-
ganization and scope, there are several considerations. termined? Are independent and qualified advis-
ers used? Are board compensation and benefits
1. Board and committee terms of reference, minutes, programs benchmarked? Are they aligned with
agendas and information packages relevant to ECB. performance results?

Consider the volume, value, and types of other consulting work done for the organization by the advisory firm when evaluating the adviser’s independence.
8

www.theiia.org/guidance / 6

Auditing Executive Compensation and Benefits
2. Board self-assessment surveys and results (consider-
ing the impact of the responses in relation to ECB
governance).
• Is the board satisfied with its processes? With
management information? With its indepen-
dence? With its use of external advisers?
3. Board performance evaluations of the CEO and
other executives.
• Is it a reasonable process, and is it done fre-
quently enough? Is there a balance of short- and
long-term objectives? Are the compensation and
benefit awards aligned with organizational and
individual performance? Are all appropriate per-
formance criteria included?
• Is the board reviewing the performance evalua-
tions and subsequent compensation and benefits
that the CEO awards to his or her subordinates?
4. Key employee retention plans.
• Is the board considering the impact of ECB on
key employees identified in the retention and suc-
cession plans?
5. Employment contracts and termination agreements.
• Has the board signed any employment contracts
with the CEO or other executives? Did the board
obtain independent legal counsel?
• Have the terms and conditions been integrated
into the board’s risk discussions? Have they been
disclosed appropriately? Have they been account-
ed for appropriately?
• Does the board review employment contracts
signed by the CEO for other executive positions?
Along with reviewing documents, the internal auditors
• Do termination agreements appear to reward
can gather information by surveying the board and com-
failure (e.g., severance paid to “keep quiet” or
mittee members and/or interviewing them.
bonuses paid when results are poor)?
6. ECB strategies and objectives.
IPPF – Practice Guide
• Has the board articulated its ECB strategies and
objectives? Are the strategies designed to motivate
appropriate behaviors? Is the board monitoring
results? Would the strategies be deemed appropri-
ate by media, the public, or other stakeholders?
• How does the board deal with special circum-
stances? For example, if share market price is
an element of the bonus program, it is generally
assumed that management can impact the value
of the organization, and therefore the share price.
But is the bonus program re-evaluated when
significant market swings occur (either up or
down) that management cannot influence? Does
the ECB consider change of control (mergers and
acquisitions, majority ownership, or significant
change in board membership)?
• What is the strategy related to post-employment
benefits and severance (e.g., golden handshakes
or golden parachutes)?
• Does the ECB strategy balance the tangible
(money, assets) with the intangible (culture, op-
portunities, monitoring, status, mission) to attract
and retain appropriate personnel?
• Is the board aware of, and satisfied with, how
much HR and payroll costs (direct and adminis-
trative) are expended on behalf of executives and
how much for other employees?
• What is the strategy for offering allowances,
rather than reimbursement of expenses? Is it
reasonable and cost-effective?
• How does ECB fit into the organization’s risk as-
sessment, and what controls have been adopted
to ensure success?
www.theiia.org/guidance / 7

Management
There are a significant number of management responsi-
bilities involved in developing, administering, and moni-
toring executive compensation, so reasonable attention
is required when planning and scoping the audit. For ex-
ample, a simple objective, such as “Is the organization in
compliance with disclosure regulations?” requires review
of many systems, such as payroll, accounts payable, cost
center accounts, board processes, contracts, and regula-
tory filings and may extend beyond the organization into
external business relationships.
Internal auditors need to evaluate their organization,
regulated compensation and benefits for their operating
locations, and employment contracts for examples of po-
tential ECB to be scoped into their audit programs. Any
departments that could pay, reimburse, or pay suppliers
on behalf of executives and their families, as well as those
departments that manage company assets, might be in-
cluded in the scope.
There are several considerations when designing audit
procedures appropriate for the organization.
1. Compensation policies and procedures.
• Have they been approved by the board? Have
they changed, and are the changes significant?
Are they aligned with other board and manage-
ment strategies? Are all compensation programs
aligned within the organization, consistently re-
warding or penalizing similar behavior or actions?
• Are they administered effectively and applied
consistently and fairly by managers?
• Are proportions of short- and long-term, fixed and
variable (at risk), legally required benefits versus
optional, cash/non-cash reasonable? Are they
competitive in the market? Are they consistent
with industry standards?
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
• Do they cover post-retirement ECB (e.g., medical
and pensions)?
2. Payroll.
• Are the salary and benefits complete and accurate
(e.g., approved programs and increases/awards)?
• Are classifications, computations, withholding,
remittances, and filings compliant with regulatory
and contractual requirements?
• Do IT controls prevent unauthorized changes?
3. Accounts Payable.
• Are expense accounts in compliance with com-
pany policies, regulatory requirement, and con-
tractual obligations?
• Can the vendor master be compared with the
check register for payments made to executives or
their family members (e.g., address matching)?
• Do IT controls prevent unauthorized changes?
• Are expense accounts of executive assistants
unreasonable, or are the executive’s expenses
claimed by the assistant and approved by the
executive?
• Can accounts payable and treasury records be
crosschecked with addresses from HR for pay-
ments sent to executives or their family (for ac-
tive, retired, and terminated employees)?
• Can the “ship to” addresses from purchase orders
be crosschecked with employee addresses?
4. Corporate treasurer or finance function.
• Are cash advances or petty cash reimbursements
to executives or family members used appro-
priately? Are advances cleared appropriately, in
compliance with policies and procedures?
• Have wire transfers to executives, their families,
and organizations commonly known to supply
www.theiia.org/guidance / 8

perquisites (e.g., for vehicle repairs, golf or enter-
tainment facilities, clubs, transportation, and gift
shops) been accounted for appropriately?
• Have share transfers to executives and family
members been controlled appropriately? Are
regulations affecting securities trading complied
with (e.g., trading bans and blackout periods)? Do
compensation or benefits that are paid as shares,
rights, warrants, or options (related to company
stock) require strong controls to ensure valuation,
accounting, disclosure, and taxation are handled
appropriately?
• Do payments made to the organization by execu-
tives indicate undocumented loans or reimburse-
ment for personal use of the organization’s credit
card?
5. Audit results and action plans.
• By regulators, such as government tax authorities
or securities exchanges.
• By customers, who may have the contractual right
to audit direct costs or rates charged.
• By external auditors for compliance with account-
ing standards, disclosure requirements, and ethics
or risk management issues.
• Does management’s strategy appear to be “We’ll
do it this way until we get caught”? Are internal
control weaknesses addressed timely and appro-
priately?
6. Market surveys, employee satisfaction surveys, and
benchmarks.
• Do results indicate ongoing or pending issues?
Have they been reviewed with the board and
executive management?
7. Public perception.
• Does the company receive recognition, such as
“Top 10 Companies to Work For,” “CEO of the
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
Year,” news clippings regarding ECB, etc.?
• Do payments from executive programs appear to
reward failure —for example, a bonus paid to an
executive for achieving targets through significant
lay-offs or facility shutdowns? This action could
lead to public outrage if the perception is that
the executive’s income is more important than
the employees’ incomes. Other examples include
significant payments to executives who are termi-
nated for failure to perform (golden parachutes)
or to encourage an executive to “go quietly.”
8. Employment contracts, including termination and
loan agreements.
• Are employee loans legal? If so, are there any
regulatory restrictions that apply to loans?
• Are the loans given at market interest rates, or
below? Are repayment terms reasonable, and are
they being met? Is there collateral/security for the
loan? Check for loan write-offs or loan forgive-
ness.
• Are key executives entitled to any of their em-
ployer’s products or services free of charge or
at a discounted rate? If so, is this appropriately
recorded and approved?
9. Turnover statistics, exit interviews.
• Do results indicate ongoing or pending issues?
The auditor may expand the audit program based
on these results.
• Have these results been reviewed with the board
and executive management?
10. The administrative cost center charges for execu-
tives/administrative assistants.
• Are there charges paid directly to vendors where
the executive benefits? These could include
charges for clubs, travel, gifts, and entertainment.
If so, have the charges been approved and report-
ed/classified appropriately?
www.theiia.org/guidance / 9
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

11. Facilities and equipment. department than the general employee benefit
payment system handles the executive payment/
• Can use of the organization’s assets by the execu-
reimbursement process (e.g., one reimbursement
tive and his or her family provide useful informa-
processed through payroll and another through ac-
tion to evaluate potential ECB (e.g., by checking
counts payable). Take for example reimbursement
logs and manifests)? Assets to consider include
of employees at a specific rate for each mile/kilo-
company vehicles (e.g., planes, trains, automo-
meter driven (to cover operating and capital costs)
biles, trucks, boats, snowmobiles, and jet skis),
when the executive is also provided with a vehicle
housing (e.g., homes, apartments, resorts, cabins,
or vehicle allowance.
trailers, hotels, and camps), dining and entertain-
ment facilities (e.g., cafeteria, catering contracts, 15. Employment taxes.
restaurants, meeting rooms, theatres, and audito-
• Are benefits handled via accounts payable or simi-
riums), and computers and telecommunications
lar, non-payroll functions?
(e.g., laptops, blackberry devices, phones, printers,
photocopiers, cameras, and software). • Are specified benefits taxable in one jurisdiction
(country, state, or province, etc.), but not taxable
• Are some of the assets located in personal resi-
in another? If so, is the organization treating the
dences?
benefits appropriately on tax returns and financial
12. Financial reporting. statements?
• Are accounting and financial reporting correct? For 16. Metrics Used for Calculation of Compensation.
example, are costs in the right accounts, cut-offs
• Are compensation amounts based, at least in part,
appropriate, accruals, estimates and valuations
on specified metrics? If so, are metrics easily verifi-
appropriately applied to transactions, commit-
able (e.g., based on public external data such as
ments, and agreements? Are significant variances
stock price or revenue growth) or dependent on
explained?
internal data which is not as easily verified?
13. Public and Regulatory filings (ECB related, such as
17. Override of ECB controls.
disclosures and taxes).
• Is it possible for management to override con-
• Are they complete, accurate, and timely?
trols in ECB, including IT controls? For example,
• Are descriptions of ECB elements clear and un- executives could apply pressure on clerical staff or
derstandable, providing the right level of transpar- their administrative assistants.
ency?
• Are ECB amounts accurately presented, derived
External Business Relationships9
from processes with sufficient internal controls?
Many organizations outsource compensation and ben-
14. Double dipping. efit services as well as payroll and accounting services. If
vendor audits have been scoped into the audit plan, some
• Is it possible for an executive to be reimbursed
of the previous review considerations may need to be
twice for some expense? The risk of double
performed.
dipping is greater when a different system or

For more information, refer to the IIA Practice Guide “Auditing External Business Relationships.”
9

www.theiia.org/guidance / 10
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

Reputation risk is often based on association with, deemed vendor’s customer.

influence over, or deemed agreement with ECB policies of
business partners. For example, an executive may receive
remuneration as an officer of a related organization. If joint
venture or partnership arrangements are included in the
scope, consider designing your audit program with the fol-
lowing considerations.
External organizations may restrict access to certain pro-
cesses or information. Internal auditing may need to use
an independent third party to perform all or part of the
audit and provide assurance.

Within your organization:

• Do contracts include a “right to audit clause” and

requirements for confidentiality? Have they been ap-
proved appropriately?
• What are the criteria for selecting vendors and were
they followed? How is vendor performance measured
and reported?
• What proportion of the vendor fees are related to
serving executives versus other employees?
• How are vendor controls monitored by the contract
or program manager?

Within the service provider’s organization:

• Are there adequate IT controls to protect the organi-

zation’s information? Attestation standards from pub-
lic or regulatory audit standard setters are a source of
information.
• Are distributions to executives accurate and com-
plete? Are they compliant with policy? How are
changes authorized?
• Is there evidence of the organization’s entertainment
of executives (vendor expense accounts and promo-
tional activities such as golf tournaments, fishing
or resort trips, and gifts)? Is it consistent with both
organizations’ policies?
• Is there evidence of possible conflict of interest with
the vendor’s customer list? For example, a board
member works for an organization that is also the

www.theiia.org/guidance / 11

Appendix A –
Types of Executive
Compensation and Benefits
There are many compensation and benefit types, but those
discussed herein are generally unique to executives, or
where executives receive enhanced programs and payouts
compared with other employees.
To determine which ECB programs to include in the scope
of an audit, auditors should consider the unique aspects of
the ECBs of the organization, employment contracts, regu-
lated compensation, and complexity of the organization.
Family members also may obtain benefits that are attribut-
able to the executive. Some benefits are considered tax-
able income for the recipient and some are not deductible
by the organization for tax purposes (varies based on legal
jurisdiction). Some compensation and benefits are legally
mandated, while others are discretionary (varies based on
legal jurisdiction), and some forms of benefits may be con-
sidered illegal in some jurisdictions.
If the organization offers any ECB programs to contractors,
the internal auditor should consider the potential legal and
ethical impacts.
Compensation
Allowance: Fixed payments paid periodically to reason-
ably approximate the employee’s costs for a particular type
of expense (e.g., car, housing, and clothing allowances).
Once received, employees may use the money as they
choose.
Awards:10 Similar to a bonus, but most often used to re-
ward individual goal achievement (e.g., safety milestones
or years of service) or for unexpected or extraordinary
In Australia, an award is a pay scale related to an industrial agreement (union led); however, in many international organizations, an award is as described in this appendix.
10
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
performance. Awards may be paid as a fixed amount or a
percentage of salary, and may be paid in currency, shares,
gift cards, property, or services (e.g., vacations, cars,
jewelry, and spa treatments).
Bonus: Remuneration paid for achieving a specific goal.
Bonuses may be structured for short- or long-term perfor-
mance of the organization, department, or individual. Bo-
nuses are generally paid once, then must be earned again.
Bonuses may be paid as a fixed amount or a percentage of
salary, and may be paid in currency, shares, stock options,
property, or services (e.g., vacations, cars, jewelry, and spa
treatments). Bonuses based on organization goals may be
referred to as profit sharing, gain-sharing, “tantieme”, or in-
centive plans. Gain sharing is a program that returns cost
savings to the employees, usually as a lump-sum bonus.
It is a productivity measure, as opposed to profit sharing,
which is a profitability measure.
Commission: Pre-established remuneration paid for
achieving specific sales (per piece, volume, or value based)
or a marketing service goal (e.g., referrals to new customers
or entry into new markets).
Pension: A fixed or variable rate of remuneration paid
periodically to a former, qualified employee (or his or her
beneficiary) who has reached a specific retirement age or
is deceased. Pension plans are often defined benefit plans
or defined contribution plans and are highly regulated in
many countries. Employees may receive pension payments
from both their employers and from governments. Pen-
sion plans may be combined with insurance schemes in
superannuation plans or provident funds for the welfare
of the employee. Executives generally have enhanced pen-
sion plans that exceed the standard for other employees. A
company may offer various types of retirement plans (e.g.,
qualified for preferential tax treatment or non deferred
benefit plans) and all should be reviewed for benefits due
an executive.
www.theiia.org/guidance / 12

Perquisites: Benefits (often called fringe benefits) offered
at the employer’s discretion, rather than benefits required
by law. Examples of perquisites include company cars or
car allowances, parking, airline lounge memberships, and
use of corporate jets. Perqs (colloquial term) are often se-
niority based and may also include the “right of first refusal”
for event tickets, job openings, conference attendance, etc.
Severance: Remuneration made to an employee upon
termination from the organization. Severance can take the
form of a lump sum payment or may be paid out over a
specified period. Severance may be paid as a fixed value or
a percentage of salary, and may be paid in currency, shares,
property, or services (e.g., health-care benefits, outplace-
ment services, cars, jewelry, club memberships, and access
to employee discounts). Severance is generally determined
by laws and company policy, which is influenced by case
law (from court rulings on cases of challenges to sever-
ance pay). Executive severance that has been pre-agreed
in an employment contract is often referred to as a golden
handshake or a golden parachute. Severance may also be
referred to as a gratuity payment. Executives generally re-
ceive enhanced severance programs compared with other
employees.
Benefits
Athletic or Cultural Facility Seats: The purchase of
seats or facilities (boxes) in sports arenas or performing arts
centers with the intent to use the tickets for entertaining
customers and as employee rewards. Personal use of the
tickets by executives, directors, and employees is consid-
ered a benefit.
Athletic, Cultural, Dining, and Travel Club Mem-
berships: Reimbursing or paying directly for employee
(and/or family) memberships in health clubs (e.g., gyms,
spas, pools), sports clubs (e.g., golf or tennis), entertain-
ment clubs (e.g., gambling, dining and dancing), and air-
line lounges as benefits.
IPPF – Practice Guide
Auditing Executive Compensation and Benefits
Financial and Retirement Planning: An allowance or
service that assists the employee in creating and managing
a personal financial plan and budget. Accounting and tax
preparation services, as well as advising on investment and
tax strategies, also may be included.
Gifts: Gifts can include currency (e.g., cash or gift cards
for retail outlets), shares, property, or services (e.g., vaca-
tions, cars, jewelry, and spa treatments) given to employ-
ees. When business property that is regularly used by the
employee is given to the employee upon termination, this
is considered a gift (e.g. office furniture, phone, computer,
and tools).
Health Examination Allowance: An allowance typically
up to a certain value for a periodic health examination.
Insurance: Payment for all, or a portion of, premiums for
life and disability insurance, medical and dental care, un-
employment insurance, home and car insurance, etc. The
organization may also choose to self-insure and pay directly
for any of these types of losses, or they may reimburse em-
ployees for all or a portion of insurance coverage or deduct-
ibles.
Loans: No- or low-interest loans to employees for reloca-
tion, purchase of company shares, purchase of home com-
puters, etc.
Outplacement: Services provided to assist terminated
employees in preparing for and finding employment else-
where.
Personal Use: Free, personal use of company facilities or
equipment, such as housing, dining rooms, hotels, resorts,
computer and communication technology, recreational ve-
hicles (e.g., snowmobiles, jet skis, yachts), theaters, and
cameras. Free personal use of the organization’s services
is also a benefit, including beauty treatments, professional
services, facility and equipment maintenance, decorating,
delivery, and use of staff to help with a personal activity.
www.theiia.org/guidance / 13
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

Relocation: Covers the costs associated with transferring • Public transit passes or tickets.
an employee to a new location. Benefits are often derived • Transportation from home to work (e.g., by bus).
from the types of costs covered by the relocation program.
• Use of the company airplane, train, or boat.
For example, allowances may be paid for miscellaneous
costs, loans to purchase houses, signing bonuses, remote • Purchase of airline tickets or vacation packages.
location allowances, storage of personal effects that re- • Frequent flyer points from trips taken for business
main behind, tax and financial planning services, pass- purposes, if the employee is able to use the points for
ports, language training, guarantees of spousal income or personal travel.
spousal placement services, guaranteed paid trips to alter-
Taxes: When the organization pays the employment/in-
nate locations (e.g., family visits), tuition fees and school
come taxes on behalf of the employee, by paying the gov-
searches for children, maintenance of recreation property,
ernment directly, by reimbursing the employee, or by in-
and paid leave for moving.
creasing bonus payments to cover the estimated cost of
taxes.
Savings and Investment: Programs that facilitate and
administer employee savings. Many organizations choose
to contribute to such investments.

Security Services: Usually provided as a result of threat

assessments and risk management programs, but they also
may have a personal benefit associated with them. Ex-
amples of security services include personal bodyguards,
alarm systems or patrols in the homes of executives, home
safes or panic rooms, and self-defense training. Security
Services may also be known as Executive Protection Pro-
grams.

Transportation: Transportation available to employ-

ees, and/or their families, for personal use (i.e., no busi-
ness purpose can be rationalized, or the transportation is
deemed as personal by regulations). Benefits take many
forms, including:

• Allowances.
• A vehicle — where the organization purchases or
leases a car, truck, etc. A process for reimbursement
of operating expenses often accompanies this benefit.
• A vehicle and chauffer.
• Parking.
• Airline lounge memberships.

www.theiia.org/guidance / 14
 IPPF – Practice Guide
Auditing Executive Compensation and Benefits

Authors:
• Lynn C. Morley, CIA

Reviewers and Contributors

• Abraham D. Akresh
• Douglas J. Anderson, CIA
• David F. Bentley
• Steven E. Jameson, CIA, CCSA, CFSA
• Norman D. Marks
• James A. Rose, III, CIA

www.theiia.org/guidance / 15
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice Guides embody an IIA statement to as-
sist a wide range of interested parties, including Copyright
those not in the internal audit profession, in un- The copyright of this practice guide is held by The
derstanding significant governance, risk, or con- IIA. For permission to reproduce, please contact
trol issues and in delineating the related roles and The IIA at guidance@theiia.org.
responsibilities of internal auditors on a signifi-
cant issue. Practice Guides are part of The IIA’s
International Professional Practices Framework.
As part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended and the guidance is
endorsed by The IIA through formal review and
approval process. For other authoritative guid-
ance materials provided by The IIA please visit
our Web site, www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 IPPF – Practice Guide

Auditing External
Business Relationships

MAY 2009
 IPPF – Practice Guide
Auditing External Business Relationships

Table of Contents
Introduction..................................................................................................................1

Executive Summary......................................................................................................1

Overview of External Business Relationships (EBRs)...................................................2

Examples of EBRs.........................................................................................................2

Benefits of EBRs...........................................................................................................3

Business Risks of EBRs................................................................................................6

Auditing EBRs.............................................................................................................12

Understand the Organization and Its Relationships.............................................13

Assess Risks and Controls...................................................................................13

Perform Audit Procedures....................................................................................14

Report..................................................................................................................14

Monitor Progress.................................................................................................15

www.theiia.org/guidance / A

Introduction
This guide provides internal auditors with guidance in au-
diting external or extended business relationships (EBRs).
Management also may use this guide in managing and
monitoring the risks associated with these relationships.
Executive Summary
When contemplating the role of the internal audit activity
in external business relationships, consider the following:
1. Organizations have multiple EBRs that satisfy a variety
of business needs;
2. Each relationship presents risks;
3. It is management’s responsibility to manage these risks
and achieve the benefits;
4. Internal auditing plays a key role in assisting manage-
ment and validating management’s efforts.
Organizations conduct business with EBR partners for a
variety of reasons. Organizations may seek benefits like
enhancing revenues through licensing and distribution ar-
rangements, reducing costs in areas of an organization’s
that are outside of its core competencies, or augment-
ing existing resources focused on its core competencies.
However, with these business relationships also comes
inherent and control risks associated with working with
external business partners. By associating with exter-
nal partners, an organization often bears risks similar to
those it would experience internally, without the external
association (for example, an organization still bears risks
for outsourced processes). In addition, the organization
is exposed to risks imposed by association with the third
party, as well as the activities of the third party, including
reputation, brand, and economic risks. Internal auditors
can help management and the board identify, assess, and
manage these risks.
Organizations’ managements are responsible for manag-
ing and monitoring their EBRs and related risks. While
IPPF – Practice Guide
Auditing External Business Relationships
entering into a business relationship does allow an orga-
nization to create benefits and share some risk with the
EBR, the organization still retains ultimate responsibility
and accountability over a number of risks. Not all risks
can be relegated to the business partner. The organization
needs to monitor and manage these risks.
The organization is responsible for risk management ac-
tivities encompassing tasks such as selection of business
partners, contract effectiveness, partner/customer con-
tract management controls, contract compliance monitor-
ing and reporting, and business relationship management.
Without proper controls in place to address the risks as-
sociated with these responsibilities, the organization may
lose revenue or incur higher costs, as well as have ineffi-
cient operations, misreporting, and even damaged brand,
in addition to impacted business relationships.
By taking ownership and control of these responsibili-
ties, organizations have the ability to reduce risk and help
foster a relationship of trust and accountability with its
business partners. With good oversight of its business re-
lationships, an organization can account for all revenues
and potentially reduce costs the organization can receive
the full benefits of the business relationship.
Internal auditors need to understand all of the elements
associated with EBRs, from initiating a relationship, con-
tracting and defining a relationship, procurement, manag-
ing and monitoring the continued relationship (including
control environment considerations of objectivity and in-
dependence of those responsible for managing and moni-
toring), and finally discontinuing the relationship. After
understanding the expectations of both parties, along with
the appropriate processes to manage and monitor the re-
lationship, the internal auditor develops an appropriate
audit program with relevant audit objectives for audits of
external relationships. In addition, internal audit proce-
dures may include elements of evaluating adherence to
(and compliance with) contractual terms to determine
whether monetary and non-monetary obligations are met.
www.theiia.org/guidance / 1
 IPPF – Practice Guide
Auditing External Business Relationships

It is important for organizations to know that they are
getting what they are paying for, that they are collecting
what they are earning, or, simply, that they are receiving
the benefits anticipated from the relationship. Such audit
procedures may uncover missed revenue or cost savings,
improve reporting accuracy, and enhance value resulting
from the relationship through one or more of the follow-
ing: limiting fraudulent activity, increasing trust within the
relationship, fostering feedback, improving relationships,
and helping management improve internal and external
controls.
Overview of External Business
Relationships (EBRs)
“External business partners,” “extended relationships,”
and “contractual relationships” are among the numerous
names by which today’s organizations define their extend-
ed business relationships. Throughout this practice guide
we will simply refer to these relationships as EBRs and
the other entity as the EBR partner.
Organizations often use business relationships and varied
partnerships to accomplish their objectives. To support
and sustain growth, businesses are increasingly supported
through outsourcing and licensing. More than ever, prod-
ucts and services are now developed through strategic al-
liances and joint development arrangements. Businesses
have chosen to leverage these business relationships for
reasons ranging from cost savings, a more economical
or efficient labor force, increasing customer reach and
scalability, or enhancing access to new technologies or
a known brand. This business model, where businesses
are interdependent, and where “external” and “extended”
business relationships exist, is also known as the extended
enterprise.
As used in this guide, EBRs do not include business rela-
tionships where the organization only furnishes informa-
tion to other organizations and relationships are not nec-
essarily created as a matter of choice; examples include
rating agencies, financial analysts, and tax authorities.

Examples of EBRs
Relationship Type Service Examples
Service Provider • Processing (e.g., benefits, payroll)
• Accounting/computer service centers
• Information technology
• Shared service centers
• Internal audit co-sourcing or outsourcing
• Warranty processing
• Call centers
• Advertising/marketing
• Leasing
• Construction

www.theiia.org/guidance / 2
 IPPF – Practice Guide
Auditing External Business Relationships

Examples of EBRs continued

Supply-side Partners • Production outsourcing or assistance

• Research & development
• Suppliers/vendors
• Software development

Demand-side Partners • Distributor/reseller

• Franchisee
• Licensee
• Replicator
• Original equipment manufacturer (OEM)

Strategic Alliances, Consortia, and
Joint Ventures
• Cost sharing relationships (e.g., pharmaceutical development, production and
distribution of oil and gas products, and media production and distribution)
• Revenue sharing relationships (e.g., pharmaceutical development and media
production and distribution)
• Profit sharing (e.g., real estate, pharmaceutical, media)
• Combination of the above

Intellectual Property (IP) Partners • IP licensees

• Internal IP usage (e.g., software)
• Bandwidth (e.g., telecom)
• Subscribers

Benefits of EBRs
Organizations choose to do business with EBR partners
for a variety of reasons. There is value that an EBR partner
brings a value that an organization, by itself, cannot effi-
ciently or effectively create for its customers and potential
customers. Some of the more common reasons for using
EBRs include cost savings and leveraging a competence
of the EBR partner that is not a core competence of the
organization; but the benefits of using an EBR do not end
there. See the table below for some of the benefits of us-
ing an EBR partner.

Benefit description of benefit

Cost Reduction • Access to EBR partner’s lower cost structure
• Lower labor cost
• Reduce operational inefficiencies

www.theiia.org/guidance / 3
 IPPF – Practice Guide
Auditing External Business Relationships

Benefits of EBRs continued

Organization focus on core capabilities • Allow the organization to focus on primary business and core competencies
and offerings • Better use of in-house resources
• EBR partner’s comparative advantage in providing service

Improved quality of service or product • Utilize expertise of EBR partner

• Combined and collaborative knowledge brings together strengths of
each organization
• Reduction in operational inefficiencies and errors

Access to new markets • Increased opportunities to reach new markets

• Leverage relationships through EBR partners
• Economies of scale and size
• EBR partner’s knowledge of local culture and language

Timely completion of projects • Timely, agile, and flexible resource pool, including personnel
• Larger and deeper knowledge pool to develop and implement more efficient and
productive action plans

Resource augmentation • Larger and more flexible personnel resource pool

• Access to a new resource pool of knowledge
• Access to better technologies and skills

Sharing of risk and risk management • Sharing of investment risk

• Increased agility to allow an organization to change and react to risks
more quickly

Organizations may reduce costs through EBRs. For ex-
ample, costs may be reduced through leveraging an EBR
partner’s lower cost structure which could exist through
a greater economy of scale or location in a country with
lower labor costs. Organizations that choose to proceed
without using EBR partners are responsible for all costs,
including research, marketing, development, and employ-
ee costs. Cost reduction is a common reason organizations
choose to work with EBR partners.
Another key benefit gained through EBRs is enablement;
an organization can leverage the capabilities of others and
may focus on its own core competencies. Through the
use of EBRs, organizations do not spend their resources
on areas where they do not have expertise. By spending
resources on non-core competencies, organizations may
lose their competitive advantages and valuable internal
resources such as employees are required to support a
ctivities that tend to be more costly and less profitable.
Meanwhile, resources pulled from an organization’s
core business could cause a reduction in the success of
its core business. EBR partners can solve this problem
by addressing those areas outside of the core business,
and internal resources can better leverage their skills by
focusing on the core business.

www.theiia.org/guidance / 4

EBR partners also have the ability to help the organization
deliver improved services or create an improved product.
An EBR may bring specialized skills or knowledge that an
organization does not have. This knowledge and skill can
greatly enhance the organization’s service or product by
bringing innovation, learned efficiencies, and many
other attributes the organization may not have. In addi-
tion, this collective knowledge and knowledge sharing
may lead to greater innovation and better products and
services as skills are used collaboratively.
EBRs may bring access to new markets. An EBR partner
may have a presence in an existing market where an or-
ganization is trying to enter. By working with that EBR
partner, the organization increases and enhances its abil-
ity to penetrate and grow within that new marketplace.
The EBR partner may be able to share its relationships;
it may have a known brand the organization can leverage
in the new marketplace, it may have capabilities to lever-
age the organization’s intellectual property, or it may have
regulatory, cultural, or other relevant knowledge of a new
marketplace the organization does not have. An EBR part-
ner may also increase an organization’s ability to penetrate
and grow within a market through increased economies
of scale and size by providing resources to help match the
accelerated growth within a new market.
Projects may be completed more timely with the help of
EBRs. One of the benefits EBRs can provide is a larger,
more flexible resource pool. They can quickly provide an
organization with skilled, specialized resources, which
can help with the timely completion of projects that the
organization may not have the resources to complete. In
addition, EBR partners may have more experience in the
area the organization is seeking help with, which can im-
prove the likelihood for timelier completion of tasks and
projects. The organization will not need to struggle on its
own as it learns on the job. Ramp-up time will be reduced
through the benefit of known successes and operational
efficiencies from the EBR partner.
IPPF – Practice Guide
Auditing External Business Relationships
In general, an EBR partner can augment and improve the
overall resource pool with experienced, knowledgeable
skilled personnel on a greater scale. This resource pool
can augment areas of weakness for which an organization
may have neither the resources nor inclination to address.
EBR partners can also provide resources other than per-
sonnel, such as technology, to benefit an organization.
Access to specialized technology can provide the organi-
zation with benefits such as automating existing manual
processes, thus improving operating efficiency, produc-
tion and service quality, or increasing the scalability of an
organization’s output or reducing errors. Using an EBR
can help the organization improve its internal controls, for
example when the EBR partner has stronger controls than
the organization.
Lastly, through EBRs, an organization can benefit through
the sharing of risk and risk management. An organization
can share its investment risk with an EBR partner in a
new venture through capital investment, resource invest-
ment, and time investment. This may be the most com-
mon way in which organizations share risk. By sharing its
capital, resources, and time investments in a project or
venture, an organization reduces its risk of “putting all of
its eggs in one basket.” The impact to an organization is
reduced if business partners share in these investments,
allowing the organization to make other investments and
diversify its portfolio. Risk can also be reduced and risk
management improved through EBRs. The comparative
advantages that an EBR partner brings may be in areas
that address the biggest risk an organization faces, thus
reducing the overall risk of a project or venture. Benefits
can include an increased ability to react to risks and make
the appropriate changes with the EBR partner’s resourc-
es, knowledge, and skills available. Because an EBR may
provide these benefits, internal auditors need to consider
EBRs in making recommendations to improve operations
and controls.
www.theiia.org/guidance / 5
 IPPF – Practice Guide
Auditing External Business Relationships

Business Risks of EBRs

Even though EBRs are designed to achieve benefits, there
are significant overall and detailed risks. The following
table lists a few examples of general business objectives
and goals, associated risks, as well as potential control
activities to mitigate those risks. Risks and controls as-
sociated with a sound procurement and contract manage-
ment process are not addressed in the table below; rather,
they are addressed in various IIA publications and training
courses. Further, many aspects of Corporate Social Re-
sponsibility (CSR) are relevant when conducting business
with EBRs. The table below briefly touches upon a few
CSR concepts, but a broader discussion can be found in
other IIA publications and information.
To achieve the benefits of EBRs and mitigate the associ-
ated risks, the organization needs to develop appropriate
procedures and controls. These are addressed in the chart
below and include the need to comply with EBR agree-
ments and to proactively manage the relationship to en-
hance value and minimize risk.

Potential Risks that May Possible Organizational

Goal / Objective Prevent Achievement of Goals Activities to Mitigate Risks
Note: In each example below, conducting audits of EBR
and Objectives compliance is generally appropriate.

1. Identify and assess all EBRs
EBRs are not identified.
Additional risks:
• Relationships not identified cannot be as-
sessed nor monitored appropriately.
• Relationships not identified may not have
contracts in compliance with organization’s
contract policy and guidelines or organiza-
tion’s EBR policy and guidelines.
Designated employees document all EBRs and
keep the documentation current.
Supervisors review the documentation for ap-
propriateness.
Identify risks inherent in each relationship and
assess residual risks, after considering controls.

2. Maintain positive reputation EBR’s actions negatively impact organization’s
reputation.
Additional risks:
• EBR misrepresents organization values.
• EBR does not comply with contractual
obligations.
• EBR violates laws and government regulations
Legal department reviews contract to determine
whether it includes ethical standards, compli-
ance with laws/regulation clauses, compliance
requirements with specific organization values,
and a well-documented right to audit (more than
‘books and records’, it relates to the broader
relationship risks).
When the relationship is initiated, appropri-
ate due diligence is performed to determine if
the EBR is likely to misrepresent organization
values.

www.theiia.org/guidance / 6

Business Risks of EBRs continued
3. Minimize insurable risks
(e.g., professional indemnity)
EBR partner does not maintain adequate/
effective insurance coverage, including for the
following:
• Workers’ Compensation (e.g., for time lost due
to injury)
• Professional Indemnity
• Public Liability
• Motor Vehicle Insurance
Additional risks:
Other risks arise where consortia are formed
to provide a service or where the organization
providing the service is a subsidiary of a larger
organization (especially where the parent is not
based in the same country):
• Insurance recommended for the particular
contract might not cover all of the consortia
members for that particular contract.
• In the case of a subsidiary, the insurance rec-
ommended for the particular contract might
not apply to the subsidiary and/or the country
in which the work is to take place.
• The parent company takes actions that void
the insurance coverage of the subsidiary.
• Solvency of the underwriter and reinsurers.
IPPF – Practice Guide
Auditing External Business Relationships
Management review of adequacy and effective-
ness of EBR partner’s insurance coverage, before
signing of contract and during the life of the
contract. Management may review:
• How the level of insurance was determined,
and whether or not it is adequate.
• Whether insurance needs to be increased
during the term of the relationship (e.g., the
effect of inflation; previous claims record of
provider).
• Whether EBR partners provide third party
proof, such as a certificate from the insurance
company.
• Contract clauses that require provider
furnishing updated insurance certificates dur-
ing long term contracts (where the contract
extends beyond the expiry date of the initial
insurance certificate).
• Effectiveness (including solvency) of
insurance provider.
Management’s review may include engaging an
insurance specialist, review of case histories
for similar circumstances, direct inquiry of the
insurance company, and review of insurance
coverage of the consortia or subsidiary.
www.theiia.org/guidance / 7

Business Risks of EBRs continued
4. Clear understanding of Service levels are inadequate or unsatisfactory.
service levels between the Disputes or disagreements regarding the scope
organization and its EBR of services between the organization and its
EBR.
Additional risks:
• The scope of the EBR’s deliverables are not
adequately defined in contract documentation,
a memorandum of understanding, a service
level agreement, or some other similar docu-
mentation detailing the terms of reference.
• Differences in understanding or interpretation
of the service requirements.
Initially, this may be documented in a request for
tenders/quotes, where an organization requests
potential EBR partners to provide the best value
for money solution.
Products to be delivered or constructed may be
defined in a scope of work document that defines
quality requirements, regulations or standards to
be complied with.
Whatever the form of service or product to be de-
livered, the guiding principle is that the service
or product to be delivered is adequately defined,
understood and agreed upon by all parties.
IPPF – Practice Guide
Auditing External Business Relationships
Management and legal review of contract for the
following:
• Are the contract and/or supporting documen-
tation clearly documented?
• Have key stakeholders in the relationship
approved the document?
• Does the contract include an adequate right
to audit clause (not just limited to financial
books and records) and an agreed-upon
disputes resolution process?
• Has responsibility for managing the contract
been assigned?
• Does the contract include clear duty to report
key parameters on a regular and timely basis?
• Does the EBR partner have adequate skills
and experience?
• Are invoices received from the EBR partner
adequately documented to enable identifica-
tion of “out of scope” requests?
• Are approvals for work to be performed and
payments to be made at an appropriate level
of authority?
• Are processes adequate to measure and
validate expected levels of service?
• Is information provided by the EBR partner
validated for accuracy, relevance and
timeliness?
www.theiia.org/guidance / 8

Business Risks of EBRs continued
5. EBR is able to provide
services without conflicts of
interest interest prior to accepting appointment.
6. The organization receives
appropriate remuneration for
intellectual property (IP).
The EBR appropriately
secures the organization’s
intellectual property (IP)
EBR identifies conflicts of interest in providing
services.
Additional risks:
Conflicts of interest may be actual, potential, or
perceived. A conflict of interest may not neces-
sarily preclude an EBR from providing a service;
however, adequate controls are needed to miti-
gate the risks. Examples of how these may arise
in an EBR include:
• Quality or timeliness of work may be ad-
versely affected due to other contracts in place.
• Information obtained during the contract
may adversely influence decision making due to
other contracts in place.
Intellectual property (IP) licensed to others could
be receiving inappropriate royalty streams.
Theft or misuse of ideas or technology.
Additional risks:
• Revenue leakage
• Breach of confidential information
• Inappropriate usage of intellectual property
• Risks associated with differing jurisdictions,
legal practices, legal inefficiency, or even
legal corruption. To reduce the risk in countries with less than
IPPF – Practice Guide
Auditing External Business Relationships
• Requiring the EBR partner to declare any
actual, potential, or perceived conflicts of
• Requiring the EBR partner to declare any
actual, potential, or perceived conflicts of
interest as and when they may arise through-
out the contract.
• Management review of declarations of interest
for impact and to decide whether this is a
contract violation and what action to take
Management and legal review to determine
whether contract includes clauses that ideas,
technology, and/or intellectual property (IP) sup-
plied by the organization are receiving appropri-
ate royalty streams and remain the organiza-
tion’s property.
The contract is clear as to measurement and
validation of royalty streams and who owns the
IP generated as a result of the contract and what
the provider can and cannot do with such IP.
adequate legal protection, the contract with the
EBR partner is written so that the EBR partner
shares in the loss of poor control over IP.
www.theiia.org/guidance / 9

Business Risks of EBRs continued
7. Accurate fees for
EBR services performed.
8. Risk of EBR going out of
business is consistent with
organization’s expectations
Overcharges for inefficiencies or services not
Overcharges because of clerical billing errors.
Additional risks:
• Services performed do not agree with contrac-
tual obligations.
EBR goes out of business and is unable to fulfill
contractual obligations.
Additional risks:
• Solvency of guarantors or insurers could also
pose risks.
IPPF – Practice Guide
Auditing External Business Relationships
• Require the EBR partner to maintain effective
controls over its time recording system and
any other system(s) that affect the amount
charged.
• Project management plans identify the
achievement of milestones and quality assur-
ance over the services provided.
• Require the EBR partner to maintain effective
controls over billing.
• Project director/manager review whether
outputs of the contract meet all requirements
and approve all charges for services prior to
payment.
Prior to appointment, management performs
due diligence of the EBR partner’s business to
provide reasonable assurance that it will remain
viable throughout the contract period. The due
diligence may include review of such areas as:
• What will be the impact of the contract on the
EBR partner’s business?
• Does the EBR partner over rely on certain key
contracts?
• Do key financial indicators appear reason-
able?
• Has data provided been audited?
• Does the organization have contingency plans
in place to cover cancellation or the EBR
partner’s inability to fulfill the contract?
For longer-term contracts, management updates
this review at least annually.
www.theiia.org/guidance / 10
 IPPF – Practice Guide
Auditing External Business Relationships

Business Risks of EBRs continued

9. Information shared with EBR
is properly secured and in
compliance with appropriate
privacy rules
Loss of confidential information.
Additional risks:
• Reputational risk
• Legal risk associated with loss of personally
identifiable information (PII).
• Require the EBR partner to maintain appro-
priate physical and logical security controls
in place to restrict access to appropriate
individuals.
• Require the EBR partner to review access to
information on a periodic basis for appropri-
ateness.
• Require the EBR partner to comply with data
privacy and other laws and regulations.
• Management evaluates the EBR partner’s
Statement on Auditing Standards (SAS) 70
or International Standard on Auditing (ISA)
402 report.

Some of the risks may be fraud risks, such as where the

EBR partner fraudulently misappropriates the organiza-
tion’s assets.

Lastly, and while not the focus of this guide, the internal
auditor should consider whether the organization has ap-
propriately complied with obligations and commitments it
assumes when contracting with others, i.e., mitigating the
risk that the organization itself does not comply with con-
tractual requirements.

www.theiia.org/guidance / 11
 IPPF – Practice Guide
Auditing External Business Relationships

Auditing EBRs
Similar to other internal audits, the International Stan-
dards for the Professional Practice of Internal Auditing
apply when auditing EBRs. For example, the chief audit
executive (CAE) includes internal audits of EBRs in the
audit universe, determines which audits to perform each
year, and staffs each audit with a competent independent
internal audit team. The internal auditor may combine the
audit of EBRs with other audits either of operational, com-
pliance with laws and regulations, or financial statements.
The CAE needs to decide whether to audit each EBR as
a separate audit, audit certain types of relationships, or
audit the EBR process in totality. This last approach may
allow the internal auditor to provide overall assurance on
the EBR process. The remainder of this practice guide fo-
cuses on auditing the EBR. The broader context, includ-
ing contract management, business partner selection, and
others, are beyond the scope of this practice guide.
The following chart illustrates the cycle in performing in-
dividual EBR audits.

Understand the
Organization and
Its relationships

Monitor Progress Assess Risks

and Controls

Report Perform Audit

www.theiia.org/guidance / 12

The following are the essential steps like most internal
audits, the process is usually iterative and need not follow
the order below:
Understand the Organization and
Its Relationships
• Understand the organization – The organization may
have a variety of reasons for maintaining EBRs, as pre-
viously discussed. Each relationship presents its own
set of risks and benefits. EBRs may be entered into and
managed by one department or many, and may repre-
sent a broad range of importance to an organization.
Understanding the organization’s structure, business
model, strategic goals, and enterprise risks will enable
an internal auditor to better understand the risks of
non-compliance by an EBR partner.
• Understand the environment – Determine whether the
organization’s EBRs have been identified; if not, request
management to identify them. If the EBRs have been
sufficiently identified, obtain information about the
nature of each relationship, including contact informa-
tion for the EBR partner, what they provide, amounts
involved, contract details, and other factors.
• Understand your organization’s processes – How does
the organization:
–– Determine the need for an EBR?
–– Determine and document the objectives and goals
for the EBR?
–– Identify, assess, and document risks for the EBR?
–– Control the identified risks?
–– Perform due diligence (including obtaining
background and checking references) on the EBR
partner?
–– Approve entering into the agreement?
–– Approve the wording of the agreement?
–– Manage the relationship?
–– Monitor the EBR partner’s performance?
IPPF – Practice Guide
Auditing External Business Relationships
–– Provide feedback to EBRs?
–– Monitor its own compliance with the agreement?
–– Determine whether objectives were achieved?
–– Learn from the EBR partner?
–– Terminate the relationship?
–– Continue the relationship?
• Understand the general nature of each EBR – What are
your organization’s objectives? What type of service is
rendered? Who controls and monitors the relations with
the EBR partner? Is there a written agreement, includ-
ing appropriate expectations and protections? What
are the key provisions? What level of approval did it re-
ceive? How important is the EBR to the organization’s
business model? Is there an audit clause in the contract
with the EBR partner? What does the organization do to
enhance the relationship?
Assess Risks and Controls
• Understand the inherent risks – Determine poten-
tial impacts in the absence of any controls of inherent
risks that the organization has assessed, along with
those that the internal auditor has identified and as-
sessed. See “Business Risks of EBRs” for examples of
overall inherent risks and details.
• Understand the design of controls your organiza-
tion has put in place to mitigate risks – Evaluate
the control risk on a preliminary basis.
• Determine the key controls – Key controls, which
if not effective would mean the risks are not mitigated.
See table above for some typical controls.`
• Understand the EBR partner’s environment, pro-
cesses, and controls – How will goods or services be
provided and how will the EBR partner’s processes and
controls mitigate the organization’s risks? This will pro-
vide further background and help in the internal audi-
tor’s risk assessment.
• Determine which EBRs to audit further, which pro-
cesses to audit, and the audit objectives – The audit
www.theiia.org/guidance / 13

could be an operational audit (for example, did your or-
ganization achieve its objectives at a reasonable cost?),
a compliance audit (is the EBR complying with laws
and regulations, such as employee safety, child labor,
product quality, or contractual obligations?), a financial
audit (are controls over financial reporting effective and
in compliance with regulatory guidelines such as Sar-
banes-Oxley and is information fairly stated?), or some
combination of these audits.
• Determine whether the EBR partner’s internal audi-
tor has performed work relating to the contract – Con-
siderations include the objective, scope, and results
of their work. Does the substance of the work support
your objectives; and how or whether you will use their
work?
Perform Audit Procedures
• Determine whether to perform on-site work at
the EBR – Based on the audit objectives, determine
if procedures need to be performed at the EBR (Note:
some EBRs may not allow access by a business partner’s
internal audit activity unless the contract provides ac-
cess). If appropriate, design and perform tests to deter-
mine whether the key controls are operating effectively
and/or to validate substantive matters.
The auditor may obtain the EBR partner’s user manuals
and other guidance about its processes. For financial pro-
cesses, this usually includes recommended procedures for
the user and reports from a service auditor. International
Standard on Auditing 402 (Revised and redrafted), Audit
Considerations Related to an Entity Using a Third Party
Service Organization (ISA 402) provides guidance and
standards for external auditors; this guidance is useful for
internal auditors testing those relationships. [ISA 402 is
similar to SAS 70 (AU 324) in the US].
ISA 402 discusses two types of reports that a service audi-
tor may provide:
–– Type A – Report on the Design and Description of
Controls at a Service Organization;
IPPF – Practice Guide
Auditing External Business Relationships
–– Type B – Report on the Design, Description and
Operating Effectiveness of Controls at a Service
organization. Type A reports are used to understand
the service organization’s processes and the design of
controls. The internal auditor uses Type B reports to
determine whether controls at the service organiza-
tion are operating effectively. For further guidance,
see ISA 402.
The organization’s internal auditor may use the work of
other auditors in auditing EBRs. For example, the inter-
nal auditor may work with the internal auditor of an EBR
partner to obtain needed information or to perform neces-
sary tests. Before making a decision to rely on the work of
another auditor, the internal auditor determines whether
the auditor performing the work is competent and objec-
tive. Further, the nature, objectives, and scope of the work
to be relied upon are evaluated to determine if it supports
the organization’s internal audit objectives.
• Evaluate test results.
• Identify findings and, as appropriate, reach con-
clusions – In doing so, consider whether findings ap-
ply beyond the individual EBR to other EBRs or to the
organization’s entire EBR process. Taken individually,
the results of EBR audits may identify deficiencies at
the EBR partner or in the organization’s individual busi-
ness processes. Even if the CAE did not plan the audits
to reach overall conclusions, it may sometimes be pos-
sible to do so. By aggregating the results of individual
EBR audits, the internal auditor may identify broader,
systemic issues. After performing the individual con-
tract audits, the internal auditor may consider forming
an overall assessment and conclusion on the effective-
ness of the organization’s EBR monitoring program. In
doing so, the internal auditor considers whether enough
work was done to reach overall conclusions.
Report
• Draft, discuss, and report the results – Results may be
reported internally to aid in business process and control
www.theiia.org/guidance / 14
 IPPF – Practice Guide
Auditing External Business Relationships

improvements. Normally the auditor follows the usual

reporting process to communicate with management
and, if appropriate, with the board. However, when the
auditor finds deficiencies in the controls or operations
of the EBR, the auditor may also communicate with
those managing the relationship with the EBR partner.

Monitor Progress
• Provide feedback to the EBR – Those charged with
managing the relationship may communicate with the
EBR about the need to correct any deficiencies identi-
fied. If the deficiencies are not corrected, those manag-
ing the relationship and others in management deter-
mine how to best mitigate the risks, including whether
to continue the EBR. This may be considered when the
EBR is scheduled to be renewed or earlier for a signifi-
cant deficiency. This is easier if the contract allows for
renegotiation when significant deficiencies are found.
The internal auditor may periodically perform procedures
to determine whether management has appropriately ad-
dressed the findings identified and may be called upon to
assist management to determine whether EBRs are being
appropriately managed.

This guide provides internal auditors with guidance in au-

diting external or extended business relationships (EBR).
Management also may use this guide in managing and
monitoring the risks associated with these relationships.

www.theiia.org/guidance / 15
 IPPF – Practice Guide
Auditing External Business Relationships

Practice Guide Team Members

David W. Zechnich, CIA
Abraham D. Akresh
Gregory S. Dubis, CIA, CCSA
Gaston L. Gianni Jr., CGAP
Stephen J. Linden
Gilbert T. Radford, CIA
Susan L. Rudolph, CIA

www.theiia.org/guidance / 16
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice Guides embody an IIA statement to as-
sist a wide range of interested parties, including Copyright
those not in the internal audit profession, in un- The copyright of this position paper is held by The
derstanding significant governance, risk, or con- IIA. For permission to reproduce, please contact
trol issues and in delineating the related roles and The IIA at guidance@theiia.org.
responsibilities of internal auditors on a signifi-
cant issue. Position Papers are part of The IIA’s
International Professional Practices Framework.
As part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended and the guidance is
endorsed by The IIA through formal review and
approval process. For other authoritative guid-
ance materials provided by The IIA please visit
our Web site, www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice Guide

Auditing Privacy Risks

2nd Edition

July 2012
 IPPF – Practice Guide
Auditing Privacy Risks

Table of Contents

Executive Summary......................................................................................... 1
Introduction.................................................................................................... 2
Privacy Frameworks and Principles................................................................. 6
Privacy — Business, Nonprofits, and Government.......................................... 9
Auditing Privacy............................................................................................ 12
Top 12 Privacy Questions CAEs Should Ask................................................... 22
Appendix ...................................................................................................... 23
Authors and Reviewers................................................................................. 25

www.globaliia.org/standards-guidance / .
 IPPF – Practice Guide
Auditing Privacy Risks

Executive Summary
Why Is Privacy Important? The Benefits of Good Privacy Governance
and Controls
One of the many challenging and formidable risk man-
agement issues faced by organizations today is protecting Good governance involves identifying significant risks to
the privacy of personal information about customers, em- the organization — such as a potential misuse, leak, or
ployees, and business partners. Consumers are concerned loss of personal information — and ensuring appropriate
with how businesses and organizations use and protect controls are in place to mitigate these risks. For business-
this information. Business owners and management want es, the benefits of good privacy controls include:
to meet the needs and expectations of their customers,
business partners, and employees; keep any commitments • Protecting the organization’s public image and brand.
pursuant to contractual agreements; and comply with ap- • Protecting valuable data on the organization’s cus-
plicable data privacy and security laws and regulations. tomers, employees, and business partners.
• Achieving a competitive advantage in the market-
Privacy is a global issue. Many countries have adopted pri- place.
vacy legislation governing the use of personal information,
as well as the export of this information across borders. • Complying with applicable privacy laws and regula-
For businesses to operate effectively in this environment, tions.
they need to understand and comply with these privacy • Enhancing credibility and promoting confidence and
laws. Examples of influential privacy legislation include goodwill.
Canada’s Personal Information Protection and Electronic
Documents Act (PIPEDA), the European Union’s (EU’s) For public-sector and nonprofit organizations, the benefits
Directive on Data Privacy, and privacy acts from Australia, of good privacy controls also include:
Japan, and New Zealand. Industry-sector privacy legisla-
tion from the United States includes the Gramm-Leach- • Maintaining trust with citizens and noncitizens.
Bliley Act (GLBA) for the financial services industry and • Sustaining relationships with donors of nonprofit
the Health Insurance Portability and Accountability Act organizations by respecting the privacy of their activi-
(HIPAA) for the health care industry. ties.

There are many news stories about security breaches that
involve the loss or disclosure of personal information. A
greater number of organizations are outsourcing business
processes and applications that contain personal infor-
mation in addition to using new technologies that can
increase their privacy risk profile. Stakeholders such as
boards1, audit committees, and other oversight groups
want assurance around the organization’s processes that
protect personal information.
Sustaining Effective Privacy Practices
Most organizations recognize the need for implementing
good privacy practices. However, the challenge is sustain-
ing these practices. With the proliferation of technology
that enables the collection, use, disclosure, retention, and
destruction of personal information in large volumes and
extensive outsourcing of information technology (IT) and
business processes in domestic and overseas locations,
organizations may have difficulty identifying where this

1
The term board is used in this guidance as defined in the International Standards for the Professional Practice of Internal Auditing (Standards) glossary: “a board is an organization’s governing
body, such as a board of directors, supervisory board, head of an agency or legislative body, board of governors or trustees of a nonprofit organization, or any other designated body of the
organization, including the audit committee to whom the chief audit executive may functionally report.”

www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Auditing Privacy Risks
data is stored, how it is protected, who has access to it,
and whether it is disposed securely. The rapid evolution of
technology, such as mobile computing, social networking,
radio frequency identification (RFID), and location-based
services, has increased the availability of and accessibil-
ity to personal information about customers, employees,
and others. This evolution has outpaced legal frameworks,
as well as industry and individual organization’s standards
and practices needed to protect the privacy of this valu-
able asset. In addition, accountability and responsibility
for maintaining a privacy program is not always clearly as-
signed and is often distributed throughout the organiza-
tion. This can lead to inconsistency and uncertainty when
it comes to ensuring good privacy practices are in place
and are working effectively.
Introduction
As presented in The IIA’s Practice Advisory 2130.A1-2:
Evaluating an Organization’s Privacy Framework, the in-
ternal audit activity can contribute to good governance
and risk management by assessing the adequacy of man-
agement’s identification of risks related to its privacy ob-
jectives and the adequacy of the controls established to
mitigate those risks to an acceptable level. The following
describes some of the benefits of undergoing a privacy au-
dit.
Privacy Audit Benefits
• Facilitates compliance with laws and regulations.
• Measures and helps improve compliance with the
organization’s data protection system.
• Identifies potential inconsistencies between policies
and practices.
• Increases the level of data protection awareness
among management and staff.
2
“The Right to Privacy,” Warren and Brandeis, Harvard Law Review, Vol. IV December 15, 1890, No.5.
2 / www.globaliia.org/standards-guidance
• Provides information for a data protection system
review.
• Provides assurance over reputational risks.
• Improves procedures for responding to privacy com-
plaints.
This practice guide complements and expands on Prac-
tice Advisory 2130.A1-2. The guide provides the chief au-
dit executive (CAE) and internal auditors with insight into
privacy risks that the organization should address when
it collects, uses, retains, discloses, and disposes of per-
sonal information. This guide provides an overview of key
privacy frameworks to help readers understand the basic
concepts and find the right resources for more guidance
regarding expectations and what works well in a variety of
environments. It also provides direction on how internal
auditors can complete privacy assessments.
What is Privacy?
Privacy can take on several meanings and is often dis-
cussed in many contexts. It can be seen as descriptive
or prescriptive, as a moral interest or a legal right. It can
mean freedom from unwanted attention from others or
freedom from observation or surveillance. It can cover the
privacy of communication as well as information. In its
simplest form, privacy has been defined as “the right to be
let alone.”2
Privacy definitions in the business environment vary
widely depending on country, culture, political environ-
ment, and legal framework. In many countries, privacy is
closely linked to data protection. Of particular importance
to organizations is how privacy is defined in their context.
Whether using one of the definitions in Figure 1, or sim-
ply defining privacy as the protection of the collection,
storage, processing, dissemination, and destruction of
personal information, the many definitions of privacy can
be used by any organization to guide its privacy program.
 IPPF – Practice Guide
Auditing Privacy Risks

Figure 1–Privacy Definitions

“Privacy is the protection of personal data and is considered a

fundamental human right.”
— Organisation for Economic Co-operation and Development
(OECD) Guidelines, 1980

“Member States shall protect the fundamental rights and

freedoms of natural persons, and in particular their right to
privacy with respect to the processing of personal data.”
— European Union (EU) Directive, 1995

“The rights and obligations of individuals and organizations

with respect to the collection, use, disclosure, and retention of
personal information.”
— The American Institute of Certified Public Accountants/Ca-
nadian Institute of Chartered Accountants (AICPA/CICA), 2009

In today’s business context, privacy often refers to the per-

sonal information about an individual and the individual’s
ability to:

• Know how his or her personal information is han-

dled.
• Control the information collected.
• Control what the information is used for.
• Control who has access to the information.
• Amend, change, and delete the information.
Personal information is data that can be linked to or used
to identify an individual either directly or indirectly. Some
personal information is considered sensitive, as described
in Figure 2. Privacy of personal information can be main-
tained by assuring adequate treatment and protection.

www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Auditing Privacy Risks

Figure 2–Examples of Personal and Sensitive Information

PERSONAL • Name.
INFORMATION • Gender.
• Date of birth.
• Home address.
• Personal telephone number.
• Personal email address.
• Government identifier (e.g., identity card, social security number).
• Biometric identifier.
• Photograph or video identifiable to an individual.
• Behavioral information (e.g., in a customer relationship management system).

SENSITIVE HEALTH • Medical records.

INFORMATION • Health plan beneficiary information.
• Physical or mental health information.
• Provided health services or any information collected during the health service.

SENSITIVE FINANCIAL • Account numbers (e.g., bank accounts, credit cards).

INFORMATION • Financial history.
• Salary information.

OTHER SENSITIVE • Racial or ethnic origin.

INFORMATION • Religious or philosophical beliefs.
• Political opinions.
• Trade union membership.
• Legal proceedings and civil actions.
• Combinations of certain information.

4 / www.globaliia.org/standards-guidance

Some information, although not personal by itself, be-
comes personal and sensitive when combined with other
information. Sensitive personal information generally re-
quires an extra level of protection and a higher duty of
care. Implementing a data classification methodology that
includes personal information is an effective way for the
organization to address the appropriate level of protection
and duty of care needed. It provides guidance to help de-
liver and ensure consistent practices throughout the orga-
nization based on the nature of the data.
Privacy Protection
Privacy protection can be considered a process of es-
tablishing an appropriate balance between privacy and
multiple competing interests. To minimize intrusiveness,
maximize fairness, and create legitimate, enforceable
expectations of privacy, a set of principles governing the
processing of an individual’s personal information and a
model of the privacy roles involved has evolved over de-
cades (see Figure 3). The principles include a blend of
substantive concepts such as data quality, integrity, and
limitation of use, and procedural principles such as the
concepts of consent and access rights.
IPPF – Practice Guide
Auditing Privacy Risks
Figure 3–Privacy Roles
When implementing a privacy program, there are major roles
to consider:
Data subject — Individual whose personal information is col-
lected, used, disclosed, retained, and disposed of.
Data controller — Organization that controls access to and
processing of personal information.
Privacy officer — An organization’s privacy oversight, moni-
toring, and contact function.
Privacy commissioner — A governmental oversight authority.
Service providers — Circumstances where third parties are
involved in processing personal information.
The way an organization manages personal information
about customers, employees, and business partners that
it collects, uses, retains, protects, discloses, and disposes
of is at the core of the privacy issue for businesses. Re-
cent incidents of identity theft, mismanagement of per-
sonal information, and violation of privacy principles have
increased regulatory and consumer pressure on organiza-
tions to develop appropriate controls in relation to privacy,
data management, and information security.
Privacy Risks
Privacy is a risk management issue for businesses, gov-
ernments, and nonprofit organizations. Surveys continue
to show that consumers and citizens are concerned with
how organizations use their personal information. Failure
of management and data controllers to address the protec-
tion of personal information presents numerous risks to
the organization, including:
• Possible damage to the organization’s public image
and branding.
www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Auditing Privacy Risks
• Potential financial or investor losses.
• Legal liability and industry or regulatory sanctions.
• Charges of deceptive practices.
• Customer, citizen, or employee distrust.
• Loss of customers and revenues.
• Damaged business relationships.
Privacy Controls
Providing adequate governance and oversight by boards
and management is an essential control for addressing pri-
vacy risks faced by the organization. Other basic privacy
control activities include setting objectives, establishing
policies and procedures, and implementing monitoring
and improvement mechanisms. In addition, the organiza-
tion should assess privacy compliance and data handling
practices and weaknesses, and benchmark them against
internal policies, laws and regulations, and best practices.
An effective privacy program includes:
• Privacy governance and accountability.
• Roles and responsibilities.
• Privacy statement/notice.
• Written policies and procedures for the collection,
use, disclosure, retention, and disposal of personal
information.
• Information security practices.
• Training and education of employees.
• Privacy risk assessments and maturity models.
• Monitoring and auditing.
• Compliance with privacy laws and regulations.
• Inventory of the types and uses of personal informa-
tion.
• Data classification.
• Plans to address privacy risks for new or changed
business processes and system development.
6 / www.globaliia.org/standards-guidance
• Controls over outsourced service providers.
• Incident response plans for breach of personal infor-
mation.
• Plans to address corrective action.
Practice Advisory 2130.A1-2 also recommends that inter-
nal auditors contribute to good governance and account-
ability by playing an assurance and advisory role in helping
their organization meet its privacy objectives.
Privacy Frameworks and
Principles
3.1 Dealing With Numerous Regulations and
Complex Expectations
Many privacy frameworks and principles have been devel-
oped and published since the late 1960s. The most use-
ful frameworks are principles-based and usually address
the rights of the individual for privacy, but they also try
to give weight to the information rights of organizations,
businesses, and economies to operate effectively.
Laws and regulations addressing privacy needs are varied,
increasingly complex, and rapidly increasing in number by
industry, local regulator, nation, or even region. Sound pri-
vacy frameworks can help an organization better comply.
The core of a useful framework is better articulation of
fundamentally accepted privacy principles.
Privacy needs and regulations have been a growing issue.
Recognizing the importance of privacy needs, the United
Nations formally sponsored studies as early as 1968 and
developed principles based on human rights shortly there-
after. More recently, focus has been on developing “gener-
ally accepted” privacy principles to help balance conflicts
in perspective. For example, governments need to protect
individuals from harm, while also protecting society from
criminal or terroristic threats by preventive monitoring of
information or detective and investigative action using in-
formation trails.
 IPPF – Practice Guide
Auditing Privacy Risks

Various recent privacy frameworks and principles are use- • Oversee and manage risks and compliance in an
ful to those who: organization.
• Assess compliance and audit privacy and security
• Oversee and monitor privacy and security programs. programs.
• Implement and manage privacy in an organization. • Regulate privacy.
• Implement and manage security in an organization.

Figure 4 provides an example of some significant privacy frameworks from laws, regulators, and professional organizations
as well as the commonalities of principles among these frameworks.

Figure 4–Privacy Framework Principles3

Japan Personal
AICPA/CICA Australia OECD
Canada PIPEDA EU Directive Information U.S. FTC5
GAPP4 Privacy Act Guidelines
Protection Act
Management. Accountability. Notification. Designate Accountability.
responsibility.

Notice. Openness. Identifying Information to be Notice, public Purpose Notice.

purposes, given to the data announcement of specification,
openness. subject. purpose of use. openness.
Choice and Use and Consent. Criteria for Consent. Collection Choice.
consent. disclosure. making data limitation.
processing
legitimate, data
subject's right to
object.
Collection. Collection, Limiting Principles No unjust method Collection
sensitive collection. relating to of collecting. limitation
information, data quality, (including
anonymity. exemptions, and consent).
restrictions.
Use, retention, Identifiers, use, Limiting use, Making data Purpose of use Use limitation
and disposal. and disclosure. disclosure, and processing does not exceed (including
retention. legitimate; its scope. disclosure
special categories limitation).
of processing;
principles related
to data quality,
exemptions, and
restrictions; the
data subject’s
right to object.
3
Adapted from the AICPA/CICA’s Comparison of International Privacy Concepts.
4
Generally Accepted Privacy Principles.
5
Federal Trade Commission.

www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Auditing Privacy Risks

Figure Japan
4 provides an example of some significant privacy
Personal
AICPA/CICA Australia frameworks OECD
Canada PIPEDA EU Directive Information regulators, and professional
from laws, U.S. FTC5orga-
GAPP4 Privacy Act Guidelines
Protection
nizations as well asAct
the commonalities of principles among
Access. Access and Individual The data these frameworks.
Access and Individual
correction. access. subject's right of correction. participation.
access to data.
Disclosure to Use and Use and Transfer of Transfer of Use limitation
third parties. disclosure, disclosure, personal data to personal (including
transborder data transborder data third countries. data, opt-out disclosure
flows. flows. exception, limitation).
delegation,
merger, joint use.
Security for Data security. Safeguards. Confidentiality Security control Security Security.
privacy. and security of measures. safeguards.
processing.
Quality. Data quality. Accuracy. Principles related Data integrity. Data quality. Integrity.
to data quality.

Monitoring and Enforcement Challenging Judicial remedies, Enforcement. Individual Enforcement.

enforcement. by the Office compliance. liability and participation
of the Privacy sanctions, codes (including
Commissioner. of conduct, challenging
supervisory compliance).
authority, and
Working Party on
the Protection of
Individuals with
Regard to the
Processing of
Personal Data.

8 / www.globaliia.org/standards-guidance

3.2 Which Privacy Framework to Use?
It is critical for management to consult its own legal coun-
sel for specific advice on applicable privacy laws and regu-
lations in coordination with how the organization’s privacy
framework and compliance approach is developed, as-
sessed, and monitored.
The frameworks illustrated in Figure 4 share many com-
mon principles. In general, these frameworks are designed
to help implement principles articulated by the applicable
body. Some are globally, regionally, or nationally applicable,
while others cover an industry, regulatory body, or specific
set of professional or business needs. From a technical
and legal standpoint, frameworks range from binding to
fully voluntary, to transnational and national legislation,
and to nongovernment organizations. Moreover, they en-
compass professional standardization bodies such as the
International Organization for Standardization (ISO) and
industry-driven bodies such as the Payment Card Industry
(PCI) Security Standards Council.
No Single-source Solution
Identifying a specific privacy framework that is appropri-
ate for any given organization depends on many factors; as
such, it is not addressed in this guidance. In many cases,
privacy laws and regulations dictate and influence the pri-
vacy framework the organization will adopt. In other situ-
ations, individuals and organizations may apply common
sense, follow legislation, or pronounce how they plan to
respond to potential privacy concerns by group or indi-
vidual declaration. In any case, it is critical to coordinate
and seek advice from legal counsel when developing or
adopting a privacy framework.
Privacy — Business,
Nonprofits, and Government
Commercial organizations have three major groups of
stakeholders: owners/lenders, employees/staff, and cus-
IPPF – Practice Guide
Auditing Privacy Risks
tomers/general public. Nonprofit organizations have em-
ployees/staff and oversight boards to manage their ac-
tivities. Governmental organizations serve citizens and
noncitizens and may have customers as well. In all cases,
good governance recommends organizations consider pri-
vacy risks, even when they may be based on divergent rea-
sons — from legal rights to just good business practice.
4.1 Privacy Impacts
Organizations use an individual’s personal information for
various business activities such as market research, cus-
tomer ratings, rights management, direct marketing, and
data trading. This information also may be of interest to
the individual’s community, friends, family, and profes-
sional network.
Personal information also could be collected and used by
domestic and foreign governments, competitors, disgrun-
tled employees, hackers, cyberterrorists, saboteurs, and
identity thieves. Threats to data subjects require organiza-
tions to protect personal information adequately, avoiding
adverse consequences and litigation.
4.2 Privacy Threats
Privacy threats and risks may be analyzed using a layered
approach that depicts the organization, stakeholder, and
individual.
Threats to Organizations
Organizations face tangible threats and risks: They realize
the consequences of privacy failures almost immediately.
The impact on the organization in the event of a privacy
breach often attracts a high level of attention from the
press, supervisory authorities, and privacy watchdogs.
Functional threats may restrict an organization’s ability
to attain its objectives and can cause operational disrup-
tion, inefficiency, or ineffectiveness. Threats to an orga-
nization’s reputation potentially limit its future capability
to increase its customer base, serve the needs of clients,
www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Auditing Privacy Risks
or meet the expectations of citizens. Although privacy
threats and risks may limit an organization’s capability to
perform, a competitive advantage can be gained by man-
aging them effectively. Financial impacts to an organiza-
tion are of greatest interest to stakeholders; they are main-
ly a consequence of functional and reputational issues
related to privacy risks. Additional privacy risks surface
when an organization outsources or cosources some of its
business operations, combines or discontinues business
activities, or hires, administers, or terminates employees.
Other business practices and control weaknesses that po-
tentially elevate the organization’s risk profile are listed in
Figure 5.
Figure 5–Privacy Control Weaknesses When Pro-
cessing Personal Data
• Excessive collection.
• Incomplete information.
• Damaged data.
• Outdated information.
• Inadequate access controls.
• Excessive sharing.
• Incorrect processing.
• Inadequate use.
• Undue disclosure.
• Retaining personal information longer than neces-
sary.
Threats to Stakeholders
Although implementing excessive privacy practices and
controls may restrict an organization’s internal and ex-
ternal processing efficiencies, stakeholders usually face
much higher risks from damaged reputation and litigation,
thereby reducing the value and profitability of their invest-
ment. Maintaining good privacy practices is important in
securing the value of shareholders’ investments in a cor-
poration.
10 / www.globaliia.org/standards-guidance
Threats to Individuals
Individuals often face direct consequences from privacy
threats. They may be a victim of identity theft, bear extra
cost, experience discrimination, or have limited choices
when they offer their personal information to organiza-
tions such as governmental agencies, financial institu-
tions, retailers, vendors, and service providers.
For example, when searching for new employment, indi-
viduals submit detailed résumés to portals, consultants, or
potential employers, who may use their personal informa-
tion for other purposes without the individual’s consent
or knowledge. Personal information may be processed
through screening and profiling techniques, which may
be intrusive, unfair, unreliable, or cause adverse effects
for the individual.
4.3 Sector Privacy Issues
It is crucial for internal auditors to understand the legal
framework in which the organization operates and take
into account all relevant laws, regulations, and other sec-
tor guidance. It also is important for the internal auditor to
consult with legal counsel when gaining this understand-
ing. This section covers examples of potential privacy is-
sues by sector.
Government and Citizen
A large variety of governmental institutions collect, store,
and exchange personal information linked to individu-
als. Data subjects and data controllers face the constant
threat of personal information from vast government files
being misused, lost, or stolen.
Public-sector regulation determines how to treat personal
information. In many countries, laws exist for the differ-
ent levels of public entities. Other countries have rules
that apply on a case-by-case basis. Therefore, government
auditors have to focus on a broad variety of records and
programs — for example, real estate records, voter regis-
ters, census and opinion polls, taxation records, national

security files, and information collected for welfare pro-
grams, social work, education, and law enforcement.
Community Life and Social Services
Many social services institutions — insurers, public wel-
fare programs, and social work programs, as well as other
nonprofit organizations — maintain significant and sensi-
tive databases to perform their activities. In many cases,
public- or private-sector regulations would apply. Some
institutions such as churches may be exempt from gen-
eral legal frameworks, which may lead to a weak privacy
regime. Communities have a high risk of losing the con-
fidence and trust of their constituents when treating per-
sonal information without a high regard for confidentiality.
Social security and governmental systems can cause ad-
ditional exposures through excessive or inappropriate data
matching, or comparing personal information from a va-
riety of sources. Often, there are specific rules, laws, and
agreements that determine in which circumstances and
to what extent data matching and sharing is legitimate.
Another problem stemming from data matching is identi-
fiers that could be abused to gather and match data, to
manipulate, or to steal an identity.
Financial Services
Financial service organizations such as banks, credit card
issuers, funds, and insurers maintain extensive sensi-
tive personal information such as credit ratings, income,
spending patterns, place of residence, and credit history.
As a result, many regulations and active supervisory bod-
ies exist.
Marketing and Retail
The marketing and retail industry is an extensive collec-
tor, user, and distributor of personal information. Personal
information maintained for marketing and retail purposes
can range from address lists to detailed consumer profiles,
financial information, and purchase histories. For exam-
ple, when an individual makes a purchase, his or her ac-
IPPF – Practice Guide
Auditing Privacy Risks
count may be debited immediately, with a record of the
transaction showing the date, time, location, and vendor.
When you are buying or surfing the Internet, retailers and
marketing vendors may use behavioral advertising track-
ing techniques to monitor and gather personal informa-
tion. In addition, tracing and tagging mechanisms such
as RFID raise privacy issues about the capability to trace
individuals.
Personal information is collected from many sources, in-
cluding point-of-sale, individuals, public sources, infor-
mation brokers, and other organizations. This information
may be used to determine and contact potential custom-
ers, define customer clusters using data mining, or create
detailed profiles for targeting individual needs and inter-
ests.
Sector associations offer various codes of conduct for
marketing companies. For example, the Australian Direct
Marketing Association (ADMA) provides a self-regulatory
code of conduct that covers 10 National Privacy Princi-
ples (NPP) to be considered and addressed by all ADMA
members.
Communication and Social Media
Communication and social media privacy include the
ability to maintain the confidentiality of personal infor-
mation, as well as the freedom to access media and com-
munication channels. Personal information is captured by
customer, subscriber, and lender registers. The entirety of
such data can be used to derive preferences and profile
individuals. Additional transactional data provides a re-
pository of personal information related to purchase and
utilization patterns, including communication partners,
time, location, and content. This may cause issues such
as spam, eavesdropping, unexpected disclosure of com-
munication and content, and excessive government sur-
veillance.
www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Auditing Privacy Risks
Utilities, Transportation, and Travel
Utilities and public transportation systems are sophisti-
cated and networked. For example, when an individual
passes a toll bridge, a toll is registered through RFID, the
license plate is registered with the toll agency, and a credit
card is charged. Another system registers the vehicle when
it enters a parking lot five minutes later. These integrated
systems can generate detailed profiles of individuals by
matching data from traffic and access control systems
with further transactional information. Many countries
foresee the need to establish extra safeguards to avoid the
excessive collection of personal data to protect citizen and
consumer privacy in these circumstances.
Health Care and Research
Health care providers requires and collects sensitive per-
sonal information on patients. Personal information is
needed for clinical research, medical services, payment
processing, medical testing, and disease management. In
the United States, HIPAA protects patients’ personal in-
formation and applies to health plans, health-care clear-
inghouses, health-care providers, and employers. The
legislation includes key elements such as limiting the
use and disclosure of personal information and requiring
administrative, technical, and physical safeguards to pre-
vent intentional or unintentional use or disclosure. Other
countries have similar comprehensive laws.
International Businesses
Many laws and regulations require that individuals’ per-
sonal information not leave the regulated zone. These
rules help address the concern regarding loss of control
when personal information is transferred to another legal
jurisdiction. Organizations that transfer such data could
be subject to significant embarrassment, damaged repu-
tations, or financial losses if the information is misman-
aged. This creates serious challenges in a world of net-
worked systems, where information is transported across
borders within an organization, processed or stored in the
cloud — which potentially traverses national boundaries
12 / www.globaliia.org/standards-guidance
and regulatory jurisdictions — or is shared with trading
partners that use and process personal information on a
transnational level.
Auditing Privacy
Auditing the organization’s privacy practices involves risk
assessment, engagement planning and performance, and
communication of results. However, there are addition-
al aspects the CAE should take into account, including
possible privacy breaches, staff management and record
retention issues, and privacy assessments performed by
other assurance providers. Many of these aspects are cov-
ered by practices of the internal and external audit profes-
sions. This chapter outlines some of the key issues and
methodologies.
It is important for the auditor to communicate with legal
counsel in the early stages of an engagement to discuss
the objectives and scope of a privacy audit as well as to
determine whether the audit and report of findings should
be performed under attorney-client privilege.
5.1 Internal Auditing’s Role in the Privacy
Framework
An organization’s governing body is responsible for de-
ciding the risk it is willing to take and to ensure that
resources are in place to manage risk according to that
appetite. Addressing privacy risks includes establishing
an appropriate privacy framework consisting of policies,
procedures, and controls. Internal audit can evaluate that
framework, identify significant risks, and make appropri-
ate recommendations to enhance the privacy framework.
When evaluating an organization’s privacy framework, in-
ternal auditors should consider:
• Liaising with legal counsel to understand legal im-
plications:
o Laws and regulations in all jurisdictions in which
business is conducted.

o Impact of laws and regulations in all jurisdictions
in which personal information transverses, is col-
lected, or is stored.
o Determine whether the privacy assessment
should be under attorney-client privilege.
• Liaising with persons responsible for privacy within
the organization to understand:
o Internal privacy policies and guidelines.
o Privacy policies intended for customers and the
public.
o The maturity of the organization’s privacy con-
trols.
• Liaising with IT specialists and business process
owners to understand information security implica-
tions:
o Internal security policies and procedures.
o Security policies communicated to customers and
the public.
o Information flows, system controls, storage, and
use of personal information.
o Incident response programs and plans.
Typical areas that internal audit may review when audit-
ing privacy include:
• Governance/management oversight.
• Privacy policies and controls.
• Applicable privacy notices.
• Types and appropriateness of information collected.
• Systems that process, store, and transmit personal
information.
• Collection methodologies.
• Consent and opt-in/opt-out management.
• Uses of personal information for compliance with
IPPF – Practice Guide
Auditing Privacy Risks
stated intent, applicable laws, and other regulations.
• Security practices, operations, and technical con-
trols in place to protect personal information.
• Retention and disposal practices of personal infor-
mation.
For additional considerations, refer to the Appendix, un-
der Privacy Control Weaknesses and Actions Matrix–An
Illustration.
Internal auditors should be careful not to assume respon-
sibility for developing and implementing the privacy pro-
gram, as this may impair their independence. Due to the
complex regulatory and technical landscape impacting
privacy, legal counsel should be engaged and consider-
ation should be given to procuring third-party expertise
for guidance as necessary.
5.2 Engagement Planning
Examples of privacy-related themes that would impact the
nature of work by the internal auditor include:
• Ever-changing laws and regulations throughout the
world to protect individual privacy.
• Protecting the personal information of individuals in
third-party/cloud computing arrangements.
• The maturity level of the organization’s privacy prac-
tices, policies, and procedures.
• New technologies and business strategies that ex-
pose personal information to greater risk.
• Outsourcing and off-shoring of business processes
that collect, use, retain, disclose, and dispose of
personal information.
• Increased collection, use, disclosure, retention, and
disposal of personal information.
• Continued threat of exposure to privacy breaches
underscoring the need for a comprehensive privacy
incident response plan.
www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Auditing Privacy Risks
5.3 Prioritizing and Classifying Data
A data inventory and classification program will assist in
identifying and prioritizing critical business data, includ-
ing personal information requiring protection. The audi-
tor should determine the organization’s data classification
levels, the framework used to classify data, and the base-
line controls established for each classification. To assist
in this determination, the auditor can ask the following
questions:
• Does the organization have a comprehensive data
classification policy? Are the levels of classification
appropriate to ensure adequate controls? Are the
classifications defined adequately?
• Has personal information data been classified? Are
the levels of classification appropriate for ensuring
adequate privacy controls? Has the data classifica-
tion policy been communicated to those who are
involved — including third-party service provid-
ers — in handling the data, from receipt through
disposal? Is there a process to monitor changes in
laws and regulations that would impact data classifi-
cation? Are the classifications reviewed periodically
to ensure they remain appropriate?
• Has data ownership for personal information been
assigned, and have appropriate controls been estab-
lished in handling the data?
• What are the regulatory penalties for mishandling
privacy-protected data? What legal recourse would
the impacted individuals have?
• How much harm can be caused to an individual if
the information was unintentionally disclosed to
unauthorized persons?
• How widely would a privacy breach be disclosed?
• Who would need to be notified? How will they be
notified?
• How costly would it be to remedy various types of
unauthorized privacy disclosures?
14 / www.globaliia.org/standards-guidance
• How would a privacy breach impact customer,
citizen (in case of a public entity), or investor confi-
dence? How much would it cost to recover trust and
confidence?
5.4 Assessing Risk
Four major areas of risk should be addressed throughout
audit planning and when preparing the individual risk as-
signment: legal and organizational, infrastructure, appli-
cation, and business process.
Legal and Organizational Risks
Legal and organizational risks include areas such as non-
compliance with laws and regulations, lack of governance
and privacy leadership, and insufficient resources to
maintain an effective privacy program. Some questions to
ask when addressing legal and organizational risks as part
of the planning for a privacy audit include:
• Who are the designated privacy contacts? What
percentage of their time is devoted to privacy issues,
and is it adequate?
• Do they have sufficient knowledge, authority, bud-
get, and management support to implement and
maintain the privacy program?
• How do the organization’s privacy leaders maintain
their knowledge of laws and regulations that impact
the organization? Have they noted the privacy laws
and regulations that impact their business? How do
they monitor changes in laws and regulations and
evaluate their impacts on the organization’s policies,
procedures, and systems? How do they work with
the data owners to implement appropriate controls
to respond to the changes?
• How involved are the organization’s privacy contacts
in the evaluation of new technologies and busi-
ness programs to determine their potential privacy
impacts?

• If the organization uses cloud computing services,
has consideration been given to the privacy impli-
cations arising from the geographic location of the
data and possible international transfers of personal
information governed by international security and
privacy laws, and do the contracts address these
risks and security requirements adequately?
• Does the organization have a plan to respond to a
privacy incident? Are the appropriate people in-
cluded in the plan? Is the plan documented and up
to date? Does it include requirements for breach
notification in compliance with all the disparate
international, national, and local regulations? Does
the breach response plan include steps to lock down
involved systems to preserve evidence needed for
forensic investigation of the breach?
• Are templates of needed documentation for breach
response already prepared, including a notification
letter, frequently asked questions for those im-
pacted, instructions for consumers to freeze credit
reports, and a basic press release?
Infrastructure Risks
A basic principle of information security is to provide
confidentiality, integrity, and availability of data, which
coincides with many of the goals of a privacy program.
An audit of a privacy program will necessarily involve sig-
nificant review of information security controls. A chal-
lenging area may be identifying how personal information
flows in and out of the organization, as well as where and
how the information flows among third parties outside the
organization.
Information has to enter and leave the application to be
useful, often changing media several times during its use-
ful life. The data can start as paper; be transported across
the Internet; be processed in the cloud; obtained from,
sent to, or stored on mobile devices; stored on a magnetic
disk; printed out and put into a filing cabinet; backed up
on an optical disk; and later sent off-site to a third party on
IPPF – Practice Guide
Auditing Privacy Risks
tape. Each time personal information moves and changes
format, new potential vulnerabilities are introduced.
Shredders, encryption, data leakage protection tools,
locked files, and many other practices all play a role as
countermeasures to leaking sensitive data. Auditors
should review the life cycle of personal information the
organization obtains from collection to disposal and de-
termine whether it is handled with due diligence along
each step.
Specific considerations for the auditor in evaluating the
infrastructure risks to privacy include:
• Does the organization have a current data map and
inventory of all personal information, including
where it resides internally, where it flows into and
out of the organization, and how it is transferred
among third parties involved in handling personal
data on behalf of the organization? Each platform,
database, and other technology infrastructure com-
ponent has its own risks to consider.
• The auditors should trace personal information
both in transit over public and private networks and
media handled by courier. Auditors also should fol-
low up on stored personal information in production
as well as in backup and disaster recovery environ-
ments. Specifically:
o How is personal information encrypted during
transmission into and out of the organization and
among third parties?
o Is personal information stored on portable media
encrypted?
o Is personal information encrypted at rest?
• What role do mobile devices play in the collection,
handling, and storage of personal information in the
organization?
• What general controls are in place on IT platforms
where personal information is processed or stored,
www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Auditing Privacy Risks
including access controls, patch management, and
vulnerability scanning?
• Is personal information processed or stored in the
cloud? Do cloud service contracts include speci-
fications to ensure the appropriate infrastructure
security and controls are in place, and does a right-
to-audit clause exist?
• If personal information is being transferred or cop-
ied, is the post-transfer residual data treated with
the same set of rules as the originating data?
Application Risks
Discovering not only who, but what handles your informa-
tion becomes critically important when identifying privacy
risks. Software can offer speed and accuracy to many er-
ror-prone manual functions. Unfortunately, software sys-
tems can be complex, with flaws and unintended behav-
iors. Evaluating software functions is not simple because
organizations often mix in-house developed software, cus-
tomized commercial off-the-shelf software, cloud-based
applications and supporting middleware, and operating
systems to process, share, and distribute their data.
After the auditor identifies the automated processes, ba-
sic security questions need to be addressed regarding any
application that handles personal information:
• Was a privacy risk assessment performed to identify
and address privacy issues during software develop-
ment? There is a trend of “privacy by design” that
incorporates privacy awareness into every facet of
daily business, including the development of new
applications and processes involved in personal data
collection and use.
• Have data classification standards been implement-
ed in the application to ensure appropriate baseline
controls over personal information?
• How was the implementation of the privacy require-
ments and associated controls validated in develop-
16 / www.globaliia.org/standards-guidance
ment and deployment of the application?
• How does the application authorize and authenti-
cate users? What user roles does the application
have to limit access to “minimum necessary” based
on their job responsibilities? Are their authorizations
reasonable?
• How is user access to personal information tracked
and logged to ensure all successful and failed access
attempts can be researched and accountability can
be established?
• Are there external interfaces to other applications?
Do these applications give an equivalent level of
control over personal information?
• What is the process for maintaining and upgrading
the applications and the underlying database?
• Who responds to potential security issues and en-
sures that security patches are tested and applied?
• Who is responsible for the general security of the
application?
• In development and testing of applications, is test
data used or has production data been made ap-
propriately anonymous for personal or sensitive
information? If not, are the controls in the test en-
vironment equivalent to controls in the production
environment?
• Does the application include processing or storing
personal information data in the cloud? If so, are
the controls equivalent to the controls required for
internal applications handling personal information?
• What types of cookies, web beacons, or web pixels
are used on the organization’s Web applications? Are
they for internal use, or are they to gather informa-
tion for third parties? What type of personal infor-
mation is collected, how is it used, and, if sensitive,
how is the user’s consent obtained and stored?
Ensuring transparency in the use of these tracking/
information-collecting technologies is a key focus of
current privacy litigation and regulation.

• Do any applications use geographic location tracking
to provide services or obtain personal information
from customers? If so, what personal information is
collected, how is it used, and, if sensitive, how is the
user’s consent obtained and stored?
Business Process Risks
Despite technicians’ efforts to guard, encrypt, and other-
wise secure personal information, the business process
will eventually necessitate that personal information is
used for its intended purpose. As the personal informa-
tion is used, it is important that individuals treat it with
the level of care corresponding to its data classification.
Measures to protect printed personal information should
follow the same principles used to classify and protect
electronic data. At a minimum, desks should be clean,
drawers and filing cabinets should be locked, and record
disposal and destruction should be secure. Discretion
should be used in areas open to the public. Risk assess-
ments, handling procedures, and training and awareness
programs should help to identify and minimize privacy
risks inherent in the business processes.
5.5 Preparing the Engagement
Practice Advisory 2130.A1-2 outlines internal audit activi-
ties related to an organization’s privacy framework. These
activities include:
• Assessing the adequacy of management’s identifica-
tion of risks related to its privacy objectives.
• Assessing the adequacy of the controls established
to mitigate privacy risks.
• Identifying the types and appropriateness of per-
sonal information gathered, the collection method-
ology used, and whether the organization’s use is
in accordance with its intended use and applicable
legislation.
• Providing assurance on the effectiveness of the orga-
nization’s privacy policies, practices, and controls.
6
Privacy Handbook: Guidelines, Exposures, Policy Implementation, and International Issues, Albert J. Marcella Jr. and Carol Stucki, John Wiley & Sons, May 23, 2003
7
Privacy: Assessing the Risk, Kim Hargraves, Institute of Internal Auditors Research Foundation, 2003
IPPF – Practice Guide
Auditing Privacy Risks
Approaches to developing a privacy audit program are
identified in several regulations and publications. An in-
tuitively sequenced model for an audit program structure,
which builds on the OECD criteria, is provided in Privacy
Handbook6. In comparison, Privacy–Assessing the Risk7
presents an exhaustive program with a more technolo-
gy-oriented structure. Key principles and concepts con-
tained in the AICPA/CICA Generally Accepted Privacy
Principles–A Global Privacy Framework along with major
international privacy laws and regulations can be very use-
ful in developing privacy themes for the audit program, as
shown in Figure 4.
Privacy Assessments
Many legal and regulatory bodies require, or at a mini-
mum, recommend that organizations conduct privacy as-
sessments. Many organizations also realize an operational,
internal control, and risk management-driven need to re-
view the effectiveness of privacy policies and practices.
Existing assessment models provide extensive guidance
for setting up audit work programs. The objectives of a
privacy assessment need to be established first. An exam-
ple of objectives includes:
• To determine inherent and residual privacy-related
risks.
• To provide assurance on controls over privacy risks.
• To verify adherence with a set of privacy standards
or regulations.
• To ensure compliance with the organization’s own
privacy statement on the use, collection, retention,
protection, and disposal of personal information.
The U.K. Information Commissioner’s Data Protection
Audit Manual contains a methodology for conducting
data protection compliance audits together with a series
of checklists aimed at testing compliance with the Data
Protection Act of 1998. The audit manual has been tai-
lored to enable any data controller or data owner to help
www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Auditing Privacy Risks
judge his or her organization’s own data protection com-
pliance. Similarly, it also may be used by any organization
offering such services to data controllers. The Audit Man-
ual describes general privacy audit processes: external
and internal audits, adequacy and compliance audits, and
vertical (functional) or horizontal (process) audits. Audi-
tors may begin an assessment by scoping the audit areas
— the whole organization, a function, a business process,
or a category of information. A fully scoped audit is built
to cover all privacy principles. A risk-oriented approach
focuses on the key risk areas that can be derived by as-
sessing structural, process, and data category dimensions,
based on impact and likelihood of events.
Ready-made work programs available from supervisory
bodies, industry organizations, and privacy advocates may
prescribe mandatory audit work and generally provide a
good starting point for customized regular or one-time
audit work programs. The CAE or a delegate should re-
view or approve each internal audit work program before
a privacy audit begins. Where a privacy commissioner or
comparable function is commissioning or performing pri-
vacy reviews, internal audit should review both the suf-
ficiency of the audits performed and the effectiveness of
the follow-up mechanism in place.
Foundation for a Privacy Audit–Understanding
the Data
It is important to realize that compliance with applicable
laws and regulations is a foundational issue that should be
addressed when performing a comprehensive privacy risk
assessment and audit for an organization. When planning
a privacy audit, the auditors should:
• Obtain a comprehensive understanding of the
personal information collected and stored, its use by
the organization, its processing by technology, and
the jurisdictions/countries through which the data is
processed.
• Interview the individuals responsible for the organi-
zation’s privacy policy and its enforcement and/or in-
18 / www.globaliia.org/standards-guidance
house or outside legal experts to gain an understand-
ing of the privacy laws and regulations governing
the business and the type of information handled,
as well as the known risks, designed controls, and
reported incidents.
• Identify the laws and regulations that govern per-
sonal information in the jurisdictions where the
organization conducts business.
• Determine the regulations and governmental bodies
responsible for enforcing privacy rules. Ask the pri-
vacy officer or the individual responsible for privacy
compliance how such rules are codified in the orga-
nization’s policies and procedures.
• Identify the customers’, employees’, and business
partners’ personal information that the organization
collects. If a data inventory of personal information
is available, that may provide a starting point for
the auditor. If there is no documented inventory,
interviews with business process owners and their
IT counterparts may be necessary to identify what
personal information is collected. Also, automated
discovery tools can assist the auditor in this phase.
• Identify what, if any, personal information is shared
with third parties. Determine how the data is shared
with each of these third parties, including hard copy,
file transfer, and portable electronic media. The
intent is to identify the formal and informal means
by which personal information is shared within
the organization and with other entities to identify
potential threats, vulnerabilities, and overall risk.
Determine whether agreements with third-party
service providers and business partners include pro-
visions on appropriate controls for handling personal
information from receipt through disposal.
Identify Privacy Threats
Internal auditors should identify privacy threats to the
organization through research, benchmarking, and brain-
storming, and rank them according to the likelihood of
occurrence and impact. Risk assessment meetings with

business process owners also can ensure risks and threats
to personal information are explored and identified thor-
oughly. Assigning values to threats and assets through a
privacy risk assessment highlights where the strongest
controls or countermeasures should be and the areas on
which the auditors should focus to identify vulnerabilities.
A threat uses a vulnerability to exploit an asset. For the
purposes of privacy management, the asset is protected
personal information. So, who or what is the threat? The
threat is the individual or process that, intentionally or
not, makes an organization’s personal information public
or allows any unauthorized access to personal information.
A legitimate threat could be a business partner violating
contractual obligations or a hacker employed by organized
crime. Empirically verified, threats posed by employees,
contractors or temporary workers, competitors, develop-
ers, janitors, and maintenance staff — those who often
have access to stores of confidential information — are
very relevant. Whether through malice or carelessness,
individuals with access to personal information have the
ability to make that information public. If personal infor-
mation is shared with business partners and contractors,
the additional threats to and within their operations and
processes should be evaluated.
Identify the Controls and Countermeasures
To determine what the organization is doing to protect per-
sonal information from the worst threats, auditors should
validate the basic infrastructure and general controls in
place, as well as the specific application and internal con-
trols throughout the organization that are active and relied
on by the privacy program. Common steps to identify the
controls include:
• Requesting and reviewing documentation. Review
the privacy program as it is implemented in policies,
procedures, and other documentation. How do the
policies match up with the high-risk areas defined
in the privacy risk assessment? How often, if ever,
are these policies reviewed? Do they incorporate the
IPPF – Practice Guide
Auditing Privacy Risks
latest regulatory and legal guidance? Is the guid-
ance consistent across divisions in the organization?
Identify any gaps for follow-up.
• Interviewing and observing the processing of personal
information in action. The gap between the written
policy and the operational action can be significant.
Sit with employees on the front lines in operations
and IT to determine whether they are aware of the
impact of their actions/processes in handling per-
sonal information. Determine whether the outright
requirements, as well as the spirit or intent of the
privacy program, motivate the staff ’s decisions and
actions.
• Reviewing third-party contracts and contacts. The
depth of the review will depend on how the con-
tractors and the personal information handled by
them rank in the threat matrix, but the auditor, at
a minimum, should review for language compliant
with applicable laws and regulations. If right-to-
audit clauses are included, are they exercised with
appropriate frequency and depth? Another com-
mon technique that auditors can use in reviewing
third parties is a security/privacy control survey or
questionnaire. This will allow the auditor to obtain
information about the controls the third party has in
place to protect the organization’s personal infor-
mation and help to identify areas that may require
follow-up.
Using a third-party provider’s controls wholly, or in con-
junction with the organization’s own controls, may impact
the organization’s ability to achieve its control objectives.
A lack of controls or weakness in third parties’ control de-
sign, operation, or effectiveness could lead to such things
as loss of personal information confidentiality and privacy.
Hence, contracts with third-party providers are a critical
element and should contain appropriate provisions for
data and application privacy and confidentiality.
By this point, the potential high-impact risks should come
into sharper focus, but significant questions will remain
www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Auditing Privacy Risks
unanswered. It is time to test the controls and counter-
measures, hitting the highest impact assets and modeling
the highest impact threats.
5.6 Performing the Assessment
The common steps throughout an audit are described in
detail in The IIA’s International Professional Practices
Framework (IPPF). When the auditor understands the or-
ganization’s privacy objectives, its privacy risks, the types
of personal information handled, and the legal framework
in which the organization conducts business, an audit pro-
gram including scope, objectives, and timing of the audit
can be developed and approved. The audit team will gath-
er information, perform tests, and analyze and evaluate
the test work to prepare the report and recommendations.
Test Work Methodologies
After the risk assessment is completed, traditional test
work is focused on general, application, and security con-
trols. Potential testing may include methods beyond the
usually applied techniques such as vulnerability assess-
ments and penetration tests, physical control tests, and
social engineering tests.
Vulnerability Assessments and Penetration Tests
These methods are often cited as assurance methods for
network-accessible applications and infrastructure. Con-
sultants often use terms such as “tiger team” or “ethical
hacking” to describe this methodology of identifying and
exploiting vulnerable services in a production environ-
ment.
Vulnerability assessments generally focus on identifying
potential vulnerabilities in information systems. The as-
sessments identify and prioritize vulnerabilities in the con-
figuration, administration, and architecture of information
systems. Penetration tests take vulnerability assessments
one step further, exploiting the identified vulnerabilities.
Penetration tests generally require a higher degree of
technical skill and could potentially disrupt production
20 / www.globaliia.org/standards-guidance
systems. Vulnerability assessments and penetration tests
require a set of skills that the internal auditor may need to
acquire, either through contracting third-party expertise
or training.
Physical Control Tests
Personal information is not limited to digital data. If the
organization’s modeled threat has access to the building,
all the encryption, firewalls, and patched databases in the
world cannot keep that individual from retrieving printed
information from the trash or accessing data through an
unlocked workstation. Digging through trash for protected
information, identifying logged-in and unattended work-
stations, and reviewing secure information storage and
handling processes may identify vulnerabilities in the han-
dling of private information. This type of test can answer
questions such as:
• Is personal information being disposed of according
to policy and procedures?
• Are documents containing personal information
stored securely prior to disposal or shredding?
• Are working documents with personal information
stored securely?
• Are documents or monitors that display personal
information viewable by unauthorized personnel?
• Are workstations locked when unattended?
• Is the application of privacy controls consistent
across various departments?
Social Engineering Tests
Social engineering, in the context of security, is the tech-
nique of gaining unauthorized access through nontechni-
cal deception. In the scope of testing a privacy program,
social engineering can be used to test the effectiveness of
controls regarding release of personal information. In oth-
er words, can an individual obtain personal information by
simply asking for it? The auditor could impersonate exec-
utives, network administrators, or other authorized users

to “con” or “sweet talk” passwords or personal information
from employees who act as key countermeasures. Social
engineering tests can help answer some of the following
audit questions:
• How effective are the organization’s privacy aware-
ness and training programs?
• Is the balance between customer service and re-
stricting personal information appropriate?
• Is the privacy program supported by the corporate
culture?
Organizations have different attitudes toward the conning
of employees by internal auditors, so build a threat model
and identify vulnerabilities carefully. Discuss the process
with the human resources and legal teams to ensure the
results will be used to improve privacy practices and not
for random firing of tested employees.
5.7 Communicating and Monitoring Results
Many privacy audits are evaluations of compliance pro-
grams, and the auditor should consult with legal counsel if
potential violations are to be included in audit communi-
cations. Consultation and coordination with counsel can
reduce the conflict between the auditor’s responsibilities
to document the results of the engagement with the coun-
sel’s legal obligation to defend the organization.
Some of the challenges specific to reporting the results of
a privacy audit include:
• Getting all of the participants involved in the scope
of the privacy audit. An effective privacy program is
practiced by nearly all areas of the organization. Be
sure that key participants have input.
• Developing a common, understandable language to
describe the risks.
• Ensuring that legal counsel has reviewed the pro-
posed audit plan and draft audit report before issu-
ance to ensure that compliance considerations are
addressed appropriately.
IPPF – Practice Guide
Auditing Privacy Risks
The CAE should be aware of IIA Performance Standard
2600: Resolution of Senior Management’s Acceptance
of Risks in the event that he or she believes that senior
management has accepted a level of residual risk that may
be unacceptable to the organization related to its privacy
program and practices.
5.8 Privacy and Audit Management
The IIA’s IPPF reminds auditors to take regulations and
risks into account when planning, performing, and report-
ing assurance and consulting assignments. Many other
professional bodies, legislators, and supervisory authori-
ties issue a broad variety of guidance and regulations. The
privacy of personal information and how the organization
manages this asset should be considered when developing
the risk-based audit plan.
The internal audit staff is a key part of the organization’s
governance structure to address privacy. As such, training
programs and policies should be in place to provide inter-
nal auditors with the necessary background and knowl-
edge to conduct privacy engagements effectively. There
also is a need for due diligence to ensure that auditors act
in accordance with relevant laws and policies when us-
ing personal information during assurance or consulting
engagements. Internal auditors should understand that it
may be inappropriate — and in some cases illegal — to
access, retrieve, review, manipulate, or use personal in-
formation when conducting internal audit engagements.
Before initiating an audit, the internal auditors should in-
vestigate these issues and request advice from legal coun-
sel, if needed. Finally, internal auditors should consider
related privacy regulations, regulatory requirements, and
legal considerations when reporting information outside
the organization.
www.globaliia.org/standards-guidance / 21
IPPF – Practice Guide
Auditing Privacy Risks

Top 12 Privacy Questions CAEs 9. Is any personal information collected by the orga-
Should Ask nization disclosed to or processed by third parties?
1. Does the organization have a governing body in
place to address the acceptable level of privacy risk 10. Do employees receive privacy awareness training
it will take? and have guidance on their specific responsibili-
ties in handling privacy requirements, issues, and
concerns?
2. What level of privacy risk is management prepared
to accept?
11. Does the organization have and provide adequate
resources to develop, implement, and maintain an
3. What privacy laws and regulations currently impact
effective privacy program?
the organization or may likely be required in the
near future?
12. Does the organization complete a periodic assess-
ment to ensure that privacy policies and proce-
4. What type of personal information does the or-
dures are being followed and meet new or current
ganization collect, who defines what is personal
requirements?
or private, and are the definitions consistent and
appropriate?

5. Does the organization have privacy policies and

procedures with respect to collection, use, reten-
tion, destruction, and disclosure of personal infor-
mation?

6. Does the organization have responsibility and

accountability assigned for managing a privacy
program?

7. Does the organization know where all personal

information is stored and who has access?

8. How is personal information protected at various

levels — databases, networks, system platforms,
application layers, and business process/functional
levels?

22 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Privacy Risks

Appendix 2120-2: Managing the Risk of the Internal Audit Activ-

The IIA’s International Professional Practices
Framework (IPPF)
Internal audit authoritative guidance is addressed in the
IPPF, which comprises mandatory guidance and strongly
recommended guidance. The three mandatory elements
of the IPPF are the Definition of Internal Auditing, the
Code of Ethics, and the International Standards for the
Professional Practice of Internal Auditing (Standards). The
three strongly recommended elements of the IPPF are Po-
sition Papers, Practice Advisories, and Practice Guides.
Specific privacy-related guidance can be found in the The
IIA’s Code of Ethics, Standards, and Practice Advisories.
Relevant portions of this guidance are included below.
IIA Code of Ethics
The section on confidentiality states that internal audi-
tors:
ity
2130-1: Assessing the Adequacy of Control Processes
2130-A1-2: Evaluating an Organization’s Privacy
Framework
2200-2: Using a Top-down, Risk-based Approach to
Identify the Controls to Be Assessed in an
Internal Audit Engagement
2300-1: Use of Personal Information in Conducting
Engagements
Privacy Control Weaknesses and Actions
Matrix–An Illustration
The following are examples of possible privacy control
weaknesses and potential actions by the internal auditor
to address those weaknesses. Note that the examples of
weaknesses and actions were not intended to be compre-
hensive and may not apply in your environment.

• Shall be prudent in the use and protection of infor-

mation acquired in the course of their duties.
• Shall not use information for any personal gain or
in any manner that would be contrary to the law or
detrimental to the legitimate and ethical objectives
of the organization.

IIA Practice Advisories

Although in some cases the following advisories are not
specifically related to privacy, they are key practice advi-
sories that the internal auditor should be aware of when
assessing an organization’s privacy program:

2010-1: Linking the Audit Plan to Risks and Exposures

2010-2: Using the Risk Management Process in Inter-
nal Audit Planning
2120-1: Assessing the Adequacy of Risk Management
Processes

www.globaliia.org/standards-guidance / 23
IPPF – Practice Guide
Auditing Privacy Risks
Control Weaknesses
The organization does not have a privacy policy and related control
framework elements.
The organization is not complying with its privacy policy.
The organization is not adequately protecting personal information it
collects, uses, retains, discloses, and disposes of.
The organization has not identified the types of personal information it
collects, who has access to it, or where it is stored.
The organization has not documented the business purposes for col-
lecting personal information to ensure it does not collect and retain
more than necessary.
The organization does not have a formal governance structure related
to privacy compliance.
The organization does not have internal privacy policies for protection
of personal information.
The organization has not established a compliance auditing or monitor-
ing framework.
The organization does not have an incident response plan in place.
The organization has not conducted formal privacy awareness, data
handling, or information security training.
The organization has not implemented a third-party vendor privacy
and security management program to create a consistently applied ap-
proach to contracting, assessing, and overseeing the privacy practices
of its vendors.
24 / www.globaliia.org/standards-guidance
Actions
Discuss with senior management the need for a documented privacy
policy and development of an effective privacy program.
Review the organization’s privacy practices to ensure the organization
is following the commitments made to customers in its privacy notice.
Review the organization’s information security practices relating to
administrative, physical, and technical controls to ensure personal
information is protected adequately.
Map data flows of personal information collected through automated
systems or manual processes, who has access to personal information,
and the business need for such access.
Map data flows of personal information collected through automated
systems or manual processes and identify the business purposes for
such collection and retention.
Discuss with senior management or the board, if necessary, the need
for a governance structure over privacy compliance.
Review current policies, standards, and procedures related to privacy
of personal information to ensure they address areas such as data
classification, record management, retention, and destruction.
Include privacy compliance in the risk-based auditable inventory. Ob-
tain an inventory of laws and regulations that apply to the organization
from the legal department. Complete a privacy compliance audit.
Discuss with senior management — including the IT and legal depart-
ments — the need to develop an incident response plan in the event of
a breach of personal information.
Review privacy training and awareness materials to determine whether
they meet the needs of the organization. Review training records to
ensure employees who handle or have access to personal information
have undergone the required training.
Review contracts of third-party providers to ensure they contain
protection requirements for personal information, contract termination
clauses, destruction of records containing personal information, and
a right-to-audit clause. Perform periodic audits to ensure third-party
providers are complying with the contract terms.
 IPPF – Practice Guide
Auditing Privacy Risks

Authors:
Ken Askelson, CIA, CPA, CITP, CGMA

Stefanie Hardgrove, CIA, CPA, CIPP/IT

Michael Lynn, CPA

Sara Lademan, CIA, CISA, CGEIT, CISSP

David Williams, CISA, PCI-ISA

Reviewers:
Steve Hunt, CIA, CBM, CGEIT, CISA, CRISC, CRMA

Steven Jameson, CIA, CBA, CCSA, CFE, CFSA, CGMA,

CPA, CRMA

www.globaliia.org/standards-guidance / 25
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120907
IPPF – Practice Guide

Auditing
the control
environment
APRIL 2011
 IPPF – Practice Guide
Auditing the Control Environment

Table of Contents

Executive Summary......................................................................................... 1

Introduction.................................................................................................... 2

An Organization’s Control Environment........................................................... 2

Scope and Approach to Auditing the Control Environment............................... 3

Practical Considerations in Auditing the Control Environment........................ 6

How to Audit the Control Environment............................................................. 9

Evaluating Control Environment Deficiencies................................................ 10

Communicating Results................................................................................ 11

Appendix ...................................................................................................... 13

Authors ...................................................................................................... 34

www.theiia.org/guidance / B

Executive Summary
The control environment1 is the foundation of an effective
system of internal control. Most of the well-publicized
failures (including not only Enron and WorldCom, but
also the governance failures that led to the 2008 financial
crisis) were, at least in part, the result of weak control
environments. In the absence of a demonstrably effective
control environment, no level of “design and operating”
effectiveness of controls within business and IT processes
can provide meaningful assurance to stakeholders of the
integrity of an organization’s internal control structure.
The International Standards for the Professional Practice of
Internal Auditing (Standards) Glossary defines the control
environment as:
The attitude and actions of the board and management re-
garding the significance of control within the organization.
The control environment provides discipline and structure
for the achievement of the primary objectives of the system
of internal control. The control environment includes the
following elements:
• Integrity and ethical values.
• Management philosophy and operating style.
• Organizational structure.
• Assignment of authority and responsibility.
• Human resource policies and practices.
• Competence of personnel.
Central to any approach to auditing the control environ-
ment is the assessment of risks from failure of each one
of the six individual control environment elements as de-
fined in the glossary of the Standards. Upon determining
the risks relating to each one of the six control environ-
ment elements, the chief audit executive (CAE) may con-
sider including in his or her annual audit plan one or more
1 Because “control environment” includes assessing an organization’s culture, the reader of this Practice Guide is also encouraged to review The IIARF publication, “Best Practices:
Evaluating the Corporate Culture,” by James Roth, 2010.
IPPF – Practice Guide
Auditing the Control Environment
audits of higher control environment risks. The CAE may
choose to address these risks in (1) a single audit of the or-
ganization’s control environment, (2) a series of audits fo-
cusing on aspects of the control environment, and (3) au-
dits of controls over specific risks (i.e., the scope includes
the assessment of controls performed within the control
environment as well as within business processes). Since
the audit of an organization’s control environment will of-
ten involve discussion of sensitive issues, the CAE must
plan and execute these audits diligently.
There are many practical considerations that the CAE
should pay close attention to when planning and ex-
ecuting a control-environment related audit. First, there
should be support or buy-in from senior management and/
or the board or the audit committee for such an audit.
Second, internal auditing’s reporting structure should be
sufficiently independent to ensure minimal or virtually
no scope limitation of the audit team. Third, the CAE
should clearly articulate and communicate the criteria to
be used, for the benefit of the auditee and the audit team
members, in assessing the control environment. Finally,
due attention should be given to differences in business
culture, language, local laws, etc., while conducting such
audits in a global organization.
Because the audit of the control environment includes
auditing “soft” controls, some of the traditional testing ap-
proaches and tools may not enable gathering of sufficient
direct evidence of their effective operation. The auditor
will need to think “outside-the-box” to gather sufficient,
competent evidential matter in such audits to ensure that
audit findings are not challenged due to lack of rigorous
audit procedures and evidence.
Control environment deficiencies need to be evaluated in-
dividually and it should be understood how they interact
with or impact other controls in the organization. The cor-
rective actions sometimes may need to extend beyond the
immediate control environment element being evaluated.
www.theiia.org/guidance / 1

Communication of the control environment audit findings
involve many practical considerations such as determining
the appropriateness of the standard audit report format,
limiting the distribution of the audit report, confidential
nature of the findings, timeliness, and involvement of the
general counsel and the human resource (HR) function ei-
ther as the co-executive sponsor or in a supporting role, etc.
Auditing the control environment or one or more of its
elements either as stand-alone or part of other inter-
nal audits is not only consistent with the intention of
various standards within the International Professional
Practices Framework (IPPF) but is also value-added to
the organization.
Introduction
The control environment is the foundation on which an
effective system of internal control is built and operated
in an organization that strives to (1) achieve its strategic
objectives, (2) provide reliable financial reporting to inter-
nal and external stakeholders, (3) operate its business effi-
ciently and effectively, (4) comply with all applicable laws
and regulations, and (5) safeguard its assets. Part of the
blame for the 2008 financial crisis and other prominent
failures of the 21st century can be appropriately attributed
to failures in the control environment.
The purpose of this Practice Guide is to provide guidance
to the internal auditor on the significance of the control
environment; how to determine which elements of the
control environment should be addressed by engagements
in the periodic audit plan; how to scope, staff, and plan
such engagements; and which items to consider in per-
forming related audit work, including evaluating and re-
porting deficiencies.
Focusing only on assessing and reporting on controls
within business and IT processes without assessing and
reporting on the related risk of control environment
IPPF – Practice Guide
Auditing the Control Environment
failures can miss the fundamental aspects of the orga-
nization’s foundation. An entity’s control environment is
the foundation of an organization’s entire internal control
structure — financial, operational, and compliance — in-
cluding safeguarding of its assets. Internal auditors need
to consider the risk of control environment failures in the
development of annual (and other periodic) audit plans as
well as in planning each individual audit.
The Standards defines the control environment as “the at-
titude and actions of the board and management regard-
ing the significance of control within the organization.”
Specifically, Standard 2130: Control states, “the internal
audit activity must assist the organization in maintaining
effective controls by evaluating their effectiveness and
efficiency and by promoting continuous improvement.”
Furthermore, Standard 2130.A1: Control states “the in-
ternal audit activity must evaluate the adequacy and ef-
fectiveness of controls in responding to risks within the
organization’s governance, operations, and information
systems regarding the: reliability and integrity of financial
and operational information; effectiveness and efficiency
of operations and programs; safeguarding of assets; and
compliance with laws, regulations, policies, procedures,
and contracts.”
An Organization’s
Control Environment
The Committee of Sponsoring Organizations of the
Treadway Commission (COSO) published the Internal
Control–Integrated Framework in 1992. It uses a very simi-
lar definition to that in the Standards Glossary referenced
above. The Executive Summary states:
“The control environment sets the tone of an organization,
influencing the control consciousness of its people. It is the
foundation for all other components of internal control,
www.theiia.org/guidance / 2

providing discipline and structure. Control environment
factors include the integrity, ethical values and competence
of the entity’s people; management’s philosophy and oper-
ating style; the way management assigns authority and re-
sponsibility, and organizes and develops its people; and the
attention and direction provided by the board of directors.”
Guidance on Control Number 1 from the Canadian Insti-
tute of Chartered Accountants Criteria of Control (CoCo)
Board2 uses four criteria as the basis of understanding and
evaluating the effectiveness of an entity’s internal control
structure: purpose, commitment, capability, and monitor-
ing and learning. The criteria of commitment embodies
shared ethical values, integrity, HR policies and proce-
dures, authority, responsibility, and accountability, and
an atmosphere of mutual trust — essentially the same as
the 1992 COSO framework and The IIA Standards defini-
tions.
Similarly, the original Turnbull Guidance, Internal Con-
trol: Guidance for Directors on the Combined Code, issued
by the Institute of Chartered Accountants of England
and Wales in 1999, states that, “a company’s system of
internal control will reflect its control environment which
encompasses its organizational structure. The system will
include: control activities, information and communica-
tions processes, and processes for monitoring the continu-
ing effectiveness of the system of internal control.”
While there may be differences in control language around
the world, the intent and the principles are similar and
consistent. An effective control environment functions
like a keystone in an arch bridge without which, no mat-
ter what, the best material and craftsmanship cannot hold
the bridge together. Auditing the control environment and
assessing its effectiveness is an important part of an audi-
tor’s assurance responsibility.
IPPF – Practice Guide
Auditing the Control Environment
Scope and Approach to Auditing
the Control Environment
Even though the control environment has a pervasive ef-
fect on risk management and internal controls across the
entity, any approach to auditing the control environment
should include an assessment of the risks from failure of
each individual control environment element and their in-
teraction with each other. This Practice Guide uses the six
elements described in the Standards Glossary definition of
the control environment:
• Integrity and ethical values.
• Management philosophy and operating style.
• Organizational structure.
• Assignment of authority and responsibility.
• HR policies and practices.
• Competence of personnel.
The level of risks may vary across geography, business
unit, process, etc. For example, the level of risk relat-
ing to integrity and ethical values may be higher in some
locations than others. Some business units may have a
more established and experienced workforce, leading to a
significant reduction in the risks associated with compe-
tence of personnel than in business units where personnel
turnover is high.
There are several examples of situations that might influ-
ence the assessment of risk of failure for one or more con-
trol environment elements:
• Compensation and incentive structures can contrib-
ute to inappropriate behavior or excessive risk-taking.
• A high rate of employee turnover in key functions
can lead to a lack of experience and less reliable ex-
ecution of controls. This may be the result of a num-
ber of failures in the control environment, including
ineffective supervision and other HR process issues.
www.theiia.org/guidance / 3

• The absence of a defined code of conduct and ethics
and/or a whistleblower policy, the failure to establish
an ethics hotline, the absence of a process to evalu-
ate the effectiveness of the code of conduct and
ethics policy, a high number of reported frauds, or
management over-ride of established controls can all
lead to inappropriate activity that is not detected and
addressed timely.
• Key functions may be staffed by personnel who do
not possess the necessary level of competence. The
level of risk is heightened if there is a perception that
they hold their positions by virtue of their relation-
ship to senior managers, the promoters, or executive
directors of the board.
• The board may not provide effective oversight over
the conduct of the organization’s operations, and may
not understand and monitor the broad organizational
control environment.
• Key managers in the organization may tend to make
business decisions without clearly understanding the
risks related to their decisions; management may not
exhibit risk and control consciousness in its decision-
making.
• Processes relating to defining job descriptions for
key positions may be weak, background checks and/
or reference checks are not consistently performed,
or the organization has difficulty hiring and retaining
qualified individuals.
Once the CAE has assessed the risks relating to each of
the six control environment elements, he or she may in-
clude one or more audits of the higher control environ-
ment risks in the annual audit plan. The CAE may deter-
mine the frequency of auditing the control environment
based on his or her assessment of risk of control failures
associated with one or more of the control environment
elements.
3 Risks related to the control environment at a location or within a business unit might also be included as part of the scope of broader individual audit engagements of that location or busi-
ness unit. For example, an audit of a factory in China might include assessments of control environment elements (such as code of conduct and ethics awareness) as well as controls over
inventory and procurement. An audit of the shared service center in Ireland might include assessments of HR practices in addition to general ledger and accounts payable controls.
IPPF – Practice Guide
Auditing the Control Environment
The CAE may decide to address the risks in:
• A single audit across the organization.
• A series of audits, each of which addresses selected
aspects of the control environment (such as the eth-
ics hotline, board and committee operations, etc.).
• Audits of the control environment within selected
divisions or operating units3.
• A variation of the above.
For instance, if individual operating units have their own
ethics policies and autonomous compliance committees,
separate control environment audits at each unit may be
the best approach. If each division investigates ethics vio-
lations based on organizational guidelines and tips from a
centralized hotline, an organizationwide audit focusing on
the hotline combined with local audits focusing on the in-
vestigations may be more relevant. If new personnel hiring
and screening is considered an important control environ-
ment activity and this process is centralized, an organiza-
tionwide audit may be the best approach.
Although the initial scope and approach can be altered
over time as better assessments and knowledge of the or-
ganization’s control environment comes to light, the CAE
should consider:
• What are the control environment elements and
their attributes (ethics policy, board governance,
compliance, fraud detection, etc.) that are key to the
entity’s control environment?
• How are these elements and related attributes man-
aged during day-to-day operations? Is there clear
accountability across the organization?
• Can these elements and attributes be managed effec-
tively and efficiently in the scope of one large audit
or would separate focused audits of each principle
and related attributes be more effective and efficient?
www.theiia.org/guidance / 4

• Does the balance of centralized versus decentralized
operations within the organization influence how the
control environment operates and thus the nature of
audit work?
• What combination of control environment audits will
allow the CAE to provide assurance to senior man-
agement and the board regarding the organization’s
system of internal control?
• Should the control environment audit be one annual
audit, one audit occurring periodically every few
years, or separate focused audits each year on differ-
ent principles rolling up into a review of all control
environment principles every few years?
• If the control environment has not been reviewed
previously, what knowledge is there that would
guide the decision on the audit approach? Would a
high-level risk assessment of all control environment
principles provide a basis for decisions? Should a
first year audit be different than the ongoing audits
that have been put in place in the audit plan?
• Should any aspect of the control environment assess-
ment be performed at the direction of legal counsel;
for example, those pertaining to investigations?
• Are adequate audit resources available?
• Are there any explicit senior management and board
preferences (e.g., a stated desire to have the assess-
ment completed by a certain date)?
As noted earlier, the audit plan may include a single audit
of control environment risks. It may also include multiple
audits, each addressing separate elements of the control
environment, or control environment elements in differ-
ent locations or business units. Where the plan includes
multiple control environment audits and the CAE is plan-
ning to provide an overall assessment based on the results
of these individual audits, the CAE should:
• Determine, during the initial planning phase, the
process that will be used to aggregate the results of
IPPF – Practice Guide
Auditing the Control Environment
the individual audits into an overall assessment of
the control environment.
• Plan the individual audits so that differences in their
timing do not impede the overall assessment. In the
case of a substantial time lag between individual
audits, it may be necessary to perform procedures
to update the results of earlier audits to support the
overall assessment.
• Consider staffing the audits in ways that would
ensure continuity in the audit approach and consis-
tency in the assessment process. Well-defined audit
programs also could help in this regard.
Audits of the control environment often involve the dis-
cussion of sensitive issues, including the actions or inac-
tions of senior management and the board. The internal
auditor should consider the following issues during the
planning phase:
• Whether specific skills will be required (e.g., requir-
ing the use of internal or external subject matter ex-
perts). These skills may be provided through the use
of guest auditors from other parts of the organization
or from a co-source service provider.
• Whether conversations with senior management and
the review of confidential documents require staff-
ing the audit with mature, experienced personnel.
In some situations, the CAE may decide to lead the
audit and/or personally perform certain aspects (e.g.,
the review of executive compensation or the results
of investigations involving senior management).
• Ensuring, through discussions well in advance of the
audit, that the information required to perform the
audit (especially any information considered confi-
dential) will be available when required. In addition,
the auditor should ensure that everybody asked to
support the audit understands the need to provide
the audit team with the information required timely.
This may require the involvement of the sponsor.
www.theiia.org/guidance / 5

Control Environment Implications for Indi-
vidual Internal Audit Engagements
Effective management of risks involves evaluating and
monitoring not only business process controls but also
controls relating to the entity’s control environment. If the
effectiveness of the control environment is not considered
in an audit engagement, there is a risk that the assessment
of the adequacy of controls will be incomplete and per-
haps even misleading or incorrect.
When defining the scope of any audit, the internal auditor
should consider the level of reliance placed on the effec-
tiveness of control environment activities, and the risk of
deficiencies in the control environment. In some cases,
these risks and the related controls will be included with-
in the scope of the audit. In others, reliance will be placed
on separate audits performed of the control environment
or one or more of its six elements.
For example, when developing the scope of work for an
audit of accounts payable (AP), the auditor should con-
sider risks such as:
• AP staff and managers involved in the AP process
(e.g., as approvers of invoices) are not familiar with
the organization’s expectations for ethical behavior.
• Hiring practices are not effective in staffing key AP
positions with experienced personnel.
Audit procedures around these risks might be included
within the scope of the AP audit. However, if separate
audits are being performed that specifically address these
risks — for example, as part of audits of the code of con-
duct and hiring practices — the auditor might want to
make reference to, and rely on the results of, those audits
rather than duplicate the work.
When the scope of work for an audit does not include cov-
erage for control environment risks, that limitation should
be clearly communicated to management or the executive
sponsor during the planning phase and in the final report.
IPPF – Practice Guide
Auditing the Control Environment
The results of separate audits of the control environment
should be considered when preparing the audit report:
• When the control environment audit has already
been completed, the auditor should consider those
results and include them in assessing whether the
system of internal control — including those in the
control environment — is adequate.
• When the control environment audit has not yet
been completed, the auditor should consider ac-
knowledging that fact and make it clear that the
assessment of internal controls is based on the
assumption that the control environment activities
are effective. The auditor should consider revisiting
his or her assessment of the adequacy of internal
controls should the audit of the control environment
result in the identification of deficiencies.
�
Practical Considerations
in Auditing the
Control Environment
Discussed below are some of the practical considerations
that should be taken into account while planning, execut-
ing, and reporting on audits in this area.
Senior Management and Board Support
or Buy-in
An audit of the control environment involves assessing con-
trols that in many cases, directly and/or indirectly, are per-
formed by or at the direction of senior management or the
board. Whether the audit is of all or only one element of the
control environment, consideration should be given during
the planning phase as to whether the internal audit team
will be challenged in its need for access to the pertinent in-
dividuals and required documentation. Actions may be re-
quired to mitigate and manage such challenges before the
commencement of the audit. These actions might include:
www.theiia.org/guidance / 6

• Discussing the need for access during the develop-
ment of the audit plan.
• Ensuring that the audit charter provides for appro-
priate access.
• Obtaining the support and sponsorship of the board
and/or the chief executive for the audit. In some
cases, the support of the chief financial officer
(CFO) or general counsel may be sufficient.
• Written communications from an appropriate
member of the executive management instructing
the organization to provide the required access and
information.
• Attendance by the executive sponsor4 at the audit’s
opening meeting.
• Meeting with key members of executive manage-
ment who are in a position to enable access, early
in the audit planning phase. The internal audi-
tor should ensure that the executives understand
what information and access is needed and why.
Their concerns should be heard, understood, and
addressed where possible. Escalation to execu-
tive management or the board may be necessary to
resolve continued denial of access.
Internal Auditing’s Position Within
the Organization
The reporting structure for internal auditing also may be
an issue. Standard 1110: Organizational Independence
states that “the chief audit executive must report to a
level within the organization that allows the internal au-
dit activity to fulfill its responsibilities.” When the CAE
does not report to an appropriate level, his or her ability
to perform an audit of the organization’s control environ-
ment or its elements may be challenged. For example,
the CAE may be directed not to assess certain elements
of the control environment (e.g., competence of person-
nel in the finance function), or have only limited access
to confidential information (such as board minutes or
4 For the purposes of this Practice Guide “executive sponsor” is a member of the executive team or board who will actively support the completion of the audit.
IPPF – Practice Guide
Auditing the Control Environment
records containing discussions about allegations against
senior management). This may be mitigated if the CAE
is able to obtain strong support from the board or execu-
tive management, with a clear mandate that the audit
team should be provided full access to the information
required to perform the audit.
If the CAE is unable to ensure that the audit team will
have full access to information necessary to complete an
effective control environment audit, or will be unable in
fact or perception to be sufficiently objective and inde-
pendent in its assessment of the control environment,
such scope restrictions and other limitations should be
promptly reported to the board. The CAE should consid-
er whether to pursue an audit with appropriate scope re-
strictions communicated in the report per the Standards.
Such restrictions do not relieve the CAE of her/his obliga-
tion to report to the governing board on the importance
and need to evaluate the control environment.
Criteria for Assessing the Control
Environment
The audit planning process includes consideration of the
end-product of the audit, in particular what criteria will
be used for the assessment. As with other engagements,
options include:
• An assessment of the controls included in scope us-
ing the organization’s standard rating system, togeth-
er with opportunities for improvement.
• The assessment of the controls using a defined
control maturity model, in addition to the standard
rating and opportunities for improvement.
• Assessment of controls as directed by the general
counsel with a specific objective in mind.
• Benchmarking (between companies and/or between
units/departments in the company).
www.theiia.org/guidance / 7

The CAE should use judgment, in consultation as neces-
sary with the board or executive sponsor or the general
counsel, in determining what criteria will be used to mea-
sure the effectiveness of the control environment. The
CAE should ensure the board, senior management, and
management responsible for the area being audited clear-
ly understand how the results will be communicated if
they are different from the standard internal audit report-
ing process.
Whether the assessment will be of the design and operat-
ing effectiveness of specific controls or the overall quality
of such controls using a particular control maturity model,
the criteria for that assessment should be defined during
the planning process and clearly explained to the engage-
ment client including appropriate members of senior
management. The CAE should consider discussing the
criteria to be employed with management and obtaining
its agreement if possible. Significant value to the organiza-
tion can be obtained through such discussion and buy-in
prior to beginning the audit.
Consideration of Local Culture and Values
Local culture and values should be considered when de-
termining the criteria for assessing business conduct and
other elements of the control environment. Business con-
duct and other standards and expectations are not uniform
around the world, due in large part to differences in legal
traditions, social and cultural values, and the structure of
capital markets. For example, while there are traditions
in some emerging markets for commerce to be enabled
by payments to involved individuals and for purchases
to be made from related parties, this practice is consid-
ered illegal under the U.S. Foreign Corrupt Practices Act
(FCPA) and UK Bribery Act. Nations differ in their gov-
ernance laws and regulations (e.g., on the requirement for
independent members of the board and other governing
bodies), or in other aspects of the control environment
(e.g., some restrict the ability of employers to perform
5 Lack of familiarity with the local business culture and language may present barriers to developing an effective understanding of differences in culture and behavioral norms from
that of internal auditors’ host country. Experience in, and understanding of, the local language and culture is likely to improve the auditor’s ability to understand and assess compli-
ance or lack thereof with organizational policies, standards, and expectations.
IPPF – Practice Guide
Auditing the Control Environment
background checks on employees; in some geographies,
practices related to the hiring and treatment of minorities
are accepted that would be illegal in other countries).
Most multinational organizations have developed and
published an organizational code of conduct that applies
to all of their operations globally. In such cases, audits of
the control environment already have a set standard on
which the internal auditors should base their audit scop-
ing, program, assessment, and reporting.
However, not all organizations have adopted global stan-
dards, or the global standards may need to be adjusted for
the unit being audited to comply with local laws. In these
cases, the internal audit team should, in consultation with
appropriate management, seek an agreement on what cri-
teria or standard the audit team will follow. This should be
clearly communicated to operating management before
the start of the audit. If the standards differ in any way
from the organizationally published standards, the reasons
for variation should be clearly explained.
The CAE should consider variations in culture, values,
and practices, as well as the need for language skills,5 in
assessing risks relating to the control environment and in
staffing each audit. The team should include individuals
who are able to understand the context as well as the prac-
tices in each region and enable an objective, balanced,
and fair assessment of the adequacy of the control envi-
ronment practices.
�Coordination with External Auditors
While it is clear that internal auditing’s evaluation of an en-
tity’s control environment, or one or more of its elements,
provides much needed assurance to senior management
and the board of directors, the internal auditor should
be aware that external auditors may not be able to place
complete reliance on their work in assessing the control
www.theiia.org/guidance / 8

environment with respect to audits of the financial state-
ments and the system of internal control over financial re-
porting. Depending on the external auditor’s assessment,
the external auditors may feel compelled to validate cer-
tain controls themselves to bolster their independence.
Internal auditing should work with the external auditors
during annual planning sessions to minimize duplication
and ensure the board and other stakeholders understand:
(a) the external auditors may only review those aspects of
the control environment that relate to a risk of a material
misstatement of the financial statements, (b) the external
auditors may be required to perform some levels of inde-
pendent assessment, (c) a review by internal auditing will
generally address a greater range of risks (operational and
compliance risks in addition to financial reporting risks),
and (d) there is an opportunity for internal auditing to
contribute to improvements in related processes through
its greater understanding of the organization as a whole.
How to Audit the
Control Environment
This section elaborates on generic tools and techniques
to audit the control environment. The Appendix lists
potential audit procedures that might be considered in
developing an audit of an entity’s control environment
or one or more of its elements. The seven elements and
attributes are taken from COSO’s Internal Control–Inte-
grated Framework control environment component.6 The
elements and attributes include financial, compliance,
and operating effectiveness control objectives. The Ap-
pendix is presented only for illustrative purposes and is
not intended to be complete or comprehensive.
An audit of some elements of the control environment
will include a review of soft controls, such as those
around ethics, integrity, competencies, behaviors, and
6 The seven control elements include the six from the Standards and one additional element — “Importance of the Board” — as defined by COSO.
IPPF – Practice Guide
Auditing the Control Environment
perceptions. These are considered soft controls because
it may be difficult to obtain direct evidence of their effec-
tive operation through traditional testing. Instead, self-as-
sessments, surveys, workshops, or similar techniques may
be better suited than traditional methods. Specifically:
• Employee surveys are frequently used in evaluating
the success of management’s efforts in establish-
ing an effective control environment. These surveys
provide useful measurements of the effectiveness
of one or more control environment elements. An-
nual employee ethics compliance forms are another
example.
• The CAE should use his or her network within the
organization. The network is critical in discerning
whether communication, tone at the top, manage-
ment walking the talk, and effective supervision are
present on a day-to-day basis.
• The internal auditor’s knowledge of the organiza-
tion’s inner-workings is useful to further corroborate
the effectiveness of soft controls.
• The value of “auditing by walking around” cannot
be overstated. By being present, visible, and obser-
vant across the organization, auditors can identify
those intangible clues that may lead to deeper
assessments. Associates who trust they can provide
concerns to auditors with an appropriate degree of
anonymity are also valuable.
• Past audit results over control activities and the
reaction and remediation from management also are
good indicators.
• Internal auditors’ participation in committees,
taskforces, workgroups, and involvement in ethics
and compliance program implementation and as-
sessments provide valuable insights over extended
periods of time.
As the above may provide primarily indirect evidence,
the auditor must always ensure sufficient evidence is
www.theiia.org/guidance / 9

obtained to support the audit conclusions and assess-
ment. Wherever feasible, the auditor should not hesitate
to employ data analytics to filter patterns and anomalies to
generate hard evidence.
Controls related to other control environment elements
(e.g., publishing an updated and appropriate code of con-
duct and obtaining references and performing background
checks for new employees) may lend themselves to tradi-
tional audit techniques.
In planning the audit, the auditor should understand the
different nature of soft and other controls, and select the
most appropriate techniques.
Evaluating Control Environment
Deficiencies
Control environment deficiencies generally impact mul-
tiple areas or processes and are essentially pervasive in
nature. Deficiencies in control environment might be
identified during audits that focus on (1) the organiza-
tion’s control environment, or one or more of its elements;
(2) the control environment or one or more of its elements
within a business unit, location, or equivalent; and (3) one
or more control environment elements as part of other in-
ternal audits.
1. Evaluating deficiencies found during an audit that is
focused on the organization’s control environment or
one or more of its select elements.
The internal auditor may choose to assess the deficien-
cies within the context of the control environment audit.
In other words, the audit report may limit discussion to
whether the individual control environment elements are
effective.
IPPF – Practice Guide
Auditing the Control Environment
However, limiting the assessment in this way is likely to
result in a failure to understand and act on the pervasive
effect of the deficiency. Preferred practice is for the inter-
nal auditor to work with management and understand any
or all implications for the management of critical risks and
the effectiveness of related internal controls.
For example, deficiencies in the hiring process may lead
to an inability to hire sufficient, competent personnel in
the accounting function. As a direct result, key account
analyses, bank reconciliations, and the resolution of un-
matched cash receipts may not be completed timely.
When assessing deficiencies in control environment ele-
ments, the auditor should be alert to indicators that other
affected controls are also failing. These controls may be
business process, IT processes, or even other control envi-
ronment controls. For example, a failure to hire sufficient
staff can lead to shortcuts in processes. These indicators
may point to a higher level of risk to the organization from
the control environment deficiency.
The auditor also should consider the implications of multi-
ple, related deficiencies in control environment elements.
Some deficiencies may have a greater effect when they are
both present than simple aggregation of their individual
risks may suggest. For example, when the absence of new
employee training in an organization’s code of ethical con-
duct is coupled with the failure to obtain references and
perform background checks on new employees, the risk
of hiring potentially incompetent personnel — and even
individuals with a criminal record — is exacerbated.
Even if the audit report is limited to disclosure of the
deficiencies without consideration of their pervasive ef-
fect, the CAE should discuss the implications and related
management actions with the board or audit committee.
The corrective actions required to address control envi-
ronment deficiencies may have to be extended beyond the
immediate control environment element; for example, to
www.theiia.org/guidance / 10

include greater monitoring of affected controls in busi-
ness processes.
2. Evaluating deficiencies found during an audit that is
focused on the control environment within a business
unit, location, or equivalent.
In addition to the analyses discussed above, the auditor
should determine whether control environment issues
identified in a localized audit are indicative of more per-
vasive issues across the business units, areas, or processes
within the organization. For example, if hiring practices in
the divisions are deficient, could the related procedures,
processes, and systems be deficient in other divisions? If
there is a lack of awareness of the organization’s code of
conduct, is it due to the fact that the current version of
the code was not posted on the corporate portal, thereby
affecting all parts of the organization? Has the code been
translated into local languages, to support all parts of the
organization?
The internal auditor and the CAE should discuss the po-
tential implications of local control environment deficien-
cies on the organization as a whole, and adjust the audit
plan accordingly. In some cases, additional audit work
may be required to assess whether the deficiencies are
widespread rather than confined to the unit, country, etc.
covered by the audit.
3. Evaluating deficiencies found during an audit that
focuses on the control environment or one or more of
its elements as part of another audit (e.g., an audit of
AP that includes assessing the competence of manage-
ment and staff and awareness of the code of conduct
and ethical expectations).
Many of the issues discussed above also apply here. The
internal auditor should confer with the CAE and consider
whether the control environment issues that have been
identified might extend to other parts of the organization.
The audit plan should be adjusted accordingly.
IPPF – Practice Guide
Auditing the Control Environment
The assessment of the overall system of internal controls
for the business risks covered by the audit should con-
sider whether the control environment deficiencies are
compensated for or mitigated by other controls that are
operating effectively within or outside the business unit/
function/area that is being audited.
Communicating Results
When communicating the results of a control environ-
ment audit, the auditor should consider:
• Whether the standard audit report format, includ-
ing the standard assessment scale, should be used.
In some cases, senior management or the board may
prefer a presentation rather than a standard audit
report.
• In many situations, limiting the distribution of the
report. This may be achieved in some organizations
by clearly marking the report as confidential and
thereby limiting its distribution. However, the CAE
should clearly understand how and when findings of
control environment deficiencies related to the sys-
tem of internal control over financial reporting need
to be communicated to the external auditors.
• Additional safeguards if the audit was performed at
the direction of the general counsel, especially when
there may be a need to protect the confidentiality of
the report under client-attorney privilege or similar
protective measures.
• Whether the audit did not include procedures relat-
ing to an element of the control environment that is
relevant to the assessment. Such a scope limitation
should be clearly reported in the final audit report,
even if the exclusion is based on the risk assessment
as discussed above.
• If the review of the control environment was per-
formed as part of a risk-based business audit in line
www.theiia.org/guidance / 11
 IPPF – Practice Guide
Auditing the Control Environment

with the audit plan, whether to include a discussion �Nature and Tone of Recommendations
of issues related to the control environment as part
Recommendations in the report should be practical with
of the audit or as part of a separate report on the
positive intent and should address the root cause for the
overall control environment.
identified control environment risk.
• Varying the timelines for issuance of the report based
on: Follow-up of Recommendations
• Significance of the issues identified. �Much like other internal audits, the recommendations
• Timing of the quarterly attestation on internal con- brought out in these audits should also be followed-up.
trols over financial reporting and compliance. Given the sensitive nature of the findings, the follow-up
• The scope and objective of the audit. may be performed by internal auditing or by others in the
organization such as the audit committee and/or the board
• The nature or sensitivity of the issues identified. of directors.
• The audience of the audit report.
In addition, the CAE should consider the following spe-
cific factors in determining how to communicate the re-
sults of control environment audits.

Sensitive Information
In some situations, communication of risks within the
control environment due to the nature of the control defi-
ciencies may be considered sensitive or confidential. For
example, if there is an issue at the senior management
level that could have a potential adverse bearing on the
perception of their integrity and represent a potential
compromise of organizational values, the CAE should
consult with appropriate members of the senior manage-
ment team, especially the general counsel, and the board
to determine the appropriate communication strategy and
process — including how corrective action will be docu-
mented and monitored.

�Identification of Significant Issues

If an audit of the control environment identifies issues of
significance, the CAE should review the results of prior
internal audits to determine whether earlier assessments
should be revised. The results of this review should be
communicated to senior management and the board. This
may result in changing the audit plan mid-stream because
of a potential change in the organization’s risk profile.

www.theiia.org/guidance / 12
 IPPF – Practice Guide
Auditing the Control Environment

�Appendix
The following is an example of audit procedures that use seven basic principles for a broad-based audit that assesses the
control environment. The principles, as well as the elements and attributes, are adapted from COSO’s Internal Control–
Integrated Framework control environment component.7 The elements and attributes include financial, compliance, and
operating effectiveness control objectives.

Control Design 8
Elements and Attributes (methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)

1. Integrity and Ethical Values: Basic Principle — Sound integrity and ethical values, particularly of senior management, are developed and
set the standard of conduct for doing business.

Developed — senior management develops
a clearly articulated statement of values or
ethical behaviors that are understood by key
executives and the board.
Senior management conveys the message that
integrity and ethical values cannot be compro-
mised, both in words and in actions.
Senior management has developed a code
of ethics that emphasizes the organization’s
expectation that employees will act with
integrity in all actions related to their scope of
employment.
Senior management has developed a code
of business conduct that emphasizes the
organization’s commitment to fair and honest
dealings with customers, suppliers, and other
external parties.
Performance expectations and incentives are
designed so as to not create undue tempta-
tions to violate laws, rules, regulations, and
organization policies and procedures.
Conduct periodic, anonymous “pulse” surveys
of employees as to the ethical attitude com-
municated by senior management.
Review the existence and content of the
organization’s code of conduct and ensure a
process exists for periodic updating of the
code.
Review the existence and content of the
organization’s code of business conduct and
ensure a process exists for periodic updating
of the code.
Review the mix between fixed and variable el-
ements in employee compensation plans, and
the relative weighting on short-term financial
performance in compensation plans.
Review senior management’s compensation
system to understand if it unduly incents
excessive risk-taking and the override of the
entity’s system of internal control.

7 Adapted from “Internal Control over Financial Reporting-Guidance for Smaller Public Companies: Volume III, Evaluation Tools.” COSO, 2006, pages 25-31 for Control Environment
Principles, Attributes and related summary of Entity-wide Controls and Management Documentation. Auditors should consider obtaining and reviewing the COSO literature found
at www.COSO.org for more in-depth guidance and methodology tools.
8 The suggested control testing in many instances asks the internal auditor to obtain certain documentation. In practice the auditor may encounter situations where the documentation
may be missing or may not exist. It is important that this lack of documentation be listed when appropriate as a significant audit finding by the auditor.

www.theiia.org/guidance / 13

Elements and Attributes
1. Integrity and Ethical Values: Basic Principle — Sound integrity and ethical values, particularly of senior management, are developed and
set the standard of conduct for doing business.
Communicated — senior management
communicates its commitment to ethical
values through words and actions.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
New employees receive a copy of the
organization’s code of ethics and code of
business conduct and are trained as to how
these guidelines apply to specific factual
situations common to the organization’s
business environment.
Existing employees are provided with updated
copies of the organization’s code of ethics and
code of business conduct at least yearly, and
receive periodic retraining on the application
of these guidelines to the organization’s
business environment.
Customers, vendors, and other external
parties receive a copy of the organization’s
code of business conduct at least yearly, by
inclusion in other mailings to these parties.
Contractual arrangements with these parties
should include requirements for adherence to
the organization’s code of ethics and code of
business conduct.
IPPF – Practice Guide
Control Testing Considerations
Review the signed employee representation
that they have read and understood the
codes of ethics and business conduct and,
for existing employees, their certification
that they have not violated the codes during
the past year and are aware of no other
such violations (or, if they are aware of such
violations, they have 1) communicated these
violations as directed by their compliance
or ethics office training and 2) if based on
their perspective the violations have not
been resolved, communicated the potential
violations via their company’s ethics hotline.
Review organization training courses,
including the process for ensuring that all
employees attend these courses on the codes
of ethics and business conduct.
Review the organization’s policy for including
the code of business conduct in a yearly
mailing to customers, vendors, and other
external parties. Verify that the code of
business conduct is included in mailings.
www.theiia.org/guidance / 14

Elements and Attributes
1. Integrity and Ethical Values: Basic Principle — Sound integrity and ethical values, particularly of senior management, are developed and
set the standard of conduct for doing business.
Reinforced — the importance of integrity
and ethical values is communicated and
reinforced to all employees in a manner
suitable for the organization.
IPPF – Practice Guide
Auditing the Control Environment
Control Design
(methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)
The organization’s newsletter (and other Review editions of the organization’s
internal communication devices) highlights: newsletter during the year to examine whether
a. Ethical dilemmas often arising in coverage of ethical dilemmas, ethical failures,
the organization’s industry and how and ethical successes are included.
management expects employees to act
in these situations.
b. Ethical failures (with names disguised)
and the consequences of these failures
for both the organization and the
employees involved.
c. Ethical successes (with names
retained and highlighted) with the
situation described, the employee
behavior, and why the behavior was
consistent with organization guidelines.
www.theiia.org/guidance / 15

Elements and Attributes
1. Integrity and Ethical Values: Basic Principle — Sound integrity and ethical values, particularly of senior management, are developed and
set the standard of conduct for doing business.
Monitored — processes are in place to
monitor the organization’s compliance with
principles of sound integrity and ethical
values.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
All new employees are required to sign
the code of ethics and business conduct
indicating that they have read and understand
these codes.
All existing employees are required to sign an
annual contract acknowledging that they have
read the most recent versions of the code of
ethics and business conduct and that they
understand and are in compliance with these
codes.
HR or hiring department management monitor
whether new and existing employees have
completed the required training on the codes
of ethics and business conduct.
The organization has established a hotline
— a reporting mechanism that permits
anonymity, and preferably staffed by an
internal group with a direct reporting
relationship to the board or by an outside
vendor — for receiving reports of suspected
violations of the organization’s codes of ethics
and business conduct and publicizes the
existence of the hotline.
IPPF – Practice Guide
Control Testing Considerations
Review the signed employee representation
that they have read and understood the
codes of ethics and business conduct and,
for existing employees, their certification
that they have not violated the codes during
the past year and are aware of no other
such violations (or, if they are aware of such
violations, they have communicated these
violations via the hotline).
Review organization training courses,
including the process for ensuring that all
employees attend these courses, on the codes
of ethics and business conduct.
Review the existence of the hotline —
including the organizational unit responsible
for managing and overseeing the hotline.
Examine the organization’s efforts to
publicize the hotline. Review a sample of
calls received on the hotline and examine
the appropriateness of investigation and
resolution of allegations.
www.theiia.org/guidance / 16

Elements and Attributes
1. Integrity and Ethical Values: Basic Principle — Sound integrity and ethical values, particularly of senior management, are developed and
set the standard of conduct for doing business.
Deviations Addressed — deviations from
sound integrity and ethical values are
identified timely and are addressed and
remediated at appropriate levels within the
organization.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
A senior executive, preferably with a direct
reporting relationship to the board, is
responsible for oversight of the organization’s
ethics and compliance function.
Allegations of violations of the organization’s
codes of ethics and business conduct are
appropriately investigated, and the necessary
corrective, disciplinary, and remedial actions
happen timely. This includes hotline reported
matters.
IPPF – Practice Guide
Control Testing Considerations
Review the organizational unit, and related
reporting relationships, responsible for
oversight of ethics and compliance.
Examine the appropriateness of investigations
of allegations of violations of the
organization’s code of ethics and business
conduct, including corrective, disciplinary, and
remedial actions taken.
Review the organization’s investigation
policies and practices to ensure that
appropriately qualified personnel are
performing the investigations. Evaluate
the qualifications of the investigators and
ascertain that there is good segregation of
duties between investigations, operating
management, and the discipline decision
makers.
www.theiia.org/guidance / 17

Elements and Attributes
2. Importance of Board: Basic Principle — The board understands and exercises oversight responsibility related to financial reporting,
applicable laws and regulations, operating effectiveness and efficiency, and related internal control.
Evaluates and Monitors Risk — the board
actively evaluates and monitors:
• The risk of management fraud via
override of internal controls.
• Risks affecting the achievement of
internal control objectives.
Oversees Quality and Reliability — the
board provides oversight for the effectiveness
of the system of internal control.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
The board develops governance principles and
included among these principles is the board’s
responsibility for evaluating and monitoring
risks, especially the risk of fraud by senior
management.
The board actively, or by delegation of the
audit committee, evaluates and monitors the
risk of management fraud by overriding of
internal controls.
The board actively evaluates and monitors
the risk of not achieving internal control
objectives.
The board charter vests oversight
responsibility for the organization’s internal
control system with the board.
The board receives periodic reports on the
effectiveness of internal control.
IPPF – Practice Guide
Control Testing Considerations
Review the board’s governance principles,
and that among these principles is the
board’s responsibility for evaluating and
monitoring risks. Inquire of the board, senior
management, the CAE, and the external
auditor as to the board’s processes for
evaluating and monitoring risks.
Review board agenda, minutes, and
information packets for evidence that the
board evaluates and monitors the risk of fraud
by senior management via management’s
override of internal controls. Inquire of the
board, senior management, the CAE, and
the external auditor as to board processes
for evaluating and monitoring the risk of
management fraud and management override
of internal controls.
Review board agenda, minutes, and
information packets for evidence that the
board evaluates and monitors the risk of
not achieving internal control objectives.
Inquire of the board, senior management,
the CAE, and the external audit partner as
to the board’s processes for evaluating and
monitoring the risk of not achieving internal
control objectives.
Review the board charter to verify that the
board has responsibility for oversight of the
internal control system. Review board meeting
agenda and minutes denoting substantive
board attention to this issue.
Review board meeting agenda, minutes, and
information packets for evidence of reporting
to the board on the effectiveness of internal
control.
www.theiia.org/guidance / 18

Elements and Attributes
2. Importance of Board: Basic Principle — The board understands and exercises oversight responsibility related to financial reporting,
applicable laws and regulations, operating effectiveness and efficiency, and related internal control.
Oversees Audit Activities — the board
oversees the work of all audit functions,
including internal and external auditing,
and interacts with regulatory auditors, as
necessary. The board has the exclusive
authority to hire, fire, and determine the
compensation of the external audit firm and
the CAE.
Independent Critical Mass — the board
has a critical mass of members who are
independent of management.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
The board charter vests the audit committee
or the similar governing body with the
authority to oversee the:
• Financial reporting and external
audit processes, and the exclusive
authority to hire, fire, and determine the
compensation of the external audit firm.
• The internal audit activity, and the
authority to hire and fire the CAE and to
approve the budget for the internal audit
activity.
The organization’s charter or bylaws requires
a critical mass of independent directors
on the board, and is appropriate given the
organization’s size, industry, and regulatory
environment.
IPPF – Practice Guide
Control Testing Considerations
Review the audit committee charter to verify
that the audit committee is vested with the
authority to oversee the:
• Financial reporting and external audit
processes, and with the exclusive
authority to hire, fire, and determine
the compensation of the external audit
firm. Inquire of board members, senior
management, and the external auditors
as to the board’s role in overseeing the
financial reporting and external audit
processes, including responsibility for
selecting the audit firm and determining
the audit fee.
• Internal audit group, and with the
authority to hire and fire the CAE, and
to approve the budget for the internal
audit activity. Inquire of board members,
senior management, and the CAE as to
the board’s role in overseeing the internal
audit activity, including responsibility
for selecting the CAE and approving the
internal audit budget.
Review charter or bylaw provisions requiring
independent directors on the board, and
evaluate the number of independent directors
given the organization’s size, industry, and
regulatory environment. Review director
backgrounds for those directors classified as
independent.
www.theiia.org/guidance / 19

Elements and Attributes
2. Importance of Board: Basic Principle — The board understands and exercises oversight responsibility related to financial reporting,
applicable laws and regulations, operating effectiveness and efficiency, and related internal control.
Financial Expertise2 — the board has one or
more members who have financial expertise.
Frequency — the board meets regularly,
often in executive sessions, and devotes
sufficient time and resources to adequately
carry out its functions.
9 Although COSO’s Small Business Guidance focuses on internal controls over financial reporting, it is important to note that boards need and have other experts (e.g., risk manage-
ment, etc.) as members on various committees. In such cases, it is expected that educational background and related experience of such individuals also be evaluated.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
The board charter requires at least one
member to have financial expertise and
requires all members to be financially literate.
At least one member on the board has
substantive experience in accounting
(e.g., certified public accountant, CFO, or
controller).
The charter for the board requires it to meet
no less frequently than quarterly.
The board holds an executive session at every
meeting.
The board allocates time to meet alone
with the partner from the registered public
accounting firm and with the CAE at every
meeting.
The board devotes sufficient time to carry out
its responsibilities (e.g., as a rule of thumb,
the board should meet for 1-2 days at each
meeting and the audit committee should meet
for 3-4 hours at each meeting).
The chairman of the board, if independent,
or, if not, the lead independent director is
primarily responsible for developing the
agenda for board meetings. Other directors,
the CAE, senior management, and external
auditors have input to the agenda-setting
process.
IPPF – Practice Guide
Control Testing Considerations
Review the backgrounds, including education
and experience, of board members to evaluate
the nature of their financial expertise and
literacy.
Review the charter for these provisions.
Evaluate whether the board was in compliance
with this aspect of the charter. Inquire of
board members as to whether the number
of meetings was sufficient (separately for
independent and non-independent directors).
Review board minutes, and inquire of board
members as to whether an executive session
was held at every meeting.
Review board minutes, and inquire of audit
committee members as to whether the board
had the opportunity to meet alone with the
audit partner from the registered public
accounting firm and with the CAE at every
meeting and does so on multiple occasions
throughout the year.
Review board minutes as to the length of
board meetings. Inquire of board members
as to whether the number of meetings was
sufficient (separately for independent and
non-independent directors).
www.theiia.org/guidance / 20
 IPPF – Practice Guide
Auditing the Control Environment

Control Design
Elements and Attributes (methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)

2. Importance of Board: Basic Principle — The board understands and exercises oversight responsibility related to financial reporting,
applicable laws and regulations, operating effectiveness and efficiency, and related internal control.

The board has input into the packet of
information received before board/committee
meetings. The information packet is received
at least three days before the meeting.
Board members spend sufficient time
reviewing the pre-meeting information packet.
The charter for the board authorizes the
board to retain outside advisers or counsel as
needed.
Inquire of the chairman of the board (lead
independent director) and other board
members as to the process for setting the
board agenda. Confirm that board members
have an opportunity to review and provide
input into the setting of the agenda.
Inquire of board members as to their
involvement in determining the content of the
information packet and appropriateness of the
advanced distribution for review prior to the
meeting.

Inquire of board members, senior

management, the audit partner, and the
CAE as to board preparedness for meetings.
Review the annual board peer evaluation
process, ascertaining that board preparedness
is evaluated.

Review the charters for provisions allowing the

board to retain outside counsel and advisers
as needed. Inquire of board members as to

www.theiia.org/guidance / 21

Elements and Attributes
3. Management’s Philosophy and Operating Style: Basic Principle — Management’s philosophy and operating style support achieving
effective internal control.
Set the Tone — management’s philosophy
and operating style emphasize high-quality
and transparent internal and external
reporting, and the importance of effective
internal control and risk management.
Articulate Objectives — management
establishes and clearly articulates internal
control objectives.
Select Principles and Estimates —
management follows a disciplined, objective
process in developing internal control
objectives.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
Management emphasizes the importance of
meeting internal control objectives through
both its words and actions.
Internal control objectives over financial
reporting, compliance with applicable laws
and regulations, efficiency and effectiveness
of operations, and safeguarding of assets
are communicated to relevant individuals
throughout the organization.
The organization follows a periodic, disciplined
process for establishing internal control
objectives over financial reporting, compliance
with applicable laws and regulations,
efficiency and effectiveness of operations, and
safeguarding of assets and involves senior
financial and operating management.
IPPF – Practice Guide
Control Testing Considerations
Inquire of relevant employees as to their
perception of the importance of complying
with internal control objectives. Review
criteria for employee performance reviews,
ascertaining whether employees are held
accountable for meeting internal control
objectives.
Review speeches and presentations to internal
and external parties that may reflect the tone
and style of leadership.
Independently observe or inquire with
attendees of executive and/or board meetings
to confirm that the extent and depth of
conversations regarding risk, controls, and
compliance matters is appropriate given the
matters facing the organization.
Review employee survey results where
questions concerning the culture and
leadership have been asked.
Review organization operating and accounting
manuals and other means of disseminating
internal control objectives throughout the
organization. Inquire of relevant individuals
as to their understanding of internal control
objectives.
Review documentation of the organization’s
process for establishing internal control
objectives. Inquire of senior financial and
operating management as to their involvement
in establishing internal control objectives.
www.theiia.org/guidance / 22

Elements and Attributes
4. Organizational Structure: Basic Principle — The organization’s organizational structure supports effective internal control.
Establishes Responsibility – management
establishes internal reporting responsibilities
for each functional area and business unit in
the organization.
Maintains Structure — management
maintains an organizational structure that
facilitates effective reporting and other
communications about internal control
among various functions and positions of
management.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
The organization designs a structure that is
appropriate given its size, industry, age, and
business risks.
Management establishes reporting
responsibilities for all organizational units.
The organization develops and maintains an
organization chart that establishes roles and
reporting responsibilities for all employees.
The organization develops and maintains job
descriptions for key positions.
IPPF – Practice Guide
Control Testing Considerations
Review the entity’s organizational structure.
Compare the organizational structure to other
companies of similar size, industry, and age.
Review established reporting responsibilities
and written evidence of the discharge of these
reporting responsibilities during the period.
Inquire of key operating, financial, and legal
personnel as to their understanding of, and
compliance with, reporting responsibilities.
Review whether the risks associated with the
organization’s structure have been discussed
by senior management and the board (e.g.,
risks associated with legal entity complexities,
centralization vs. decentralization, span of
control, pace of business change and whether
the organizational structure is adapting, etc.).
Review whether the organization’s structure
facilitates the flow of risk information
upwards, downwards, and across the
organization.
Review the organizational chart, including
delineation of roles and reporting
responsibilities, and review the organization’s
process for updating the organizational chart.
Inquire of key employees in the internal control
structure as to their understanding of roles
and responsibilities.
Review job descriptions for key employees,
including the organization’s process for
updating job descriptions. Inquire of key
employees in the internal control structure as
to their understanding of their job description.
www.theiia.org/guidance / 23

Elements and Attributes
4. Organizational Structure: Basic Principle — The organization’s organizational structure supports effective internal control.
Maintains Processes — management’s
lines of reporting recognize the importance
of maintaining processes for objective
verification of information generated from the
organization’s information system.
5. Commitment to Competence: Basic Principle — The organization retains individuals competent in financial reporting, internal control,
and risk management, and related oversight roles.
Identifies Competencies — competencies
that support effective financial reporting,
internal control, and risk management are
identified.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
The organization has established processes
for periodically validating the reliability of
its information system and the accuracy,
completeness, and timeliness of the
information generated from that system.
A clear and transparent competency strategy/
plan exists that is aligned to the organization’s
business strategy and objectives. The strategy
has been approved by executive management
and communicated. The strategy/plan should
include the competency requirements for
activities that have been outsourced. The
plan should include methods for acquiring the
competencies required.
Plans are in place to ensure the appropriate
level of staffing.
Formal job/role descriptions exist that define
tasks and competencies for each position.
Job/role descriptions (and experience) should
include both skills and behaviors necessary
to complete the assigned work. For each
competency, the desired level of competency
should be articulated.
IPPF – Practice Guide
Control Testing Considerations
Review the organization’s process for
periodically validating the reliability of
its information system and the accuracy,
completeness, and timeliness of the
information generated from that system, and
reports generated as a result of this process.
Review deficiencies identified, and the
organization’s investigation, resolution, and
remediation of identified deficiencies.
Obtain and review the competency strategy/
plan to verify that it exists, aligns to business
strategies and objectives, has been approved
by executive management, and has been
communicated as appropriate.
Review staffing levels and organization charts
and inquire with management to understand
the methodologies used to assess that there
is sufficient staff to execute strategies and
operating plans.
From the organization charts, select a
sample of positions and review the job/role
descriptions to ensure that the right level of
competencies have been articulated to fulfill
the assigned tasks of the position. Do the
skills seem appropriate and competencies
(and experience) reasonable and consistent?
It is recommended that the sample include
key leadership, management, and supervisory
positions particularly as they relate to
financial reporting, risk, and control.
www.theiia.org/guidance / 24

Elements and Attributes
5. Commitment to Competence: Basic Principle — The organization retains individuals competent in financial reporting, internal control,
and risk management, and related oversight roles.
Retains Individuals — the organization
employs or otherwise utilizes individuals who
possess the required competencies in financial
reporting, internal control, compliance, and
risk management.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
Individuals are placed in positions based on
the fit of their competencies (and experience)
to the job requirements as defined by the job
descriptions.
In filling key management positions, broad
functional experience should be a goal.
Consideration is given to competency of
service providers when outsourcing activities.
There should be a plan to cross train
management and staff to provide
understanding of other functions impacting
their specific duties and for back-up.
Plans are in place to ensure adequate staffing
levels are maintained.
Succession plans for key positions exist and
individuals identified in those succession
plans have the required competencies or plans
exist to develop those competencies.
There is a process in place to obtain
assistance for highly complex technical
matters.
Hiring of individuals includes background
checks and references, etc.
IPPF – Practice Guide
Control Testing Considerations
For recent hires, obtain the incumbents’
curriculum vitae or résumés to ascertain
that there is an appropriate match of their
competencies to the job position. Consider
competencies, background, education, and
experience. Inquire with management about
the adequacy of the selection process.
In reviewing the key management job
descriptions of incumbents, ascertain that
there is broad functional experience rather
than over-weighting from one or two functional
areas. Inquire with management about the
alignment of current skills and competencies
of incumbents given ongoing business
changes, risks, and current operational
performance.
Review outsource agreements/arrangements
to ascertain that competencies were given due
consideration in selecting the service provider
(pre-qualification). Ensure that provisions
exist requiring the service provider to maintain
the necessary competencies. Assess whether
the process for monitoring competencies is
effective.
Obtain training plans and ascertain that cross
training is being included in training plan
strategies.
Inquire of external auditors their perception
of capabilities and staffing levels within
the financial reporting and key governance
functions within the organization. Review
audits completed by external parties
(regulators, contract, environmental, etc.).
www.theiia.org/guidance / 25

Elements and Attributes
5. Commitment to Competence: Basic Principle — The organization retains individuals competent in financial reporting, internal control,
and risk management, and related oversight roles.
Evaluates Competencies — needed
competencies are regularly evaluated and
maintained.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
There is a competency assessment approach
and guidance that is documented and updated
regularly. The approach is designed to identify
competency gaps and establish written
development plans to address gaps within
a reasonable timeframe and a monitoring/
reporting system to ensure that the gaps are
addressed.
For individuals in key financial reporting, risk,
and control functions, the board annually
assesses their competencies.
Annual assessments of competencies and
performance of both organization and
outsourced service provider employees is in
place.
Skills noted in job descriptions are part of the
regular annual employee performance review.
IPPF – Practice Guide
Control Testing Considerations
Were competencies evaluated and if so what
were the conclusions/ recommendations?
Review succession plans for key positions.
Ensure that training development plans
and competencies of potential succession
planning candidates generally align to job/role
requirements.
Inquire with finance staff and independently
with external auditors to determine how past
needs for technical assistance/confirmation of
accounting procedures were handled.
Obtain and review the adequacy of procedures
for assessing individual competencies. Select
a sample of management and staff and review
assessments, plans to address gaps, and
progress made to date. Review the reporting
system, and conclude on whether people
collectively are progressing adequately in
addressing competency gaps.
For key individuals, review documentation that
this was completed.
Review those business processes where
surprise risk events, material weakness,
or deficiencies occurred to determine if
competency assessments were properly
carried out.
Review a sample of performance appraisals
to determine whether skills noted in job
descriptions are indeed part of employees’
annual performance appraisal and whether
compensation adjustments differ for
employees performing the same skill at
various levels of competency.
www.theiia.org/guidance / 26

Elements and Attributes
6. Authority and Responsibility: Basic Principle — Management and employees are assigned appropriate levels of authority and responsibility to
facilitate effective internal control.
Board Oversees Internal Control and
Risk Management — the board oversees
management’s process for defining
responsibilities for internal control and risk
management.
Defined Responsibilities — assignment of
responsibility and delegation of authority are
clearly defined for all employees involved in
the internal control and risk management,
compliance, and financial reporting processes.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
Legal entity board and committee
structures, bylaws, and/or charters set
forth responsibilities for the oversight and
evaluation of management’s principal roles
and responsibilities for risk management and
internal control.
Board meetings should regularly include
discussions on the effectiveness of
management’s roles and responsibilities for
risk management and internal control.
As a result of discussions, the board should
make recommendations on realignment where
necessary.
The board delegates authorities and
responsibilities to the CEO who in turn
delegates authority and responsibilities to
appropriate individuals in the organization.
These delegated authorities and assigned
responsibilities should be formally
documented.
For key management positions, the board
reviews and approves descriptions of the
positions’ responsibilities and authorities,
and considers how those positions affect the
strength of internal control.
The evidence for assignment of authorities
can be in the form of a delegated authorities
matrix, written job descriptions, or individual
authority grant letters. Employees should
clearly understand their authorities and
responsibilities.
IPPF – Practice Guide
Control Testing Considerations
Obtain and review the organization’s legal
documents to ensure that proper oversight
roles exist and are documented.
Review board meeting agenda and minutes
to ascertain that appropriate oversight
discussions are taking place.
Review completeness of process for defining
responsibilities and delegating authorities.
Evaluate appropriateness of criteria for
delegating authorities.
Through inspection, verify that key
management has appropriate documented
authorities. By interview, ascertain that
management understands its authorities and
responsibilities.
Verify that authorities are reviewed and
adjusted where appropriate periodically.
Review employee surveys (or conduct a survey
if not conducted by others) to determine
whether authorities and responsibilities were
clearly communicated and understood.
www.theiia.org/guidance / 27
 IPPF – Practice Guide
Auditing the Control Environment

Control Design
Elements and Attributes (methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)

6. Authority and Responsibility: Basic Principle — Management and employees are assigned appropriate levels of authority and responsibility to
facilitate effective internal control.

When management assigns authority and

responsibilities to key individuals, it considers
the impact on the effectiveness of the
control environment and the importance of
maintaining effective segregation of duties. A
defined set of criteria should exist upon which
management bases level of authority.

When delegating levels of authority and

responsibility, management establishes an
appropriate balance between the authority
needed to “get the job done” and the need to
maintain adequate internal control over key
business processes.

Authority levels should be reviewed

periodically to ensure they are appropriate.

Employees are empowered to correct problems

or implement improvements in their assigned
business processes as deemed necessary.
Empowerment to take these actions is
accompanied by pre-approved levels of
responsibility and authority.

Management considers the nature of employee

positions within the organization when
assigning responsibilities to individuals or
determining certain levels of authority for
positions.

www.theiia.org/guidance / 28
 IPPF – Practice Guide
Auditing the Control Environment

Control Design
Elements and Attributes (methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)

6. Authority and Responsibility: Basic Principle — Management and employees are assigned appropriate levels of authority and responsibility to
facilitate effective internal control.

Limit of Authority — assignment of authority
and responsibility includes appropriate
limitations.
As part of granting authorities, the
organization process includes clear lines of
authority for approving transactions over a
specific dollar amount or in meeting certain
described characteristics. As dollar threshold
increases, additional approvals from senior
management are required, with the highest
dollar thresholds reserved for CEO and board
approval.
Include verification of authority limits in
testing above.
During the review period for any significant
events/ transactions, verify that the
appropriate approval process and levels of
approval were followed.

There is a process in place to monitor

compliance to authority levels and a
remediation process in those cases where
authorities are exceeded.

www.theiia.org/guidance / 29
 IPPF – Practice Guide
Auditing the Control Environment

Control Design
Elements and Attributes (methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)

7. Human Resources: Basic Principle — HR policies and practices are designed and implemented to facilitate effective internal control.

Establish HR Policies — management
establishes HR policies and procedures that
demonstrate its commitment to integrity,
ethical behavior, and competence.
HR policies and procedures exist. These are
reviewed and approved by the board and
implemented by management. The policies
and procedures are documented and thus
provide evidence of the control process.
HR policies and procedures are periodically
reviewed, updated where necessary,
and signed off/approved by appropriate
individuals.
An effective policy exists for disseminating
the HR policies and procedures and employees
understand them.
Obtain and review the organization’s HR
policies and procedures to ensure that
they are complete, current, and approved
appropriately.
Review most recent employee survey content.
Did it ask employees to evaluate quality/
effectiveness of the policies, procedures, and
practices? Where improvement opportunities
exist, what is the status of the actions? Were
the results summarized and reviewed with
senior management and the board?

Newly hired employees receive a copy of the

policies and procedures and all employees
receive updates.

Periodic employee surveys are conducted to

assess employee understanding of HR policies
and procedures and whether they have been
effective in achieving HR objectives.

www.theiia.org/guidance / 30
 IPPF – Practice Guide
Auditing the Control Environment

Control Design
Elements and Attributes (methods to achieve control environment Control Testing Considerations
principles, elements, and attributes)

7. Human Resources: Basic Principle — HR policies and practices are designed and implemented to facilitate effective internal control.

Recruiting and Retention — employee
recruitment and retention for key positions are
guided by the principles of integrity and by the
necessary competencies associated with the
positions.
Management establishes and enforces
standards for hiring qualified individuals
consistent with job description requirements.
Policies over conflicts of interest regarding
employment relationships such as those
involving family members or personal
relationships among co-workers are in place
and enforced.
Recruiting practices include formal, in-depth
employment interviews. Screening procedures,
including reference checks, resume review,
and background checks are employed for job
applicants, particularly those applying for key
management positions.
Interview and screening practices comply with
local employment, human rights, and privacy
laws/regulations.
The organization develops and maintains
position descriptions that reflect its values
and the competencies needed to fulfill the
position requirements. The job descriptions
contain specific references to control related
responsibilities.
Include review of recruiting/retention
procedures when completing above review.
Verify that screening procedures are being
followed.
For recent hires into key positions, verify that
the new hire meets the position requirements.
Review exit interview documentation. Verify
that follow-up action was appropriate.
Obtain and review succession plans for
key positions. Ensure they are periodically
reviewed and approved.
Review turnover statistics and trends. Were
results outside reasonable range analyzed and
discussed at an appropriate level?
Assess whether HR or another management
area reviews turnover levels. Independently
review turnover data regarding overall
turnover, turnover of recent hires, and turnover
of key positions or competencies. Inquire
further about potential root cause of excessive
or unexpected or unexplained turnover.

The organization performs exit interviews with

those leaving the organization and inquires
about any concerns related to internal control.

Retention strategies include formal

succession plans. The organization should
have a documented succession plan for key
management positions. Succession plans
should be updated periodically and approved
by the CEO and board.

www.theiia.org/guidance / 31

Elements and Attributes
7. Human Resources: Basic Principle — HR policies and practices are designed and implemented to facilitate effective internal control.
Adequate Training — management supports
employees by providing access to the tools
and training needed to perform their roles.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
Training programs exist to enforce and
promote ethical behavior and internal control.
A training program should include
identification of the knowledge, skills, and
competencies necessary to perform their
roles. Individual training needs should be
documented in a training plan.
The ongoing training process enables people
to effectively deal with evolving business
environments.
Training includes development and coaching in
leadership and interpersonal skills.
Management supports employees by providing
them the tools and resources necessary to
perform their jobs.
IPPF – Practice Guide
Control Testing Considerations
Obtain and review training and development
programs to ensure they address key
elements.
Verify that the program includes steps to
evaluate employee effectiveness and to set a
plan to close any identified gaps.
Inspect training plans for several key
management team members to verify
existence. Evaluate progress in closing “gaps.”
Review budgets to ensure that there are
adequate resources (e.g. time, people, funds,
equipment) to achieve the development plans.
Review actual spending to ensure that the
employees are availing themselves of the
training.
Review the organization’s supplemental
education program if one exists.
Sample employees regarding the adequacy
of internal training and the value add
of the training for enhancing skills and
competencies.
www.theiia.org/guidance / 32

Elements and Attributes
7. Human Resources: Basic Principle — HR policies and practices are designed and implemented to facilitate effective internal control.
Performance and Compensation —
employee performance evaluations and
the organization’s compensation practices,
including those affecting senior management,
support the achievement of internal control
objectives.
Auditing the Control Environment
Control Design
(methods to achieve control environment
principles, elements, and attributes)
A performance management process that
includes objective setting, assessment, and
reward exists.
The organization’s compensation/incentive
plan for senior executives is balanced among
achievement of financial and non-financial
goals and is not over-weighted to achievement
of quarterly financial results.
The performance management process
includes steps to confirm awareness of
an employee’s progress to achievement of
objectives during the performance period.
Performance reviews are conducted annually
and signed by the employee and respective
manager. The documented review is evidence
of the performance review and is retrievable.
Performance evaluations and compensation
to include incentive compensation for key
management are reviewed by the board before
administration/payout.
Compensation programs are benchmarked in
the market and by industry periodically. The
board is apprised of such benchmarks.
The board is assured of the integrity of
incentive program information systems and
that information used to award incentive
compensation is reliable.
IPPF – Practice Guide
Control Testing Considerations
Obtain and review organization’s documented
performance management process. Verify that
key elements exist.
For key management (particular emphasis
on executive) verify that performance
management process was performed as
required.
Review board meeting minutes and other
documentation to support its review and
approval of performance and rewards.
Verify that compensation changes, incentive
comp awards, and stock grants made are
consistent with board approved amounts.
Review information packages to the board
to ensure that it is getting appropriate
information for benchmarking compensation
and awarding incentives.
Review processes used to develop and compile
compensation information and identify that
assurance activities cover all important
activities.
Review actual compensation paid and
incentive awards made to approved amounts
and pay guidelines.
www.theiia.org/guidance / 33
 IPPF – Practice Guide
Auditing the Control Environment

Authors
Parveen P. Gupta

Philip D. Bahrman, CIA

Joseph Carcello, CIA

Princy Jain, CIA, CCSA

Norman Marks

James A. Rose, CIA

Erich Schumann, CIA

Natarajan Girija Shankar, CIA

Reviewers
Carlos Alberto Reyes, CIA

Maria E. Mendes, CIA, CCSA

Lynn C. Morley, CIA

David W. Zechnich, CIA

Douglas J. Anderson, CIA

Steven E. Jameson, CIA, CCSA, CFSA

www.theiia.org/guidance / 34
About the Institute
Established in 1941, The Institute of Internal
Auditors (IIA) is an international professional
association with global headquarters in Altamonte
Springs, Fla., USA. The IIA is the internal audit
profession’s global voice, recognized authority,
acknowledged leader, chief advocate, and princi-
pal educator.
About Practice Guides
Practice Guides provide detailed guidance for
conducting internal audit activities. They include
detailed processes and procedures, such as tools
and techniques, programs, and step-by-step ap-
proaches, as well as examples of deliverables.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category of
guidance, compliance is not mandatory, but it
is strongly recommended, and the guidance is
endorsed by The IIA through formal review and
approval processes. For other authoritative guid-
ance materials provided by The IIA, please visit
our website at www.theiia.org/guidance.
Disclaimer
The IIA publishes this document for informa-
tional and educational purposes. This guidance
material is not intended to provide definitive an-
swers to specific individual circumstances and as
such is only intended to be used as a guide. The
IIA recommends that you always seek indepen-
dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
anyone placing sole reliance on this guidance.
Copyright
Copyright ® 2011 The Institute of Internal
Auditors. For permission to reproduce, please
contact The IIA at guidance@theiia.org.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice Guide

BUSINESS
CONTINUITY
MANAGEMENT
AUGUST 2014
 IPPF – Practice Guide
Business Continuity Management

Table of Contents

Executive Summary ........................................................................................ 1

Introduction ................................................................................................... 2
Internal Audit Roles and Engagements .......................................................... 4
Internal Audit’s Evaluation of Key BCM Elements ........................................... 5
Internal Audit Activities Before a Crisis.......................................................... 7
Internal Audit Activities During and After a Crisis .......................................... 7
Appendix ....................................................................................................... 9
Authors & Reviewer...................................................................................... 23

www.globaliia.org/standards-guidance /
 IPPF – Practice Guide
Business Continuity Management

Executive Summary
Business continuity management (BCM) prepares orga-
nizations for future incidents or crises that could inter-
fere with the achievement of business objectives. Crisis
management (CM) is a key component of BCM and
deals with communicating pertinent information about
the crisis to the organization’s stakeholders.

Internal audit’s breadth and depth of skills and qualifica-

tions, position in the organization, and in-depth knowledge
of organization-wide operations position it well to make
meaningful contributions to the development, implemen-
tation, and assessment of an organization’s BCM and CM
initiatives. Internal audit may perform a variety of key and
supporting roles, depending on the existence and/or matu-
rity of BCM and CM initiatives, as well as the severity and
circumstances of the crisis.

Internal audit’s roles may involve assurance and advisory

services before, during, and after a crisis. Assurance and
advisory services both require expert knowledge of key
BCM elements including program governance, risk man-
agement, business impact analysis, and business continu-
ity and recovery planning (BCRP).

• Assurance engagements may be performed to verify

that BCM and CM are effective.
• Advisory services may be performed to help
management focus planning activities and coordinate
BCM and CM with risks and controls.
During a crisis, internal auditors also may be expected and
authorized to perform critical non-auditing roles to serve
the needs of the organization.

www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Business Continuity Management
Introduction
The IIA Global Technology Audit Guide (GTAG) 10:
Business Continuity Management speaks to the impor-
tance of BCM, serves as a valuable reference for the key
components of an effective BCM program, and provides
direction for the continuity of critical IT infrastructure
and business applications systems during and after a cri-
sis. This practice guide expands on Business Continuity
Management by exploring auditors’ potential roles in cri-
sis management and providing guidance on:
• Internal audit activities before, during, and after
a crisis.
• Internal audit’s evaluation of key BCM elements.
Practice aids provided in the appendix include a risk
assessment checklist, sample audit programs, a glossary,
and references.
Business Significance and Related Risks
All organizations will eventually face business interrup-
tions. A well-defined BCM/CM plan is like an insurance
policy for the organization — it helps to ensure that the
organization will continue to be viable and meet stake-
holder expectations. The BCM/CM plans also can pro-
vide internal audit with a venue to continually update
and communicate effective risk management and control
throughout the organization.
Crisis management plans (CMP) consolidate preventive
and reactive risk management measures for acute crises
situations. Deficient, poorly constructed or communi-
cated CMPs with inadequate testing or training may el-
evate organizational risks from a crisis to unacceptable
levels. CMPs developed post-crisis rely primarily on the
recent crisis to drive content development and may not be
comprehensive enough to be effective. For public sector
organizations, including governments, exposures due to a
crisis or incident may have broader local and international
implications.
2 / www.globaliia.org/standards-guidance
A well-communicated and comprehensive CMP may
help organizations effectively navigate through a crisis
and related risks. Moreover, a CMP may improve an or-
ganization’s resilience in the face of crisis. CM tools and
programs, when built thoughtfully, validated periodically,
and advocated and approved by management and/or the
board, will enable organizations to manage events and
mitigate risks to minimize overall operational, financial,
reputational, regulatory, and legal exposure for key inter-
nal and external stakeholders.
Related IIA Standards and Guidance
The International Standards for the Professional Practice
of Internal Auditing (Standards) related to BCM and CM
include:
Standard 2100: Nature of Work
The internal audit activity must evaluate and contribute
to the improvement of governance, risk management, and
control processes using a systematic and disciplined ap-
proach.
Standard 2110: Governance
The internal audit activity must assess and make appro-
priate recommendations for improving the governance
process in its accomplishment of the following objectives:
• Promoting appropriate ethics and values within the
organization;
• Ensuring effective organizational performance
management and accountability;
• Communicating risk and control information to
appropriate areas of the organization; and
• Coordinating the activities of and communicating
information among the board, external and internal
auditors, and management.

Standard 2120: Risk Management
The internal audit activity must evaluate the effectiveness
and contribute to the improvement of risk management
processes.
Standard 2400: Communicating Results
1. Internal auditors must communicate the results of
engagements.
Definitions of Key Concepts
BCM is the process by which an organization prepares for
future incidents or crises that could jeopardize the organi-
zation’s core mission and its short- and long-term ability to
continue operations and meet stakeholder expectations.
CM, considered a key component of BCM, addresses
how the organization will inform the general public, its
staff, its business partners, and various stakeholders of a
disaster or crisis and the steps being taken to resume busi-
ness operations and minimize internal/external stakehold-
er impact. A CMP is a consolidated portfolio of activities
consisting of preventive and reactive measures executable
by any organization to effectively mitigate and manage
risks created by a crisis or event.
Business Continuity Management
BCM is a risk management approach based on business
value. It aligns business continuity capabilities with risks.
The goal of BCM is to enable any organization to restore
critical operational activities, manage communications,
and minimize financial and other effects of a disaster,
business disruption, or other major event. BCM is a sim-
ple matter of risk management designed to create busi-
ness continuity capabilities to match likely risks based on
business value. While terminology in professional litera-
ture may vary, the term BCM in this practice guide ad-
dresses the overall policy/model/framework for managing
various types of service interruptions that can be triggered
by events internal or external to the organization. This
definition also may apply to public sector organizations
such as governments. For these organizations, the term
IPPF – Practice Guide
Business Continuity Management
business represents governing agencies, critical public op-
erations, public safety, and the security of its constituents.
Key components of BCM include:
• Management Support – Management shows
support to appropriately prepare, maintain, and
exercise a business continuity plan (BCP) by assign-
ing adequate resources, people, and budgeted funds.
• Risk Assessment and Risk Mitigation –
Potential risks due to threats such as fire or flood,
are identified, and the probability and potential im-
pact to the organization are determined. This is done
at the site and division level to ensure that the risks
of all credible events are understood and managed
appropriately.
• Business Impact Analysis (BIA) – Identifies
business processes that are integral to keeping the
business unit functioning in a disaster and to deter-
mine how soon these integral processes should be
recovered following a disaster.
• Business Recovery and Continuity Strategy –
Addresses the actual steps, people, and resources
required to recover critical business processes. This
also should identify key communication mechanisms
and protocols. The strategy may consider company or
industry benchmarks and standards.
• Plan Awareness and Training – Education and
awareness of the BCP are critical to the execution
of BCM. Training also may include performance of
exercises and/or practice drills for portions of the BCP.
• Maintenance – The BCM capabilities and docu-
mentation are maintained to ensure that they remain
effective and aligned with business priorities.
Crisis Management
CM is a key component of BCM that is triggered when
the disruption of business service rises to the level of a cri-
sis or disaster. CM documents methods used to respond
www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Business Continuity Management

to the reality and perception of crises. CM also involves

establishing metrics to define what scenarios constitute
Internal Audit Roles and
a crisis and should consequently trigger the necessary Engagements
response mechanisms. It consists of the communication
that occurs within the response phase of emergency man- Internal Audit’s Role Defined
agement scenarios. Internal auditors are positioned to contribute to crisis
management by providing organizations with practical in-
Types of Interruptions sights into operations. The chief audit executive (CAE)
BCM seeks to manage internally and externally generated should define internal audit’s roles before, during, and af-
threats. Each threat can have varying degrees of impact ter a crisis, taking care not to assume responsibility for
on the organization’s business processes, which could the ownership or management of crisis-related risks. Of-
adversely affect regulatory compliance, personnel safety, ten, the internal audit function may have a seat at the
protection of the environment, the ability to maintain op- table during the crisis management planning process. As
erating standards and satisfy contractual requirements, an initial action, the CAE, along with key internal audit
and the organization’s brand/reputation. Types of inter- management, should become familiar with leading BCM
ruptions include: practices through external references and standards. Re-
sources are provided in Practice Aid III of this guide.
• Cyberattack. Once roles are developed, they should be documented
and communicated within the function and to key exter-
• Disease/pandemic.
nal stakeholders who will be directly impacted.
• Earthquake/tsunami.
• Fire. If internal audit or the CAE do not have a role in the crisis
management process, the audit committee should be no-
• Flood.
tified to avoid gaps in expectations. When internal audit
• Hurricane/tornado. serves in an advisory role to management in the context of
• Labor disruption. BCP/CMP development, the potential impact on internal
audit’s independence and objectivity should be explicitly
• Production failure/outage.
addressed. As roles are identified, they should be approved
• Product contamination. by the CAE’s administrative and functional reporting lines
• Sabotage. and potentially documented in the internal audit charter.
• Service or product outage for key business
partners/vendors.
Advisory or Assurance Engagements
Regarding BCM
• System failure.
The internal auditor’s responsibility to add value and im-
• Terrorism. prove an organization’s operations and risk management
• Utility outage. efforts should extend to BCM assurance or advisory en-
gagements, depending on the maturity of the organiza-
tion’s BCM program. The inclusion of the internal audit
activity in BCM and CM planning or refinement process
may be key to the program’s success. This is especially the
case for organizations with a low level of maturity in this

4 / www.globaliia.org/standards-guidance

space. Given its interaction with, and understanding of,
the needs of the organization’s board and executive man-
agement, internal audit can provide perspective and help
focus planning activities. Ensuring that key BCM focus
areas are aligned with board and executive management
level needs is critical to success.
Assurance Engagements
Internal audit may perform periodic assurance engage-
ments to verify that the BCP and CMP are comprehen-
sive, relevant to the current business operating environ-
ment, and communicated to the appropriate internal and
external stakeholders. The frequency, nature, and extent
of work performed will be driven by risks or requests from
stakeholders to validate the effectiveness and relevance of
planned efforts.
The scope of assurance engagements may include a com-
prehensive BCM program or specific elements (e.g., test-
ing the occurrence and update frequency of the BCP, and
the maturity of the CMP). Internal audit’s knowledge of
the risks mitigated by the BCP or CMP and prior involve-
ment in an advisory capacity during plan development may
promote a more efficient engagement planning process.
Assurance engagements may include:
• Requests for review by the audit committee or
executive management on the BCM program or por-
tions thereof, including vendor or business partner
reviews.
• BCM reviews to evaluate plan completeness, maturi-
ty, and appropriateness based on organizational risks,
growth, or divestitures.
• Program risk assessments.
• Reviews of existing provisions of an organization’s or
a business partner’s BCP/CMP as defined by con-
tractual terms (i.e., right to audit clauses or defined
service-level agreements).
IPPF – Practice Guide
Business Continuity Management
See Practice Aid I for additional guidance on assurance
engagement programs.
Advisory Engagements
The focus of BCM can quickly turn toward the review
and analysis of IT infrastructure because data access and
transfer are considered core business functions. However,
when providing BCM/CM advisory services, internal au-
dit should consider broad organizational objectives and
risks and not limit the engagement’s emphasis to IT is-
sues. BCM advisory engagements should not compromise
internal audit’s objectivity. Care should be taken not to ac-
cept responsibility for ownership or management of busi-
ness continuity risks.
Internal Audit’s Evaluation of
Key BCM Elements
BCM programs include common elements such as pro-
gram governance, risk management, business impact anal-
ysis (BIA), and business continuity and recovery planning
(BCRP). It is critical that each element involve the right
sponsors, stakeholders, and business partners to help en-
sure the development of a comprehensive, supported, and
actionable plan. Overall communication elements within,
and information about, the plans should be shared with
key stakeholders. Internal audit activity may include eval-
uating the effectiveness of BCM and the CMP.
Program Governance
The key to successful BCM is the support and sponsor-
ship of executive management. Internal audit can help
identify and forge relationships between key internal
BCM stakeholders. The following activities may be per-
formed by internal audit during the initial stages of BCM
evaluation:
• Determining whether key leadership positions have
been documented and approved to help ensure
ownership and accountability for the organization’s
www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Business Continuity Management
programs. Leadership is critical to identifying plan
interdependencies, promoting continuous improve-
ment, and learning from post-crisis activities.
• Recommending the development of a BCM charter.
The charter helps to establish program sponsorship
and support within the highest levels of the organiza-
tion. In addition to validating the BCM program’s
existence, a well-defined charter establishes a BCM
governance structure (i.e., BCM committee) and
guidance regarding periodic re-evaluation of the char-
ter. A governance structure approves BCM or CM
decisions and provides a forum for visibility into or-
ganizationwide BCP or CMP development, revisions,
and associated internal and external communications.
• Evaluating whether an established BCM and CM
governance structure is adequately funded, appropri-
ate, and effective in serving the needs of the board,
audit committee, or executive management. Internal
audit may play a nonvoting member role or attend
meetings to provide feedback on the role, charter,
and efforts of such a body.
• Communicating and advising on whether BCM
governance appropriately and effectively serves the
needs of the board, audit committee, and executive
management.
• Apprising the board (audit committee) of the risks
associated with, and current best practices for, busi-
ness continuity and CMPs.
Risk Management
For BCM to be effective, it must consider the relevant pri-
oritized risks facing an organization in the event of a crisis.
Internal audit often has a detailed understanding of core
business risks. Risks may be magnified and reprioritized
during a crisis based on the nature and extent of events
facing an organization. Internal audit may share informa-
tion about key organizational risks during the establish-
ment and evaluation of BCM.
6 / www.globaliia.org/standards-guidance
Understanding key BCM risks can help strengthen the
development of the proposed internal audit plan. Being
exposed to the organization’s BCM activities helps the in-
ternal auditor identify key exposure areas including orga-
nizational tone/support, operational control activities, and
core processes and potential systems/data/vendor depen-
dencies. Weakness or failures in these areas could prompt
the internal audit function to focus resources on provid-
ing assurance or advisory engagements geared toward add-
ing value and organizational improvement. Gathering risk
data helps guide internal audit’s plan and allows internal
audit to perform analyses to assess risk probabilities, im-
pacts, comprehensiveness, and credibility. Practice Aid I
provides a sample risk assessment checklist.
Business Impact Analysis (BIA)
Internal audit may provide guidance on how management
can perform a BIA, a key component of BCM. A BIA will
support the identification of key business assets, func-
tions, applications, partners, vendors, resources, and the
eventual evaluation of potential loss to an organization
in the event of a crisis. GTAG 10: Business Continuity
Management provides useful direction on performing a
BIA. The results of the BIA will likely drive the levels of
pre-emptive actions, coverage, and risk appetite to be as-
sumed by the organization. A BIA, if performed effective-
ly, will outline critical operations, critical resources, and
processes — facility, personnel, and technology (includ-
ing logical and physical security) — and may ultimately
drive investment priorities for a BCP and related CMP.
Business Continuity and Recovery Planning
(BCRP)
BCRP provides a proactive method by which organizations
can identify business continuity and recovery measures to
manage and mitigate key organizational risks triggered by
a crisis. Internal audit may provide advisory or assurance
services related to BCRP.

Internal Audit Activities Before
a Crisis
Internal audit’s evaluation of BCM, and specifically CMP,
may help ensure that the CMP remains relevant to orga-
nizational priorities in the event of a crisis.
Included below are typical activities in which internal
audit may be engaged before a crisis:
• Share knowledge of leading developments for
BCM with executive management and the audit
committee.
• Specifically consider BCM as a risk facing the orga-
nization and consider residual risks in the develop-
ment of the annual audit plan.
• Evaluate key business partner arrangements for ap-
propriate contractual terms, including service-level
agreements, right-to-audit clauses, and requisite
reporting to management regarding the partner’s
control environment.
• Advise management in its performance of BCM risk
assessments or evaluate the accuracy of manage-
ment’s BCM risk self-assessments.
• Perform assurance engagements related to the BCP
and/or CMP, as part of the annual audit plan. Assur-
ance engagements may include evaluation of plan
components, communication protocols within the
plan, and the operational aspects of the plan.
• If not established by the provisions of the internal
audit charter or directives from the board, clarify and
establish BCM roles for internal audit and the CAE.
Internal Audit Activities During
and After a Crisis
The headings below describe common activities that
internal audit may perform during and after a crisis.
IPPF – Practice Guide
Business Continuity Management
During the Crisis:
• Monitor and assess the organization’s response to
an event and be an active participant on the crisis
management team.
• Monitor outage details for subsequent audits.
• Serve on a crisis management committee to ensure
that risks associated with a crisis are understood and
provide recommendations on alternate courses of
action to management, as appropriate.
• Participate in the wider crisis management and
recovery process for the organization, as agreed upon
and authorized.
The Standards allow for these types of involvement provid-
ed that the details of any potential impairment to internal
audit independence are disclosed to appropriate parties
(e.g., audit committee and BCM leadership). Involvement
by internal audit may be greater during the initial stages
of a crisis when support of the organization’s limited avail-
able resources is in high demand.
After the Crisis:
• Evaluate and report on the effectiveness of the
organization’s recovery efforts.
• Continue to assess risk, provide guidance, and help
develop business improvement efforts.
• Perform post-crisis reviews to identify opportunities
for BCM activities and, specifically, for CMP
evolution.
• Perform assurance engagements to evaluate whether
management performed and appropriately consid-
ered the results of root-cause analysis to update the
BCP and CMP, as needed. Participate in the orga-
nizationwide recovery process, as agreed upon and
authorized per the BCP and CMP.
These activities are discussed in greater detail in the fol-
lowing pages.
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Business Continuity Management

Conduct Audits of the Recovery Processes Participate in the Broader Recovery Process
and Plan Effectiveness Internal auditors may be requested by organizational lead-
The disaster recovery plan, as a component of the BCM, ership to lend additional support to operational staff who
may include requirements for internal audit to conduct an are either:
audit of the recovery process. Where this is the case, this
additional work will need to be included in the initial draft • Working on recovery processes.
plan and may lead to changes to those priorities. • Working on revisions to normal business processes
as a result of the unavailability of IT systems.
Additionally, where such a role has not been specifically
assigned, the CAE should consider whether, following a • Using alternate defined procedures to carry out
risk-based assessment, he or she should recommend to activities for which normal processes have been
the BCP leadership team that particular aspects of data disrupted.
recovery and/or CMP should be audited. It will be important for the CAE to consider requests au-
thorized by the audit committee in advance of determin-
The types of audit work that might be undertaken include: ing internal audit’s BCP/CMP role. Additionally, when in-
ternal audit staff is released to assist with CM or recovery
• An end-to-end review of the recovery process (i.e., efforts, assigned duties should be carried out under the
whether it complied with the planned process and direction of operational management. To protect objectiv-
whether the plan proved to be detailed enough to ity, the CAE should consider the operational duties per-
deal with the issues that emerged). formed by internal auditors and avoid assigning them to
• An audit of the effectiveness of the recovery pro- future internal audit assurance activities in the same area.
cess, including performance against defined metrics
or plan components as well as effective and timely
internal and external stakeholder/business partner
communication.
• A review of controls and special processes intro-
duced outside the normal control framework and
potential impact on operational or financial risks for
the organization.
• An audit of management’s data recovery processes,
which may include examining key data reconcili-
ations performed by management to ensure data
completeness and accuracy.
• A review of actual BCP and CMP variations follow-
ing activation of the plans, including recommenda-
tions that will allow for effective plan evolution. This
also should apply to the internal audit activity’s own
plans.

8 / www.globaliia.org/standards-guidance

Appendix
Practice Aid I: Sample Work Programs for
BCM Assurance or Advisory Engagements
The internal audit activity plays an important role in
providing an independent review of the adequacy of the
overall BCM. The depth and frequency of audit activi-
ties and reporting should be scaled to the criticality of the
operation. While the scope of the audit activities and de-
liverables may vary, in all cases they must encompass an
independent and objective evaluation of the effectiveness
of the testing program. The internal audit activity should
determine the reasonableness of the underlying assump-
tions that were made in developing the testing program.
The reasonableness of underlying assumptions, as well as
the adequacy of the test plan, scenarios, schedules, and
reports, should be evaluated relative to the size and com-
Example 1:
BCM SAMPLE WORK PROGRAM
SUB AREA ITEMS
1. Business environment and strategy Industry
External dependencies
IPPF – Practice Guide
Business Continuity Management
plexity of the organization, the criticality of the business
line, and the risk and impact of possible business disrup-
tion. Internal audit also should observe test exercises to
assess the control environment of alternative locations,
verify the results, assess that appropriate reporting and
escalation mechanisms are established and used, and
evaluate whether test plans are updated to reflect prior
test results. An audit considers five common aspects of
the BCM:
1. Business environment and strategy.
2. BCP methodology and strategy.
3. Business impact analysis (risk evaluation and
controls).
4. Recovery plan.
5. Awareness, testing, and training.
POSSIBLE CONSIDERATIONS
1. Key industry standards for BCM.
2. Legal requirements for industry in which the company
operates.
3. History of industry-specific vulnerabilities.
4. Listing of identified bodies and authorities (external
agencies).
1. Critical business partner relationships and stakeholder
dependencies are identified and considered (includes key
suppliers, vendors, and outsourced functions).
2. Key business partner contracts and service-level
agreements are identified and key provisions documented.
3. Right-to-audit clauses are periodically triggered, and
Statement on Auditing Standards (SAS) 70/Statement
on Standards for Attestation Engagements (SSAE) 16 or
equivalent business partner reporting is received (i.e.,
system validation exercises, including back-up recovery
capabilities and periodic security reviews).
www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Business Continuity Management
SUB AREA
2. BCP methodology linkage to business,
operational, and financial strategy
3. Impact Analysis (includes business
impact analysis [BIA], risk evaluation,
and controls)
10 / www.globaliia.org/standards-guidance
BCM SAMPLE WORK PROGRAM
ITEMS POSSIBLE CONSIDERATIONS
Business strategy 1. BCP is based on the company’s business strategy.
2. All relevant entities and critical functions are considered
within this BCP.
Operational/technical 1. Both operational and IT are integrated.
strategy
2. BCM planning is considered in every relevant business
decision.
3. BCP/CMP responsibilities, including maintenance, are
incorporated in applicable employee job descriptions and
personnel evaluations.
4. BCP is updated, reviewed, and tested at a frequency
appropriate for risks, vulnerabilities, and value of business
functions.
Financial strategy 1. Adequate financial resources are made available for the
preparation and maintenance of a BCP.
Tone at the top 1. Board of directors and senior management is supporting
the BCM initiative.
2. Senior executive is responsible for ensuring successful
implementation, maintenance, and update of plans
supporting BCM.
3. BCM policy/charter exists and is updated periodically.
4. BCM-related plans, including BCP and CMP, are approved
by board of directors and each appropriate level of
management.
 IPPF – Practice Guide
Business Continuity Management

BCM SAMPLE WORK PROGRAM

SUB AREA ITEMS POSSIBLE CONSIDERATIONS
Risk Assessment 1. A comprehensive impact analysis/BIA exists and is
prepared with the line of business input.
2. Various types of events that could prompt the formal
declaration of a crisis or disaster and the process for
invoking the BCP and CMP are clearly described.
3. Work flow analysis was performed and results are
documented, if deemed necessary by the organizational
leadership.
4. Prioritization of business functions is adequate.
5. Risk assessment includes impact and probability of
disruptions of all business, operational, and IT areas, and
considers acceptable downtime.
6. Procedures exist to execute the plan’s priorities for critical
versus noncritical functions, services, and processes.
7. Financial impact in case of emergency reflects accurately
the cost in case of emergency.
8. Reputation risks are considered and all relevant
stakeholders are considered in the BIA.
Mitigation 1. Adequate risk mitigation, including preparedness and
prevention strategies, have been considered, such as:
a) Alternative locations and capacity (ensure geographic
diversity).
b) Back-up of data, applications, telecommunications,
and other relevant data is ensured and procedures
exist.
c) Communication channels in case of emergency are
clearly defined (communication tree).
2. All critical personnel are identified and the contact list is
updated.
3. Employees understand their role in case of emergency.
4. Redundant vendor support is established.
4. Recovery plan Recovery point objective 1. RPOs are clearly defined and communicated.
(RPO)
2. RPOs consider the organization’s recovery needs.
Recovery time objective 1. RTOs are clearly defined and communicated.
(RTO)
2. Recovery time adequately reflects how much downtime the
organization is willing to tolerate.
3. BIA results are considered in defining RPO and RTO.

www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Business Continuity Management

BCM SAMPLE WORK PROGRAM

SUB AREA ITEMS POSSIBLE CONSIDERATIONS
5. Awareness, testing, and training Testing policy 1. Within the BCP, the organization has set testing
requirements for the organizationwide continuity functions,
business lines, support functions, and CM.
2. Key roles and responsibilities are defined in the testing
policy.
3. Testing cycles with increasing levels of test scope and
complexity are defined.
Testing strategy 1. Testing strategy includes documented test plans and
related testing scenarios, methods, and schedules.
2. Expectations for testing internal and external
independencies are defined.
3. Testing strategy is in line with management’s assumptions
and expectations.
4. BCP is validated through annual or more frequent testing
cycles.
Testing observations 1. Tests are done without prior notice to employees. Internal
audit activity may observe management’s execution of test
exercises with focus on the following:
a) All relevant employees were available and received
timely communication.
b) Back-up facilities and resources satisfied the needs of
the business units.
c) Relevant back-up procedures worked as intended.
d) Key business partners were included in the testing.
e) Business processes were re-established in the
expected time frame.
2. Internal audit documents audit findings.
Post-testing 1. Gap analysis is performed by BCM leadership team.
2. Internal audit independently documents and communicates
audit findings, if any.
3. BCM findings or areas for improvement are addressed
and corrected; BCM leadership team discusses corrective
actions and communicates findings to appropriate
stakeholders. Such data may support the need for BCM
evolution or plan updates.

12 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Business Continuity Management

BCM SAMPLE WORK PROGRAM

SUB AREA ITEMS POSSIBLE CONSIDERATIONS
4. Conclusions regarding the testing program and whether it
is appropriate for the size, complexity, and risk profile of
the organization are documented pursuant to plan content.
5. Board of directors and/or executive management is
informed of testing results.
Training 1. All staff is trained and aware of their responsibilities.
2. Training details, such as content, participants, and timing
are documented.

www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Business Continuity Management

Example 2:
Selected portions of the assessment below are completed to provide examples of potential content.

BCM RISK OR SELF-ASSESSMENT

ITEM STATUS ASSESSMENT NOTES
PURPOSE, SCOPE, AND OBJECTIVES
Define program Is the BCM program Yes Yes — overall program scope
documented to define? established and documented.
• BCM purpose, scope, and
objectives.
• BCM procedures.
• BCM resources, roles, and
responsibilities.
• BCM measurement and
verification.
• BCM continual improvement.
Does the BCM scope cover No All facilities not addressed.
the entire operation, including
all business processes and
operations, as well as related
facilities and workforce that
are the responsibility of the
company?

PROCEDURES
Risk assessment Has a BCM risk assessment NI Greater formalization and
Designed to identify been conducted for the (Needs improvement) documentation needed.
threat scenarios (credible organization?
events) that could disrupt
business. To successfully
complete this BCM risk
assessment, those who are
Did the risk assessment NI Consider regional events.
knowledgeable of threats to
consider these categories of
the organization, environment,
risks:
and region should participate.
Participation may include • Natural hazards.
those from security staff, • Militant/people.
facilities staff, etc.
• Human factors/IT.
• Operational.

14 / www.globaliia.org/standards-guidance

ITEM
A site-based BCM risk
assessment should be
completed and shared with
applicable facility/location
tenants.
Business impact analysis
(BIA)
Identifies critical business
processes that need to be
recovered following a disaster
event. After completing the
BIA, identify recovery solutions
needed to resume the critical
business processes.
Recovery solutions
Recovery solutions are
developed and a list of the
resources needed to support
the CM (recovery) efforts of
the organization and/or team
are created.
Written plans
IPPF – Practice Guide
Business Continuity Management
BCM RISK OR SELF-ASSESSMENT
STATUS ASSESSMENT NOTES
Were risk mitigation strategies
identified?
Were risks mitigated?
Did you align your BCM risk
assessment (e.g., disaster
scenarios) with other
organizations at your site?
Has a BIA been conducted for
the organization (including all
business teams)?
Were critical business
processes identified?
Has your leadership team
approved the list of critical
business processes identified
during the BIA and the
associated proposed recovery
solutions?
Have the recovery solutions
and resource requirements
been identified for each critical
process?
Have all teams documented
the resources required to
recover critical business
processes?
Have the IT requirements been
assessed?
Has a written BCP been
prepared that includes all
business teams, critical
business processes, and
organizational CMP?
www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Business Continuity Management
ITEM
Service-level agreements
(SLAs), memorandum of
understanding (MOU), and
contracts
Alignment
16 / www.globaliia.org/standards-guidance
BCM RISK OR SELF-ASSESSMENT
STATUS ASSESSMENT NOTES
Have SLAs and/or an MOU
been established for:
• Office space (with facilities
management)?
• IT/communications (with IT
provider)?
• Data restoration (with IT pro-
vider)?
• Other third-party contracts?
Has action been taken to
protect company interests
when third-party contracts
include a “force majeure”
clause?
Do you participate in
multitenant, multisite
coordinated planning?
Has your organization
established an emergency
communications plan,
including accounting for all
staff?
Have you aligned the BCP with
CM and emergency response?

ITEM
Training and exercise
Staff supporting BCM
BCM executive
Serves as organizational
advocate for BCM (including
alignment with the leadership
team), supporting the
creation and adoption of BCM
plans through the effective
coordination of funding,
personnel, and consideration
of the organization’s business
plan and risks.
IPPF – Practice Guide
Business Continuity Management
BCM RISK OR SELF-ASSESSMENT
STATUS ASSESSMENT NOTES
Have the BCM executive
and BCM manager received
training?
Has the BC coordinator been
trained?
Have all members of the
BCM team received training
pertaining to their roles and
responsibilities?
Are key BCM activities
exercised on an annual basis
or more frequently?
• Notification drill.
• Table top exercise.
• Functional exercise.
• Full scale exercise.
RESOURCES, ROLES, AND RESPONSIBILITIES
Have you verified that
alternative staff who will
perform critical work have
the capabilities (knowledge,
access, etc.) to perform these
functions?
Has the organization’s
leadership team identified a
BCM executive?
Does the BCM executive have
access to the leadership team?
Are funding, personnel, and
resources adequate?
Has BCM been coordinated
with other organizational
processes and linked to the
organization’s business plan?
www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Business Continuity Management

BCM RISK OR SELF-ASSESSMENT

ITEM STATUS ASSESSMENT NOTES

BCM manager Has an organizationwide BCM
manager been identified?
Does the BCM manager
coordinate and lead the
implementation of BCM?
Does the BCM manager ensure
cross-functional resources are
available and appropriately
engaged when needed?
Does the BCM manager
ensure the effectiveness and
efficiency of CM is measured,
verified, and periodically
reviewed for improvement
opportunities?
BCM coordinator Has an organizationwide BCM
coordinator been identified?
Does the BCM coordinator
manage business continuity
planning at the organization,
business unit (BU), regional
BU, or other sub-level?
Does the BCM coordinator
participate in multitenant,
multisite coordination
activities, as appropriate?
MEASUREMENT AND VERIFICATION
Are measurement and
verification processes in
place to verify annually that
requirements of BCM have
been addressed in a way
that is aligned with current
business needs?

18 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Business Continuity Management

BCM RISK OR SELF-ASSESSMENT

ITEM STATUS ASSESSMENT NOTES

CONTINUAL IMPROVEMENT
Have the IT requirements
been validated, including
IT requirements needed to
support relocation planning,
network or remote access,
local or central data, etc.?
Are measurement and
verification processes linked
with continual improvement
processes?
Do you track actions required
to resolve BCM gaps identified
during the BCM exercise to
ensure timely completion?
Do you have a process in place
to reassess the effectiveness
of your BCM program?

www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Business Continuity Management

Practice Aid II: Glossary of Key Terms Incident – an event that is not part of operational stan-
dards, which may temporarily impact a business and in
Business Continuity Plan (BCP) – the ability to plan
some cases could lead to an emergency or disaster.
for the continuity of critical business processes; protect
critical assets; and provide service and support to custom-
Impact Analysis – a process to analyze key operational
ers in the face of a crisis, disaster, incident, or emergency.
functions or critical data with a view to understand poten-
Such a plan allows an organization to recover effectively
tial internal or external impact of potential loss/disruption.
from, and manage risks associated with, a crisis. This is
Impact analysis includes Business Impact Analysis (BIA),
often included in a crisis management program.
which involves the identification of critical business as-
sets, functions, and resources, as well as an evaluation of
Business Continuity and Recovery Planning (BCRP) –
the potential damage or loss that may be caused to the
a proactive method by which organizations can identify
organization resulting from a disruption or a change in the
business continuity and recovery measures to manage and
business or operating environment. A BIA should identify:
mitigate key organizational risks triggered by a crisis.
a) sources of damage, interruption, or loss; b) the extent to
which time passage will magnify the potential damage, in-
Crisis – an event that, if not handled appropriately, may
terruption, or loss; c) the level of services or resources re-
significantly impact an organization’s ability to operate,
quired to sustain core business activities; and d) the time
remain profitable, and manage reputational risk. Com-
line during which all critical business assets, functions,
monly, these are natural or physical disasters, failures of
and resources should be restored to avoid permanent sig-
critical operations and/or connectivity, disruptions to key
nificant loss for the organization.
business partner relationships, and technology exposures.
Recovery Point Objective (RPO) – the point in time to
Crisis Management Program (CMP) – a consolidated
which systems and data must be recovered after an outage
portfolio of activities consisting of preventive and reac-
(e.g., end of previous day’s processing). RPOs often are
tive measures executable by an organization to effectively
used as the basis for developing backup strategies and to
mitigate and manage risks implied by a crisis or event. A
determine the amount of data that may need to be recre-
CMP often will include a business continuity plan and a
ated after the systems or functions have been recovered.
disaster recovery plan.
Recovery Time Objective (RTO) – the period of time
Disaster – a sudden, unplanned catastrophic event caus-
within which systems, applications, or functions must
ing unacceptable damage or loss. This may include events
be recovered after an outage (usually one business day).
that compromise an organization’s ability to provide critical
RTOs often are used as the basis for developing recovery
functions, processes, or services. This is an example of an
strategies and to determine whether to implement those
event in which business continuity and/or disaster recov-
strategies during a disaster situation. Maximum allowable
ery plans often are activated as part of an overall CMP.
downtime is a commonly associated term.
Emergency – an unplanned, impending incident or
Risk Assessment/Analysis – the process of identifying
situation that may cause injury; loss of life; destruction
the risks to an organization, assessing the critical func-
of property; or interference, loss, or disruption of normal
tions necessary for an organization to continue business
business operations. Such events may escalate into a cri-
operations, defining the controls in place to reduce or-
sis if not controlled or managed.
ganizational exposure, and evaluating the cost for such

20 / www.globaliia.org/standards-guidance

controls. Risk analysis often involves an evaluation of the
probabilities and likelihood of a particular event. A crisis
is an example of an event.
Practice Aid III: BCM Standards and
Guidance Resources
Numerous resources provide standards and guidance re-
lated to BCM. Resources include frameworks and ma-
turity models to benchmark the internal auditor’s role in
supporting the business continuity plan (BCP) and crisis
management plan (CMP) development life cycles. Many
resources may serve to educate internal audit staff and
provide an opportunity for knowledge sharing with orga-
nization management that are seeking to build, adjust, or
validate BCM efforts. Resources as of April 2013 include:
• The Institute of Internal Auditors’ International
Standards for the Professional Practice of Internal
Auditing (Standards) and related guidance
(www.theiia.org), including:
o Global Technology Audit Guide 10: Business
Continuity Management. This guidance includes:
1) common disaster scenarios, 2) management
roles during business interruption, 3) disaster
recovery solutions, 4) risk assessment and mitiga-
tion, 5) business recovery and continuity strategy,
and 6) CM plan testing.
o 2010 GAIN Survey and Results–Crisis Manage-
ment.
o Audit Executive Center’s 2011 Knowledge Alert–
Three Crisis Management Imperatives for CAEs.
• ANSI/ASIS/BSI CM.01:2010, Business Continuity
Management Systems–Requirements With Guidance
for Use (2010). Collaboration between the American
National Standards Institute (ANSI), ASIS Interna-
tional, and the British Standards Institute (BSI) to
provide a framework of auditable criteria and accom-
panying guidance that can be tailored to meet the
needs of organizations across their global operations.
IPPF – Practice Guide
Business Continuity Management
• Disaster Recovery Institute (www.drii.org), Profes-
sional Practices for Business Continuity Planners
(2008). A widely used framework that includes
information on: 1) program initiation and manage-
ment, 2) risk evaluation and control, 3) business
impact analysis, 4) business continuity strategies, 5)
emergency response and operations, 6) business con-
tinuity plans, 7) awareness and training programs, 8)
audit and maintenance, 9) communications, and 10)
coordination with external agencies.
• Federal Financial Institutions Examination Coun-
cil (www.ffiec.gov), Business Continuity Planning,
IT Examination Handbook (2008). The handbook
includes seven elements: 1) board and senior man-
agement responsibilities, 2) business continuity
planning process, 3) business impact analysis, 4) risk
assessment, 5) risk management, 6) risk monitoring
and testing, and 7) other policies, standards, and
processes.
• The Business Continuity Institute’s (www.thebci.
org) Good Practice Guidelines (2010). The guidelines
include six elements: 1) policy and program manage-
ment, 2) embedding CM in the organization’s cul-
ture, 3) understanding the organization, 4) determin-
ing CM strategy, 5) developing and implementing a
CM response, and 6) exercising, maintaining, and
reviewing.
• International Organization for Standardization (ISO)
(www.iso.org) guidelines:
o ISO/Publicly Available Specification (PAS) 22399,
Societal Security–Guideline for Incident Prepared-
ness and Operational Continuity Management
(2007). “Provides general guidance for an orga-
nization (private, governmental, and nongovern-
mental) to develop its own specific performance
criteria for incident preparedness and operational
continuity, and design an appropriate manage-
ment system.”
o ISO/IEC 24762, Guidelines for Information and
www.globaliia.org/standards-guidance / 21
IPPF – Practice Guide
Business Continuity Management

Communications Technology Disaster Recovery • Business Continuity Management Institute —

Services (2008). “Provides guidelines on the www.CM-institute.org.
provision of information and communications • Business Continuity Planners Association —
technology disaster recovery (ICT DR) services as www.bcpa.org.
part of BCM, applicable to both “in-house” and
• Business Resilience Certification Consortium
“outsourced” ICT DR service providers of physi-
International — www.brcci.org/index.htm.
cal facilities and services.”
o ISO 27001, Information Security Management
(2002). Assists organizations in developing an
information security management system that is
integrated, comprehensive, and incorporates glob-
ally recognized best practices.
o ISO 22301, Societal Security–Business Continuity
Management Systems–Requirements, which super-
seded BS 25999. Specifies generic BCM system
requirements applicable to all organizations or
parts thereof.
• British Standards Institute (www.bsigroup.com).
o PAS 200 (2011) advises organizations regarding
the types of activities and resources they need to
develop and maintain to allow for effective crisis
detection, preparedness, and response. This spec-
ification is sponsored by the U.K. Cabinet Of-
fice, and the crisis management specification has
been developed through consultation with several
leading U.K. businesses and public organizations.
This specification addresses the requirements for
CM, in addition to the guidance provided by BS
25999: Business Continuity Management and
ISO 27001.
o BS 25777: Information and Communications Tech-
nology Continuity Management–Code of Practice
(2008). “Provides recommendations for informa-
tion and communication technology continuity
management within the framework of business
continuity management provided by BS 25999-1.”
Several organizations mentioned above also provide BCP
education and certifications. Other organizations that of-
fer such training and certifications include:

22 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Business Continuity Management

Authors:
David Bentley, CIA
Brian Foster, CIA
Brian Peterson
Brian Reed, CIA
Erich Schumann, CIA, CRMA
Rita Thakkar, CIA
Benito Ybarra, CIA

Reviewer:
Steven E. Jameson, CIA, CCSA, CFSA, CRMA

www.globaliia.org/standards-guidance / 23
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2014 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

GLOBAL HEADQUARTERS T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

140455
 IPPF – Practice Guide

Chief Audit Executives —

Appointment, Performance
Evaluation, and Termination

May 2010
 IPPF – Practice Guide
Chief Audit Executives – Appointment, Performance Evaluation, and Termination

Table of Contents
Introduction................................................................................................................. 1

Executive Summary..................................................................................................... 1

Appointing a CAE......................................................................................................... 1

Attributes . ......................................................................................................... 2

Skills .................................................................................................................. 2

Evaluating CAE Effectiveness . ................................................................................... 3

Attributes . ......................................................................................................... 3

Skills .................................................................................................................. 3

Termination of the CAE................................................................................................ 4

The CAE Resigns, Retires, or Contract Period Expires ........................................ 4

The CAE is Terminated by the Employer ............................................................. 5

Detailed Internal Auditor Competencies...................................................................... 5

www.theiia.org/guidance / B

Chief Audit Executives – Appointment, Performance Evaluation, and Termination
Introduction
This practice guide discusses the types of considerations
senior management and boards of directors would typi-
cally address when appointing, evaluating, or terminating
a chief audit executive (CAE). CAEs may also want to
have a good understanding of these considerations as they
evaluate their own performance and how they support an
organization in their role.
The International Professional Practices Framework’s
(IPPF’s) International Standards for the Professional Prac-
tice of Internal Auditing (Standards) include attribute and
performance standards that help identify the attributes
and skills of an effective CAE.
Executive Summary
In today’s business environment, where there is increas-
ing focus on governance, risk management, and control,
appointing a CAE is a critical undertaking for any organi-
zation. This imperative activity is one of the key respon-
sibilities of the organization’s board. The CAE will have a
high degree of interaction with senior management and
the board and thus needs to demonstrate the right attri-
butes and skills for the position.
The CAE’s unique role in the organization requires in-
dependence and objectivity while also demonstrating an
ability to partner within the organization to add value to its
operations. Independence and objectivity are fundamen-
tal to the CAE’s role because the individual must be will-
ing to raise difficult issues with both senior management
and the board, even if that proves unpopular. To maintain
credibility, CAEs must demonstrate the ability to escalate
difficult issues to an appropriate level to ensure they are
adequately addressed. In addition, a CAE exhibits the
attributes of integrity, intellectual curiosity, and a focus
on audit quality. Key skill categories for a CAE include
IPPF – Practice Guide
technical, business, communication, and people manage-
ment skills.
During the process of a CAE’s appointment and periodic
evaluations, senior management and the board typically
will consider those attributes and skills. A CAE may want
to consider them when evaluating his or her own perfor-
mance and considering his or her development needs.
APPOINTING A CAE
When hiring a CAE, the board and senior management
will likely seek individuals who possess strong manage-
ment and leadership skills. While strong internal audit
knowledge, technical skills and experience at the time
of appointment would be an advantage, they are not a
requirement if the internal audit staff collectively have
the requisite knowledge, skills and experience to deliver
internal audit services in accordance with the Standards.
However, it is strongly encouraged that all CAEs, either
before appointment or within a reasonable time period af-
ter appointment, demonstrate a strong understanding of
the roles and responsibilities of internal audit, the IPPF,
and audit technical skills through attainment of the Certi-
fied Internal Auditor® (CIA®) designation. The key pro-
fessional and personal attributes are likely to be detailed
in the job description for the position and will generally
make clear the reporting relationships with the board and
senior management. The board may request to meet with
the CAE candidates before making a final hiring decision.
Potential CAEs also need to demonstrate well-tuned soft
skills, including the ability to:
• Accurately evaluate situations and instinctively do
the right thing in the face of opposition and conflict.
• Demonstrate good judgment and strength of charac-
ter and bring forth issues in a balanced way.
• Present himself or herself as an astute business
person, with excellent verbal and written commu-
www.theiia.org/guidance / 1

Chief Audit Executives – Appointment, Performance Evaluation, and Termination
nication skills, a clear and analytical thinker, a good
facilitator and consensus-builder, and a creative
problem-solver and idea generator.
• Behave as an ethical professional who can be trusted
always to operate at the highest level of integrity
and to act on the strength of his or her convictions
regardless of the potential consequences.
For CAEs to be effective in today’s dynamic environments
they must have the following essential attributes and
skills.
Attributes
Independent, Objective, and Ethical.
• The CAE should be both a partner to senior manage-
ment in monitoring the organization’s ethical and
operational environment and an independent and
objective professional in assessing the results of man-
agement’s work on behalf of the board.
• The CAE must balance these two responsibilities
and deliver an unbiased and equitable assessment
under all circumstances. Uncompromising ethics,
the ability to listen with an open mind, and the
strength and integrity to be firm under pressure will
enable the CAE to report to the board and senior
management evidence-based, objective findings of
the internal audit work performed.
Intellectually Curious.
• The CAE should be a curious explorer, investigative
reporter, and avid analyst whose role it is to discover,
interpret, question, and challenge. This once again
enables the CAE to add value and to provide inde-
pendent and objective assurance and consulting to
all levels of the organization.
Quality Focused.
• The CAE should have a strong focus on the quality
of the internal audit activity achieving the highest
level of professionalism. This includes adhering to
the IPPF, which requires establishing a quality as-
IPPF – Practice Guide
surance and improvement program and undergoing
internal and external quality assessments.
Skills
Solid Business, Technical, and Process Skills.
• To effectively evaluate risk, assess sufficiency of con-
trols, identify process improvement opportunities,
and effectively communicate with senior manage-
ment and the board, the CAE must have a good
understanding of the organization’s business process-
es and the structures used in the delivery of these
processes. Additionally, in today’s environment where
IT drives key business processes, the CAE needs
to understand the organization’s IT environment to
identify and assess the magnitude of the IT-related
issues facing the organization.
Communication and Listening Skills.
• The CAE must communicate in a concise, profes-
sional manner to be effective in articulating risks and
opportunities to a broad spectrum of stakeholders,
including the board, senior management, external
auditors, and regulatory agencies.
• The CAE also must demonstrate excellent listening
skills during all exchanges with the various stake-
holders.
People Management.
• To build and sustain a successful internal audit team,
which may include or consist of cosourced profes-
sionals from an external service provider, the CAE
must be an effective leader and exhibit expert man-
agement skills. The CAE must be able to bring out
the best in people, while balancing differing needs of
professional growth, travel, and personal life.
Before appointment, the CAE candidate may wish to
inquire whether the organization has an appropriately
constituted board and determine if they have the proper
safeguards in place to enable the CAE to carry out the
duties of the position. This enables CAEs to fulfill their
www.theiia.org/guidance / 2
 IPPF – Practice Guide
Chief Audit Executives – Appointment, Performance Evaluation, and Termination
responsibilities objectively without fear of reprisal and to
know that action will be taken by the board if required.
Without this safeguard, that CAE could be removed,
placed under duress, censored, or have his or her scope
and resources reduced inappropriately by senior manage-
ment.
EVALUATING CAE
EFFECTIVENESS
An effective internal audit activity will likely include the
board and senior management having in place a formal
evaluation of the CAE’s performance on a regular (at least
annual) basis. This evaluation could include criteria per-
taining to the CAE’s required attributes and skills. The
CAE may be required to review the criteria through a
scorecard, which can be tied back to the internal audit
activity charter and the CAE’s job description.
CAEs should be prepared for their performance evalua-
tions to include the criteria described below.
Attributes
Independent, Objective, and Ethical.
• The CAE demonstrates objectivity in his or her ac-
tions and provides verbal and written reports that are
clear, complete, and free from bias.
• The CAE communicates issues accurately and
timely, even when there is opposition and conflict in
doing so.
• The CAE provides a balanced perspective on topics
such as organizational risks and exposures and can
maintain positions in meetings even when they may
be contrary to popular and forceful opinion.
• The CAE is open and direct in his or her communi-
cation with the board and candidly expresses opin-
ions in executive sessions.
Executive sessions are those where the CAE meets alone with the board without the presence of organization management.
1
• The CAE and his or her team have no direct authority
to perform operational duties for the organization that
conflict with the scope of the internal audit activity.
Intellectually Curious.
• The CAE monitors the organization and its surround-
ings regularly, and provides proactive audit responses
to changes in the risk environment (for example, new
products and services, changes in regulation).
• The CAE incorporates the latest developments and
new ideas related to governance, risk management,
and internal controls into his or her practice where
appropriate.
Quality Focused.
• The CAE ensures that work is performed in accor-
dance with all elements of the IPPF.
• The CAE facilitates the monitoring of quality by
both continuous and periodic, internal and external
quality assurance initiatives and addresses perfor-
mance gaps through monitored action plans.
• The CAE incorporates feedback from the board, as
appropriate, to improve the quality of internal audit
services provided.
• The CAE routinely collects critical feedback from
stakeholders to improve internal audit service and
ensure stakeholder expectations are continuously
assessed and met.
• The CAE has appropriate professional credentials,
preferably holding the CIA designiation, and actively
encourages all internal audit staff to attain and main-
tain such qualifications.
Skills
Solid Business, Technical, and Process
Knowledge.
• Adequate audit coverage is aligned with organization-
al goals and documented in annual and long-term
internal audit plans.
www.theiia.org/guidance / 3

Chief Audit Executives – Appointment, Performance Evaluation, and Termination
• Internal audit plans are developed and documented
using a risk-based methodology to ensure they are
focused on the right areas, performed on the right
cycle, and with the right scope.
• The CAE has a thorough understanding of the
business and related risks and ensures resources
are deployed to maintain appropriate risk coverage
throughout the year.
• The CAE requests appropriate board and senior
management input to the internal audit plan.
• The CAE works effectively with the external audi-
tor and other stakeholders to ensure sufficient and
efficient risk coverage.
• Plans are monitored and amended as the business
environment and risks change, and the board and
senior management are appropriately informed of
such amendments.
• The CAE allocates time for special projects and
advisory services as requested by senior management
and/or the board after appropriate consideration of
the risks involved.
• The CAE is held accountable for achieving planned
internal audit coverage.
• No major control issues come to light after audit
work that indicates deficiency in the scope or quality
of the audit.
Communication and Listening.
• The CAE requests regular, concise communications
with the board (through formal meetings, executive
sessions, and access to board members for private
conversations).
• The CAE provides a balanced perspective on topics
such as organizational governance, risk, and internal
control issues.
• When issues requiring action are identified, the CAE
works with senior management to facilitate effective
solutions and encourage appropriate corrective ac-
tion in a timely manner.
IPPF – Practice Guide
• The CAE candidly expresses opinions to senior
management and can maintain positions in meetings
even when they may be contrary to popular opinion.
• The CAE holds regular meetings with other stake-
holders for purposes of debriefing, sharing informa-
tion, and ensuring ongoing coordination.
People Management.
• The CAE maintains adequate resources to discharge
responsibilities and manages turnover to appropriate
levels.
• The CAE has available, or acquires, resources with
the professional proficiency and business knowledge
required to execute the audit plan.
• The CAE effectively uses expertise of other depart-
ments as necessary, such as legal, compliance, fraud,
and IT.
• The CAE supports internal audit staff who rotate
into and out of management and line positions to
promote the importance of control awareness in all
aspects of the organization.
• The CAE’s reliance on and coordination with the ex-
ternal auditors are optimized resulting in appropriate
audit coverage at a reasonable cost while minimizing
duplication of effort.
• The CAE provides staff with appropriate perfor-
mance evaluations.
TERMINATION OF THE CAE
The termination of the services of the CAE may be
voluntary by the CAE or involuntary. Upon termination,
the board would likely consider the following issues.
The CAE Resigns, Retires, or Contract Period
Expires.
The CAE may resign or retire from the position at any
time in accordance with the conditions of the contract
www.theiia.org/guidance / 4

Chief Audit Executives – Appointment, Performance Evaluation, and Termination
(if a contract exists) by providing appropriate notice to
the employer. The CAE may wish to resign for a range of
reasons, and the employer, through the board, may have
in place a process, such as an exit meeting and/or a ques-
tionnaire, to identify the reasons for the CAE’s resignation
and determine whether there are any issues that require
further attention. When a contract exists and the term ex-
pires but is not renewed, the board may desire assurance
that nonrenewal of the contract is appropriate.
Questions the board might consider include:
• Did the CAE resign due to inappropriate limitations
placed on the scope of his or her role and activities
by management?
• Did the CAE resign due to remuneration/bonus is-
sues, which management controlled?
• Did the CAE receive adequate support from the
board and management to enable conformance with
the Standards?
• Did the CAE have adequate resources to fulfill the
requirements of the internal audit activity?
• Are there opportunities for future improvement that
the CAE would recommend?
The CAE is Terminated by the Employer.
Generally, the board would oversee the termination of
a CAE. Boards will want to determine if termination is
justified and appropriate. Identifying sensitive issues or
wrongdoing by management are not reasons a board would
generally consider for termination of a CAE; whereas, ter-
mination that is either voluntary or due to poor perfor-
mance would be considered acceptable. The board will
most likely want to ensure the termination is not voluntary
in appearance only, but is genuinely voluntary.
IPPF – Practice Guide
It is reasonable for the CAE to expect that the board may
consider terminating his or her services when there is ad-
equate evidence that:
• Stipulated professional performance requirements
were not met.
• A material breach of either The Institute of Internal
Auditors’ (IIA’s) Code of Ethics or the organization’s
internal code of conduct was committed.
• Material non-conformance with the IPPF’s Standards
exists.
When an involuntary termination is considered, the CAE
needs to be prepared for the board to:
• Review the documentation related to the perfor-
mance issue(s).
• Meet with the member(s) of senior management
responsible for the recommendation for termination.
• Meet privately with the CAE to confirm/discuss the
performance issue(s), including the questions posed
above.
Detailed Internal Auditor
Competencies
The IIA has developed a detailed competency framework
for CAEs and all levels of internal auditors. It is available
at: http://www.theiia.org/guidance/additional-resources/
competency-framework-for-internal-auditors/.
www.theiia.org/guidance / 5
 IPPF – Practice Guide
Chief Audit Executives – Appointment, Performance Evaluation, and Termination

Authors
• Stephen Linden
• Cavell Alexander, CIA
• Amipal Manchanda
• Kathy B. Robinson, CIA, CFSA
• Richard A. Schmidt, CIA
• Fred F. Steenwinkel, CIA
• Adnan Zaidi, CIA, CCSA

Reviewers and Contributors

• Douglas J. Anderson, CIA
• Steven E. Jameson, CIA, CCSA, CFSA
• James A. Rose, III, CIA

www.theiia.org/guidance / 6
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice Guides embody an IIA statement to as-
sist a wide range of interested parties, including Copyright
those not in the internal audit profession, in un- The copyright of this position paper is held by The
derstanding significant governance, risk, or con- IIA. For permission to reproduce, please contact
trol issues and in delineating the related roles and The IIA at guidance@theiia.org.
responsibilities of internal auditors on a signifi-
cant issue. Practice Guides are part of The IIA’s
International Professional Practices Framework.
As part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended and the guidance is
endorsed by The IIA through formal review and
approval process. For other authoritative guid-
ance materials provided by The IIA please visit
our Web site, www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice Guide

COORDINATING
RISK MANAGEMENT
AND ASSURANCE

March 2012
 IPPF – Practice Guide
Coordinating Risk Management and Assurance

Table of Contents

Executive Summary......................................................................................... 1
Introduction.................................................................................................... 1
Risk Management and Assurance (Assurance Services)................................. 1
Assurance Framework..................................................................................... 2
The Respective Roles of Risk Management, Internal Audit, Compliance,
and other Assurance Providers........................................................................ 4
Coordination Role of the CAE.......................................................................... 4
Using the Risk Management Process in Internal Audit Planning...................... 6
Preparation of Assurance Maps...................................................................... 8
Feedback on Significant Risk Areas in Internal Audit Reports......................... 8
Assessment by Internal Audit of the Adequacy of Risk Management............... 8
The Promotion of Risk Management by Internal Audit..................................... 9
Where Internal Audit Facilitates Risk Managment......................................... 10
Impact on Internal Audit Where a Formal Risk Management
Function Does Not Exist................................................................................ 10

www.globaliia.org/standards-guidance / B

Executive Summary
Risk management is fundamental to organizational con-
trol and a critical part of providing sound corporate gov-
ernance. It touches all of the organization’s activities. The
establishment of an effective enterprise-wide risk man-
agement system is a key responsibility of management and
the board, which are responsible for adopting a holistic
approach to the identification of organizational risks, cre-
ating controls to mitigate those risks, and monitoring and
reviewing the identified risks and controls. They should
ensure that risk management is integrated into the organi-
zation, both at the strategic and operational levels.
With responsibility for assurance activities traditionally
being shared among management, internal audit, risk
management, and compliance, it is important that as-
surance activities be coordinated to ensure resources are
used in an efficient and effective way. Many organizations
operate with traditional (and separate) internal audit, risk,
and compliance activities. It is common for organizations
to have a number of separate groups performing different
risk management, compliance, and assurance functions
independently of one another. Without effective coordi-
nation and reporting, work can be duplicated or key risks
may be missed or misjudged.
Many internal audit functions work in close cooperation
with risk management. Some organizations do not have a
formal risk management function and in this case the in-
ternal audit activity often provides risk management con-
sulting services to the organization. Internal audit should
not give independent assurance on any part of the risk
management framework for which it is responsible. Other
suitably qualified parties should provide such assurance.
IPPF – Practice Guide
Coordinating Risk Management and Assurance
Introduction
Standard 2050: Coordination states, “The chief audit ex-
ecutive [CAE] should share information and coordinate
activities with other internal and external providers of as-
surance and consulting services to ensure proper coverage
and minimize duplication of efforts.” This responsibility
requires the CAE’s inclusion and participation in the orga-
nization’s assurance provider framework. This framework
can consist of internal audit, external audit, governance,
risk management, or other business control functions/
disclosures performed by the organization’s management
team. Inclusion and participation in this framework helps
ensure that the CAE is aware of the organization’s risks
and controls in relation to organizational goals and objec-
tives.
Boards will use various sources to gain reliable assurance,
including management, internal audit, and third parties.
As discussed in Practice Advisory 2050-2: Assurance
Maps, an assurance map is a valuable tool for coordinat-
ing risk management and assurance activities to increase
the efficiency and effectiveness of risk management as-
surance investments made by an organization.
Risk Management
and Assurance
(Assurance Services)
The International Standards for the Professional Practice
of Internal Auditing (Standards) Glossary defines risk
management as “a process to identify, assess, manage, and
control potential events or situations to provide reason-
able assurance regarding the achievement of the organiza-
tion’s objectives.” This is consistent with the International
Standards Organization’s definition of risk management,
which is “coordinated activities to direct and control an
organization with regard to risk.”
www.globaliia.org/standards-guidance / 1

Enterprise risk management (ERM) — also known as
enterprise-wide risk management — is a commonly used
term. The Committee of Sponsoring Organizations of the
Treadway Commission defines it as “a process, effected
by an entity’s board of directors, management, and other
personnel, applied in strategy setting and across the enter-
prise, designed to identify potential events that may affect
the entity, and manage risk to be within its risk appetite, to
provide reasonable assurance regarding the achievement
of entity objectives.”
Assurance services should be objective and professional,
and can be obtained from a range of assurance providers.
Such providers can be internal — such as internal audit,
workplace health and safety, compliance, and security —
as well as external, such as statutory audit.
The Glossary of the Standards defines assurance services
as “an objective examination of evidence for the purpose
of providing an independent assessment on governance,
risk management, and control processes of the organiza-
tion.”
There are generally three parties involved in assurance
services:
• The person or group directly involved with the entity,
operation, function, process, system, or other subject
matter, and oversight functions such as risk manage-
ment, compliance, and finance.
• The person or group making the assessment (the as-
surance provider).
• The user of the assessment, such as executive man-
agement and the board.
IPPF – Practice Guide
Coordinating Risk Management and Assurance
Assurance Framework
The need for assurance arises from an organization’s gov-
ernance processes. Its origin is in the stewardship rela-
tionship between the board of an organization and its
shareholders. This stewardship relationship demands
that boards establish processes to both delegate and limit
power to pursue the organization’s strategy and direction
in a way that enhances the prospects for the organization’s
long-term success. Assurance processes are needed to al-
low the board to monitor the exercise of that power.
Risk management is a management process that promotes
the efficient and effective achievement of organizational
objectives. Assurance and risk management are comple-
mentary processes. In support of the risk management
process, the major role of internal audit and other inde-
pendent assurance providers is to provide assurance that:
• The risk management process has been applied
appropriately and that elements of the process are
suitable and sufficient.
• The risk management process is keeping with the
strategic needs and intent of the organization.
• Processes and systems are in place to ensure that
all material risks have been identified and are being
treated.
• All prioritized intolerable risks have cost-effective
treatment plans in place.
• Controls are being correctly designed in keeping with
the outputs of the risk management process.
• Key controls are adequate and effective.
• Risks are not over-controlled or inefficiently con-
trolled.
• Line management review and other non-audit as-
surance activities are effective at maintaining and
improving controls.
• Risk treatment plans are being executed.
www.globaliia.org/standards-guidance / 2

• There is appropriate and as-reported progress in the
risk management plan.
In support of the assurance process, the risk management
process should:
• Establish an organization-specific, documented risk
management policy and framework.
• Assign responsibility for effective identification and
management of significant risks.
• Provide a structured analysis of the risks of the orga-
nization recording:
– Risks, their associated exposures, and current risk
ratings.
– The organizational objective(s) to which the risk
applies.
– The organizational position responsible for identi-
fying and managing each risk.
– Key control systems established to identify and
manage each risk.
The assurance strategy is closely aligned with the corpo-
rate or other strategic plans of the organization. The legal,
legislative, cultural, and economic environment in which
the organization is operating, as well as the nature of the
organization’s activities and its long-term plans drives as-
surance needs.
It is an important first step to identify who will be the
users of organizational assurance. Clearly, the board and
management are the primary users. Other users may in-
clude the owners, regulators, government, or customers
for whom the organization is a critical supply component.
In today’s highly interconnected economy, external enti-
ties may require assurance of the organization as part of
their own risk management process.
The required assurance may range from providing comfort
to the board when they need to approve the formal finan-
cial statements or the contents of the annual report to the
IPPF – Practice Guide
Coordinating Risk Management and Assurance
provision of a formal statement of compliance or comfort
to an external body.
The assurance objectives will dictate the assurance strate-
gy and level of rigor employed, but the basic requirements
include assurance that:
• All material risks have been identified.
• Risks have been accurately analyzed and evaluated.
• Key controls are both adequate and effective.
• Management is appropriately addressing intolerable
risks.
There are three fundamental classes of assurance provid-
ers, differentiated by the stakeholders they serve, their
level of independence from the activities over which they
provide assurance, and the robustness of that assurance.
They are:
• Those who report to management or are part of
management (management assurance), including
individuals who perform control self-assessments,
quality auditors, environmental auditors, and other
management (designated assurance personnel).
• Those who report to the board, including internal
audit.
• Those who report to external stakeholders (financial
statement assurance), a role traditionally fulfilled by
the independent/statutory auditor.
The level of assurance desired will vary depending on the
risk and other factors such as regulations. Who should
provide that assurance will vary based on the ability of the
assurance provider to deliver the necessary level of inde-
pendence and objectivity, as well as the historical organi-
zational design of the entity and skill sets available within
the assurance group.
www.globaliia.org/standards-guidance / 3

The Respective Roles of Risk
Management, Internal Audit,
Compliance,and Other
Assurance Providers
Assurance providers for an organization may include:
• Line management and employees (management
provides assurance as a first line of defense over the
risks and controls for which they are responsible).
• Senior management.
• Internal and external auditors.
• Compliance.
• Quality assurance.
• Risk management.
• Environmental auditors.
• Workplace health and safety auditors.
• Government performance auditors.
• Financial reporting review teams.
• Subcommittees of the board (such as audit, actu-
arial, credit, governance).
• External assurance providers, including surveys,
specialist reviews (health and safety), etc.
Refer to The IIA’s Practice Guide, Reliance on Internal
Audit by Other Assurance Providers (December 2011),
for more information on the range of internal and external
assurance providers. Also, refer to The IIA’s Position Pa-
per, The Role of Internal Auditing in Enterprise-wide Risk
Management, (January 2009) regarding what roles are ap-
propriate for internal audit in regard to risk management.
The internal audit activity will normally provide assurance
coverage over parts of the organization approved in the
internal audit charter or terms of engagement letter. This
coverage should include risk management processes (both
IPPF – Practice Guide
Coordinating Risk Management and Assurance
their design and operating effectiveness), management of
those risks classified as high risk (including the effective-
ness of the controls and other responses to them), veri-
fication of the reliability and appropriateness of the risk
assessment, and reporting of the risk and control status.
With responsibility for assurance activities traditionally
being shared among management, internal audit, risk
management, and compliance, it is important that assur-
ance activities are coordinated to ensure resources are
used in the most efficient and effective way. Many organi-
zations operate with traditional (and separate) internal au-
dit, risk, and compliance activities. Compliance is defined
in the the Glossary of the Standards as “adhering to the re-
quirements of laws, industry, and organizational standards
and codes, principles of good governance and accepted
community and ethical standards.” A compliance program
is a series of activities that when combined are intended
to achieve compliance. Without effective coordination
and reporting, work can be duplicated or key risks may be
missed or misjudged.
Risk management is fundamental to organizational con-
trol and a critical part of providing sound corporate gov-
ernance. It touches all of the organization’s activities. For
this reason many organizations have moved to adopt a
more formalized ERM process.
Coordination Role of the CAE
IIA Standard 2050: Coordination states that the CAE
should share information and coordinate activities with
other internal and external providers of assurance and
consulting services to ensure appropriate coverage and
minimize duplication of efforts. This responsibility re-
quires the CAE’s inclusion and participation in the orga-
nization’s assurance provider framework. This framework
can consist of internal audit, external audit, governance,
risk management, and other business control functions/
disclosures performed by the organization’s management
team. Inclusion and participation in this framework helps
www.globaliia.org/standards-guidance / 4

ensure that the CAE is aware of the organization’s risks
and controls in relation to goals and objectives.
Most internal audit functions perform annual and engage-
ment-based risk assessment activities to help prioritize
risks according to their potential impacts on the organiza-
tion’s achievement of goals and objectives. At the macro-
level, these activities assist the internal audit activity to
develop a proposed audit plan to submit to the board. At
the micro-level, these activities help prioritize the scope
of audit work and assurance being provided by internal
audit engagements.
It is important that the work performed by assurance
providers is understood and assessed by the CAE on an
ongoing basis. This helps ensure that appropriate due pro-
fessional care is exercised in the performance of internal
audit work, including risk assessment activities performed
to derive proposed audit plans submitted to the board.
This also helps the board understand the coverage pro-
vided by the organization’s assurance providers to better
assess appropriate assignment of resources and potential
exposures due to non-coverage.
Coordination between assurance providers includes regu-
lar sharing of reports and outcomes of assurance activities.
This formal coordination should occur on a regular basis
and include time for discussion and review of techniques
and methods used to reach conclusions. This includes
management’s responses and an understanding of activi-
ties performed to mitigate any risks or control deficiencies
identified.
The CAE may develop an annual report to be shared with
the organization’s board and executive management team.
This report should outline the organization’s assurance
provider framework, the coverage of the assurance being
provided, areas of high risk, and residual/un-mitigated risk
areas within the organization. Another alternative would
be for the CAE to coordinate the development and dis-
tribution of this report through the organization’s gover-
IPPF – Practice Guide
Coordinating Risk Management and Assurance
nance or risk management function. Regardless of the ori-
gin of the report, it is important that the CAE can rely on
the techniques and methods performed by the assurance
providers.
A thorough, documented and continuous risk manage-
ment process is part of good governance and an important
management tool to provide assurance that appropriate
controls are in place to achieve the objectives of an orga-
nization.
The establishment of an effective enterprise-wide risk
management system is a key responsibility of manage-
ment. Boards and management are responsible for adopt-
ing a holistic approach to the identification of organi-
zational risks, creating controls to mitigate those risks,
monitoring and reviewing the identified risks and controls,
and ensuring that risk management is integrated into the
organization — both at the strategic and operational lev-
els. Some organizations have delegated independent risk
management functions, but others do not have an inde-
pendent risk management function and require internal
audit to provide consulting services in this area. Internal
audit can assist in identifying, evaluating, and facilitating
risk management methodologies. Internal audit also is re-
sponsible for evaluating the effectiveness and contribut-
ing to the improvement of the risk management process.
Identifying risks in a systematic way supports sound deci-
sion making. It is about performing a thorough analysis of
the organization on various levels, describing events that
might occur, deciding on the importance of those risks,
and developing adequate measures to deal with them.
www.globaliia.org/standards-guidance / 5

Using the Risk Management
Process in Internal Audit
Planning
The documentation of risk management in an organiza-
tion can be at various levels below the strategic risk man-
agement process. Many organizations have developed risk
registers that document risks below the strategic level,
providing documentation of significant risks in an area
and related inherent and residual risk ratings, key con-
trols, and mitigating factors. An alignment exercise can
then be undertaken to identify links between the items
included in the audit universe documented by the internal
audit activity and risk categories and aspects described in
the risk registers.
Some organizations may identify several high (or higher)
inherent risk (potential exposure) areas. While these risks
may warrant internal audit attention, it is not always pos-
sible to review all of them. Where the risk register shows
a high, or higher, ranking for inherent risk (or major po-
tential exposure) in a particular area, and the current risk
remains similarly high with no action by management or
internal audit planned, the CAE should report those areas
to the board with details of the risk analysis and reasons
for the lack of, or ineffectiveness of, internal controls.
In addition to evaluating the effectiveness of the organi-
zation’s risk management process and contributing to its
improvement, internal audit also uses the results of the
risk management process to develop annual audit plans
and individual audit engagements.
Internal audit is often asked to deliver better results with
strained resources. This can be achieved by strategically
placing internal audit work where it can be most effective
in delivering the best results and having the highest effect
on the outcome of the strategic and operational goals of
the business entity. One of the tools of achieving this is
IPPF – Practice Guide
Coordinating Risk Management and Assurance
to base internal audit plans and individual audit engage-
ments on the main identified internal risks and controls.
Internal audit should prepare short- and long-term au-
dit plans to ensure that their activities are covering the
main risk areas and internal controls of the organization.
As business circumstances can change substantially, con-
tinuous monitoring and periodic revision of annual plans
— with at least yearly reviews of longer term plans — are
needed to ensure that audit plans are flexible, based on
up-to-date information and cover changing priorities and
risk areas.
Standard 2010: Planning states that “the [CAE] must es-
tablish risk-based plans to determine the priorities of the
internal audit activity, consistent with the organization’s
goals.” Also, Standard 2010.A1 states “the internal audit
activity’s plan of engagements must be based on a docu-
mented risk assessment, undertaken at least annually. The
input of senior management and the board must be con-
sidered in this process.”
Standard 2120: Risk Management states, “the internal au-
dit activity must evaluate the effectiveness and contribute
to the improvement of risk management processes.”
The following are steps to consider in the preparation of
internal audit plans to determine risks and exposures that
may affect the achievement of the organization’s goals and
objectives:
• Research and review corporate documents such as
enterprise business plans, strategic plans, enterprise
risk assessments, yearly reports, minutes of board
meetings, minutes of management meetings, outside
reports, external audit reports and other appropriate
sources.
• Review previous internal audit plans, progress re-
ports, and works in progress.
• Consult senior management of the organization and
www.globaliia.org/standards-guidance / 6

solicit information regarding concerns or risks areas.
• Conduct a risk assessment of the issues and deter-
mine priorities for the annual audit plan.
• Prepare a draft audit plan.
• Communicate the proposed audit plan to stakehold-
ers.
• Seek feedback and validation of the major risk areas
to review.
• Finalize the audit plans.
• Present to management and the board for approval.
• Regularly monitor, review, and re-evaluate the plans
in light of changing circumstances.
While the broader rationale and objective of an internal
audit are developed in the annual planning phase, de-
tailed research and work are needed at the onset of the
audit to define the detailed objective and scope and de-
velop criteria and methodology.
Standard 2201: Planning Considerations states that “In
planning engagements, internal auditors must consider:
• The significant risks to the activity, its objectives,
resources, and operations and the means by which
the potential impact of risk is kept to an acceptable
level.
• The adequacy and effectiveness of the activity’s risk
management and control systems compared to a
relevant control framework or model.
• The opportunities for making significant improve-
ments to the activity’s risk management and control
processes.”
Also, Standard 2210: Engagement Objectives states, “In-
ternal auditors must conduct a preliminary assessment of
risks relevant to the activity under review. Engagement
objectives must reflect the results of this assessment.”
With regard to consulting engagements, Standard 2120.
C1 states, “During consulting engagements, internal au-
IPPF – Practice Guide
Coordinating Risk Management and Assurance
ditors must address risk consistent with the engagement’s
objectives and be alert to the existence of other signifi-
cant risks.”
Thorough planning of an internal audit is crucial to its
success. It provides an opportunity to become familiar
with the entity being audited; to gather relevant issues,
concerns, and risks; to complete a risk assessment, and
determine the objectives and scope of the audit.
In developing an audit engagement plan, the internal au-
dit team should conduct a formal, comprehensive and
documented risk assessment to identify audit issues and
risk events. This involves significant research, consulting
with management of the entity or area under review, and
becoming familiar with the entity or area.
Risk assessment methods can vary; however, all risk as-
sessments should cover the following points:
• Description of the risk event (negative occurrence,
undesirable event).
• Likelihood of the event happening (strong, moder-
ate, weak).
• The impact of negative occurrence on the achieve-
ment of goals and objectives (high, moderate, low).
• Current controls (systems, policies, procedures,
etc.) in place and their effectiveness (effective/not
effective).
• Ranking of the risk events.
Every potential audit highlights a wide range of issues for
examination. However, it is not necessary, reasonable, or
cost effective to look at them all. The audit team has to
be cognizant of, and concentrate its efforts on, the most
important and high-risk issues.
By ranking the possible risk events, this process will
identify the issues with the most significance and
highest ranking. At this point, a decision can be made
www.globaliia.org/standards-guidance / 7

regarding which issues are material and will be audited
in light of the audit’s objective, and take into consider-
ation other factors such as auditability, resources, and
time lines. The results of the risk assessment should be
presented and discussed with management of the entity
under review to ensure their concurrence and validation.
Preparation of Assurance Maps
Boards will use various sources to gain reliable assurance,
including management, internal audit, and third parties.
Many organizations operate with separate internal audit,
risk, and compliance functions, and it is not uncommon
for organizations to have a number of separate groups
performing different risk management functions indepen-
dently of one another. As discussed in Practice Advisory
2050-2, an assurance map is a valuable tool for coordi-
nating these risk management and assurance activities to
increase the efficiency and effectiveness of assurance in-
vestments made by an organization. Assurance maps can
help:
• Identify duplication and overlap in assurance cover-
age, allowing the board and senior management to
decide if the overlap is necessary, intentional, or
should be eliminated.
• Define scope boundaries and roles and responsibili-
ties for various assurance providers to ensure the
right resources are focused on the right risks. This
can enhance the effectiveness of assurance providers
by ensuring they are focused on the areas that need
their attention, and by clearly articulating the expec-
tations of the board and senior management.
• Assist in identifying any gaps in assurance coverage
that need to be addressed.
It is the responsibility of the CAE to understand the as-
surance requirements of the board and the organization,
clarify the role the internal audit activity fills, and the level
of assurance it provides. However, given their unique van-
tage point to assurance activities in the organization, the
IPPF – Practice Guide
Coordinating Risk Management and Assurance
CAE can take this one step further and help in the cre-
ation of an assurance map for the organization. This will
not only assist the board in providing governance over-
sight, but also will assist the CAE in ensuring the audit
activity is optimizing its resources for maximum assurance
value, and creating a more connected assurance commu-
nity through effective coordination.
Feedback on Significant Risk
Areas in Internal Audit Reports
During all assurance work, particularly where the scope
relates to significant potential exposures identified in an
organization’s risk management process, audit approach,
audit procedures, and communications should be de-
signed to evaluate management’s assertions on the effec-
tiveness of controls in bringing risk within an organiza-
tion’s risk tolerance threshold.
Reports to management and the board can describe the
potential exposure and management’s assessment of cur-
rent risks (with the implied value of the controls in place)
together with the audit evaluation of the risk ratings. Any
differences should be fed into management’s risk manage-
ment process for consideration.
The cumulative effect over time of such assurance ac-
tivities over specific risk areas using a risk-based audit
plan will provide assurance not only over those areas, but
also on the effectiveness of the overall risk management
process.
Assessment by Internal Audit
of the Adequacy of Risk
Management
Internal audit should provide assurance as required by
Standards 2100: Nature of Work, 2120: Risk Management
and 2400: Communicating Results to senior management,
www.globaliia.org/standards-guidance / 8

and ultimately the board, that the organization is managing
its risks effectively. Insofar as internal audit will need to in-
clude the adequacy of risk management within this scope
there are two dimensions to consider:
1. Whether the risk management function includes
all appropriate risk areas within its remit.
2. Whether the risk management function is operat-
ing effectively.
The main elements of the assessment that internal audit
will need to encompass are covered to a large extent by
Practice Advisory 2120-1: Assessing the Adequacy of Risk
Management Processes. The main features are:
• Boards of management, as part of their oversight
role, may direct internal audit to assist by reviewing
and reporting on the adequacy of risk management.
• Management and the board are responsible for risk
management; however, internal auditors acting in
a consulting role can assist management in this
responsibility.
• Where the organization does not have a formal risk
management process, the CAE should formally dis-
cuss the situation with management and the board.
The CAE should establish that:
• There is a culture of effective risk management.
• There is a clear understanding at all levels of the
potential exposures or inherent risks facing the orga-
nization (e.g., a risk register).
• There is a clear understanding of the current level of
risk within the organization.
• The amount of risk taken at every level of the organi-
zation is clearly defined and understood.
• Adequate and effective controls exist to mitigate
risks.
• There is an appropriate method of communicating
IPPF – Practice Guide
Coordinating Risk Management and Assurance
the effectiveness of the status of the risk manage-
ment system to senior management and the board.
The CAE has three important functions in the review of
risk management, and as in any other audit assignment:
• Test the controls.
• Report any missing or ineffective controls.
• Recommend improvements.
The Promotion of Risk
Management by Internal Audit
Standard 2100 states, “The internal audit activity must
evaluate and contribute to the improvement of gover-
nance, risk management, and control processes using a
systematic and disciplined approach.” The internal audit
activity often has a role providing independent and objec-
tive assurance to the organization’s board regarding the
effectiveness of an organization’s ERM activities. This
helps ensure key business risks are being managed appro-
priately and the organization’s system of internal controls
is operating effectively and efficiently.
Risk management is a management process that pro-
motes the cost-effective achievement of organizational
objectives. Assurance provides reliable information about
the achievements of risk management activity. Assurance
and risk management are complementary processes.
Often the internal audit activity of an organization will
work in close cooperation with the risk management
function. By independently reviewing the risk manage-
ment process of an organization, internal audit can pro-
mote risk management throughout the organization and
the audit process can be aligned with risk management
frameworks. Consistent risk language used throughout
the organization can be adopted by internal audit.
www.globaliia.org/standards-guidance / 9
 IPPF – Practice Guide
Coordinating Risk Management and Assurance

Internal audit’s review of risk identification, risk evalua- in Enterprise-wide Risk Management (January 2009),
tion, control identification and evaluation, and appropri- describes roles that are appropriate for internal audit in
ate risk treatments challenges and enhances risk registers regard to risk management.
and the risk management framework.
Impact on Internal Audit Where
Where Internal Audit Facilitates a Formal Risk Management
Risk Management Function Does Not Exist
Some organizations do not have a formal risk management
When an organization does not have a risk management
function, and in this case the internal audit activity may
function, it typically requires increased effort from the
provide risk management consulting services to the or-
CAE to communicate risk management and assurance
ganization. Internal audit may provide risk management
activities to the board. Increased importance is placed on
consulting provided certain conditions apply:
the quality of the internal audit risk assessment as the sole
• It should be clear that management remains respon- view of risk the board may be exposed to.
sible for risk management even in those organizations
The CAE should promote the risk management function
where internal audit has been asked to facilitate the
as an important activity that assists the organization in
risk management program. Internal audit should
achieving its objectives, and provides recommendations
not manage any risks on behalf of management, nor
for establishing such a process. If requested, the CAE can
make final decisions regarding the enterprise’s risk
play a proactive consultative role in assisting with the ini-
appetite or level of resource allocation to control or
tial establishment of a risk management process for the
mitigate risk. Whenever internal audit acts to help
organization. However, while the internal audit function
the management team to set up or to improve risk
can facilitate or enable the creation of risk management
management processes, the audit committee should
processes, they should not be responsible for the process-
approve its plan of work.
es or management of the identified risks. Initially, the in-
• The nature of internal audit’s responsibilities should ternal audit function can facilitate management’s risk as-
be documented in the internal audit charter and ap- sessment processes; however, it is advisable to have such
proved by the board. Any work beyond the assurance facilitation activities separated from assurance activities
activities should be recognized as a consulting en- in the CAE’s organization.
gagement and the implementation standards related
to such engagements should be followed. If internal audit’s role exceeds normal assurance and
• Internal audit should provide advice, challenge, and consulting activities such that independence could be
act as a support to management’s decision making, impaired, the CAE should conform to the disclosure re-
as opposed to making risk management decisions. quirements of the Standards.
Internal audit cannot give objective assurance on any
part of the risk management framework for which it
is responsible. Other suitably qualified parties should
provide such assurance.
The IIA’s Position Paper, The Role of Internal Auditing

www.globaliia.org/standards-guidance / 10
 IPPF – Practice Guide
Coordinating Risk Management and Assurance

Authors:
Andrew MacLeod, CIA, CMIIA

Brian Foster, CIA

Patricia Macdonald

Andy Robertson

Teis Stokka, CIA

Benito Ybarra, CIA

Reviewers:
Doug Anderson, CIA, CRMA

Andy Dahle, CIA

Steve Jameson, CISA, CCSA, CFSA, CRMA

David Zechnich, CIA, CPA

www.globaliia.org/standards-guidance / 11
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright ® 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120362
 – Practice Guide

Developing the Internal

Audit Strategic Plan
JUly 2012
 IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Table of Contents

Executive Summary......................................................................................... 1

Introduction.................................................................................................... 2

Strategic Plan Definition and Development..................................................... 2

Review of Strategic Plan............................................................................... 10

Appendix: Illustrative Example — SWOT Analysis......................................... 11

Appendix: Illustrative Example — Strategic Plan Summary.......................... 12

Authors and Reviewer................................................................................... 14

www.globaliia.org/standards-guidance / C
 IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Executive Summary sibility, and performance (Standard 2060: Reporting to

Senior Management and the Board). It will be necessary
For internal audit to remain relevant, it should adapt to for the strategic plan to be periodically reviewed. Factors
changing expectations and maintain alignment with the influencing the frequency of reviewing the strategic plan
organization’s objectives. The internal audit strategy is include:
fundamental to remaining relevant — playing an impor-
tant role in achieving the balance between cost and value, • Changes in the organization’s strategy.
while making meaningful contributions to the organiza- • Degree of the organization’s growth and assessment
tion’s overall governance, risk management, and internal of organizational maturity.
controls. • Degree to which the organization and its senior
management rely upon the internal audit activity’s
A systematic and structured process can be used to devel-
independent assessment and/or support regarding
op the internal audit strategic plan, helping to enable the
the management of organizational risks.
internal audit activity to achieve its vision and mission.
The following steps can be used to develop the internal • Significant change in the availability of the internal
audit strategic plan: audit activity’s resources.
• Significant change in laws and/or significant changes
1. Understand the relevant industry(ies) and the orga- to organizational policies and procedures.
nization’s objectives.
• Degree of change in the organization’s control envi-
2. Consider the International Professional Practices ronment.
Framework (IPPF). • Key changes in an organization’s leadership team and
board of director composition.
3. Understand stakeholder expectations.
• Evaluation of how the internal audit activity has
4. Update the internal audit vision and mission. qualitatively or quantitatively delivered on its strate-
gic plan.
5. Define the critical success factors.
• Results of internal/external assessments of the inter-
6. Perform a strengths, weaknesses, opportunities, and nal audit activity.
threats (SWOT) analysis.

7. Identify key initiatives.
It is important for the chief audit executive (CAE) to vet
the strategic plan with key stakeholders and obtain ap-
proval from the board1, as this is part of the CAE’s obliga-
tion for periodically reporting to senior management and
the board on internal audit’s purpose, authority, respon-
This Practice Guide was developed to provide the CAE
with guidance on how to develop an internal audit stra-
tegic plan. It also highlights the IPPF’s Practice Advisory
2120-2: Managing the Risk of the Internal Audit Activ-
ity; while there is no way to mitigate all of the risks, an
internal audit activity can proactively manage its risks by
developing a strategic plan.

1
The term board is used in this guidance as defined in the Standards glossary: “A board is an organization’s governing body, such as a board of directors, supervisory board, head of an agency
or legislative body, board of governors or trustees of a nonprofit organization, or any other designated body of the organization, including the audit committee to whom the chief audit
executive may functionally report.”

www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
This guidance will be particularly effective as a guide for
first-time strategic plan preparation for an internal audit
activity.  It also provides a good review for a strategic plan
that has been in place and might need to be refreshed.
Introduction
The International Professional Practices Framework
(IPPF) is the conceptual framework that organizes au-
thoritative guidance promulgated by The Institute of In-
ternal Auditors (IIA). The IPPF includes the Definition of
Internal Auditing, Code of Ethics, International Standards
for the Professional Practice of Internal Auditing (Stan-
dards), and strongly recommended guidance such as this
Practice Guide.
According to The IIA’s definition: “Internal auditing is an
independent, objective assurance and consulting activity
designed to add value and improve an organization’s op-
erations. It helps an organization accomplish its objectives
by bringing a systematic, disciplined approach to evaluate
and improve the effectiveness of risk management, con-
trol, and governance processes.”
In order to adhere to the IPPF, internal audit practitioners
would benefit from applying a strategic approach toward
developing a strategic plan for achieving their internal
audit vision and mission statements, thereby positioning
themselves to meet the expectations of stakeholders.
2 / www.globaliia.org/standards-guidance
Strategic Plan Definition
and Development
Definition of Strategy
Strategy is a means of establishing the organization’s pur-
pose and determining the nature of the contribution it in-
tends to make while predefining choices that will shape
decisions and actions. Strategy for the internal audit ac-
tivity enables the allocation of financial and human re-
sources to help achieve these objectives as defined in the
activity’s vision and mission statements (which contrib-
ute to the achievement of the organization’s objectives).
This benefits the internal audit activity through its unique
configuration of resources aimed at meeting stakeholder
expectations.
The strategy itself is part of the set of matters to be re-
ported to senior management and the board. This respon-
sibility falls under the scope of Standard 2060: Reporting
to Senior Management and the Board, which establishes
that “the chief audit executive must report periodically to
senior management and the board on the internal audit
activity’s purpose, authority, responsibility, and perfor-
mance relative to its plan.”
A systematic and structured process can be used in devel-
oping the strategic plan to enable the internal audit activ-
ity to achieve its vision and mission statements. The fol-
lowing steps are one approach for developing the internal
audit strategic plan:
 IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Industry & Standards & Stakeholder Vision & Critical SWOT Key
Success
Objectives Guidance Expectations Mission Factors Analysis Initiatives

The starting point for developing the internal audit stra-
tegic plan should be obtaining a thorough understanding
of the organization’s objectives and the industry (or indus-
tries) in which it operates. For the internal audit activity
to deliver value, it should contribute to the achievement
of the organization’s strategic, operational, reporting, and
compliance objectives while providing assurance that the
organization maintains an ethical environment and cul-
ture of accountability. Therefore, it is imperative that the
internal audit activity have an in-depth understanding of
the applicable industries (including the applicable regula-
tions and laws) and the organization’s objectives.
Review the organization’s strategic plans prior to
interviewing stakeholders.

Industry & Standards & Stakeholder Vision & Critical SWOT Key
Success
Objectives Guidance Expectations Mission Factors Analysis Initiatives

The CAE should consider the IPPF when developing the • 2020: Communication and Approval
internal audit strategic plan. The values the internal au- • 2030: Resource Management
dit activity’s personnel should adopt are contained within
• 2040: Policies and Procedures
the framework’s Standards and Code of Ethics (along with
their organization’s own values). • 2050: Coordination
• 2060: R
 eporting to Senior Management and
Attribute Standards: the Board
• 1000: Purpose, Authority, and Responsibility • 2110: Governance
• 1110: Organizational Independence • 2120: Risk Management
• 1120: Individual Objectivity • 2201: Planning Considerations
• 1200: Proficiency and Due Professional Care • 2210: Engagement Objectives
• 1210: Proficiency • 2230: Engagement Resource Allocation
• 1230: Continuing Professional Development • 2300: Performing the Engagement
• 1300: Q
 uality Assurance and Improvement • 2310: Identifying Information
Program
• 2320: Analysis and Evaluation
• 1311: Internal Assessments
• 2410: Criteria for Communicating
• 1312: External Assessments
• 2420: Quality of Communications
Performance Standards: • 2500: Monitoring Progress
• 2000: Managing the Internal Audit Activity • 2600: R
 esolution of Senior Management’s
Acceptance of Risks
• 2010: Planning

www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
Industry & Standards & Stakeholder
Objectives Guidance Expectations
Understanding stakeholder expectations and needs is a
critical step in developing the internal audit strategic plan.
It is important to include the key internal and external
stakeholders (e.g., board members, senior management,
external auditors, and regulators).
The CAE should communicate directly with each key
stakeholder to understand his or her expectations for the
internal audit activity. Stakeholders have unique back-
grounds, roles, and responsibilities that help to shape their
expectations, as well as their understanding of internal au-
dit. Therefore, it may be beneficial to provide the stake-
holders with a general understanding of internal audit’s
role and purpose. Through discussions with stakeholders,
the CAE can determine how internal audit can add value
to the organization in both the short term and long term
Industry & Standards & Stakeholder
Objectives Guidance Expectations
The strategic plan is the means by which the internal
audit activity’s vision and mission will be pursued. The
CAE should develop and update the vision and mission
statements based on stakeholder expectations and IIA
guidance. In writing these statements, it is important to
recognize that internal audit cannot be all things to all
people. Therefore, it is necessary for the CAE to make
tough choices — recommending to the board what will be
pursued and what will not be pursued.
Sharing with senior management and the board what will not
be included is important to ensure full disclosure.
Vision Statement – The purpose of establishing a vision
statement is to articulate the internal audit activity’s phi-
4 / www.globaliia.org/standards-guidance
Vision & Critical SWOT Key
Success
Mission Factors Analysis Initiatives
based on the organization’s objectives and goals. The ex-
pectations may vary in the short term versus the long term
based on the level of maturity in the organization’s control
environment. The CAE will need to evaluate stakeholder
expectations to ensure they do not conflict with one an-
other and are supported by the internal audit charter. The
weighting placed on each stakeholder’s expectations will
vary based on his or her role and responsibilities in the
organization.
After communicating with each stakeholder, the CAE
should document and confirm stakeholder expectations.
Also, it can be beneficial to survey the stakeholders to
help prioritize their expectations after compiling their in-
dividual perspectives. This will form a key input for devel-
oping the internal audit strategic plan.
Vision & Critical SWOT Key
Success
Mission Factors Analysis Initiatives
losophy and what it hopes to contribute to the organiza-
tion. A vision transcends objectives and goals; it expresses
the desired future state and is, therefore, lofty in nature.
Mission Statement – The mission statement, constructed
on the basis of the vision statement, outlines the internal
audit activity’s primary business purpose, what it plans to
achieve in the future, its values, and how it integrates into
the organization’s strategic plan. The mission statement
should resonate with all internal audit personnel, as well
as the internal and external stakeholders. It is from the
mission statement that the internal audit strategic plan
will be developed, essentially determining how the mis-
sion will be achieved. The mission statement is commonly
the first statement in the internal audit charter.
 IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Industry & Standards & Stakeholder Vision & Critical SWOT Key
Success
Objectives Guidance Expectations Mission Factors Analysis Initiatives

Identifying the critical success factors (CSFs) will allow • Positioning – Is the internal audit activity strategi-
the internal audit activity to understand the limited num- cally positioned and supported?
ber of elements that should go right for it to achieve its • Processes – Are the internal audit activity’s process-
vision and mission. These factors will provide the depart- es enabling and dynamic in meeting business needs?
ment with the essential elements that all major initiatives
• People – Does the internal audit activity have the
should be vetted against to help ensure resources are fo-
right people strategy to deliver its mission?
cused on the most important activities. Three questions
that may be helpful in identifying the CSFs are:
Monitoring the progress of the critical success factors will
ensure management is giving them continuous attention.

Industry & Standards & Stakeholder Vision & Critical SWOT Key
Success
Objectives Guidance Expectations Mission Factors Analysis Initiatives

Performing an assessment of the current state of the in-
ternal audit activity will help identify what should be in-
corporated into a strategic plan. One technique is to per-
form a strengths, weaknesses, opportunities, and threats
(SWOT) analysis against the vision, mission, and critical
success factors. The aim of any SWOT analysis is to iden-
tify the key internal and external factors that are important
to achieving the strategy. This analysis groups information
into two main categories:
• Internal factors – The strengths and weaknesses
unique to the internal audit activity.
• External factors – The opportunities and threats
presented by the external environment to the inter-
nal audit activity. The external environment includes
forces inside the organization (but outside of the in-
ternal audit activity) and outside of the organization.

www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
The following are definitions of a SWOT analysis’ individual components:
STRENGTHS
Internal characteristics of the internal audit activity
Internal Origin
that can be considered facilitators of the audit
strategy.
OPPORTUNITIES
External elements apart from the internal audit
External Origin
activity that can increase the demand for more and
better assurance and consulting audit services and
contributions.
Topics to consider in performing the SWOT analysis in-
clude (but are not limited to):
Organizational Structure
The internal audit activity structure should be designed to
ensure an appropriate level of supervision to deliver high
quality while facilitating efficient delivery of services. Ad-
ditionally, the internal audit activity should be free from
conditions that threaten the ability to perform its respon-
sibilities in an unbiased manner. To achieve the degree of
independence necessary to carry out internal audit’s re-
sponsibilities effectively, the CAE should have direct and
unrestricted access to senior management and the board.
Resource Requirements
The skill set and knowledge of the internal audit team are
critical to its ability to help the organization achieve its
6 / www.globaliia.org/standards-guidance
WEAKNESSES
Internal characteristics of the internal audit activity
that, in opposition, can prevent the achievement of
the audit strategy, and can place the activity in an
unfavorable position.
THREATS
External elements apart from the internal audit
activity that, in opposition, can decrease the demand
of assurance and consulting services, prevent the
achievement of the audit strategy, and place the
activity in an unfavorable position.
objectives and strategy. The initial step in people planning
is to perform a skill assessment to identify the skills and
knowledge required to address items in the internal audit
strategy. It is important to assess the degree to which the
skills and knowledge identified will need to be relied upon,
as this will influence the type of sourcing model selected.
Additionally, consideration should be given regarding how
to best leverage technology resources in conjunction with
establishing the most appropriate sourcing model. These
aspects of resource consideration will support priorities
for the department as defined by the CAE.
An assessment of the necessary skills and knowledge can
include: i) the scope of the internal audit activity’s respon-
sibilities as defined by the charter, ii) expected balance
of assurance and consulting engagements, iii) stakehold-
ers expectations and requirements, iv) results of the risk

assessment, v) the level of coordination with other risk
management and assurance functions, and vi) the long-
term strategic plan for the organization. The IIA’s Com-
mon Body of Knowledge publication Core Competencies
for Today’s Internal Auditor may be valuable in identifying
what internal auditors need to know to perform their jobs
with due care while adding value to their respective orga-
nizations.
Technology & Tools
Reviewing the internal audit activity’s technology and tools
will help a CAE understand the activity’s capabilities. The
use of electronic workpapers may be helpful to improve
productivity and facilitate quality control, especially in
managing multiple components of single engagements
with multiple staff and for multiple locations. Leverag-
ing work flow tools within such applications to share files
and consolidate findings may promote effective informa-
tion sharing to allow for timely quality control of workpa-
pers and reports. Additionally, these tools can enable the
CAE to better monitor the progress of the audit plan and
drill down to the engagement component of each plan.
Such applications also provide a central repository for
workpapers and reduce the risk of multiple file versions,
which allows for effective file sharing. Return on invest-
ment analysis would be needed to support justification to
implement such tools. Some applications primarily ben-
efit the internal audit activity; however, many electronic
workpaper applications also provide surveys and certifica-
tion templates and accompanying work-flow technology
to manage governance/control initiatives.
Using data analytics and leveraging continuous control
monitoring (CCM) tools can be beneficial to a depart-
ment’s efficiency and effectiveness. Data analytics can
better focus hours spent by resources relative to risk.
CCM leveraged by the broader organization may serve to
provide reliable evidence for the effective functioning of
detective controls within an application. The presence of
CCM may not be sufficient to permit reliance if data de-
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
livered by such tools is not reviewed by management in a
timely and effective manner.
Sourcing Model
An assessment of sourcing models should be performed to
determine the most cost effective structure for perform-
ing the expected services for auditable entities within the
audit universe. The key variables to assess related to the
sourcing model include:
• Required skills
• Specialized skills
• Level of centralization vs. decentralization in the
organization
• Geographical footprint
• Language requirements
• Desired flexibility with staffing and cost structure
• Upcoming changes to laws and regulations
• Budget
• Desired level of talent sourcing for the organization
The sourcing options include:
• Full in-house staffing – only using internal resources
• Limited co-sourcing – internal resources perform
majority of activity with outsourced resources provid-
ing specialized skills
• Significant co-sourcing – CAE is supported primarily
by external resources
• Full outsourcing – external resources perform entire
activity
It may be beneficial to perform benchmarking of organiza-
tions within the same industry that are similar in size and
in geographical coverage to gauge the number of resources
appropriate for the risk appetite of the organization. Con-
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
sider the following when determining the appropriateness
and sufficiency of resources:
• Types of risks faced by the organization, and the risk
appetite of its stakeholders.
• The internal audit staff ’s experience level — expe-
rienced staff may require fewer hours to complete
engagements.
• Nature of engagements to be performed — engage-
ments that are complex, new to scope, or require
remediation testing based on risk will require more
time to execute.
• Degree to which automated control evaluation is
integrated into the audit plan — automated controls
are generally more efficient to test.
Where the internal audit activity is viewed as a source of
talent for the organization, it may be beneficial to con-
sider a rotational staffing model. This model provides the
organization with individuals who have an extensive un-
derstanding of governance, risk management, and con-
trols. Rotational models provide benefits to the internal
audit activity by introducing staff members (from outside
the activity) with nonaudit backgrounds who may provide
specialized skills along with an independent perspective
on engagements and audit procedures. Disadvantages
to such models include increased training and oversight
of rotational staff, lack of engagement continuity, and a
“cooling-off period” from auditing the area they most re-
cently worked (Practice Advisory 1130.A1-1: Assessing
Operations for Which Internal Auditors Were Previously
Responsible).
Coordination With Other Risk Management and As-
surance Functions
Based on stakeholder expectations, IIA guidance, and the
audit charter, the CAE should align resources and priori-
ties, determine how the internal audit activity will work,
and coordinate with other risk management/assurance
functions.
8 / www.globaliia.org/standards-guidance
Organizations often have separate groups performing vari-
ous risk management and assurance functions indepen-
dently of one another. The internal audit activity should
develop a clear understanding of the other groups’ objec-
tives and determine how the groups should best coordi-
nate their efforts to minimize duplication and help to en-
sure key risks are being addressed. For further information
on this topic, refer to The IIA’s Practice Guide, Reliance
by Internal Audit on Other Assurance Providers.
Methods to Deliver Services
The methodologies for performing internal audit as-
surance and consulting services should be defined and
documented to help ensure there is consistency and high
quality of services for planning, fieldwork, reporting, and
follow-up. There should be both mandatory requirements
and recommended protocols to allow for flexibility in
performing the work, allowing for circumstances when
requirements are not feasible. The methodology should
conform to the IPPF.
Communication With Stakeholders
The CAE should have a communication plan in place that
ensures senior management and the board are informed of
the plan for the internal audit activity including resource
requirements (and limitations) and progress against such
plan. It is also valuable to include in this communication
plan the results from internal audit’s assurance and con-
sulting engagements, including management’s progress in
remediating findings.
People Development
Building upon the skills identified in the previous section,
“Resource Requirements,” it is vital to have a defined ap-
proach for how the audit team will be developed, trained,
and managed. A people development plan should include
clear expectations for each position, including the nec-
essary competencies, knowledge, experience, and certifi-
cations. These expectations enable management to work
toward an individual’s readiness for his or her current po-
sition and future advancement.
 IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Industry & Standards & Stakeholder Vision & Critical SWOT Key
Success
Objectives Guidance Expectations Mission Factors Analysis Initiatives

Based on the results of the SWOT analysis, it is possible

to identify and prioritize the key initiatives that will have a
significant impact on achieving the internal audit activity’s
critical success factors and therefore its vision and mis-
sion statements. For each initiative, it is valuable to iden-
tify a timeline for implementation, the desired objectives,
the performance measurements (qualitative and quantita-
tive), and the associated SWOT elements.

Performance Monitoring
To ensure the strategic plan produces the desired results,
it is critical to monitor its execution and impact. To help in
this regard, it is beneficial to establish performance goals
(qualitative and quantitative) to measure the progress and
performance of each initiative against expectations. Feed-
back from key stakeholders on progress against the stra-
tegic plan may also provide a mechanism to support the
assessment process. Additionally, the CAE and his or her
management team can perform self-evaluations regarding
the efficiency and effectiveness of strategic plan execu-
tion. These goals can be included in reporting provided
to key stakeholders. For further information on this topic,
refer to the Practice Guide, Measuring Internal Audit Ef-
fectiveness and Efficiency.

Feedback and Approval

It is essential to vet the strategic plan with the key stake-
holders prior to its finalization. Communication of the
revised strategic plan will increase awareness and buy-in
across the organization. Final approval should be obtained
from the board.

www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Review of Strategic Plan

Similar to the strategic plan for the organization, the in-
ternal audit strategic plan should be periodically reviewed
and appropriately updated. The frequency of review will
be determined by the CAE in conjunction with discus-
sions with the board. Factors influencing the frequency of
reviews include (but are not limited to):

• Degree of the organization’s growth and assessment

of organizational maturity.
• Changes in the organization’s strategy.
• Degree to which the organization and its senior
management rely upon the internal audit activity’s
independent assessment or support regarding the
management of organizational risks.
• Significant change in the availability of the internal
audit activity’s resources.
• Significant change in laws or the volume of changes
to organizational policies and procedures.
• Degree of change in the organization’s control envi-
ronment.
• Key changes in an organization’s leadership team and
board of director composition.
• Evaluation of how the internal audit activity has
qualitatively or quantitatively delivered on its strate-
gic plan.
• Results of internal/external assessments of the inter-
nal audit activity.

10 / www.globaliia.org/standards-guidance

Appendix:
Illustrative Example —
SWOT Analysis
STRENGTHS
1. Defined internal audit vision, mission, values, and charter
2. Strong respect and credibility of CAE with senior management
3. Defined and validated audit universe
4. Formal risk-based planning process with management
validation
5. Individual staff training/certification plans
6. Independent and objective organization-wide perspective
7. Staff adaptable to change; positive attitude
8. Diverse skills, backgrounds, and business knowledge of staff
9. Process focus vs. transactional focus
10. Increased partnering with the business
11. Formalized follow-up process
OPPORTUNITIES
1. Improve perception of staff skill, knowledge, and capabilities
2. Confirm and clarify stakeholders’ evolving expectations
3. Educate stakeholders on internal audit’s role and capabilities
4. Become involved in new initiatives early to incorporate controls
5. Educate management on recurring/common issues
6. Collaborate with other assurance/risk management functions
throughout the year and during risk assessment
7. Introduce risk and control self-assessments
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
WEAKNESSES
1. Skill gaps – consulting and fraud knowledge
2. Undefined staff development model
3. Limited staff career opportunities – not a talent source for the
business
4. Risk assessment not mapped to organization’s strategy; limited
identification of emerging risks
5. Audit plan limited to one year
6. Limited understanding of stakeholder expectations
7. Inconsistent communication with stakeholders
8. Emphasis on findings (“gotcha” and “policeman” mentality)
9. Limited involvement in organization’s strategic decisions
10. Lack of formal knowledge-sharing program
11. Limited focus on operational efficiency vs. effectiveness
12. Limited use of data analytics and data mining
13. Performance evaluations only occur annually
14. Long audit cycle time
15. Not fully aligned with IIA Standards
16. Audit methodology does not address all types of engagements
THREATS
1. Predisposition of board to focus on financial and compliance
exposures without balanced attention to operational risks
2. Implementation of findings constrained by budgets, staffing,
and governance
3. Reduction in management cooperation
4. Emerging and changing risks increase skill gaps
5. Lack of awareness of business initiatives
6. Adapting to higher IIA Standards and stakeholder expectations
www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan
Appendix:
Illustrative Example —
Strategic Plan Summary
Vision
To be a high-performing internal audit activity that meets
the expectations of our stakeholders and adheres to The
Institute of Internal Auditors International Standards for
the Professional Practice of Internal Auditing (Standards)
and the attributes of high performance recognized by
leading internal audit activities. This will enable us to be
a business partner and a trusted advisor, recognized as a
driving force behind a culture of governance, accountabil-
ity, compliance, and execution that helps in the achieve-
ment of the organization’s objectives.
Mission
Deliver an independent assessment of financial, regula-
tory, and operational risks and control effectiveness to the
organization’s management and the board. We will provide
control expertise to minimize risks, improve process qual-
ity, and enhance operational effectiveness in furtherance
of our business goals.
Critical Success Factors, Initiatives,
Objectives, and Key Tasks
CSF 1: Focus on the Organization’s Highest Risks
Initiative: Enhance the planning process to identify the
highest priority strategic, operational, financial, and regu-
latory risks to the organization.
SWOT Mapping: Weaknesses - 4, 5, 9
Opportunities - 6
Objectives:
• A sustainable process that identifies the most signifi-
cant internal and external risks that could impede
12 / www.globaliia.org/standards-guidance
the achievement of the organization’s objectives and
strategy.
• Collaboration with other control and risk manage-
ment functions to coordinate coverage of the risks.
Key Tasks:
• Benchmark the current risk assessment process
against other organizations of comparable size.
• Inventory current processes and sources used to
identify emerging risks (which have never occurred
or not occurred for an extended period).
• Understand the scope of other control and risk man-
agement groups’ responsibilities and their approach
for identifying risks.
• Develop a methodology that links the organization’s
strategy to the auditable risks.
• Validate the methodology with key stakeholders.
Time frame: August – November 201X
CSF 2: Provide Impactful Reporting to Stakeholders
Initiative: Increase the transparency of internal audit’s ac-
tivities through providing timely and impactful communi-
cations to key stakeholders regarding the global collection
of risks, audit findings, and issue-remediation efforts.
SWOT Mapping: Weaknesses – 6, 7, 8
Opportunities – 3, 5
Objectives:
• A relationship map and communication plan for key
stakeholders.
• Standardized reports for regular communications.
Key Tasks:
• Identify key stakeholders.
 IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

• Obtain feedback from key stakeholders on perfor- SWOT Mapping: Weaknesses – 1, 2, 3, 10, 11, 15, 12
mance and expectations. Opportunities – 3
• Agree on improvement opportunities.
Objectives:
• Design and implement “to-be” state.
Time frame: March – April 201X • Understand the necessary skills to deliver on the
mission statement for all areas within the audit
CSF 3: Maintain Efficient and Effective Audit universe.
Processes
• Develop a formalized training and development pro-
Initiative: Develop a manual that defines the methodology gram for all staff levels.
for performing all internal audit assurance and consulting
engagements.
Key Tasks:
SWOT Mapping: Weaknesses – 1, 11, 15, 16
• Perform skills assessment.
Opportunities – 7
• Identify internal and external staffing and training
Objectives: solutions.
• Develop continual learning and development pro-
• Identification of the required and recommended gram.
practices for all engagement types, helping to ensure
Time frame: July – October 201X
a consistent approach that adheres to the Standards.

Key Tasks:
Note: A work plan would need to be developed to identify
• Assess current processes for planning, fieldwork, the detailed steps, the necessary timing, and the neces-
reporting, and follow-up of assurance and consulting sary resources to complete each initiative.
engagements against the IPPF.
• Refine processes to align with the IPPF, identifying
those that are required vs. recommended.
• Develop control self-assessments tools.
• Validate the internal audit manual with all staff.
Time frame: June – August 201X

CSF 4: Adequately Skilled and Knowledgeable Staff

Initiative: Identify the critical skills, create development
plans, and develop a sourcing strategy to deliver on the
mission statement.

www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Developing the Internal Audit Strategic Plan

Authors:
Brian Reed, CIA

Erich Schumann, CIA

Princy Jain, CIA, CCSA, CRMA

Rita Thakkar, CIA

Reviewer:
Steven Jameson, CIA, CBA, CCSA, CFE, CFSA, CGMA,
CPA, CRMA

14 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120924
 IPPF – Practice Guide

Evaluating Corporate Social

Responsibility/Sustainable
Development
February 2010
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Table of Contents
Introduction..................................................................................................................1
Executive Summary.......................................................................................................1
CSR Definitions.............................................................................................................2
Responsibility for CSR...................................................................................................2
Risks ............................................................................................................................3
Reputation...........................................................................................................3
Compliance..........................................................................................................3
Liability................................................................................................................3
Operational..........................................................................................................3
Stock Market........................................................................................................3
Employment Market.............................................................................................3
Sales Market........................................................................................................3
External Business Relationships..........................................................................3
CSR Business Activities.......................................................................................4
CSR Reporting......................................................................................................5
Approaches to Evaluating CSR......................................................................................6
Auditing...............................................................................................................6
Facilitating...........................................................................................................7
Consulting............................................................................................................7
Audit Considerations.....................................................................................................7
Use of Audit Opinion.............................................................................................7
Independence and Objectivity..............................................................................7
Skills and Body of Knowledge...............................................................................7
Resources............................................................................................................8
CSR Maturity Model.............................................................................................8
Internal Audit Program Development (Considerations).................................................9
Appendix A – Auditing by Element...............................................................................12
Governance........................................................................................................12
Ethics.................................................................................................................12
Environment.......................................................................................................12
Transparency......................................................................................................13
Health, Safety, and Security...............................................................................13
Human Rights and Work Conditions...................................................................13
Community Investment......................................................................................14
Appendix B – Auditing by Stakeholder Group............................................................15
Employees and Their Families............................................................................15
The Environment................................................................................................15
Customers..........................................................................................................15
Suppliers............................................................................................................15
Neighboring Communities..................................................................................16
Shareholders and Investors................................................................................16
Appendix C – Stakeholder Theory................................................................................17
Appendix D – Additional Resources.............................................................................18
Practice Guide Team Members....................................................................................19

www.theiia.org/guidance / B
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Introduction Executive Summary

Organizations worldwide are adopting mission state-
ments and governance activities related to corporate social
responsibility (CSR) and sustainable development. Cus-
tomers, employees, and public stakeholders have increas-
ing expectations for organizations to act in responsible and
sustainable ways, and public scrutiny of these activities is
rising. This growing attention extends beyond the organi-
zation to its partners and suppliers. Increasing regulations
relating to the environment and the workplace are leading
to new practices and management systems. In response,
organizations are developing performance targets, mea-
surement systems, and reporting systems related to CSR
and sustainable development strategies.
Chief audit executives (CAEs) should understand the var-
ious ways in which they can support management relating
to CSR and sustainable development. An internal audit
activity that conforms to the International Professional
Practices Framework (IPPF) is qualified to audit and pro-
vide assurance to the board and management on CSR and
sustainable development programs and reporting.1 This
guide is designed to assist in planning and implementing
related internal audit strategies and programs.
CSR presents significant risks and opportunities for orga-
nizations. Stakeholders expect boards and management
to accept responsibility and implement strategies and
controls to manage their impact on society and the envi-
ronment, to engage stakeholders in their endeavors, and
to inform the public about their results. The prolifera-
tion of regulation and voluntary standards has made CSR
management a complex endeavor.
Internal auditors should understand the risks and controls
related to CSR objectives. Where appropriate, the CAE
should plan to audit, facilitate control self-assessments,
verify results, and consult on the various subjects. Inter-
nal auditors should maintain the skills and knowledge
necessary to understand and evaluate the governance,
risks, and controls of CSR strategies.

Organizations adopt terminology (e.g., CSR, sustainable

development, and corporate citizenship) that best fits
within the context of their operations and that is consistent
with the strategies adopted. For the purposes of this guide,
CSR refers to social responsibility, sustainable develop-
ment, and corporate citizenship.

1. Auditors that conform to the Performance and Program Standards for the Professional Practice of Environmental, Health and Safety Auditing (Board of Environmental Health and Safety
Auditor Certifications) may also be qualified.

www.theiia.org/guidance / 1

Evaluating Corporate Social Responsibility/Sustainable Development
CSR Definitions
Governmental and nongovernmental organizations have
published many definitions of CSR, including:
• CSR is the continuing commitment by business to
behave ethically and contribute to economic develop-
ment while improving the quality of life of the work-
force and their families as well as of the local commu-
nity and society at large.2
• Generally, CSR is understood to be the way firms in-
tegrate social, environmental, and economic concerns
into their values, culture, decision-making, strategy
and operations in a transparent and accountable man-
ner and thereby establish better practices within the
firm, create wealth, and improve society.3
Some organizations focus on economic and CSR objec-
tives, where the environment is included as one element
of CSR, along with ethics, transparency, health and safe-
ty, corporate governance, human rights, and community
investment. Other organizations follow a Triple Bottom
Line reporting strategy, which covers three measures of
success: economic, environmental, and social responsi-
bility. This theme is prevalent in resource companies,
such as mining, forestry and oil, where the environment
has been an important focus of advocates, governments,
and communities. These organizations often refer to
their objectives as sustainable development:
• For the business enterprise, sustainable development
means adopting business strategies and activities that
meet the needs of the enterprise and its stakeholders
today while protecting, sustaining, and enhancing the
human and natural resources that will be needed in
the future.4
2. World Business Council for Sustainable Development.
3. Government of Canada.
4. This definition captures the spirit of the concept as originally proposed by the World Commission on Environment and Development and is substantially similar to the definition used by
the World Business Council for Sustainable Development.
5. In this guide, “board” will be used to refer to the board of directors or similar oversight group and to committees that have been delegated specific CSR responsibilities.
IPPF – Practice Guide
Responsibility for CSR
The board5 has overall responsibility for the effectiveness
of governance, risk management, and internal control pro-
cesses associated with CSR.
Management is responsible for ensuring that CSR objec-
tives are established, risks are managed, performance is
measured, and activities are appropriately monitored and
reported. There may be a CSR executive responsible for
coordinating these activities, or this responsibility may
be allocated to executives responsible for each individual
function (such as a chief ethics officer, vice president of
environment, health and safety, general manager of human
resources, and director of community and public affairs).
If the organization has limited resources to spend on CSR,
should those resources be directed toward feeding starv-
ing children, educating an aboriginal workforce, or starting
a recycle program? All are worthy causes. The challenge
management faces is ensuring that CSR activities through-
out the organization are coordinated and aligned with stra-
tegic initiatives and principles, with appropriate risk/reward
decisions being made. CSR programs for charity, product
and worker safety, pollution, and human rights often elicit
emotional and personal responses, and managers can be in-
fluenced by such responses to support personal objectives.
Management is responsible for ensuring that the organiza-
tion’s CSR principles are communicated, understood, and
integrated into decision-making processes.
Generally, CSR activities are pervasive throughout the
organization; thus, every employee has a responsibility
for ensuring the success of CSR objectives.
www.theiia.org/guidance / 2

Evaluating Corporate Social Responsibility/Sustainable Development
Risks
Organizations are exposed to a variety of risks associat-
ed with CSR activities. The board and management are
responsible for performing a risk assessment and deter-
mining what is important to their organization and the
controls they will implement to manage those risks.
The CAE should understand these risks and use that
knowledge when considering CSR activities in the audit
universe, audit plan, and audit approaches. Internal audi-
tors should understand these risks to help them develop
appropriate audit procedures.
Reputation
The organization’s brand or reputation could be damaged
due to violations of law or principles, errors or omissions
in disclosed CSR information, under-performance com-
pared with objectives/targets, or the appearance of indif-
ference to social issues. If activists believe an organiza-
tion is being unresponsive to their concerns, they may
become shareholders to introduce resolutions relating
to their CSR agenda. Organizations have the opportu-
nity to enhance their reputation by behaving in a socially
responsible manner and involving stakeholders in deci-
sions that affect them.6
Compliance
Organizations may fail to comply due to the extent, com-
plexity, and volume of regulations relating to the environ-
ment, health and safety, employment, governance, political
contributions, conflict of interest, fraud, etc. Compliance
risk also arises from contractual obligations with third par-
ties, such as customers, unions, or employees, and from vol-
untary adoption of standards. Compliance risk increases for
organizations operating in multiple countries.
Liability
Liability risk exists when contracting for CSR terms and
conditions and ensuring third-party compliance. Activists
6. For more information about stakeholder engagement, see Appendix C.
7. Refer to The IIA’s Practice Guide Auditing External Business Relationships for additional information.
IPPF – Practice Guide
or specific classes/special interest groups may take legal
action for alleged harm done by the organization
Operational
Risk arises from the CSR “pressure points” for the organi-
zation’s manufacturing processes, products, services and
impact on the environment. Other examples of potential
risk scenarios include: under-performance of other targets
due to inappropriate CSR strategies, or over-emphasis on
CSR strategies; failure to integrate CSR objectives into
processes, or to educate staff appropriately; failure to de-
velop well-controlled systems for CSR initiatives; risk as-
sociated with reporting CSR activities and results (e.g.,
inaccurate or incomplete information and poor communi-
cation and reporting strategies). In addition, international
organizations may find it challenging to apply the same
standard in multiple countries.
Stock Market
Organizations may lose investors, or limit their pool of
investors, if they do not qualify for Socially Responsible
Investment or similar funds.
Employment Market
Employees want to work for organizations that respect
their rights, have a culture of integrity, and commit to
social and community concerns.
Sales Market
Customers might boycott products or services for envi-
ronmental or social issues. Organizations have an oppor-
tunity to increase sales and advertising if they are recog-
nized by “socially responsible consumer” groups.
External Business Relationships
Customers, suppliers, or partners could violate CSR terms
and conditions, principles, or laws, yet the organization could
be included as a wrongdoer by association. Developing and
monitoring the controls over and within external business
relationships may be a challenge for some organizations.7
www.theiia.org/guidance / 3
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

CSR Business Activities • Emissions.

• Health and safety incidents.
CSR business activities generally include: • Fraud incidents.

1. Determining and communicating policies and pro- • Donation and sponsorship amounts.
cedures for areas including corporate governance, • Economic benefits to specified regions.
business ethics, human resources and employment, • Employee satisfaction.
supply chain management, stakeholder relations, do-
nations and political contributions, the environment, • Noncompliance incidents.
and health and wellness. • Commitments to stakeholders, reclamation activity.

2. Setting objectives, performance targets, and strate- 5. Stakeholder engagement, including:8

gies, such as:
• Advisory or focus groups as part of research and
• Reduce carbon emissions. development.
• Comply with laws and regulations. • Involvement in policy development and feedback.
• Donate a percentage of net profits to charitable • Satisfaction surveys.
organizations. • Complaint management processes (including protec-
• Increase indigenous workforce. tion of complainants from retaliation or intimidation).
• Reduce safety incidents. 6. Auditing:
• Reduce waste.
• Disclosures in public reports.
• Create a culture of transparency.
• Internal controls and management systems.
• Facilitate employee volunteerism.
• Contractual compliance with CSR terms and con-
• Become the employer of choice and extend the eth- ditions (both internally and with external business
ical culture throughout the supply chain. relationships).
3. Communicating and embedding CSR principles and 7. Reporting results internally and externally, along with
controls into business decision making processes. governance processes for such disclosures.
• CSR risks are considered as part of project approvals.
• Culture is based on making the right decisions for
the right reasons.
• Life-cycle value assessments are used to evaluate
impacts of products or operations.

4. Tracking, measuring performance of, analyzing trends

around, and benchmarking activities such as:

8. Refer to Appendix C for additional information regarding stakeholder theory and engagement.

www.theiia.org/guidance / 4

Evaluating Corporate Social Responsibility/Sustainable Development
CSR Reporting
Many organizations report their CSR results to the pub-
lic. Reports help audiences, such as investors, employees,
suppliers, and customers make informed decisions about
their involvement with the organization. Each organiza-
tion makes a business decision as to the cost/benefits of
producing such information and what specific informa-
tion to include.
Reporting methods can include publishing a standalone
CSR report, integrating CSR information into the annual
report, and preparing select CSR information booklets on
specific topics or events for public distribution. Distribution
formats include: Web pages, booklets, press releases, regu-
latory filings, handouts and presentations at public stake-
holder meetings, videos, infomercials, and commercials.
There are several laws that require organizations in particu-
lar sectors to publicly disclose certain CSR practices and
activities, especially for corporate governance and environ-
mental compliance. For example:
• In Canada, banks and federally incorporated trust and
insurance firms with more than $1 billion in equity
are required by federal law to produce annual public
accountability statements outlining their contribu-
tions to the economy and society.
• In the United Kingdom, legislation requires pension
fund trustees to publish a comment in their invest-
ment statements on the extent to which their invest-
ment policies address social, ethical, and environ-
mental issues.
• In France, laws require companies to report on the
social and environmental impacts of their activities.
Organizations reporting their CSR results face challenges
in choosing which subjects to report, developing and pre-
senting performance metrics, and comparability of the
information. Organizations once faced these challenges
9. Consider evaluating the use of CSR issues in advertising strategies during an operational audit of marketing.
10. Social Accountability International, a not-for-profit organization, has established SA8000 as an international standard for improving working conditions.
IPPF – Practice Guide
when presenting financial information; however, years of
developing accounting and reporting standards has mini-
mized this. For CSR information, there are organizations
developing voluntary reporting standards, such as the
Global Reporting Initiative, but comparability will con-
tinue to be a challenge until standards are met by most
organizations worldwide. Also influencing the reporting
process are international not-for-profit organizations that
benchmark CSR reports, giving awards to those that best
meet their evaluation criteria.
To meet stakeholder demands for accountability, and to
reduce the appearance of the report being viewed as a
marketing ploy, many organizations are using verification
and assurance processes for all or part of the reports.9
Organizations have used internal reviewers (including
internal auditors), independent third parties, commu-
nity or expert advisory panels, or a combination of these
to perform the assurance process. Third parties include
external audit firms, subject matter experts in environ-
mental sciences and human rights, and other relevant
consultants. There are also international not-for-profit
organizations, such as AccountAbility, that produce
standards (AA1000) for assurance of CSR reports to
help strengthen the assurance process. Professional ac-
counting organizations also have published standards for
assurance of nonfinancial information, which includes
CSR information. Organizations that need to satisfy
many stakeholders regarding their compliance with CSR
terms and conditions may choose to become certified as
meeting ISO or SA8000 standards.10
Another challenge to credibility and transparency is that
organizations are expected to present the negative as well
as the positive, the failures as well as the successes. For
some organizations, this may represent a culture shift,
and it may also introduce liability risk.
www.theiia.org/guidance / 5
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Approaches to Evaluating CSR such as COSO,12 ISO,13 etc., or compliance with cus-
tomer expectations (contractual obligations). Typical
CSR elements include:
Definition of internal auditing:
Internal auditing is an independent, objective assurance and • Governance.
consulting activity designed to add value and improve an • Community investment.
organization’s operations. It helps an organization accom- • Environment.
plish its objectives by bringing a systematic, disciplined
• Ethics.
approach to evaluate and improve the effectiveness of risk
management, control, and governance processes.11 • Health, safety, and security.
• Transparency.
As part of the risk assessment and audit planning pro-
• Working conditions and human rights.
cess, the CAE considers the CSR risks and whether to
include all or part of the processes in its audit universe 2. Audits of CSR programs related to each significant
and audit plans. The CAE also should also be aware of stakeholder group affected by CSR activities that are
CSR issues in order to respond to any special requests by further refined into audits of these subjects at the
the board or senior management. corporate office, subsidiaries, and with external busi-
ness relationships. Stakeholders could include:
Auditing
The internal audit activity may choose to evaluate the • Customers.
CSR programs as a whole and determine whether the • Employees and their families.
organization has adequate controls to achieve its CSR
• The environment.
objectives. This option would likely require a significant
allocation of resources because of the broad scope of the • Neighboring communities.
subject. Such an audit is not likely to be done to develop • Shareholders.
the first opinion on CSR controls; rather the CAE would
• Suppliers.
develop a one- to three-year plan to obtain sufficient and
reliable information about the various elements of CSR Some of these stakeholder groups could include non-
within the organization. governmental organizations (NGOs) and activist groups
that represent the stakeholders or specific interests.
There are many approaches to auditing CSR controls,
including: 3. Bundling of subjects, such as the:

• Workplace: employer of choice, health and safety,

1. Separate audits of each element of CSR that are fur-
environmental management practices, diversity
ther refined into audits of these subjects at the cor-
and equality, training and development, ethics, gov-
porate office, subsidiaries, and with external business
ernance, and human rights.
relationships. Management processes can be evalu-
ated based on internal control or quality frameworks, • Marketplace: product quality and safety, responsi-
ble advertising and sales, responsible supply chain
11. Emphasis added for this paper.
12. Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control–Integrated Framework, www.coso.org.
13. International Organization for Standardization, www.iso.org.

www.theiia.org/guidance / 6

Evaluating Corporate Social Responsibility/Sustainable Development
management, product development and testing
practices, product stewardship, disclosure prac-
tices, and privacy.
• Environment: responsible air, water, land, waste,
animal, and energy use and regulatory compliance.
• Community: philanthropy, local economic support,
capacity building, volunteerism, and stakeholder
engagement.
4. Audits of the internal controls over risk management,
recording, measuring, and reporting of CSR activities
within each department or function that is covered in
the audit plan. For example, there would be a standard
audit program section with audit steps that cover the
same CSR tests in every audit performed. At the end
of 10 audits, the CAE would have 10 sample results
of CSR activities on which to base an overall conclu-
sion of internal control operating effectiveness.
5. Assurance audits of public disclosures of financial
and nonfinancial information related to CSR or any
of the individual CSR elements. Most organizations
with stated CSR objectives provide public informa-
tion about their approach and results. These audits
could be undertaken with the CAE as project man-
ager, coordinating internal and external resources as
required, or an internal auditor could be assigned to
an assurance team coordinated by another senior per-
son within the organization.
6. Audits of third parties for contractual compliance, in-
cluding compliance with CSR terms and conditions.
A proactive role may also be taken. For example, in-
ternal auditors could perform a review as part of a
supplier pre-qualification process.
Upon completion of the CSR-related audit programs, an
opinion of the overall CSR controls can be developed.
Facilitating
The internal audit activity may facilitate a management
self-assessment of CSR controls and results. This process
IPPF – Practice Guide
would be developed based on a risk assessment and results
in action items for control improvements.
Consulting
The internal audit activity may consult on project design
and implementation for CSR programs and reports or
serve as an adviser on CSR governance, risk management,
and internal controls.
Audit Considerations
Use of Audit Opinion
Senior management or the board may choose to publicly
state that it relies on its internal controls to produce reliable
information for public reporting. Management might also
ask the CAE to provide a statement for the CSR report,
saying that the internal audit activity has provided assur-
ance on the information contained in the report. The CAE
should ensure that the elements of the Formulating and Ex-
pressing Internal Audit Opinions Practice Guide have been
reviewed before issuing an opinion about the organization’s
CSR program. Caution should be taken to manage liability
associated with the opinion, if it is published.
Independence and Objectivity
Often, the internal audit activity may have an operating
role within the CSR processes, giving rise to concerns
about its independence and objectivity. For example, in-
ternal auditing may be responsible for investigations and
tracking results for allegations of fraud or violations of
law. Information about fraud and noncompliance inves-
tigations may form part of the CSR program and reports
to the public. This would put the auditors in the position
of evaluating and reporting on their own activities, which
threatens their independence and objectivity. However,
this could be overcome by using independent auditors to
assess this portion of the CSR program and reports.
Skills and Body of Knowledge
The IPPF provides authoritative guidance for the perfor-
mance of internal auditing, including proficiency and due
www.theiia.org/guidance / 7

Evaluating Corporate Social Responsibility/Sustainable Development
professional care requirements. If the internal audit activ-
ity conforms to the IPPF, then it is qualified to undertake
the roles listed above.
Any internal audit activity that collectively lacks the ap-
propriate skills and knowledge should not undertake an
internal audit, facilitation, or consulting engagement.
Specific CSR competencies could include expertise in
regulations, management systems and best practices re-
lating to the environment,14 health and wellness, safety,
science and engineering, ethics, community investment,
employment, human rights, working conditions, and gov-
ernance. Language and other communication skills are
also important considerations when discussing sensitive
issues, such as working conditions or ethics violations,
and for designing surveys.
If the internal audit activity is involved in facilitating a
control self-assessment, facilitation skills are critical.
Auditors who have the IIA’s Certification in Control Self-
Assessment designation can be an asset to this process.
Resources
The number of auditors and skills required depends on
the audit approach.
Teaming internal auditors with internal subject matter
experts is useful; it provides an opportunity for the audi-
tors to learn the subject, and for other employees to learn
more about a logical approach to evaluating process effec-
tiveness and internal controls. The subject matter experts
should not be members of the area being audited. They
could be employees in similar departments of subsidiaries
or other divisions.
If the organization hires an external service provider to pro-
vide assurance on CSR reports, the CAE should consider
the benefits of loaning a member to the assurance team.
14. Such as those having the Certified Professional Environmental Auditor (CPEA) designation.
IPPF – Practice Guide
Such benefits can include internal auditor training oppor-
tunities, the lessons learned on the project stay within the
organization, and the internal auditor can assist the team
in accessing information more efficiently due to his or her
knowledge of the organization.
The organization should evaluate the pros and cons of
using nongovernmental organization (NGO) members
on an audit or assurance team, including: more time will
be required to train external parties on the audit process;
external parties might not be bound by confidentiality
standards; by their nature, NGOs have special interests,
and their representatives will not be unbiased and objec-
tive and may not prioritize issues the same as the organi-
zation; a report that includes a positive statement from
an NGO is deemed to be more credible; new ideas and
fresh observers might help the organization better un-
derstand the CSR issues and activities; the NGO would
gain a better understanding of the organization.
CSR Maturity Model
The CAE considers the organization’s CSR maturity level
at the time of the internal audit, and the level to which the
organization hopes to progress. This information will help
the auditor frame recommendations as audit findings or as
ideas to help move the organization toward its goal.
A sample maturity scale could include:
1. Senior management and the board have not initiated
any CSR objectives or strategies.
2. The CSR strategy is “to comply with laws and con-
tractual commitments.”
3. Ad hoc recognition of specific CSR risks and strat-
egies to meet objectives exists in some divisions of
the organization. The organization’s goal is to exceed
compliance requirements. Reporting is selective.
www.theiia.org/guidance / 8

Evaluating Corporate Social Responsibility/Sustainable Development
4. A set of integrated and managed CSR strategies and
performance measures — reported to the public —
with governance processes is in place.
5. CSR is a primary feature of the organization’s mis-
sion, principles, and performance measures. Formal
reports are produced for the public, stakeholder
engagement processes are in place, and CSR fac-
tors are embedded into business decision-making
processes throughout the organization, including at
board levels.
Internal Audit Program
Development (Considerations)
The following discussion (and information contained in
Appendices A and B) include concepts to help internal
auditors think through various subjects when developing
the audit program. Because the audit scope and program
are based on a risk assessment for the organization, not all
of the concepts within this guidance will be relevant.
Consider the proliferation of CSR information that
the organization produces. Are the messages consis-
tent and current in public reports, speeches, and hand-
outs/presentation materials and on the organization’s
Web sites? How is disclosure and updating controlled?
Are the messages relevant to the organization’s mission,
goals, objectives, and commitments?
Has the organization made a decision to report in-
formation consistent with reporting standards, such
as the Global Reporting Initiative? Can the informa-
tion be compared with the organization’s competitors or
industry peers?
How are CSR strategies and priorities established
and communicated? How are they integrated into deci-
sion making and approval processes (e.g., budget, appropria-
tions, mergers, acquisitions, and joint ventures, performance
IPPF – Practice Guide
evaluation and bonuses, leadership training, and stakeholder
relations)? What takes precedence when there are compet-
ing objectives?
Is the organizational structure of CSR responsibili-
ties and authority documented for all elements? Are
responsible positions staffed with experienced and quali-
fied individuals?
Is the organization signatory to voluntary standards
of performance? Why or why not? Were the standards
adopted by management, or by the board? How are they
integrated into management practices? How is compli-
ance monitored in the organization? Standards include:
• AccountAbility AA1000 — principle-based standards
that provide the basis for improving the sustainability
performance of organizations.
• Amnesty International — focused on protecting and
championing human rights worldwide.
• CERES Principles — 10 principles covering major
environmental concerns.
• Clean Clothes Campaign (Code of labor) — intended
to improve working conditions in the garment and
sportswear industries.
• Electronic Industry Code of Conduct (EICC) — stan-
dards for labor, health, safety, and the environment in
manufacturing and throughout the supply chain.
• European Commission’s Eco-management and Audit
Scheme (EMAS) — public reporting on environmen-
tal performance.
• Eurosif Transparency Guidelines.
• Ethical Trading Initiative — strives to improve the
lives of workers in global supply chains.
• Base Code — best practices in codes of conduct.
• Fair Labor Association (FLA) — seeks to improve
working conditions.
www.theiia.org/guidance / 9

Evaluating Corporate Social Responsibility/Sustainable Development
• Workplace code of conduct.
• Global Reporting Initiative 2002 — introduces inter-
national reporting guidelines.
• Global Sullivan Principles of Social Responsibility —
principles that encourage companies to support eco-
nomic, social, and political justice.
• Greenhouse Gas Protocol Initiative, International
Chamber of Commerce.
• Business charter for sustainable development.
• Green-e — independent consumer protection pro-
gram for the sale of renewable energy and green-
house gas reductions in the retail market.
• Imagine Canada — Advancing knowledge and rela-
tionships to foster effective and sustainable chari-
table and nonprofit organizations.
• Ethical Program — fundraising and financial account-
ability standards.
• Caring Company Program — providing guidance and
standards that help members become better corpo-
rate citizens.
• Interfaith Center on Corporate Responsibility (ICCR).
• International Organization for Standardization (ISO)
14000 — a family of standards for creating environ-
mental management systems.
• International Labor Organization Conventions (ILO
Tripartite Convention) — 28 recommendations con-
cerning multinational enterprises and social policy.
• Kyoto Protocol.
• OECD Guidelines for Multinational Enterprises —
addressing a comprehensive range of responsibil-
ity issues.
• Natural Step framework and principles.
• Convention for combating bribery.
• Principles of corporate governance.
• Responsible Care initiative (chemical industry).
IPPF – Practice Guide
• Rio Declaration on Environment and Development —
the right of people to development. Signatories have
the responsibility to safeguard the environment.
• Social Accountability 8000 — a global standard to
make workplaces more humane.
• United Nations.
• Universal Declaration of Human Rights and related
instruments.
• UN Global Compact.
• Climate Neutral Network.
• Principles for Responsible Investing.
• Voluntary Principles on Security and Human Rights —
principles on human rights and security in mining
and petroleum industries.
• Worldwide Responsible Apparel Production
(WRAP) — 12 standards of labor practices, factory
conditions, and environmental and customs com-
pliance.
How does the organization manage compliance with
local and international laws?
Does your organization meet standards required
for inclusion in environmental or social investment
funds? Why or why not? Screening agencies include:
• Dow Jones Sustainability World Index (DJSI).
• Morningstar Socially Responsible Investment Index.
• FTSE 4 Good Global Indexes.
• EIRiS – Ethical investment Research Services.
• Jantzi Social Index.
Can the CSR — especially environmental or human
rights — activities of external business relationships
impact the organization’s reputation? If yes, then
contracts should include CSR performance terms and con-
ditions, and compliance should be tested. The internal audit
activity may be involved in such tests or receive reports on
results of tests done by others.
www.theiia.org/guidance / 10
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Can the CSR activities of customers impact the orga-
nization’s reputation? Would the organization refrain from
selling products to organizations with irresponsible or unsus-
tainable practices? Does it provide programs to encourage or
facilitate customers to be responsible with its products?
• Has the organization asked for feedback? What
did the feedback say, and what was the organiza-
tion’s response?

How well controlled are the mechanisms put in place

for capturing CSR information and developing and
reporting performance metrics? What spreadsheets
are used, and are there adequate spreadsheet controls to
ensure complete, accurate, and timely information?

If your organization publishes a CSR report:

• Is the disclosure process for CSR results as rigorous as

for financial reporting?
• Does it contain clear messages that are aligned with
the company’s vision and commitments?
• Does it contain balanced reporting (i.e., the good with
the bad), performance measures, and trends?
• Does it help the reader understand the issues and the
organization’s accountabilities?
• How does the organization’s CSR program compare
with others?
• Has it competed for awards, such as the Asian CSR
Awards, the Arabian CSR Awards, China CSR
Awards, and the International Community Service
Award given by the U.S. Chamber of Commerce
Business Civic Leadership Center? Has it received
recognition in other benchmarking programs, such
as the Human Rights Campaign’s Corporate Equal-
ity Index, Institutional Investors’ “Top Shareholder-
Friendly Companies, Global Challenges Index, Pe-
gasus Corporate Social Responsibility Awards, TERI
Corporate Awards, or Ethisphere magazine?
• How good is the CSR report? Has it been bench-
marked by independent organizations such as PR
News’ CSR Awards, Carbon Disclosure Leadership
Index, CERES, or Stratos Inc.?

www.theiia.org/guidance / 11

Evaluating Corporate Social Responsibility/Sustainable Development
Appendix A –
Auditing by Element
With this audit approach consider how compliance with
laws, regulations, and contractual obligations is managed
for all elements.
Governance
• Do board members have sufficient and relevant infor-
mation to fulfill their roles and responsibilities? Board
terms of reference, agendas, and minutes are sources
of information about board governance and oversight
responsibilities and monitoring of CSR. The board
information package management sends before meet-
ings shows the type of information provided for board
members to monitor CSR activities. Do budgets ap-
proved by the board have sufficient resources allocated
to achieve CSR objectives?
• Do the board and management report reliable financial
and nonfinancial information to stakeholders?
Ethics
• Anti-corruption is the most important ethical issue in a
CSR context. Is anti-corruption included in the organi-
zation’s risk assessment, code of conduct, and policies?
• Is there a reporting system for stakeholders to report
concerns or allegations of ethics violations? Are there
appropriate protection systems in place for those who
raise concerns?
• Are there investigation standards or protocols in place
to gather evidence, manage cases, and protect the rights
of parties involved in the investigation? Is the process
credible? Are root cause analysis and improvement of
controls part of the resolution process? Is disciplinary
action appropriate and consistent?
15. Conflict risk exists when war, civil unrest, labor unrest, or activism could impede achievement of the organization’s goals and objectives, including CSR goals. In a conflict risk impact
assessment an organization analyzes the characteristics of a proposed investment and the potential impacts (negative and positive, intended and unintended) it may have on tensions in
the region or community.
IPPF – Practice Guide
• Is there a process for disclosure of conflicts of interest?
Are acceptance or constraints documented and condi-
tions monitored?
• What methods exist to provide ethics advice, train-
ing, and awareness to help stakeholders understand
the organizations principles, processes, and practical
application of the Code of Conduct?
Are ethics program performance measures and metrics
maintained and reported? Are benchmarking and trend
analysis performed and reported to senior management
and the board?
Environment
• Are social and environmental impact assessments
performed:
• As part of risk management programs?
• As part of investment decision-making and approval
processes?
• Do they include conflict risk?15
• Are life cycle value assessments done for assets and
product development?
• Are green or socially responsible procurement pro-
cesses in place? How are they monitored?
• Are incidents reported, managed, and resolved appro-
priately?
• Are environmental program performance measures
and metrics maintained and reported? Are benchmark-
ing and trend analysis also performed and reported to
senior management and the board?
• Are results of audits — internal, regulator, and ex-
ternal — reviewed and commitments monitored and
tracked to completion?
• Are reduce, reuse, and recycle concepts integrated
into operations?
www.theiia.org/guidance / 12

Evaluating Corporate Social Responsibility/Sustainable Development
• Do risk assessments consider air (greenhouse gas and
other emissions, climate change, and carbon footprint),
water (use and effluent), land (reclamation, recreation-
al spaces, garbage and disposal of hazardous wastes,
conservancy, and stewardship), and animals (product
testing, ecosystems, and biodiversity)?
• Do environmental emergency plans exist? Do these
plans balance privacy of personal information with ac-
cess to information for employees and the community?
• Does the organization calculate its carbon footprint
and does it have offset programs in place? If so, are
calculations accurate and complete, and are the strate-
gies effective?
Transparency
• Does the organization manage stakeholder informa-
tion appropriately, such as balancing privacy of per-
sonal information with access to information?
• Is accountability a clearly stated principle, and is it
demonstrated by balanced reporting of the failures as
well as successes?
• Are there effective disclosure controls to ensure fair,
consistent, and timely reporting?
• Does the organization follow appropriate accounting
standards?
• Do stakeholder engagement policies and practices exist?
• Are CSR related policies available to the public (e.g.,
on the Web site)?
• Is there a crisis management plan that includes com-
munication with stakeholders?
Health, Safety, and Security
• Are health and safety risk assessments performed as
part of investment decision-making, product develop-
ment, and approval processes? Do they include conflict
risk and workplace violence?
• Are health and safety management programs included
in procurement processes? How are they monitored?
IPPF – Practice Guide
• Are incidents reported, communicated, managed, and
resolved appropriately? Are the results of incident inves-
tigations and resolution appropriately reported with the
recognition of personal information protection?
• Are health and safety program performance measures
and metrics maintained and reported? Are benchmark-
ing and trend analysis also performed and reported to
senior management and the board?
• Are results of audits — internal, regulators, and exter-
nal — reviewed and commitments monitored and
tracked to completion?
• Are stakeholders provided sufficient information to
make informed decisions about health and safety risks?
• Are stakeholders provided sufficient training and equip-
ment to work safely?
• Are product safety (during product life cycle) and recall
programs in place?
• Is there a comprehensive product stewardship program
in place to evaluate and minimizes the risks of products
from cradle to grave (life cycle value assessment)?
Human Rights and Work Conditions
• Does compensation consider fair pay, living wages, and
job opportunities?
• Does the organization have a security program, and
has it considered human rights when developing and
implementing security measures, especially in con-
flict regions?
• Are there effective policies and programs to prevent
and manage discrimination and harassment?
• What labor standards are in place (child labor, forced la-
bor, working hours, employment equity, and diversity)?
• Does the organization accept freedom of association
and the right to collective bargaining for employees?
• Is there a conflict risk and impact assessment? How is
conflict managed? Is there a crises management plan?
www.theiia.org/guidance / 13
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

• Is there a complaint management system for issues to

be reported, investigated, and resolved?
• Are there socially responsible procurement practices?
If so, how are they monitored?

Community Investment
• What philanthropy (donations and charitable giving)
practices are in place, and how are decisions made?
An example would be adopting voluntary “giving” stan-
dards, (e.g., the Imagine program in Canada, where sig-
natories donate 1 percent of profits each year).
• Have the cost and benefits of foundations been con-
sidered (e.g., tax benefits, focused giving)?
• Has the organization distinguished the cost/benefits of
sponsorships compared with philanthropy?
• Does the organization encourage volunteerism? What
programs are in place?
• Does the organization facilitate employee or cus-
tomer philanthropy, or match employee or customer
philanthropy?
• Are social and environmental impact assessments per-
formed? How are community stakeholders engaged in
these assessments?
• Is there a complaint management system for the com-
munity to report issues or concerns? Are the com-
plaints managed and resolved effectively?
• Are there quotas or similar efforts to support local,
indigenous, or special interest suppliers?
• Have strategic partnerships been established within
the community?
• How does the organization contribute to local eco-
nomic development (e.g., purchasing in the local,
regional markets; local education and training to
reduce unemployment; and supporting infrastructure
that the presence of the organization may stress)?
• How are community investment strategies measured,
monitored, and evaluated? By whom?

www.theiia.org/guidance / 14

Evaluating Corporate Social Responsibility/Sustainable Development
Appendix B – Auditing by
Stakeholder Group
When using this audit approach consider how compliance
with laws, regulations and contractual obligations is man-
aged for all elements.
Employees and Their Families
• Volunteerism.
• Facilitation of employee or customer philanthropy, or
matching employee or customer philanthropy.
• Health, safety, and security in the workplace and at
home.
• Fair and prompt payment, living wages, and job oppor-
tunities.
• Discrimination and harassment.
• Labor standards (child labor, forced labor, working
hours, and employment equity and diversity).
• Freedom of association and the right to collective
bargaining.
• Privacy of personal information; access to information.
• Involvement of, and respect for, indigenous people.
• Conflict risk and impact assessment methodology.
• Complaint management systems.
• Alternatives to layoffs and downsizing.
• A clear business model for outsourcing work.
• Availability of a resource or referral for confidential
counseling.
• Employee satisfaction.
• Religion in the workplace.
IPPF – Practice Guide
The Environment
(See Appendix A – Environment)
• Environmental stakeholder engagement/Nongovern-
mental organization (NGO) engagement.
Customers
• Facilitation of employee and/or customer philanthropy,
or matching employee or customer philanthropy.
• Product safety and recall processes.
• Privacy of personal information; access to information.
• Discrimination and harassment.
• Involvement of, and respect for, indigenous people.
• Fair and image-appropriate advertising (transparency
and honesty).
• Anti-corruption (fair competition, bribery, and conflict
of interest).
• Complaint management system; customer satisfaction.
Suppliers
• Fair rates and payment terms.
• Local capability building programs.
• Privacy of personal information; access to information.
• Discrimination and harassment.
• Involvement of, and respect for, indigenous people.
• Anti-corruption (bribery, conflict of interest, and fair
competition).
• Complaint management system; supplier satisfaction.
• Incorporation of social, health, safety, and environ-
mental values into purchasing decisions.
• Supplier audits, including review of CSR terms and
conditions.
www.theiia.org/guidance / 15
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Neighboring Communities
• Philanthropy (donations and charitable giving).
• Safe operations and emergency response programs.
• Community relations, community satisfaction.
• Local capability programs.
• Partnering to build skills and cost effectiveness with
local businesses.
• Local economic support programs.
• Privacy of personal information; access to information.
• Involvement of, and respect for, indigenous people.
• Conflict risk and impact assessment methodology.
• Complaint management system.
• Community quality of life projects.
• Striving to balance the impacts of the business and
create communities where the employees and their
neighbors are happy to live. This could include parks,
charitable giving campaigns, etc.
• Community education.

Shareholders and Investors

• Optimize effects of donations and sponsorships.
• Tax effectiveness, compliance with laws.
• Branding opportunities.
• Privacy of personal information; access to information.
• Accountability and transparency.
• Disclosure controls — to the public and to investors.
• Compliance with securities regulations, including good
governance.
• Long-term sustainability strategies.
• Compliance with accounting standards.
• Shareholder rights.
• Anti-corruption (bribery, conflict of interest, misrepre-
sentation, and compliance).

www.theiia.org/guidance / 16
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Appendix C – determine who its primary stakeholders are, those with

whom engagement is important for the organization.
Stakeholder Theory
“Companies that build strong, mutually beneficial rela-
In the traditional view of the firm — the shareholder view tionships with stakeholders also tend to enjoy enhanced
(the only one recognized in business law in most coun- financial performance.” 16
tries) — the shareholders or stockholders are the owners
of the company, and the firm has a binding fiduciary duty
to put their needs first to increase value for them.

In older input-output models of the corporation, the firm

converts the inputs of investors, employees, and suppliers
into usable (salable) outputs that customers buy, thereby
returning some capital benefit to the firm. By this model,
firms only address the needs and wishes of those four par-
ties: investors, employees, suppliers, and customers.

However, stakeholder theory argues that there are other

parties involved, including governmental bodies, political
groups, trade associations, trade unions, communities,
associated corporations, prospective employees, prospec-
tive customers, and the public at large. Sometimes even
competitors are counted as stakeholders.

Each stakeholder has some special interest that will be

impacted by the operations of an organization, and there-
fore will make social or legal demands of it. How the
organization chooses to act will influence the response of
the stakeholder. Building relationships and mutual confi-
dence is an important consideration for sustainability.

Stakeholder engagement is a formal process for manag-

ing relationships. Engagement theory suggests that man-
agement is in a better position to act if it first listens
to the issues and ideas of stakeholders, takes the best
course of action that is aligned with its principles and
objectives, involves the stakeholders in monitoring prog-
ress, and reports periodically. The organization should

16. Source: Boston College, as quoted on http://www.interpraxis.com/stakeholderengagement.htm.

www.theiia.org/guidance / 17
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Appendix D –
Additional Resources
For more information on ethics and compliance audits,
measurements and metrics, see the Open Compliance and
Ethics Group at www.oceg.org.

The Global Reporting Initiative is one standard for report-

ing to the public: www.globalreporting.org.

IIA Guidance
• Practice Guide: Auditing External Business Rela-
tionships.
• Practice Guide: Formulating and Expressing Internal
Audit Opinions.
• PA-2130.A1-2: Evaluating an Organization’s Privacy
Framework.
• “Managing the Business Risk of Fraud, A Practical
Guide.”
• IIA seminar: Evaluating Organizational Ethics.
• IIA seminar: Evaluating Social Responsibility and Sus-
tainable Development.

www.theiia.org/guidance / 18
 IPPF – Practice Guide
Evaluating Corporate Social Responsibility/Sustainable Development

Practice Guide Team Members

Lynn C. Morley, CIA
Carlos Reyes Balza, CIA
David W. Zechnich, CIA

www.theiia.org/guidance / 19
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice guides embody an IIA statement to as-
sist a wide range of interested parties, including Copyright
those not in the internal audit profession, in un- The copyright of this practice guide is held by The
derstanding significant governance, risk, or con- IIA. For permission to reproduce, please contact
trol issues and in delineating the related roles and The IIA at guidance@theiia.org.
responsibilities of internal auditors on a signifi-
cant issue. Practice guides are part of The IIA’s
International Professional Practices Framework.
As part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended and the guidance is
endorsed by The IIA through formal review and
approval process. For other authoritative guid-
ance materials provided by The IIA please visit
our Web site, www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice guide

eValuatINg ethICs-related
PrograMs aNd aCtIVItIes

JuNe 2012
 IPPF – Practice guide
evaluating ethics-related Programs and activities

Table of Contents

Executive Summary ........................................................................................ 1

Introduction ................................................................................................... 2
Definitions ..................................................................................................... 2
Responsibilities for Ethical Climate ................................................................ 3
Considerations for an Audit of Ethics ........................................................... 10

Appendix A: Examples of Audit Tools in Evaluating Organizational Ethics .... 13

Appendix B: Pertinent Strongly Recommended Guidance ............................. 27
Authors and Reviewers ................................................................................ 29

www.globaliia.org/standards-guidance / C

evaluating ethics-related Programs and activities
executive summary
A strong ethical culture is the foundation of good gover-
nance. An ethical culture is created through a robust ethics
program that sets expectations for acceptable behaviors in
conducting business within the organization and with ex-
ternal parties. It includes effective board oversight, strong
tone-at-the-top, senior management involvement, organi-
zation wide commitment, a customized code of conduct,
timely follow-up and investigation of reported incidents,
consistent disciplinary action for offenders, ethics train-
ing, communications, ongoing monitoring systems, and an
anonymous incident reporting system.
IIA Standard 2110.A1 requires that the internal audit
activity evaluate the design, implementation, and effec-
tiveness of the organization’s ethics-related objectives,
programs, and activities. This Practice Guide provides
guidance for evaluating program effectiveness and com-
pliance; it includes a potential audit approach, proce-
dures, tools, and techniques. It is developed based on
both Mandatory and Strongly Recommended Guidance
incorporated in The Institute of Internal Auditors’ (IIA’s)
International Professional Practices Framework (IPPF).
Key Roles of Internal Audit in Organizational
Governance
As stated in IIA Standard 2110: Governance, internal
audit is responsible for assessing the governance process
and recommending improvements to promote appropriate
ethics and values within the organization.
The internal audit activity may fulfill these responsibilities
by:
• Assessing the state of the organization’s ethical cli-
mate and the effectiveness of its strategies, tactics,
communications, and other processes in achieving
the desired level of legal and ethical compliance.
IPPF – Practice guide
• Evaluating the design, implementation, and effec-
tiveness of the organization’s ethics-related objec-
tives, programs, and activities.
• Providing assurance that ethics programs achieve
stated objectives, key risks are effectively managed,
and controls continue to operate effectively.
• Providing consulting services to help the organiza-
tion establish a robust ethics program and improve
its effectiveness to the desired performance level.
• Serving as a role model and ethics advocate. Internal
audit has a high level of trust, integrity, and com-
petence to advocate appropriate conduct to comply
with the organization’s legal, ethical, and societal
responsibilities and promote appropriate ethics and
values.
• Serving as a subject matter expert on ethics-related
issues and as a member of the organization’s ethics
council (or equivalent).
• Acting as a catalyst for change, promoting and
recommending enhancements for the organization’s
governance structure and practices.
There are numerous governance and ethics-related regu-
lations around the world. Violations may create significant
reputation impairment and heavy penalties for an orga-
nization. Internal audit can provide substantial value by
assuring senior management and the board that effective
ethics programs are in place and operating effectively.
Target Audience
Ethics is an integral part of organizational governance.
The four pillars of organizational governance — the board,
management, internal audit, and external audit — along
with other stakeholders such as regulators, shareholders,
business partners, suppliers, and service providers, should
be knowledgeable about matters concerning an organiza-
tion’s business ethics.
www.globaliia.org/standards-guidance / 1
IPPF – Practice guide
evaluating ethics-related Programs and activities
INtroduCtIoN
This guide provides internal auditors with a framework
for the evaluation of ethics-related programs and activi-
ties. Because various countries and cultures have differ-
ent views of what is considered ethical behavior, the guide
provides a range of examples, definitions, and principles
that are not meant to be comprehensive but to provide a
platform on which internal auditors can build their evalu-
ations. The principles apply equally to the public and pri-
vate sectors.
IIA’s Code of Ethics for Internal Auditors —
Practice What We Preach
While this Practice Guide focuses on internal auditors’
evaluation of the design, implementation, and effective-
ness of an organization’s ethics-related objectives, pro-
grams, and activities, it is appropriate to highlight the
importance of ethics for internal audit professionals. The
IIA’s Code of Ethics underlies the conduct of internal au-
dit work and compliance with the Code is mandatory.
Compliance with the Code of Ethics is mandatory be-
cause of the trust placed by internal and external stake-
holders in the internal audit profession and the activity.
Internal audit must be viewed as a role model and an
advocate of strong ethics. Compliance with the IPPF is
consistent with other professional bodies’ requirements to
follow a strong standards framework.
The IIA’s Code of Ethics is applicable to the internal au-
dit activity and its staff. Internal auditors must apply the
principles to all aspects of their work and their relation-
ships with the audit committee, management, employees,
and other stakeholders. Noncompliance can result in dis-
ciplinary actions, including expulsion from The IIA and
withdrawal of the Certified Internal Auditor (CIA) des-
ignation.
2 / www.globaliia.org/standards-guidance
Pertinent IPPF Elements
While the International Standards for the Professional Prac-
tice of Internal Auditing (Standards) in its entirety is appli-
cable to evaluating ethics programs, there are some stan-
dards, Position Papers, Practice Advisories, and Practice
Guides that are directly related to assessment of ethics-
related objectives, programs, and activities. Some require
advance considerations during engagement planning (e.g.,
conducting work under attorney-client privilege or deter-
mining reliance on work performed by other internal and
external assurance providers). One standard warrants par-
ticular attention.
Pertinent Mandatory Guidance
2110 – Governance
The internal audit activity must assess and make appro-
priate recommendations for improving the governance
process in its accomplishment of the following objectives:
• “Promoting appropriate ethics and values within the
organization….”
2110.A1 – The internal audit activity must evaluate
the design, implementation, and effectiveness of the
organization’s ethics-related objectives, programs,
and activities.
Pertinent Strongly Recommended Guidance
Refer to Appendix B for a listing of pertinent non-manda-
tory guidance.
deFINItIoNs
Definitions – One Size Does Not Fit All
To facilitate the use of this Practice Guide, we offer gen-
eral definitions of some key terms. It is important to keep
in mind that business ethics vary across countries, cul-
tures, and organizations. Internal audit should gain an in-
depth understanding of its organization’s business culture
and context by:

evaluating ethics-related Programs and activities
• Reviewing the organization’s mission, vision, stra-
tegic plan, code of conduct, allegation reporting
system, related regulatory and privacy requirements,
etc.
• Researching the culture of the various countries
where the organization’s business units are located
and the countries with which they do business (e.g.,
the Internet has extensive information on, for exam-
ple, doing business in Brazil, Russia, India, China,
and in all the major countries around the world).
• Confirming internal audit’s understanding with man-
agement and employees.
• Reflecting on insights from past business issues and
audit findings.
• Reviewing applicable legislation and guidelines.
Definition of Ethics
(from Thomson Gale Encyclopedia)
“Ethics is the branch of philosophy that defines what is
good for the individual and for society and establishes the
nature of obligations or duties that people owe themselves
and one another.”
Elements of Business Ethics
Organizations will set their own standards of ethical con-
duct. These standards should be complementary to the
ethical standards of the country or region. Key elements
of business ethics include:
• Business ethics is a major element of governance.
• Business ethics relates to principles that are con-
sidered desirable by the majority of management or
governing bodies in conducting business.
• Business ethics are a consensus of what is deemed
acceptable behavior for a particular organization.
This consensus position is derived from compro-
mises between key constituents, and is agreed to by
IPPF – Practice guide
the board and executives. Therefore, it is not likely
to match the personal ethics of everyone.
Directors and employees are required to follow these
principles; business partners, suppliers, contractors, and
third-party service providers may also be required to abide
by them.
Definition of Values
(from Dictionary.com)
Values are an integral part of an organization’s code of eth-
ics. “Values are the beliefs of a person, social groups or or-
ganizations; they are rules by which one makes decisions
about right and wrong, should and should not, good and
bad.” They also tell us which are more or less important,
which is useful when we have to trade off meeting one
value over another.
Values are the embodiment of what an organization stands
for, and should be the basis for the behavior of its mem-
bers. They state either an actual or an idealized set of
criteria for evaluating options and deciding what is ap-
propriate, based on long experience. An organization may
publish one set of values (stated values) that is very dif-
ferent from the values that actually guide organizational
behavior (operating values). When there is a disconnect, it
may be difficult to determine what is “acceptable.” Staff
quickly learn the operating values, or they don’t survive for
long in the organization. To the extent operating values
differ from stated values, the organization will not only
suffer from doing things less effectively, but also from the
cynicism of its employees who will not trust its leadership.
resPoNsIbIlItIes For the
ethICal ClIMate
Board of Directors or Oversight Group
The board of directors or oversight group oversees the
ethical climate, ensures management has sound ethics-
related objectives and programs, and needs assurance that
www.globaliia.org/standards-guidance / 3
IPPF – Practice guide
evaluating ethics-related Programs and activities
these programs are effective in creating the desired ethi-
cal climate throughout the organization. Internal audit is
best positioned to give that assurance because it experi-
ences the ethical climate directly but is independent from
management and charged with identifying weaknesses
and opportunities for improvement. The chief audit ex-
ecutive (CAE) should ensure the board understands this
and also that internal audit has the competence to provide
that assurance.
Senior Management
Senior management has primary responsibility for promot-
ing and exemplifying ethical behavior. The importance of
tone-at-the-top cannot be overstated. Ethics programs,
no matter how well designed and executed, will struggle
to accomplish their purpose if employees see executives
behave with questionable ethics or accept such behavior
from others.
The specific methods management uses to promote ethi-
cal behavior will vary according to the organization’s en-
vironment and maturity. For a small organization with
frequent interaction between senior management and
employees, leadership by example and informal commu-
nication may be more influential. A larger, more mature
entity with an enhanced, highly effective ethical culture
will likely include most or all of the following:
(a) A formal code of conduct, which is clear and
understandable, and related statements, policies
(including procedures covering fraud and corrup-
tion), and aspirational views.
(b) Frequent communications and demonstrations
of expected ethical attitudes and behavior by the
influential leaders of the organization.
(c) Explicit strategies to support and enhance the ethi-
cal culture with regular programs to update and
renew the organization’s commitment to an ethical
culture.
(d) Several easily accessible ways for people to con-
4 / www.globaliia.org/standards-guidance
fidentially report alleged violations of the code of
conduct, policies, and other acts of misconduct.
(e) Regular declarations by employees, suppliers, and
customers that they are aware of the requirements
for ethical behavior in transacting the organiza-
tion’s affairs.
(f) Clear delegation of responsibilities to ensure that
ethical consequences are evaluated, confidential
counseling is provided, allegations of misconduct
are investigated, and case findings are appropri-
ately reported.
(g) A designated person (e.g., an ombudsman) to
whom employees can go for advice on how to deal
with and whether to report an ethical issue.
(h) Ethics training for all employees, suppliers, and
major customers, including exercises in ethical
decision-making with scenarios like those employ-
ees might encounter in their jobs.
(i) Positive personnel practices that encourage every
employee to contribute to the ethical climate of
the organization.
(j) Regular surveys of employees, suppliers, and cus-
tomers to determine the state of the ethical climate
in the organization.
(k) Regular reviews of the formal and informal pro-
cesses within the organization that could potential-
ly create pressures and biases that would under-
mine the ethical culture.
(l) Regular reference and background checks as part of
hiring procedures and prior to engaging in a con-
tract with a customer or supplier including integ-
rity tests, drug screening, and similar measures as
applicable.
(m) Compensation practices that do not inadvertently
encourage bending the rules to achieve perfor-
mance targets.
(n) Appropriate punishments for unethical behavior
regardless of the perpetrator (e.g., not making

evaluating ethics-related Programs and activities
an exception for a powerful executive or the best
salesperson) and publication of the punishment
internally by whatever legally feasible means are
available.
(o) A designated chief ethics officer to act as coun-
selor of executives, managers, and others and as
champion within the organization for “doing the
right thing.”
Operating Management
Members of operational management are responsible for
promoting, exemplifying, and evaluating ethical behavior
in their areas of responsibility. Just as tone-at-the-top is
of paramount importance for the organization as a whole,
each manager’s attitude and behavior around ethics is
centrally important to the ethical subculture in his or her
areas.
Other Employees
All people associated with the organization share respon-
sibility for the state of its ethical culture. Because of the
complexity and dispersion of decision-making processes
in most enterprises, each individual should be encouraged
to be an ethics advocate, whether the role is delegated of-
ficially or merely conveyed informally.
Third-party Service Providers, Suppliers,
Agents, and Customers
While external to the organization, these parties may act as
agents of the organization or otherwise be associated with
it. This is especially true with outsourced services like IT,
accounting, payroll, customs clearance, and research and
development. The organization can be held accountable
for unethical actions taken on its behalf by these parties.
At a minimum, such relationships pose a reputation risk.
Certain relationships could result in legal liabilities, pen-
alties, and fines. To protect itself, the organization should
incorporate into contracts with these parties a require-
ment that they comply with its pertinent policies such as
those related to accepting or offering gifts, bribes, or “fa-
IPPF – Practice guide
cilitation fees” and conflict of interest disclosures.
Internal Audit
Internal auditors should take an active role in support of
the organization’s ethical culture. They should be trusted
within the organization and possess a high level of in-
tegrity and the skills to be effective advocates of ethical
conduct. They should have the competence and capacity
to appeal to the enterprise’s leaders, managers, and other
employees to comply with the legal, ethical, and societal
responsibilities of the organization.
The IIA’s Code of Ethics helps ensure that internal audi-
tors “practice what they preach.” The CAE should ensure
that all audit work is performed in full compliance with,
and meets the intent of, the Code.
The CAE may assume proactive roles such as becoming
a nonvoting member of an internal ethics council or con-
ducting ethics training sessions. The internal audit activ-
ity may also play roles that relate to both promoting and
assessing ethics, such as hosting the organization’s whis-
tleblowing hotline or conducting fraud investigations. Be-
fore accepting such roles the CAE should consider how
they would affect the perception of internal audit within
the organization.
Internal Audit’s Role in Assessing
the Ethical Climate
At a minimum, the internal audit activity should periodi-
cally assess the state of the organization’s ethical climate
and the effectiveness of its strategies, tactics, communica-
tions, and other processes in achieving the desired state.
Assessment methods include:
• An entitywide review of ethics-related policies and
processes.
• Audits of specific ethics-related functions, such as
the compliance function.
www.globaliia.org/standards-guidance / 5
IPPF – Practice guide
evaluating ethics-related Programs and activities
• An entitywide employee survey.
• An audit project employee survey.
• Informally including ethical climate in entitywide
and audit project risk assessments and in the execu-
tion of audit projects. At a minimum, this should be
done on every audit project.
Each of these methods is discussed further below. Re-
gardless of the assessment method, the following main
points apply:
• When auditors evaluate the “design, implementa-
tion, and effectiveness of the organization’s ethics-
related objectives, programs and activities,” an
important and challenging attribute is effectiveness.
For example, consider an ethics training program.
Internal auditors can test the design of a training
program by comparing it to “best practice” models.
For example, well-designed ethics training includes
exercises in which attendees are given a concrete
situation and have to make an ethical decision. The
instructor gives feedback on thought processes and
which decision is most consistent with the organiza-
tion’s values.
Internal auditors can test the implementation of a
training program by checking the qualifications of
the instructors, noting the percentage of employees
who have taken the training, examining attendee
evaluations, quizzing employees later to see if they
retained what they learned, etc.
These are all useful tests, but the training program
is a waste of resources if it does not achieve the
desired effect. To evaluate the effectiveness of ethics
training, internal auditors should determine whether
employees have internalized the ethical values and
are likely to apply them when faced with an ethical
decision.
6 / www.globaliia.org/standards-guidance
Many internal auditors meet this challenge by using
self-assessment — not asking employees to assess
their own ethics, which may be unreliable, but ask-
ing them to assess the ethical behavior of others or
the ethical climate created by management at higher
levels. For this sort of self-assessment to be effec-
tive, employees must feel safe from retribution.
• Ethics is a sensitive area, and self-assessment in-
volves subjectivity. To reduce resistance to negative
results, internal auditors should get management’s
buy-in for the audit, including the assessment crite-
ria and evaluation methods. If management agrees
to the testing approach and methods, internal audit
will be in a stronger position when it comes time
to report the factual outcomes of the agreed-upon
tests.
There may be situations where the board or over-
sight group desires an audit of the ethical climate
but senior management does not, or when senior
management desires the audit but certain operating
managers do not. In these cases, the CAE must be
certain of full support from the top, use evaluation
methods that emphasize confidentiality to protect
employees who report honest opinions or wrongdo-
ing by others, gather as much objective evidence as
possible, anticipate the resistance that might arise,
and develop strategies to overcome that resistance.
The CAE should also consider whether the resis-
tance is a symptom of an underlying ethical issue.
• Because of its sensitivity and because the ethical cli-
mate does not lend itself easily to a traditional audit
rating system, internal auditors might consider using
a maturity model. For each attribute to be tested,
the board and/or senior management can choose the
desired level of maturity, and internal audit can de-
termine the actual level through testing. The review
will then identify both strengths and gaps, and give
a more complete and balanced picture of the ethical

evaluating ethics-related Programs and activities
climate than would an audit opinion. Appendix A
provides one example of such a maturity model.
There are various ways of assessing the ethical climate.
Five are discussed herein.
Entitywide Review of Ethics-related
Policies and Activities
Most organizations communicate ethical values in formal
statements like a code of ethics, mission statement, or
values statement. Additionally, ethical values are often ex-
pressed in function-specific policies like sales, customer
service, lending, and investment policies.
Internal auditors might review major policies to identify
the statements of ethical values they contain. They could
then consider:
• Are ethical values consistent among policy state-
ments?
• Are any policies lacking ethics statements? Should
ethics statements be added to be consistent with
other statements?
• Are the ethics statements consistently expressed
enabling employees to have a cohesive, easily under-
stood picture of the expected behavior?
• Are the statements specific and concrete enough to
be meaningful?
Ethical values that are consistent, comprehensive, and
concretely expressed are a good starting point for the or-
ganization. For the internal audit activity, they will be the
high-level criteria for the remainder of the audit, and for
other assessment methods.
Ethical statements must be communicated to employ-
ees and integrated into their everyday behavior if they are
to be effective. Internal auditors might consider the list
of methods by which senior management can promote
ethical values that was presented earlier in this Practice
IPPF – Practice guide
Guide. Not all of these methods will be appropriate for ev-
ery organization, but auditors can determine which ones
are appropriate for their own company, recommend any
that are not being used but should be, and assess those
that are being used.
Audits of Specific Ethics-related Functions
Specific ethics-related functions and activities (e.g., the
compliance function, ethics training, and hotline) might
be evaluated as part of an entitywide review or as a stand-
alone audit project.
Entitywide Employee Survey
Policy statements express the organization’s desired ethi-
cal values. Ethics-related activities are the means by
which management attempts to instill these values into
the organization’s culture. But excellent statements and
formal activities are quickly subverted when employees
observe questionable behavior in their superiors, or when
peers tell them, “That’s the theory, but this is how it’s
really done,” or “This is what you have to do if you want
to get ahead.”
To determine the effectiveness of ethics-related activities,
internal auditors must measure the ethical climate itself.
One good method for doing this is an entitywide employee
survey. Appendix A presents an example that some audit
departments have used, adapting it as needed.
In many organizations, management sponsors a similar
survey, often administered by a third party that specializes
in such surveys. If this is the case, internal auditors can
use the results of management’s survey, but they should
first evaluate the survey process to determine how much
reliance may be placed upon it. In particular, they should
determine whether the survey includes meaningful eth-
ics-related questions and whether it is administered in a
way that encourages candid and meaningful responses.
www.globaliia.org/standards-guidance / 7
IPPF – Practice guide
evaluating ethics-related Programs and activities
Whether evaluating management’s survey process or de-
veloping their own, internal auditors should consider the
following:
• Employees must feel safe from retribution for giving
honest responses. This is usually accomplished by
making the survey confidential, and the promise
of confidentiality must never be violated. Using an
outside vendor that guarantees confidentiality can
also be an advantage.
• Ethical issues are rarely yes/no issues; there are al-
ways degrees. The most common way of structuring
this kind of survey is to have statements like “Senior
management of my business unit demonstrates high
ethical values” and have employees choose their
level of agreement on what is called a Likert scale:
Strongly agree, Agree, Disagree, Strongly disagree, or
Don’t know (or not applicable).
• Ask for specific comments. Many surveys ask
employees to explain why they disagree or strongly
disagree with any of the survey statements.
• Consider the level of confidentiality needed. For
example, surveys typically ask in what area the em-
ployee works. Comparisons of one area to another
are valuable, but the smaller the area the less con-
fidential the responses will be. Some surveys give
employees the option of giving their names; most do
not. The level of confidentiality needed will differ
from one organization to another.
• It is often meaningful to stratify responses by level
(e.g., senior management, middle management, and
staff) or location and compare the differing per-
ceptions, as long as doing so does not compromise
confidentiality.
• Consider the length of the survey. The longer the
survey the more information it will yield but the
lower the response rate is likely to be. The optimum
length will vary from one organization to another.
• Survey statements should be phrased in simple,
8 / www.globaliia.org/standards-guidance
easy-to-understand language. Consider “field-test-
ing” the survey by giving it to several people indi-
vidually and asking what they think each statement
means.
• Consider language and cultural issues when using a
survey in more than one country.
• Results, together with action plans addressing is-
sues raised by the survey, should be communicated
to employees, so they know that management is
listening to them and working to improve the ethical
climate.
If internal audit develops its own survey, there are two ad-
ditional considerations:
• It is important to get buy-in from the board and/or
senior management. They must want the informa-
tion and be willing to address issues that might be
raised.
• Consider having legal review the survey to consider
liability issues. If legal is likely to be overly cautious,
be prepared to discuss the risk versus the potential
benefit of the survey.
If an effective entitywide survey is in place, whether spon-
sored by the internal audit activity or management, inter-
nal auditors should consider using the results for:
• Following up on responses that suggest a weakness
in the ethical climate to determine with corroborat-
ing evidence whether this weakness in fact exists
and, if so, have the root cause and possible correc-
tive actions been identified?
• A macro-level risk assessment. A risk universe item
in which employees perceive a weak ethical climate
is clearly at higher risk than others.
• A micro-level risk assessment. Survey results should
be considered in planning each audit project if they
can be broken down to that level. If they point to a
specific ethical weakness, testing should be done to

evaluating ethics-related Programs and activities
prove or disprove its existence.
• Identifying the root cause of exceptions. These may
be traceable to weaknesses in the ethical climate.
• Supporting audit findings. When audit findings and
survey results are consistent, both are strengthened.
An appropriately administered employee survey produces
objective evidence of employee perceptions, and these
perceptions are the most reliable indicator of the actual
state of the ethical climate. After all, the ethical climate is
what employees think it is, not what senior management
wants it to be. At the same time, employee perceptions
are subjective. Internal auditors should provide the appro-
priate perspective about the strength and limitations of
employee surveys when reporting results. To the extent
possible, internal auditors should identify the root cause
of negative perceptions and work with management to de-
velop corrective action plans.
Audit Project Employee Survey
A similar, typically briefer survey can be used during audit
projects. Appendix A is an example of a survey used by
an organization on every audit project. The considerations
discussed previously apply to audit project surveys as well.
Some additional considerations are:
• Surveys can accurately measure employee percep-
tions, but perceptions are not always accurate.
Results should not be reported as audit issues
unless they have been validated with more tangible
evidence. They should, however, be reported to the
responsible managers because managers need to
know how employees are feeling, and the knowledge
might allow them to correct misperceptions.
• Online survey tools allow you to survey 100 percent
of the population and easily compile and analyze the
results.
• Allowing managers to add survey items of concern
to them will increase buy-in and might yield valu-
able audit information.
IPPF – Practice guide
Informally Including Ethical Climate
in Entitywide and Audit Project Risk
Assessments, and in the Execution
of Audit Projects
Although less effective than the formal assessment meth-
ods discussed previously, internal auditors should at a
minimum consider their own perceptions and gather any
available evidence about the ethical climate when assess-
ing risk. This is true both when identifying audits to per-
form and when assessing risk during each audit project.
When performing audits, internal auditors should be alert
to ethical concerns. In addition, they might include ques-
tions on ethics during interviews, such as the greatest
ethical challenge faced by the employee in the past.
Considerations in Reporting Ethical Concerns
Reporting ethical violations or concerns, especially when
they involve senior management, can be extremely sensi-
tive. The CAE may want to consult the following Practice
Advisories and Practice Guides for guidance:
• PA 2400-1: Legal Considerations in Communicating
Results (May 2010).
• PA 2410-1: Communication Criteria (January
2009), #13 on separate reporting to the board.
• PA 2440-2: Communicating Sensitive Information
Within and Outside the Chain of Command (May
2010).
• PA 2440.A2-1: Communications Outside the Orga-
nization (May 2010).
• PG: Interaction With the Board (August 2011).
www.globaliia.org/standards-guidance / 9
IPPF – Practice guide
evaluating ethics-related Programs and activities
CoNsIderatIoNs For aN audIt
oF ethICs
Given the range of components to ethics-related objec-
tives, programs, and activities, the CAE will need to deter-
mine which components to include in the internal audit
plan, based on assessment of applicable risk, the levels
of assurance required, the level of maturity of the ethics-
related programs, and the approach for conducting the
review(s). For example, the CAE may decide to review
the ethics program in its entirety or to undertake a rolling
program of reviews focusing on different aspects of the
ethics program over a number of years. Once the scope
and objectives of the audits are determined, the process
for conducting the reviews is the same as for any other
individual audit.
The Audit Process
The following summarizes the points raised throughout
this Practice Guide:
Planning
Review approved documents to gain an understanding of
the organization’s ethics programs, including:
• Applicable legislation (e.g., government directives to
public sector agencies).
• Organization structure of ethics and compliance
functions and reporting relationship to the board of
directors.
• Code of conduct/ethics for employees, agents, third-
party service providers, and suppliers.
• Annual/periodic reporting requirements to the board
of directors on compliance status of the codes of
conduct, violations, and corrective action plans.
• Annual attestation of compliance with the code of
conduct by the employees.
• Annual disclosure of conflict of interest filed by the
10 / www.globaliia.org/standards-guidance
employees and management resolutions.
• Mission statement.
• Strategic planning documents (including corporate
objectives) or values statements.
• Sales, customer service, lending, or investment poli-
cies.
• Employee-related documents such as individual
employee contracts, or collective bargaining agree-
ments.
• Induction procedures for new staff.
• Ethics policies for electronic media.
• Job descriptions for ethics coordinators.
• Results and action plans on periodic employee sur-
veys on ethics-related questions.
At this stage, if there have not been any recent employee
surveys, it may be appropriate to conduct one to gain an
understanding of the organization’s ethical culture and
highlight areas of concern/high risk and the control en-
vironment.
As discussed earlier in this guide, due consideration
should also be given to pertinent IPPF elements such as
the Standards and related Position Papers, Practice Advi-
sories, and Practice Guides. The extent and timing of the
use of these materials will be dependent on the scope, ob-
jectives, and issues arising throughout the internal audit
review. It will also be useful for the audit team to review
best practices on implementing and auditing ethics-relat-
ed programs as well as breaches reported in the news.
Assess Risks and Controls
Using the information gathered in the planning phase,
assess the risks associated with the organization’s ethics
programs.
• Identify inherent risks.
• Based on the documented policies and procedures,
identify whether controls are designed to effectively

evaluating ethics-related Programs and activities
mitigate identified risks.
• Based on the results of the employee survey, identify
areas for further review. For example, management
actions do not appear to meet the expected tone-
at-the-top; there are gaps between documented
controls and actual practices.
• Develop a test plan to provide adequate levels of as-
surance in accordance with the scope and objectives
of the review.
Undertake Testing
There is a range of tools and techniques that may be
used to test the organization’s ethics program. This is an
area likely to be more sensitive and emotive than other
audit topics so the approach should be tailored with this
in mind. The need for confidentiality and sensitivity is
heightened.
Keeping in mind Standard 2110.A1, audit testing would
likely focus on the following areas, whether in a compre-
hensive audit or at various stages of a rolling audit pro-
gram:
Design
The design of the organization’s ethics-related objectives,
programs, and activities will have been identified dur-
ing the planning phase of the review. While a high-level
risk assessment will have been undertaken of the design,
detailed assessment should now be undertaken. As with
other audits, the most significant issues are often related
to weaknesses in design. These may include:
• Applicability of the code of conduct (e.g., who has
to comply: the board of directors, employees, joint
venture employees, agents, third-party service pro-
viders, suppliers?).
• Comprehensive coverage of the code of conduct
(e.g., does the code cover: integrity in the work-
place, such as compliance with health and safety
IPPF – Practice guide
regulations, disclosure of conflicts of interest, integ-
rity of information and use of company properties,
litigation and investigations; integrity in the market-
place, such as gifts, entertainment, and gratuities,
fair competition, insider trading; and integrity in
society, such as avoiding inappropriate payments to
government officials and compliance with export
regulations; integrity toward the environment, such
as compliance with environmental principles and
regulations; accountability for compliance; and pen-
alties for violations?).
Implementation
The focus of this testing will likely be dependent on the
maturity level of the organization’s ethics-related objec-
tives, programs, and activities (e.g., it may not be possible
to assess the effectiveness of the communications plan
of an immature ethics program). However, areas of focus
may include:
• The communications plan (e.g., have communica-
tions been made as designed, to the intended audi-
ence, and at the right frequency?).
• Training/awareness programs (e.g., how many
employees have attended? How did they rate the
training?).
• Processes for raising concerns within assigned areas
and escalation processes to management outside the
reporting chain.
• Processes for handling ethics-related issues (e.g., are
employees using the methods available for reporting
such issues? Are reported issues resolved?).
• The process for attesting compliance by employees
(e.g., are employees required to attest their under-
standing of and compliance with the code of con-
duct?).
• The process for reporting and resolving conflicts of
interest (e.g., are employees required to disclose
potential and actual conflicts of interest? Is manage-
www.globaliia.org/standards-guidance / 11
IPPF – Practice guide
evaluating ethics-related Programs and activities

ment responsible for working with the employees to Reporting

resolve reported conflicts? Are there documented
approvals on conflict resolution?).
Effectiveness
Internal auditors should assess how successful the orga-
nization has been in achieving the objectives of its ethics-
related programs and activities. Testing in this area may
include:
As per the requirements of Standard 2440: Disseminating
Results, the CAE must consider the design of the report
and decide to whom and how it will be disseminated. As
stated earlier in this Practice Guide, because of its sen-
sitivity and because the ethical climate may not lend it-
self easily to a traditional audit rating system, a maturity
model may be the most effective form of reporting.

• A review of ethical issues reported by employees

(e.g., are actions taken to resolve issues appropriate?
Is retribution ever taken against those who report
issues?).
• A review of illegal or unethical acts discovered by
means other than employee reporting (e.g., is the
number of acts excessive? Is there a pattern indicat-
ing an underlying root cause?).
• An assessment of methods used to measure the ef-
fectiveness of the ethics-related programs and activi-
ties (e.g., how are they reported and to whom? Are
actions taken and lessons learned from this report-
ing?).
• A review of the results of the employee survey con-
ducted earlier (or at this stage if not conducted ear-
lier) and employee interviews that indicate whether
employees understand and are committed to the
organization’s ethics-related objectives.
• An assessment of the operating effectiveness of the
key controls — identified during the risk assessment
process — that serve to mitigate risks that impact
ethics-related programs.
• An assessment of the accuracy and comprehensive-
ness of periodic reports to the board of directors.

12 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

aPPeNdIX a:
Maturity Model 1
Examples of Audit Tools in Evaluating Ethics is a sensitive area that does not easily lend itself to
Organizational Ethics traditional audit rating systems. Rather than give an audit
This attachment presents three examples of audit tools opinion on ethics, it might be less inflammatory and more
that might be useful in evaluating organizational ethics. useful to assess the maturity of the various elements of
They are not the right tools to use for every organization. the ethical climate using a maturity model. The follow-
If used, they should only be used as starting points, with ing compliance and ethics program maturity model is an
appropriate tailoring to each organization. example.

attrIbute IMMature rePeatable deFINed Mature World Class

1. Code of Ethics (How • There is no formally
effectively does
the Code outline
management’s • In general, there
expectations
regarding ethical
conduct?)
• A comprehensive
• A Code of Ethics has • Outside counsel • Specific compli-
documented code of been developed,Code of Ethics ex- reviews the Code of ance policies are in
ethics. ists, was approved
but it may not be Ethics as appropri- place to support and
by the Board and is
comprehensive or ate to ensure it provide additional
are no other means current. reviewed every two remains current and guidance on key
of communicating • Experienced employ- to three years to appropriate. components of the
management’s ex- ees generally under- determine what up- • The Code of Ethics Code of Ethics.
pectations regarding stand management’s dates are needed. is reviewed annually • Periodic focus
ethical conduct. expectations regard- • All employees must and updated as nec- groups and/or sur-
ing ethical conduct, sign off annu- essary. veys are conducted
but new employees ally that they comply • All employees must with a representative
may not have any with the Code of complete annual sample of employees
way of determining Ethics. questionnaires that to assess their un-
those expectations. • New employees must ask more probing derstanding of the
sign a document questions regarding Code of Ethics and
asserting that they compliance with the their perceptions on
have read and un- Code of Ethics. level of compliance
derstand the Code. throughout the orga-
nization.

1
Excerpted from Copyright 2009, Internal Auditing: Assurance and Consulting Services, 2nd Edition, by The Institute of Internal Auditors Research Foundation, 247 Maitland Avenue,
Altamonte Springs, Florida 32701-4201 U.S.A. Reprinted with permission.

www.globaliia.org/standards-guidance / 13
IPPF – Practice guide
evaluating ethics-related Programs and activities

attrIbute IMMature rePeatable deFINed Mature World Class

2. Culture and • The organization • There are percep- • There are percep- • Compliance and • Periodic surveys or
Consistency seems indifferent to tions that compli- tions that senior ethics are topics at focus groups are
(How does the compliance. ance is important. management takes organization and conducted to assess
organization perceive • The program was • Program was de- compliance seriously department-level the perception of
management’s developed by very veloped to address and “walks the talk.” meetings, ensuring compliance culture
commitment to few individuals with legal ramifications of • The program was a consistent cultural and make adjust-
compliance?) no outside input. noncompliance. developed with input message. ments if needed.

• There are percep- • Discipline generally from Legal, Human • The program was • Periodic input is so-
tions of disciplinary is left to the discre- Resources, and In- developed with input licited from employ-
inconsistencies and tion of business and ternal Audit. from various em- ees to help improve
“playing favorites.” department manag- • Human Resources is ployee groups. the program.

• People are promoted ers and, as such, is consulted to make • Disciplinary deci- • Disciplinary actions
without formal con- not consistent. sure disciplinary ac- sions involve an ap- are reviewed by an
sideration of ethical • While ethical con- tions are appropriate propriate mix of Hu- independent group
conduct. duct seems to be and compliant with man Resources, Le- (e.g., Internal Au-
considered, it’s not a regulations. gal, and Compliance dit) to support the
• Noncompliance personnel to ensure consistency of such
events are typi- part of job descrip- • Job descriptions
tions. include expectations appropriateness and actions.
cally learned from consistency.
complaints versus • Noncompliance for ethical conduct. • People are recog-
monitoring or audit events generally are • Many employees • Job descriptions and nized for demon-
activities. reported timely, but raise compliance interviews formally strating ethical
there are few efforts questions before cover ethical con- conduct.
to report events they become a prob- duct. • Employees make
before they become lem. • Employees feel recommendations for
noncompliant. empowered to raise improving the com-
questions about pliance program.
compliance matters.

14 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

attrIbute IMMature rePeatable deFINed Mature World Class

3. Awareness (How • EEs generally are • EEs are aware pro- • There is widespread • Annual training • Communications
aware are employees aware that the pro- gram exists, went EE awareness of the reinforces the pro- occur on a regular
[EEs] and outside gram exists, but they through training program. gram, with individual basis to remind/
stakeholders of are not sure how once and intuitively • All EEs went through modules delivered in update employees
the compliance to get information know some, but not training in the last more depth. on program expecta-
program and its about it. all, requirements of three years. • EEs know who all of tions.
requirements?) • EEs aren’t familiar the program. the risk area officers • The program is part
• EEs know who the
with specific require- • EEs know who the chief compliance of- are and generally of external sustain-
ments. chief compliance ficer and compliance understand the re- ability reporting
• EEs don’t know offi cer and/or com- manager are. sponsibilities of each conducted annually.
who the compliance pliance manager are, risk area.
manager or risk area but not the risk area • EEs know about
officers. the risk area officer • Compliance with the
officers are. positions, and may program and ethical
• Stakeholders know • Stakeholders as- know one or two if expectations are
nothing about the sume a program ex- they work with them, covered in contracts
program. ists, but don’t know but they don’t know with vendors.
anything about it or most of them.
where to get infor-
mation. • Stakeholders are
aware the program
exists and can find
references on the
company website.

www.globaliia.org/standards-guidance / 15
IPPF – Practice guide
evaluating ethics-related Programs and activities

attrIbute IMMature rePeatable deFINed Mature World Class

4. Structure and • There is no formal • A compliance of- • A compliance struc- • Reporting by risk • An integrated moni-
Accountability compliance struc- ficer has been ture has been estab- area officers to the toring plan has been
(How effective ture. designated, but the lished, with account- compliance manager implemented that
is the structure • Independent over- responsibilities of ability assigned to is timely and consis- involves the compli-
for managing sight is nonexistent the position are not risk area officers. tent. ance manager, risk
the program or ad hoc. well-developed. • Oversight is defined • The applicable Board area officers, and
and enforcing • Oversight and moni- from a senior man- committee receives Internal Audit.
accountability?) • Accountability is not
defined. toring are inconsis- agement and board quarterly updates on • Sensitive or signifi-
tent and reactionary. perspective. compliance matters. cant investigations
• Investigations are ad are conducted in
hoc. • Accountability is • Monitoring is es- • Internal Audit has a
broadly understood tablished, including consistent plan for accordance with the
• Compliance risks are but not formally Internal Audit and auditing all compli- protocol by individu-
not understood. documented. others. ance risks. als trained in foren-
sic and investigation
• Investigations are • There is a focal point • A formal inves- techniques.
typically conducted for determining who tigation protocol
by appropriate per- should conduct in- outlines appropriate • Compliance risk
sonnel. vestigations. resources to use scenarios have been
(internal vs. exter- identified, assessed,
• Compliance risks are • Compliance risks and mapped to com-
generally understood and scenarios are nal), documentation
requirements, and pliance controls and
but not formally documented. are updated at least
documented. how investigations
are closed. annually.

• A formal compliance
risk assessment has
been completed.

16 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

attrIbute IMMature rePeatable deFINed Mature World Class

5. Process Automation • There are no formal • There are some com- • Compliance controls • Compliance controls • The company has
and Integration compliance controls pliance controls and and procedures are and procedures are established an inte-
(How effectively are or procedures, procedures, but they well-documented an integral part of grated GRC program
compliance controls although many em- are not consistent and standardized business processes. that ensures compli-
and processes ployees know intui- across the organi- across the organiza- • Many compliance ance risks are man-
standardized, tively how to act. zation or formally tion. controls address key aged consistent with
integrated, and • There is no formal documented. • Compliance controls compliance risks the organization’s
automated?) protocol for employ- • There is limited test- and procedures are as part of a gov- risk appetite.
ees or outsiders to ing of the controls tested periodically ernance, risk, and • Event management
report suspected and procedures in to identify gaps or compliance (GRC) software is used to
noncompliance place. weaknesses. view of the program. ensure all key data
events. • Employee generally • An external hotline • There are multiple is gathered and the
• Information/data re- understand that they is in place to which avenues through resolution of events
lated to compliance can contact Legal or employees or out- which employees or is documented in a
is not available. Human Resources if siders can report outsiders can report complete and con-
they suspect a non- suspected noncom- suspected noncom- sistent manner.
compliance event. pliance events. pliance events, and • GRC software is
• Information/data re- • Some compliance all follow a consis- used to provide in-
lated to compliance controls are inte- tent protocol for tegrated information
events is difficult to grated with other gathering informa- on the program.
compile. business processes tion on the event and • Integrated technol-
and automated to escalating it. ogy routines are run
the extent existing • A consistent test on a regularly sched-
systems supports it. plan is used to uled basis to prevent
• Some standard re- ensure compliance or detect timely
ports are prepared controls and proce- potential compliance
related to compli- dures operate effec- events.
ance events. tively.
• Technology is used to
aid in the identifica-
tion and investiga-
tion of compliance
events.

www.globaliia.org/standards-guidance / 17
IPPF – Practice guide
evaluating ethics-related Programs and activities

attrIbute IMMature rePeatable deFINed Mature World Class

6. Goals and Metrics • No formal goals or • While goals and • Broad compliance • Specific compliance • All employees have
(How is success metrics exist or are metrics are not for- goals are established goals are integrated individual compli-
of the compliance contemplated. malized, employees and communicated. into the annual goal ance goals.
program measured?) generally understand • Broad metrics ex- setting process for • Metrics are integrat-
that the absence of ist to measure the each risk area. ed into the overall
compliance events is nature and frequency • Metrics are estab- performance mea-
indicative of a suc- of compliance lished for each risk surement process.
cessful program. events. area.

18 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

Entitywide Employee Survey 2 The following is an example of a survey some internal au-
The ethical climate is not always what executives or the ditors have used effectively. It is not focused exclusively
board want it to be or think it is. The ethical climate is on the ethical climate. Instead, the ethical issues are em-
what employees experience. Therefore, an entitywide sur- bedded into a broader survey.
vey should provide a reasonably accurate measure of the
ethical climate. By identifying gaps between the desired
and actual ethical climate, a survey can lead to action
plans to bridge those gaps and thereby add great value to
the organization.

YOUR DEPARTMENT _________________________

In what state is your office located? ........................................... IL IN MI OH WI OTHER

SAMPLE ENTITYWIDE EMPLOYEE SURVEY

(PLEASE CIRCLE THE ONE RESPONSE THAT BEST DESCRIBES YOUR REACTION TO EACH STATEMENT.)
KEY: SA = Strongly Agree A = Agree D = Disagree SD = Strongly Disagree DK = Don’t Know

SECTION I: Company Culture

The company culture sets the tone of an organization, influencing the control consciousness of its people. It is the founda-
tion for all other components of internal control. (PLEASE CIRCLE ONE FOR EACH.)
1. Senior management of my business unit demonstrates high ethical standards. SA A D SD DK

2. Senior management of my business unit strives to comply

with laws/regulations affecting the company. SA A D SD DK

3. My supervisor complies with laws/regulations affecting the company. SA A D SD DK

4. The performance targets in my work unit are realistic and obtainable. SA A D SD DK

2
Excerpted from Copyright 2010, Best Practices: Evaluating the Corporate Culture, by The Institute of Internal Auditors Research Foundation, 247 Maitland Avenue, Altamonte Springs, Florida
32701-4201 U.S.A. Reprinted with permission.

www.globaliia.org/standards-guidance / 19
IPPF – Practice guide
evaluating ethics-related Programs and activities

5. Employees in my work unit have the knowledge, skill,

and training to perform their job adequately. SA A D SD DK

6. My business unit learns from its mistakes. SA A D SD DK

7. Personnel turnover has not impacted my work unit’s

ability to effectively perform its function. SA A D SD DK

8. Integrity of financial and operational results always

takes priority over reporting acceptable performance targets. SA A D SD DK

9. Employees in my work unit are treated fairly and justly. SA A D SD DK

10. Employees in my work unit do not have to take

unnecessary safety risks to perform their job. SA A D SD DK

11. If you disagree/strongly disagree with any of the above questions on Company Culture,
why do you feel this way?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

SECTION II: Goals and Obstacles

Organizations identify and analyze potential obstacles to the achievement of their goals to determine how to manage these
obstacles. (PLEASE CIRCLE ONE FOR EACH.)
12. For the coming year, I am accountable for defined, measurable objectives. SA A D SD DK

13. I have sufficient resources, tools, and time to accomplish my objectives. SA A D SD DK

14. In my department, we identify barriers and obstacles and

resolve issues that could impact achievement of objectives. SA A D SD DK

20 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

15. In my department, the processes supporting new products, services,

technology, and other significant changes are adequately managed. SA A D SD DK

16. My business unit adequately considers customer impacts

in its decisions and actions. SA A D SD DK

17. If you disagree/strongly disagree with any of the above questions on Goals and Obstacles,
why do you feel this way?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

18. In your opinion, what are the primary business/financial risks facing your business unit?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

SECTION III: Policies and Procedures

Policies, procedures, and other safeguards help ensure that objectives are accomplished.
(PLEASE CIRCLE ONE FOR EACH.)

19. The policies and procedures in my work unit allow me to do my job effectively. SA A D SD DK

20. Employees who steal from the company (physical property, money, information,
time) will be discovered. SA A D SD DK

21. Employees who steal from the company and are discovered
will be subject to appropriate consequences. SA A D SD DK

22. Employees who break laws and regulations affecting

the company will be discovered. SA A D SD DK

23. Employees who break laws and regulations affecting the company
and are discovered will be subject to appropriate consequences. SA A D SD DK

www.globaliia.org/standards-guidance / 21
IPPF – Practice guide
evaluating ethics-related Programs and activities

24. If you disagree/strongly disagree with any of the above questions on Policies and Procedures,
why do you feel this way?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

SECTION IV: Information and Communication

Pertinent information must be identified, captured, and communicated in a form and time frame that enables people to
carry out their responsibilities. (PLEASE CIRCLE ONE FOR EACH.)

25. Our information systems provide management with timely

reports on my unit’s performance relative to established objectives. SA A D SD DK

26. Mechanisms and incentives are in place for me to provide

recommendations for process improvements. SA A D SD DK

27. The interaction between senior management and my work

unit enables us to perform our jobs effectively. SA A D SD DK

28. The communication across departmental boundaries within

my business unit enables us to perform our jobs effectively. SA A D SD DK

29. The communication across business unit boundaries enables

people to perform their jobs effectively. SA A D SD DK

30. I have sufficient information to do my job. SA A D SD DK

31. Senior management at XXX Corporate is informed and aware

of my business unit’s actual performance. SA A D SD DK

32. A communication channel exists for reporting suspected improprieties. SA A D SD DK

22 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

33. Persons who report suspected improprieties are protected from reprisal. SA A D SD DK

34. If I report wrongdoing to my supervisor, I am confident

that the wrongdoing will stop. SA A D SD DK

35. If you disagree/strongly disagree with any of the above questions on Information and Communications,
why do you feel this way?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

SECTION V: Evaluation and Feedback

Through evaluation and feedback processes, an organization assesses, tracks, and monitors its performance over time.
(PLEASE CIRCLE ONE FOR EACH.)

36. Information reported to senior management reflects

the actual results of operations in my work unit. SA A D SD DK

37. I have enough information to monitor vendor performance. SA A D SD DK

38. I have enough information to monitor customers’ satisfaction

or dissatisfaction (either internal or external). SA A D SD DK

39. External and/or internal customer feedback and complaints

are followed up timely and effectively. SA A D SD DK

40. The quality of output in my work unit is measurable. SA A D SD DK

41. Employees in my work unit know what actions to

take when they find mistakes or gaps in performance. SA A D SD DK

42. My supervisor reviews my performance with me at appropriate intervals. SA A D SD DK

43. I know what action to take if I become aware of unethical or fraudulent activity. SA A D SD DK

www.globaliia.org/standards-guidance / 23
IPPF – Practice guide
evaluating ethics-related Programs and activities

44. If you disagree/strongly disagree with any of the above questions on Evaluation and Feedback,
why do you feel this way?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

45. I suspect/know that fraudulent activity is occurring in my work place. YES NO

If question 45 is answered YES, please complete the following.

45A. What is the activity referred to in question 45?

_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

45B. Did you report it? Yes / No (Please circle)

45C. If no, why not?

_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

(NOTE: If you wish to report any fraud, you may call the XXX Integrity Line at 1-800/xxx-xxxx)

24 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

Audit Project Employee Survey 3
As noted above, operating managers create ethical sub-
climates within their own areas by their own words and
actions. The sub-climate might not be consistent with the
broader climate, so using an employee survey on each au-
dit project can also add value. The following brief survey is
used by a university on every audit project, and the results
are reported in every audit report. Local management is
asked if they want to add any statements to the survey to
get feedback on issues of concern to them.

Employee Survey
“Management” refers to the department head/director and his/her leadership team if you work in an academic de-
partment or center, or to the dean and his/her leadership team if you personally work in or directly report to a dean
or dean’s office.
Strongly Agree Disagree Strongly N/A
Agree Disagree
1. Management demonstrates the importance of
integrity and ethical behavior to its employees. SA A D SD N/A
2. Management is open to employee suggestions to improve
productivity and quality. SA A D SD N/A
3. Management sometimes overrides university policies,
procedures, or work place rules (e.g., takes shortcuts
that are contrary to policy). SA A D SD N/A
4. Management has the right knowledge, skills,
and training to effectively perform its duties. SA A D SD N/A
5. Nonmanagement (support) staff has the right knowledge,
skills, and training to effectively perform its duties. SA A D SD N/A
6. Management effectively monitors and provides oversight
and direction for the activities in my unit. SA A D SD N/A
7. Management is concerned with and responsive to customer
feedback or suggestions. SA A D SD N/A
8. I understand workplace policies and rules and have an
effective resource for obtaining clarification of policies
when needed. SA A D SD N/A
9. Management has not effectively communicated my job duties
and responsibilities to me. SA A D SD N/A

3
Excerpted from Copyright 2010, Best Practices: Evaluating the Corporate Culture by The Institute of Internal Auditors Research Foundation, 247 Maitland Avenue, Altamonte Springs, Florida
32701-4201 U.S.A. Reprinted with permission.

www.globaliia.org/standards-guidance / 25
IPPF – Practice guide
evaluating ethics-related Programs and activities

10. Management would take appropriate corrective action if

policy, procedure, or workplace rule violations were detected. SA A D SD N/A
11. I would be protected from retaliation if I report a
suspected violation. SA A D SD N/A
12. I am familiar with how to report violations of law or
policy, including the university’s confidential reporting line. SA A D SD N/A

Would you like to tell us anything else about the operations of your (college, department, center, or other term as
appropriate)?
_________________________________________________________________________________________
_________________________________________________________________________________________
_________________________________________________________________________________________

NAME (optional) ____________________________________

26 / www.globaliia.org/standards-guidance

evaluating ethics-related Programs and activities
aPPeNdIX b:
Pertinent Strongly Recommended Guidance
Pertinent Position Papers
Position Papers assist a wide range of interested parties,
including those not in the internal audit profession, in
understanding significant governance, risk, and control is-
sues and delineating related roles and responsibilities of
internal auditing. Refer to:
Position Paper “The Role of Internal Auditing in Enter-
prise-wide Risk Management” (January 2009)
Pertinent Practice Advisories
Practice Advisories assist internal auditors in applying the
Definition of Internal Auditing, the Code of Ethics, and
the Standards and promoting good practices. Practice Ad-
visories address internal audit’s approach, methodologies,
and consideration, but not detailed processes or proce-
dures. They include practices relating to international,
country, or industry-specific issues; specific types of en-
gagements; and legal or regulatory issues.
PA 2010-1: Linking the Audit Plan to Risk and Exposures
(January 2009)
PA 2010-2: Using the Risk Management Process in Inter-
nal Audit Planning (July 2009)
PA 2050-1: Coordination (January 2009)
PA 2050-2: Assurance Maps (July 2009)
PA 2050-3: Relying on the Work of Other Assurance Pro-
viders (October 2010)
PA 2060-1: Reporting to Senior Management and the
Board (May 2010)
PA 2110-1: Governance: Definition (April 2010)
IPPF – Practice guide
PA 2110-2: Governance: Relationship With Risk and
Control (April 2010)
PA 2110-3: Governance: Assessments (April 2010)
PA 2120-1: Assessing the Adequacy of Risk Management
Processes (January 2009)
PA 2130-1: Assessing the Adequacy of Control Processes
(January 2009)
PA 2130.A1-1: Information Reliability and Integrity (Jan-
uary 2009)
PA 2240-1: Engagement Work Program (January 2009)
PA 2400-1: Legal Considerations in Communicating Re-
sults (May 2010)
PA 2440-1: Disseminating Results (January 2009)
PA 2440-2: Communicating Sensitive Information With-
in and Outside the Chain of Command (May
2010)
PA 2440.A2-1: Communications Outside the Organiza-
tion (May 2010)
Pertinent Practice Guides (PGs)
Practice Guides provide detailed guidance for conducting
internal audit activities. They include detailed processes
and procedures, such as tools and techniques, programs,
and step-by-step approaches, as well as examples of de-
liverables.
PG External Business Relationship (May 2009)
PG Internal Auditing and Fraud (December 2009)
PG GTAG – 13 Fraud Prevention and Detection in an
Automated World (December 2009)
www.globaliia.org/standards-guidance / 27
IPPF – Practice guide
evaluating ethics-related Programs and activities

PG Evaluating Corporate Social Responsibility/Sustain-

able Development (February 2010)

PG Auditing Executive Compensation and Benefits (April

2010)

PG Auditing the Control Environment (April 2011)

PG Coordinating Risk Management and Assurance

(March 2012)

PG Maturity Model (TBD)

PG Organizational Governance (TBD)

28 / www.globaliia.org/standards-guidance
 IPPF – Practice guide
evaluating ethics-related Programs and activities

authors:
Stephen Linden, CPA
Angelina Chin, CIA, CCSA, CRMA
James Roth, Ph. D., CIA, CCSA, CRMA
David Zechnich, CIA, CPA
Susan L. Rudolph

reviewers:
Steve Jameson, CIA, CCSA, CFSA, CRMA

www.globaliia.org/standards-guidance / 29
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120954
 IPPF – Practice Guide

Formulating and Expressing

Internal Audit Opinions
March 2009
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

Table of Contents
1. Executive Summary..................................................................................................1

2. Introduction.............................................................................................................1

3. Planning the Expression of an Opinion.....................................................................2

3.1 Expressing an Opinion......................................................................................2

3.2 Scope of Opinions.............................................................................................3

3.3 Establishing Suitable Criteria for the Opinion...................................................4

4. Scope of Work..........................................................................................................5

4.1 Evaluation of Results........................................................................................6

5. Use of Grades in Expressing an Opinion...................................................................6

5.1 Use of Negative (Limited) Assurance Opinion and “Informal” Opinions............7

5.2 Reliance on the Work of Others When Supporting an Opinion...........................7

5.3 Guidance From Regulators and Other Standard Setters...................................8

5.4 Other Legal Considerations..............................................................................8

Appendix A: Examples: Risk Ratings or Rankings.........................................................9

Appendix B: Examples: Micro and Macro Audit Opinion (Grading)..............................11

Appendix C: Macro-level Opinion (Example)...............................................................13

Appendix D: Related IPPF Guidance............................................................................14

www.theiia.org/guidance / B

1. Executive Summary
Nature of this Guidance: This document provides practi-
cal guidance to internal auditors who wish to form and
express an opinion on some or all of an organization’s gov-
ernance, risk management, and internal control systems.
This guidance is not intended to represent all of the con-
siderations that may be necessary. Some of the related In-
ternational Standards for the Professional Practice of Inter-
nal Auditing (Standards) and other guidance documents
related to this topic are provided in Appendix D.
Applicability
This guidance may be applicable to and useful for:
• Chief audit executives (CAEs).
• Boards.
• Executive and operating management.
• Other assurance providers (OAPs).
• Other professional and regulatory bodies.
Background
Internal auditors are being asked by the board, manage-
ment, and other stakeholders to provide opinions as part
of each individual audit report as well as on the overall
adequacy of governance, risk management, and control
within the organization. These requests may be for an as-
surance or opinion at a broad level for the organization as a
whole (macro-level opinion) or on individual components
of the organization’s operations (micro-level opinion).
Examples of macro- and micro-level opinions include:
• An opinion on the organization’s overall system of in-
ternal control over financial reporting (macro).
• An opinion on the organization’s controls and proce-
dures for compliance with applicable laws and regula-
tions, such as health and safety, when those controls
and procedures are performed in multiple countries
or subsidiaries (macro).
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
• An opinion on the effectiveness of controls such as
budgeting and performance management, when such
controls are performed in multiple subsidiaries and
coverage comprises the majority of the organization’s
assets, resources, revenues, etc. (macro).
• An opinion on an individual business process or activ-
ity within a single organization, department, or loca-
tion (micro).
• An opinion on the system of internal control at a sub-
sidiary or reporting unit, when all work is performed
in a single audit (micro).
• An opinion on the organization’s compliance with
policies, laws, and regulations regarding data privacy,
when the scope of work is performed in a single or just
a few business units (micro).
2. Introduction
The need for audit opinions and the ability of internal au-
diting to express them depends on several circumstances,
including understanding the needs of stakeholders; de-
termining the scope, nature, timing, and extent of audit
work required; ensuring there are sufficient resources to
complete the work; and assessing the results of the work
performed.
Stakeholder requirements for internal audit opinions, in-
cluding the level of assurance required, should be clari-
fied by the CAE with senior management and the board.
Discussions with stakeholders may include:
• The value of the opinion to the stakeholders, includ-
ing (where appropriate) why it is being requested.
• The timing for issuance and type of the opinion(s).
• The form of opinion to be provided (e.g., written or
verbal).
• The level of assurance to be provided.
• The period or point in time the opinion covers.
www.theiia.org/guidance / 1

• The scope of the opinion sought (e.g., whether it
should be limited to financial reporting, operational
controls, or compliance with specified regulations).
• The criteria used in expressing opinions.
• The rating process to be applied in relation to indi-
vidual audit findings.
• Potential users of the assurance beyond management
and the board.
When issuing internal audit opinions, the CAE considers
the potential impact to the organization if the report is
likely to be distributed to outside users. In such circum-
stances it would be appropriate to consult legal counsel,
particularly if “privileged information” is an important
factor.
3. Planning the Expression of
an Opinion
In developing audit plans to support the expression of an
opinion, there are a number of factors that the internal
audit activity needs to consider. These include:
• The unique characteristics of macro-level versus
micro-level opinions. Macro opinions generally
are based on the results of multiple audit projects,
whereas micro opinions are typically based on the
results of a single audit project or a few projects per-
formed over a limited period of time.
• The nature of the opinion to be provided; specifically,
whether positive or negative assurance will be issued.
In general, more evidence and a broader scope of
work are required for a positive assurance opinion.
• The purpose and use of any special requests where
an opinion will be rendered.
• The nature and extent of audit evidence needed to
support the opinion to be provided and the time pe-
riod required to perform the work. This is especially
3.1 Expressing an Opinion
It is not uncommon for the internal audit activity to pro-
important for macro opinions, where the opinion may
vide opinions at both macro and micro levels, including
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
require multiple projects to be completed.
• Discussion and agreement with stakeholders (typi-
cally senior management and the board) on the cri-
teria that will be used in determining the opinion to
be provided.
• The need for careful planning and development of
an audit plan and approach that will provide the in-
ternal audit activity with sufficient, relevant evidence
to support the opinion. This approach may include
aggregating the results of previously completed au-
dits to support the opinion, or identifying areas of sig-
nificance and risk where audit evidence will need to
be completed or obtained to support the expression
of the planned internal audit opinion. In addition,
where multiple projects will be required to provide
the opinion, these projects should be identified and
included in the internal audit plan.
• The consideration of all related, planned projects (in-
cluding reliance on the work of others or self-assess-
ments), and allowing time for the final assessment.
For example, rendering an opinion on inventory con-
trols in a global organization (e.g., audits in 30 inter-
national locations) will require extensive planning on
scope coverage and the time to complete the work
before an opinion can be rendered.
• Whether there are adequate resources and skills to
perform all the work required to provide sufficient
support for the opinion. If not, a determination is
made whether to decline to express the opinion, or
to qualify the opinion (by excluding certain areas or
risks from the scope of the opinion).
• Discussions with management and communication
of the internal audit plan, including the timing and
scope of each project and the criteria that will be
used in determining the opinion to be provided to
management and, if appropriate, the board.
www.theiia.org/guidance / 2

an opinion on the overall adequacy of the organization’s
policies, procedures, and processes to support gover-
nance, risk management, and internal controls. When
rendered, such opinions are generally in writing and will
be of the highest value if they take the form of “positive as-
surance,” sometimes referred to as “reasonable assurance”
opinions. The CAE is in the best individual to provide
macro opinions given his or her position to obtain a perva-
sive overview of micro-level audit results.
Positive assurance (reasonable assurance) provides the
highest level of assurance and one of the strongest types
of audit opinions. In providing positive assurance, the
auditor takes a definite position, which may be binary in
nature; for example, that internal controls are or are not
effective in the situation or that risks are or are not being
effectively managed.
Variations in expressing a positive assurance opinion may
include the use of grades, where the effectiveness of in-
ternal controls or risk management is rated using a grad-
ing system. Common examples of a grading system in-
clude the use of color coding (such as red-yellow-green)
or the use of a grading scale (such as 1 to 4). When such
scales are used, they should have an agreed-upon and
commonly understood meaning within the organization.
More guidance on the “Use of Grades” is provided in the
Appendices.
The expression of the opinion may also include informa-
tion about the direction of the opinion since a previous
audit. For example, the opinion may indicate that controls
or risk management are satisfactory, but their effective-
ness may have diminished since the prior audit period.
A positive assurance opinion requires the highest level of
evidence. It implies not only whether controls/risk miti-
gation processes are adequate and effective, but also that
sufficient evidence was gathered to be reasonably certain
that evidence to the contrary, if it exists, would have been
identified. The auditor takes full responsibility for the
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
sufficiency of the audit procedures to find what should
have been reasonably found by a prudent auditor.
Positive assurance opinions provide the reader a high level
of confidence and comfort in the reliability of the underly-
ing information. As such, internal audit activities are often
requested to provide such positive assurance opinions.
An opinion can be qualified which may be useful in situ-
ations where there is an exception to the general opinion.
For example, the opinion may indicate that controls were:
“Satisfactory with the exception of accounts payable con-
trols, which require significant improvement.”
3.2 Scope of Opinions
CAEs may be requested to render opinions at an overall
level (macro) or on an individual audit assignment level
(micro). The following highlights distinctions between
the two.
Macro Level
While macro-level opinions are issued or provided at a
point in time (e.g., on an annual basis), the supporting
audit evidence is generally built-up over a period of time
and based on the results of several audit assignments,
work performed by others, and informal evidence. A mac-
ro-level opinion may evolve or change as the individual
assignments are completed and additional audit evidence
(including findings/exceptions) is obtained.
When expressing a macro opinion, the CAE considers
several factors:
• The purpose for which the opinion will be used.
• Whether the opinion can be rendered based on the
audit period and testing timelines.
• A clear understanding of what the organization con-
siders “overall” satisfactory performance.
• The organization’s risk appetite and the criteria for the
opinion.
• The sufficiency of audit work and audit evidence (in-
cluding the work of others and informal evidence) to
support the opinion requested.
www.theiia.org/guidance / 3

On occasion, internal auditing may not be able to obtain
sufficient evidence (e.g., because of resource limitations)
to support all the areas covered by a macro opinion. As a
result, only a limited macro opinion may be possible; for
example, an opinion on compliance with environmental
regulations may be limited by excluding an assessment
with regulations governing waste disposal. The potential
for a limited opinion should be recognized as part of the
planning process, so that stakeholders understand the
opinion will be limited.
Expressing an opinion at the macro level can be a complex
task. It may require establishing methodologies and plan-
ning for:
• Aggregation and interpretation of findings from sev-
eral audits, some of which may have been completed
months before the opinion date. In such circumstanc-
es the CAE will have to exercise due care to ensure
consistent standards have been used in all audits to
assess any findings and to draw conclusions. In ad-
dition, follow-up on remedial action and subsequent
events to the earlier audit should be considered.
• Methodologies for incorporating audit evidence de-
veloped through less formal means. This may occur
since macro opinions are generally pervasive in na-
ture and require a greater breadth of coverage. As
such, reliance on other types of assurance processes
may be required. For example, the results of manage-
ment self-assessments and the consideration of in-
formal evidence (i.e., evidence that is not specific to
an audit engagement) from different sources might
be utilized if the auditor believes them to be reliable.
Informal evidence may include the subjective assess-
ment of internal auditing (e.g., based on visits to lo-
cations and observations of operations), but reliance
on such evidence may be disclosed when expressing
the macro opinion.
• Consideration of evidence that may have been ob-
tained through reliance on the work of others. This
may include, for example, a review of the work of
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
various quality assurance groups within the organiza-
tion or work completed to meet regulatory require-
ments, each of which may have been performed us-
ing different or varying assurance methodologies. In
such situations, it is imperative that the CAE evalu-
ates the risk associated with utilizing the work of
others and consider explaining this when expressing
an opinion.
Micro Level
Opinions at the micro level are generally the result of an
individual audit assignment. Such an assignment may be
in relation to controls around a specific process, risk, or
business unit. The formulation of such opinions requires
consideration of the audit findings and their respective
ratings.
Micro opinions are typically less complex than macro
opinions. Recent surveys indicated that most audit or-
ganizations throughout the world issue micro-level audit
opinions, using a rating/grading system as part of express-
ing their overall opinion. However, it was also noted that
many audit organizations have not developed a formal cri-
teria framework against which to draw their conclusions.
In some organizations, where the auditor provides macro
opinions on risks and the organization as a whole, indi-
vidual assignment-level (micro) opinions may not be as
important to senior-level stakeholders or the board be-
cause they are mostly concerned with the overall macro
opinion. In such instances, it is particularly important to
manage stakeholder expectations below this senior level
since stakeholders responsible for the audited areas will
typically expect a report and an opinion on completion of
the specific assignment.
3.3 Establishing Suitable
Criteria for the Opinion
Auditors should have a means of measuring or judging the
results and impact of matters identified on an audit. This
can be achieved through the development of a criteria
www.theiia.org/guidance / 4

framework. Suitable criteria are factors that are relevant
and appropriate to the particular characteristics of the au-
dited organization and against which actual outcomes can
be objectively assessed. They focus, wherever possible, on
the results expected to be achieved by systems of internal
controls and ideally are established before the execution
of the overall audit plan. These criteria should be relevant,
reliable, neutral, understandable, and complete. For ex-
ample, the aggregate of the observations allows the audit
team to form a conclusion against each audit objective
or on a process or function taken as a whole. The CAE
ensures there is an evaluation framework for this process.
As part of the planning process, the basis for the opinion is
discussed with various stakeholders using the criteria and
evaluation framework. This includes discussing specific
objectives with key process owners, senior executives, and
other stakeholders, including the board, as appropriate.
It is important that management within audited organiza-
tions understand and accept these criteria and how they
could impact them and their responsibility in relation to
maintaining a strong internal control environment.
In establishing suitable criteria, it is important for
the internal audit activity to determine whether the or-
ganization has established basic principles as to what
constitutes appropriate governance, risk management,
and control practices. This would include:
• A clear articulation of the definition of control adopt-
ed or used by the organization; for example, has the
organization adopted the COSO or CoCo model?
• Management’s understanding of what would con-
stitute a satisfactory level of control. For example,
satisfactory could mean that 90 percent (or another
acceptable percentage) of transactions within one
control objective are conducted in accordance with
established control procedures; alternatively, it could
also mean that 85 percent (or another acceptable per-
centage) of overall controls are working as intended.
• A clear articulation by management of its risk toler-
ances or appetite, including materiality thresholds.
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
Such key corporate principles provide an agreed-upon
framework against which conclusions can be reached and
an opinion expressed in a manner that is mutually under-
stood by management and the internal auditors.
In the absence of such principles, it is recommended
that internal auditing should not render an opinion, since
there is no frame of reference to objectively support the
internal auditor’s conclusion.
4. Scope of Work
The nature and form of the opinion expressed depends
on the scope of work performed and audit evidence gath-
ered. A key step in developing the scope is to design an
audit plan that will result in sufficient, appropriate audit
evidence that will allow the auditor to draw a conclusion
on the results of audit work performed. When discuss-
ing the plan with key stakeholders, the CAE articulates
precisely what is included within the scope of work and
type of opinion to be rendered. This is important to com-
municate to key stakeholders to avoid confusion, partic-
ularly around macro-level opinions.
Consideration of the appropriateness of audit scope
is required for both micro- and macro-level opinions.
However, with macro opinions this becomes more com-
plex. Whether a macro-level opinion on governance, risk
management, and control is possible will depend on the
completeness of the audit universe and the auditor’s cov-
erage of the universe. The expression of a macro-level
opinion may take longer to complete as a result of the
extent of work that will need to be completed and the
need to aggregate the results of several individual audits
that collectively will support the macro-level opinion.
Common elements included in defining the scope over
which the opinion applies are:
• Descriptions of the portions of the organization
being covered, whether the scope is defined as the
organization as a whole or just specific components
www.theiia.org/guidance / 5

of the organization, high level risks (e.g., competitor
actions), or risk categories (e.g., credit risk).
• Control components covered by the audit; that is, the
specific financial, operational, or compliance con-
trols being addressed (e.g., specifically stating that
the opinion relates to design processes, performance
objectives, documentation requirements, financial re-
sults, etc.).
• The point of time or the time period over which the
opinion is expressed.
4.1 Evaluation of Results
An important step in the planning process is the estab-
lishment of a methodology that will be followed to evalu-
ate the results of audit work completed. This may involve
assessing and rating individual audit findings and their
significance relative to the individual project, individual
risks/risk categories, or the organization as a whole.
The following elements should be considered:
Materiality – The magnitude or significance of a key
business objective that is fundamental to the opinion is
important. The internal auditor should consider the mag-
nitude of the residual risk that a business objective will
not be achieved.
Impact – The implication of audit issues/findings are
considered and fully understood in the context of the
opinion to be given (i.e., micro versus macro). An audit
opinion may be given a different level of importance using
the same rating criteria depending on the impact to the
organization. For example, some issues may have a materi-
al impact on the achievement of goals or mitigation of risks
at a micro level, but not at a macro level (e.g., the failure to
manage potential duplicate payments may be material to a
subsidiary but not to the organization as a whole).
Another factor to be considered when rating the adequacy
of controls in a macro opinion is rating the level of risks
provided by the controls in place so that management’s
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
objectives will be achieved. (Examples of risk ratings are
presented in Appendix A.)
5. Use of Grades in Expressing
an Opinion
It is common for internal audit activities to use a grading
system when issuing audit reports.
When using a grading system to communicate a positive
assurance opinion, care must be taken with wording, par-
ticularly around defining “waterlines” such as adequate or
inadequate. Wording should be clear and appropriately
defined for the reader. Using general terms such as sat-
isfactory, effective, or unsatisfactory may not sufficiently
define the meaning. The organization needs to have a
clear, common understanding of these terms and what
constitutes an acceptable level of performance, all of
which require a frame of reference. For example, the term
effective usually refers to controls being effective both in
design and in operation. The opinion needs to indicate
whether both meanings are included.
Clarity of communication is improved if the organization
has adopted a broadly understood definition of internal
controls, such as in the COSO model. In preparing the
report, the CAE ensures that any technical terms (e.g.,
material weakness) are clearly defined for the reader. De-
veloping a guideline such as those included in the Ap-
pendices will eliminate some of the subjectivity and help
avoid confusion.
Use of a grading scale generally requires a well-defined
evaluation structure. For example, an opinion that merely
states that internal controls meet minimum defined cri-
teria would not require as much evidence as an opinion
that stated how much better or worse internal controls are
than a defined benchmark.
Increased precision in the information provided in
an opinion normally increases the amount of evidence
needed to support the opinion. Providing a grade as
part of a positive assurance opinion may provide useful
www.theiia.org/guidance / 6

information to the reader, but sufficient evidence is need-
ed to support that finer level of detail given in the opinion.
The rating scale clarifies whether the opinion is in relation
to the organization as a whole or on the subject of the au-
dit (specific audit assignment).
It is also important to consider consistency and sustain-
ability of the grading or rating system across audit years.
Grading or rating systems that change too frequently
|can be confusing to the stakeholders and may impact
the comparability and clarity of reporting across the
organization.
5.1 Use of Negative (Limited) Assurance
Opinions and “Informal” Opinions
A “negative assurance,” sometimes referred to as “limited
assurance,” opinion is a statement that nothing came to
the auditor’s attention about a particular objective, such
as the effectiveness of a system of internal control, ad-
equacy of a risk management process, or on any other spe-
cific matter. The internal auditor takes no responsibility
for the sufficiency of the audit scope and procedures to
find all significant concerns or issues. Such an opinion
is generally considered less valuable than positive assur-
ance and therefore auditors consider their value before
rendering them.
Occasionally, internal auditing may be asked for an “infor-
mal” or verbal opinion on the adequacy of governance, risk
management, or control policies and processes, either at
the macro or micro level. Where possible, the expression
of such an opinion should not be subjective in nature, but
should be based on objective evidence (as discussed previ-
ously). However, where stakeholders would accept a more
subjective opinion, the fact that the opinion is subjective
should be clearly disclosed with any verbal commentary.
When expressing an informal opinion, the CAE considers
a number of factors:
• The sufficiency of audit work (including the work of
others and informal evidence) to support the opinion
requested.
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
• Whether the opinion can be delayed until additional
evidence is obtained.
• The criteria for the opinion and a clear understand-
ing of what the organization considers satisfactory
performance.
• The organization’s risk appetite.
• The purpose for which the opinion will be used.
• Whether the informal opinion will be positive or
negative in nature.
• Whether the opinion will be limited and put in the
context of what supporting evidence has and has not
been obtained (e.g., “This opinion is based on the sev-
en audits completed this year. We have not completed
audits of the XYZ subsidiary, and our opinion does not
extend to it”).
In essence the factors considered are the same as those
that would be considered in expressing a written opinion.
It will be important to recognize instances where the most
appropriate response is an indication that further work
would be needed to express an opinion on the area sub-
ject to discussion.
In some instances, it may be necessary for internal audit-
ing to decline to issue a verbal opinion, especially when
there is a lack of sufficient evidence or work to support
the opinion.
5.2 Reliance on the Work of Others When
Supporting an Opinion
In many organizations, there are a range of functions or
people who provide management and the board with as-
surance on specific aspects of the organization’s opera-
tions, commonly referred to as “other assurance providers”
(OAPs).
If the CAE intends to rely on this work for purposes
of expressing his or her own opinion, appropriate steps
should be taken, including assessing the competency,
www.theiia.org/guidance / 7
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

independence, and objectivity of the OAPs. The CAE:
• Determines that the OAP possesses the knowledge,
skills, and other competencies necessary for the work
to be relied upon.
• Assesses the organizational relationships of the OAP
to determine that there are no relationships that will
prevent the OAP from rendering impartial and unbi-
ased judgments and opinions in the performance of
their assurance activities.
• Obtains sufficient information regarding the objec-
tives and scope of the OAP’s work to confirm that they
meet auditing’s specific requirements. A common
best practice is to establish frequent communication
meetings where the CAE has visibility of the planned
activities, results of work, and OAP reports (or other
similar communications).
• Evaluate the risks of using the work of OAPs, particu-
larly related to the level of assurance and confidence
related to opinions.
Once the CAE determines he or she will rely on the work
of others, that fact should be included in discussions with
key stakeholders and, if significant, the board. It is im-
portant that all parties understand how the work of OAPs
may impact macro or micro audit opinions, including the
degree of confidence to be placed in such opinions.
5.4 Other Legal Considerations
The use of opinions can result in increased reliance on
internal audit reports. This is a desirable outcome as it
increases the value and clarity on the level of assurance
given in an audit report. However, increased reliance can
also result in legal and other ramifications if someone
relies on the audit report and a control failure emerges
after the report is issued. In addition, the CAE’s own per-
sonal certification credentials can have legal ramifications
if noncompliance issues should arise. In managing these
ramifications, the CAE is encouraged to use appropriate
language in the report and any disclaimer that puts the
reader on notice of any limitations to the level of assur-
ance given. When signing a report opinion as a chartered
accountant, certified public accountant, certified internal
auditor, or other similarly credentialed professional, the
CAE should alert readers that it is not possible to pro-
vide absolute assurance and encourage them to consider
all legal implications. By being clear on these matters and
documenting them to the users of reports, the CAE is able
to manage expectations and limit unnecessary legal risk.

5.3 Guidance From Regulators and Other

Standard Setters
To the extent practicable, this guidance aims to harmonize
with other global regulators and is not intended to conflict
with known laws and regulations from other regulatory
bodies and standard setters. Internal auditors are not to
overlook their responsibilities to comply with local laws
and regulations. However, where such regulations or laws
do not exist or may conflict, this guidance can be useful
for providing audit opinions to all practitioners who aim to
comply with this guidance to the extent practicable.

www.theiia.org/guidance / 8

Appendix A:
Examples: Risk Ratings or
Rankings
The following are examples of systems that may be ap-
plied to rate or rank risks. For all of these, it is important
to clarify context (i.e., rating relative to the organization
as a whole versus the subject of the audit). These risk rat-
ings/rankings may also be applicable to certain micro-level
opinions.
Company A: Risk Rating Opinion
Very High – The residual risk after consideration of the
adequacy and/or effectiveness of controls/risk mitigators
remains very high according to the organization’s (or divi-
sion’s or entity’s) risk assessment matrix (risk rating crite-
ria). This is above the acceptable tolerance level.
High – The residual risk after consideration of the ad-
equacy and/or effectiveness of controls/risk mitigators re-
main high according to the organization’s (or division’s or
entity’s) risk assessment matrix. This is above the accept-
able tolerance level.
Medium – The residual risk after consideration of the
adequacy and/or effectiveness of controls/risk mitigators
is medium according to the organization’s (or division’s or
entity’s) risk assessment matrix and thus is within the or-
ganization’s risk tolerance.
Low Risk – The residual risk after consideration of the
adequacy and/or effectiveness of controls/risk mitigators
is low and thus is within the organization’s risk tolerance.
Company B: Deficiency Risk Rating in
Relation to Audit Findings (Micro Level)
High Priority Risk – As this is a high priority issue, im-
mediate management attention is required. This is a seri-
ous internal control or risk management issue that if not
mitigated, may, with a high degree of certainty, lead to:
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
• Substantial losses, possibly in conjunction with other
weaknesses in the control framework or the organiza-
tional entity or process being audited.
• Serious violation of corporate strategies, policies, or
values.
• Serious reputation damage, such as negative publicity
in national or international media.
• Significant adverse regulatory impact, such as loss of
operating licenses or material fines.
Medium Risk – As this is a medium-priority issue, timely
management attention is warranted. This is an internal
control or risk management issue that could lead to:
• Financial losses (stipulate levels).
• Loss of controls within the organizational entity or
process being audited.
• Reputation damage, such as negative publicity in lo-
cal or regional media.
• Adverse regulatory impact, such as public sanctions
or immaterial fines.
Low Risk – As this is a low priority issue, routine man-
agement attention is warranted. This is an internal con-
trol or risk management issue, the solution to which may
lead to improvement in the quality and/or efficiency of
the organizational entity or process being audited. Risks
are limited.
Company C:- Priority Risk Ranking of a
Deficiency (Micro Level)
Any one or more criteria noted below will result in a prior-
ity ranking providing mitigating controls are not in place:
(Note: Two or more priority ranking observations can re-
sult in an “unsatisfactory” audit opinion.)
• There is a potential financial statement or financial
disclosure misstatement requiring an after-tax adjust-
ment to the financial statements or related disclosures
greater than or equal to $XX million.
www.theiia.org/guidance / 9
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

• Controls are not operating as intended and it is esti-

mated that there could be an operational effectiveness
and efficiency opportunity having a potential economic
impact greater than 0.5 percent of total net income or
greater than 1 percent of a group classification of bal-
ance sheet accounts such as fixed assets, current as-
sets, current liabilities, etc., or have a material adverse
effect on the company’s reputation.
• A key control is not functioning as intended as sup-
ported by the auditors’ test exception results in excess
of XX percent (using a sufficient representative sample
size), and no mitigating controls exist (or a lower test
exception rate if exposure is significant).
• Critical information systems (as defined) are signifi-
cantly compromised due to ineffective controls over
logical/application security, data protection (including
customer/employee information), and a lack of system
edit checks and limited mitigating controls.
• Priority control weaknesses identified in a previous in-
ternal audit remain unresolved without a reasonable
cause for delay.
• Audit findings have identified ineffective controls that
have led to an internal or external fraud (as defined
being perpetrated (i.e., proven) or there is a high likeli-
hood that a potential (i.e., credible) fraud could exist
that is greater than $XX.

www.theiia.org/guidance / 10
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

Appendix B: Company D: 3 Tier Grading

Examples: Micro and Macro
Audit Opinion (Grading)
The following are grading examples that may be applied in
relation to audit opinions. For all of these, it is important
to clarify context; that is, opinion relative to the organiza-
tion as a whole (macro) versus an individual audit review
of a particular subject or process (micro). It will be im-
portant to have a risk ranking process and methodology in
place, similar to those in Appendix A, when formulating
these opinions.
Inadequate System of Internal Control - Findings
indicate significant control weaknesses and the need
for urgent remedial action. Where corrective action has
not yet started, the current remedial action is not, at the
time of the audit, sufficient or sufficiently progressing to
address the severity of the control weaknesses identified.
Adequate System of Internal Control Subject to
Reservations – A number of findings, some of which
are significant, have been raised. Where action is in
progress to address these findings and other issues
known to management, these actions will be at too early
a stage to allow a satisfactory audit opinion to be given.

Satisfactory System of Internal Control -

Findings indicate that on the whole, controls are satis-
factory, although some enhancements may have been
recommended.

Company E:- 4 Tier Grading

Controls evaluated are adequate, appropriate, and effective to provide reasonable assurance that risks
Effective
are being managed and objectives should be met.

A few specific control weaknesses were noted; generally however, controls evaluated are adequate,
Some Improvement Needed appropriate, and effective to provide reasonable assurance that risks are being managed and objec-
tives should be met.

Numerous specific control weaknesses were noted. Controls evaluated are unlikely to provide reason-
Major Improvement Needed
able assurance that risks are being managed and objectives should be met.

Controls evaluated are not adequate, appropriate, or effective to provide reasonable assurance that
Unsatisfactory
risks are being managed and objectives should be met.

www.theiia.org/guidance / 11
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

Company E:- 5 Tier Grading With Scale

Evaluation and Grading Matrix

Material Opportunities for
Well-Controlled Satisfactory – High Satisfactory — Low
Scope of Work Determinants Improvement
(A) (B) (C)
(F)

Operating Effectiveness and Serious Problems but

Effective Adequate Disclosure
Efficiency Not Material

Reliability of Financial Serious Problems but

Effective Adequate Disclosure
Reporting Not Material

Compliance With Applicable Serious Problems but

Effective Adequate Disclosure
Laws and Regulations Not Material

Serious Problems but

Safeguarding of Assets Effective Adequate Disclosure
Not Material

www.theiia.org/guidance / 12
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

Appendix C: agreed with management (define who) before the conduct

Macro-level Opinion (Example)
Note: It is necessary to have a methodology and process in
place to evaluate the cumulative results of audit assignments
and audit findings to express such an opinion.
of detailed audit procedures.
We concluded that (insert a positive opinion/grade for
each objective). Our overall opinion on XXX is satisfactory
or unsatisfactory (base the overall opinion of the entity
through evaluation of specific audit objective opinions).

In my professional judgment as (title), sufficient and

appropriate audit procedures have been conducted and
To: Chair, Audit Committee evidence gathered to support the accuracy of the conclu-
sions reached and contained in this report. The conclu-
From: Head of Internal Audit sions were based on a comparison of the situations as they
existed at the time against the audit criteria. The conclu-
Subject: Internal Audit of (subject matter or other entity) sions are only applicable for the entity examined. The evi-
for the period ended ___ dence gathered meets professional audit standards and is
sufficient to provide senior management with proof of the
conclusions derived from the internal audit.

We have completed the internal audit plan of (state the

subject matter or other entity). The objective(s) of this en-
gagement was (were) to (list the broad audit objective(s)).

The plan was prepared considering (state primary drivers

used to develop the plan). The internal audit was con-
ducted in accordance with the International Standards for
the Professional Practice of Internal Auditing.

The internal audit examined (describe what has been ex-

amined; e.g., the management control framework, the risk
assessment strategy, policies and practices, information
used for decision making, reporting as applicable to the
entity examined, etc.).

The scope of the audit included (scope inclusions).

Furthermore, the examination covered activities that have
occurred during the period (period covered by the exami-
nation).

The criteria used to assess the entity were (describe the

criteria and their source). The criteria were discussed and

www.theiia.org/guidance / 13

Appendix D:
Related IPPF Guidance
Related IPPF mandatory guidance includes:
2010 – Planning: “The CAE must establish risk-based
plans to determine the priorities of the internal audit ac-
tivity, consistent with the organization’s goals.”
2410.A1 – Criteria for Communicating: “Final com-
munication of engagement results must (where appropri-
ate) contain the internal auditor’s overall opinion and/or
conclusion.”
2120 – Risk Management: “The internal audit activity
should monitor and evaluate the effectiveness of the orga-
nization’s risk management system.”
2120. A1 – The internal audit activity must evaluate risk
exposures relating to the organization’s governance, opera-
tions, and information systems regarding the:
• Reliability and integrity of financial and operational
information.
• Effectiveness and efficiency of operations.
• Safeguarding of assets; and
• Compliance with laws, regulations, and contracts.
2130. A1 – The internal audit activity must evaluate the
adequacy and effectiveness of controls in responding to
risks within the organization’s governance, operations, and
information systems regarding the:
• Reliability and integrity of financial and operational
information;
• Effectiveness and efficiency of operations;
• Safeguarding of assets; and
• Compliance with laws, regulations, and contracts.
Related IPPF strongly recommended guidance includes:
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
Practice Advisory 1210.A1-1 – Obtaining External
Service Providers to Support or Complement the Internal
Audit Activity. It also embodies concepts from the follow-
ing AICPA’s Auditing Standards: SAS 65 - The Auditor’s
Consideration of the Internal Audit Function in an Audit
of Financial Statements and SAS 73 - Using the Work of
Others
Practice Advisory 1210.A1-1: Obtaining External Ser-
vice Providers to Support or Complement the Internal
Audit Activity
1. Each member of the internal audit activity need not be
qualified in all disciplines. The internal audit activity
may use external service providers or internal resourc-
es that are qualified in disciplines such as accounting,
auditing, economics, finance, statistics, information
technology, engineering, taxation, law, environmental
affairs, and other areas as needed to meet the internal
audit activity’s responsibilities.
2. An external service provider is a person or firm, inde-
pendent of the organization, who has special knowl-
edge, skill, and experience in a particular discipline. Ex-
ternal service providers include actuaries, accountants,
appraisers, culture or language experts, environmental
specialists, fraud investigators, lawyers, engineers, ge-
ologists, security specialists, statisticians, information
technology specialists, the organization’s external audi-
tors, and other audit organizations. An external service
provider may be engaged by the board, senior manage-
ment, or the chief audit executive (CAE).
3. External service providers may be used by the
internal audit activity in connection with, among other
things:
• Achievement of the objectives in the engagement
work schedule.
• Audit activities where a specialized skill and knowl-
edge are needed such as information technology,
statistics, taxes, or language translations.
www.theiia.org/guidance / 14

• Valuations of assets such as land and buildings, works
of art, precious gems, investments, and complex fi-
nancial instruments.
• Determination of quantities or physical condition of
certain assets such as mineral and petroleum reserves.
• Measuring the work completed and to be completed
on contracts in progress.
• Fraud and security investigations.
• Determination of amounts, by using specialized
methods such as actuarial determinations of employ-
ee benefit obligations.
• Interpretation of legal, technical, and regulatory re-
quirements.
• Evaluation of the internal audit activity’s quality as-
surance and improvement program in conformance
with the Standards.
• Mergers and acquisitions.
• Consulting on risk management and other matters.
4. When the CAE intends to use and rely on the work of
an external service provider, the CAE needs to consider
the competence, independence, and objectivity of the
external service provider as it relates to the particular
assignment to be performed. The assessment of com-
petency, independence, and objectivity is also needed
when the external service provider is selected by senior
management or the board, and the CAE intends to use
and rely on the external service provider’s work. When
the selection is made by others and the CAE’s assess-
ment determines that he or she should not use and rely
on the work of the external service provider, communi-
cation of such results is needed to senior management
or the board, as appropriate.
5. The CAE determines that the external service pro-
vider possesses the necessary knowledge, skills, and
other competencies to perform the engagement by
considering:
• Professional certification, license, or other recogni-
tion of the external service provider’s competence in
the relevant discipline.
IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions
• Membership of the external service provider in an ap-
propriate professional organization and adherence to
that organization’s code of ethics.
• The reputation of the external service provider. This
may include contacting others familiar with the exter-
nal service provider’s work.
• The external service provider’s experience in the type
of work being considered.
• The extent of education and training received by the
external service provider in disciplines that pertain to
the particular engagement.
• The external service provider’s knowledge and
experience in the industry in which the organization
operates.
6. The CAE needs to assess the relationship of the ex-
ternal service provider to the organization and to the
internal audit activity to ensure that independence and
objectivity are maintained throughout the engagement.
In performing the assessment, the CAE verifies that
there are no financial, organizational, or personal re-
lationships that will prevent the external service pro-
vider from rendering impartial and unbiased judgments
and opinions when performing or reporting on the
engagement.
7. The CAE assesses the independence and objectivity of
the external service provider by considering:
• The financial interest the external service provider
may have in the organization.
• The personal or professional affiliation the external
service provider may have to the board, senior man-
agement, or others within the organization.
• The relationship the external service provider may
have had with the organization or the activities being
reviewed.
• The extent of other ongoing services the external ser-
vice provider may be performing for the organization.
• Compensation or other incentives that the external
service provider may have.
www.theiia.org/guidance / 15
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

8. If the external service provider is also the organization’s In reviewing the work of an external service provider, the
external auditor and the nature of the engagement is CAE evaluates the adequacy of work performed, which
extended audit services, the CAE needs to ascertain includes sufficiency of information obtained to afford a
that work performed does not impair the external au- reasonable basis for the conclusions reached and the reso-
ditor’s independence. Extended audit services refer to lution of exceptions or other unusual matters.
those services beyond the requirements of audit stan-
dards generally accepted by external auditors. If the When the CAE issues engagement communications, and
organization’s external auditors act or appear to act an external service provider was used, the CAE may, as
as members of senior management, management, or appropriate, refer to such services provided. The external
as employees of the organization, then their indepen- service provider needs to be informed and, if appropriate,
dence is impaired. Additionally, external auditors may concurrence should be obtained before making such ref-
provide the organization with other services such as tax erence in engagement communication.
and consulting. Independence needs to be assessed in
relation to the full range of services provided to the or-
ganization.
9. To ascertain that the scope of work is adequate for the
purposes of the internal audit activity, the CAE obtains
sufficient information regarding the scope of the exter-
nal service provider’s work. It may be prudent to docu-
ment these and other matters in an engagement letter
or contract. To accomplish this, the CAE reviews the
following with the external service provider:
• Objectives and scope of work including deliverables
and time frames.
• Specific matters expected to be covered in the en-
gagement communications.
• Access to relevant records, personnel, and physical
properties.
• Information regarding assumptions and procedures to
be employed.
• Ownership and custody of engagement working pa-
pers, if applicable.
• Confidentiality and restrictions on information ob-
tained during the engagement.
• Where applicable, conformance with the Standards
and the internal audit activity’s standards for working
practices.

www.theiia.org/guidance / 16
 IPPF – Practice Guide
Formulating and Expressing Internal Audit Opinions

Practice Guide Team Members

Gilbert T. Radford, CIA
Bruce C. Sloan
Debbie E. H. Loxton
Norman D. Marks
Trygve Sorlie, CIA, CCSA

www.theiia.org/guidance / 17
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for any-
About Practice Guides one placing sole reliance on this guidance.
Practice Guides embody an IIA statement to as-
sist a wide range of interested parties, including Copyright
those not in the internal audit profession, in un- The copyright of this position paper is held by The
derstanding significant governance, risk, or con- IIA. For permission to reproduce, please contact
trol issues and in delineating the related roles and The IIA at guidance@theiia.org.
responsibilities of internal auditors on a signifi-
cant issue. Position Papers are part of The IIA’s
International Professional Practices Framework.
As part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended and the guidance is
endorsed by The IIA through formal review and
approval process. For other authoritative guid-
ance materials provided by The IIA please visit
our Web site, www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 IPPF – Practice Guide

Independence
and Objectivity

october 2011
 IPPF – Practice Guide
Independence and Objectivity

Table of Contents

Executive Summary........................................................................................ 1

Introduction................................................................................................... 2

Guidance on Independence and Objectivity.................................................... 3

Relationship of Independence and Objectivity................................................ 3

Independence................................................................................................. 4

Objectivity...................................................................................................... 7

Considerations for Assurance and Consulting Engagements........................ 10

Considerations for Rotational Audit Assignments......................................... 11

Frameworks for Evaluating Independence and Objectivity............................ 12

Author, Contributors and Reviewers............................................................. 18

Appendix ..................................................................................................... 19

www.theiia.org/guidance / B
 IPPF – Practice Guide
Independence and Objectivity

Executive Summary designed to add value and improve an organization’s op-

erations.” Objectivity is also one of the four key principles
of The IIA’s Code of Ethics (Code), which defines the
The importance of independence and objectivity, which
rules of conduct that support these principles. The Code
has always been significant for internal auditors, con-
applies both to organizations and individuals that perform
tinues to increase among the challenges facing internal
internal audit services. Standards 1100 – Independence
audit activities in the constantly changing business envi-
and Objectivity; 1110 – Organizational Independence;
ronment. An ever-growing number of stakeholders, both
1120 – Individual Objectivity; and 1130 – Impairment to
inside and outside an organization, continue to demand
Independence or Objectivity outline the specific require-
greater transparency, increased disclosures, expanded in-
ments for the internal audit activity and internal audit pro-
ternal audit services, increased professionalism, improved
fessionals. All internal audit practitioners should periodi-
coordination among internal and external auditors, greater
cally refresh their understanding of this guidance.
responsibilities, and more accountability from internal au-
dit professionals. This practice guide was developed to ad-
This practice guide highlights the IPPF International
dress these changes and increased expectations.
Standards for the Professional Practice of Internal Audit-
ing (Standards) related to independence and objectivity,
There are many assurance providers within the organiza-
as well as The IIA’s supporting practice advisories. This
tion, such as frontline managers and executives, quality
guide also acknowledges the confusion that is often pres-
assurance staff, health and safety staff, compliance and
ent when people use the terms independence and objec-
risk management staff. Internal audit is distinguished
tivity interchangeably. While independence and objectiv-
from many other internal assurance providers by virtue of
ity are related, they are distinctly different attributes and
a requirement to comply with professional standards and
require specific actions and safeguards to ensure auditors
a code of ethics that demand independence and objectiv-
are both independent and objective.
ity. Further, objectivity is a key determinant for whether
external auditors can place reliance on work performed by
This guide also highlights activities supporting both in-
internal audit. As specified in The International Standard
dependence and objectivity and discusses various factors
on Auditing (ISA) 610 – Using the Work of Internal Audi-
that can affect an auditor’s independence and objectivity.
tors, issued by The International Auditing and Assurance
Combinations of threats, unresolved threats, and consid-
Standards Board (IAASB) of the International Federation
erations for both assurance and consulting services also
of Accountants (IFAC), to determine potential areas of
are discussed.
reliance, first and foremost, the external auditors have to
evaluate the internal audit activity’s degree of objectivity, its
Frameworks for evaluating and managing independence
level of competence, and the extent to which judgment is
and objectivity are presented as models that internal au-
involved in planning, performing, and evaluating that work.
ditors can use to help ensure that independence and ob-
jectivity are promoted and fostered in their own organiza-
Independence and objectivity are integral parts of the
tions.
mandatory guidance of The Institute of Internal Audi-
tors’ (IIA) International Professional Practices Framework
Key sections that provide further information relating to
(IPPF). The use of these terms starts with the definition of
considerations about independence and objectivity in-
internal auditing, which states that “Internal auditing is an
clude:
independent, objective assurance and consulting activity

www.theiia.org/guidance / 1

• Definitions of independence and objectivity, as well
as related guidance included in the IPPF.
• Factors impacting independence, such as the orga-
nizational reporting relationship of the internal audit
activity, access to information, control over the scope
of internal audit activities and content of audit com-
munications, and the oversight and involvement of
governing bodies.
• Activities supporting independence, such as organi-
zational placement, strong governance environment,
hiring practices (including outsourcing, as neces-
sary), and a strong audit charter.
• Factors threatening objectivity, such as social pres-
sure, economic interests, personal relationships,
familiarity, cultural and other biases, self-review, and
intimidation and advocacy threats.
• Managing threats to objectivity through the use of
incentives, teams, rotational assignments, training,
supervision and review, quality assessments, hiring
practices, and outsourcing.
• Unresolved challenges to objectivity and consider-
ations for assurance and consulting engagements.
• A process for managing threats to independence and
objectivity and frameworks for evaluating indepen-
dence and objectivity at the individual, engagement,
activity, organization, and professional levels.
Introduction
In the midst of a global drive to improve corporate gov-
ernance, internal auditors face many challenges and op-
portunities, including increasingly complex and perva-
sive use of technology, a need for new and ever-changing
skills, flattening organizational structures, demand for an
expanding scope of services, and increasing competition
and globalization. Internal auditors are developing new
strategies to meet these challenges, and are becoming
more proactive by providing a broadened variety of servic-
IPPF – Practice Guide
Independence and Objectivity
es and otherwise changing the internal audit model. This,
in turn, creates additional challenges in managing both
independence and objectivity.
Management employs internal auditors, yet these same
internal auditors review the performance of management
and other activities within the organization. In addition,
management often relies on internal auditors for consult-
ing services and incorporates audit recommendations into
the reengineering of business processes. In their role as
assurance providers, auditors evaluate management’s
processes. The combination of the internal auditor as an
employee of the organization, the increasing importance
of internal audit activities, and the growing demand for
internal audit consulting activities lead to escalating con-
cern about internal auditor independence and objectivity.
As internal auditors expand their role in governance and
risk management activities, additional challenges are pre-
sented for managing independence and objectivity. The
IIA’s Position Paper on the Role of Internal Auditing in
Enterprisewide Risk Management provides an excellent
example of the expanded roles for internal audit as well
as safeguards needed to address any threats to internal
audit’s independence and objectivity.
As both private and public organizations around the world
grow in size and influence, society is demanding greater
accountability. This drive for accountability has led to an
increased focus on audit activities as a cornerstone of
governance systems and, in some parts of the world, has
resulted in calls for mandating an internal audit activity.
The purpose of this practice guide is to:
• Highlight IIA guidance on independence and objec-
tivity.
• Discuss potentially confusing aspects encompassing
independence and objectivity.
• Identify activities that support independence and
objectivity.
www.theiia.org/guidance / 2

• Identify various considerations and potential chal-
lenges related to independence and objectivity.
• Provide frameworks for managing independence and
objectivity.
Guidance on Independence
and Objectivity
The IIA’s IPPF provides guidance for independence and
objectivity in several standards, practice advisories, and
position papers. The following standards, which include
a paraphrased interpretation, address independence and
objectivity.
1100 – Independence and Objectivity (Standard)
The internal audit activity must be independent, and in-
ternal auditors must be objective in performing their work.
Interpretation:
“Independence is the freedom from conditions that threaten
the ability of the internal audit activity to carry out internal
audit responsibilities in an unbiased manner. . . . Objectivity
is an unbiased mental attitude that allows internal auditors
to perform engagements in such a manner that they believe
in their work product and that no quality compromises are
made. . .”
1110 – Organizational Independence (Standard)
The chief audit executive must report to a level within
the organization that allows the internal audit activity to
fulfill its responsibilities. The chief audit executive must
confirm to the board, at least annually, the organizational
independence of the internal audit activity.
Interpretation:
Organizational independence is effectively achieved when
the chief audit executive reports functionally to the board.
IPPF – Practice Guide
Independence and Objectivity
Examples of functional reporting to the board involve the
board:
• Approving the internal audit charter;
• Approving the risk-based internal audit plan;
• Receiving communications from the chief audit execu-
tive on the internal audit activity’s performance relative
to its plan and other matters;
• Approving decisions regarding the appointment and
removal of the chief audit executive; and
• Making appropriate inquiries of management and the
chief audit executive to determine whether there are
inappropriate scope or resource limitations.
1120 – Individual Objectivity (Standard)
Internal auditors must have an impartial, unbiased atti-
tude and avoid any conflict of interest.
1130 – Impairment to Independence or Objectivity
(Standard)
If independence or objectivity is impaired in fact or ap-
pearance, the details of the impairment must be disclosed
to appropriate parties. The nature of the disclosure will
depend upon the impairment.
The various standards and practice advisories related to
independence and objectivity are reproduced in detail in
the appendix of this practice guide.
Relationship of Independence
and Objectivity
In practice, there is often confusion about independence
and objectivity, and many people use these terms inter-
changeably. Independence and objectivity are not the
same thing. Someone can be independent but not objec-
tive, and conversely, someone can be objective but not in-
www.theiia.org/guidance / 3
 IPPF – Practice Guide
Independence and Objectivity

dependent. It is important to understand the difference
between the two and realize how threats and safeguards
affect each.
It is easier to measure or gauge independence and imple-
ment safeguards to ensure it than to ensure objectivity.
Safeguards such as reporting relationships, segregation
of duties, restrictions on responsibilities, remuneration
structure, and actions or requirements that avoid conflicts
of interest can help improve independence.
this confusion. While these terms are certainly related,
they are extremely different concepts. In practice, the in-
dependence concept is usually expressed in factual mat-
ters, such as the organizational placement of the internal
audit activity, reporting relationships to the board, an au-
dit committee or other governing body separate from man-
agement, and authorities to access information, people,
and records. Objectivity relates more to a state of mind,
the individual auditor’s judgment, biases, relationships,
and behaviors.

Objectivity, however, is something for which an individual

auditor retains ultimate accountability and control. For
example, statistical sampling techniques can be used to
pull an unbiased sample for testing, but it is still up to
Independence
the individual auditor to exercise professionalism and due Factors Impacting Independence
care in applying the test attributes or procedures and in-
The specific role of internal audit activities varies from or-
terpret the results in an unbiased manner. Supervisory re-
ganization to organization based on factors such as organi-
view of the test work is a safeguard to help ensure that test
zational size, type of operations, capital structure, and the
results and conclusions are objective.
legal and regulatory environment. In some organizations,
the work of internal auditors is confined to special assur-
The IPPF Standards Glossary provides the following defi-
ance and consulting projects for management. In these
nitions for independence and objectivity (as revised Jan.1,
situations, management is the only user of the internal
2011):
audit work and the only party that derives direct benefit
from that work. In other organizations, the internal au-
Independence: The freedom from conditions that threat-
dit activity provides assurance and consulting services to
en the ability of the internal audit activity to carry out in-
various groups inside and outside the organization, such
ternal audit responsibilities in an unbiased manner.
as governing bodies (e.g., boards of directors), regulators,
external auditors, customers, and suppliers.
Objectivity: An unbiased mental attitude that allows in-
ternal auditors to perform engagements in such a manner
The particular role of the internal audit activity in an
that they believe in their work product and that no quality
organization determines the appropriate structure of re-
compromises are made. Objectivity requires that internal
sponsibilities and reporting level as well as the degree of
auditors do not subordinate their judgment on audit mat-
reliance that should be placed on the assurance and con-
ters to others.
sulting services provided. An internal audit activity with a
broad assurance and consulting role ideally should report
As previously noted, many auditors have struggled with
directly to the governing board of the organization and,
these concepts, often using the terms interchangeably
more specifically, to the audit committee of the board or
and incorrectly. This confusion was compounded by us-
other similar body.
ing one term to define the other. The newly revised Stan-
dards Glossary definitions should help alleviate some of

www.theiia.org/guidance / 4

The organizational placement and status of the internal
audit activity poses a practical constraint or a limit on the
scope of internal audit services that can be appropriately
undertaken by internal auditors. For example, if the in-
ternal audit activity resides in the controller’s department
with the chief audit executive (CAE) reporting directly to
the controller, it is difficult — if not impossible — for the
internal auditor to objectively evaluate the performance of
peer offices under the chief financial officer. In general,
the higher the reporting level, the greater the potential
scope of engagements that can be undertaken by the in-
ternal audit activity while remaining independent of the
audited entity.
The ability to achieve appropriate and adequate internal
audit activity independence depends critically on the ap-
propriate placement or organizational status of the activ-
ity within the organization. The organizational status of
the internal audit activity should be sufficient to allow it
to accomplish its activities as defined by its role within
the organization. In this regard, the internal audit activity
must be positioned to obtain cooperation from the entity
being audited and free access to required information.
Noting such access in audit department and audit com-
mittee charters is always a good practice. Including CAEs
as part of senior or executive management and as partici-
pants in critical meetings helps demonstrate strong and
supportive top management commitment to the internal
audit activity. In addition, reports of audit findings must
not be subject to potential interference and suppression
by management.
The internal audit activity should be organized to afford
a higher organizational status as its role expands and as
more parties inside and outside the organization derive
assurance from its work. For example, to provide assur-
ance to the governing body of the organization, such as
the board of directors or similar bodies, the CAE should
have direct and unrestricted access to that body. This al-
lows the activity to be insulated from possible threats to
independence.
IPPF – Practice Guide
Independence and Objectivity
If the internal audit activity does not have sufficient orga-
nizational status and autonomy, the ability to effectively
manage the independence of its work and reports is sub-
ject to question. For example, the risk that independence
will be compromised may be high in situations in which
the CAE may be fired by top management without consul-
tation with the organization’s governing body. The risk also
may be high in situations in which the scope of audit ac-
tivities or the activity’s budget is determined by top man-
agement without consultation with the governing body.
In these situations, there is a risk that management may
inappropriately affect the scope of the audit work, impose
bias, or suppress audit findings. When the risk that appro-
priate and adequate independence will not be achieved
is significant, it is difficult to determine how much assur-
ance may be derived from the audit work.
In evaluating the appropriate organizational status of the
internal audit activity, consideration also should be given
to other constituents who derive benefit from the assur-
ance and consulting work. For example, external auditors
may have greater confidence in internal controls because
they know an effective internal audit activity reviews the
system. Similarly, the governing body of an organization
may obtain assurance on overall control from the fact that
the internal audit activity performs risk assessments to
determine the appropriate areas to audit. The knowledge
that risk assessment and monitoring are being performed
may provide implicit assurance in areas beyond those ex-
plicitly examined and reported on by internal auditors.
Internal auditors are being asked more frequently to pro-
vide assurance to parties outside the organization. For
example, regulatory agencies often require copies of in-
ternal audit reports. Some regulations even require estab-
lishment of an internal audit function. In addition, cus-
tomers and suppliers are beginning to request assurances
about such matters as the organization’s controls over the
confidentiality of shared information, particularly in elec-
tronic commerce cases. Providing credible assurance to
these outside parties requires the highest degree of orga-
www.theiia.org/guidance / 5

nizational status and autonomy on the part of the internal
audit activity.
The organizational status of the internal audit activity cor-
relates with the scope of engagements that can be un-
dertaken. When there is high-level reporting, the scope
of potential engagements is less limiting; when there is
lower-level reporting, the reporting universe (i.e., the pop-
ulation of users who could benefit from the audit work)
becomes more limited.
In organizations where assurance is derived by parties oth-
er than management, the organization’s governing body
should review the autonomy of the internal audit activity
to ensure its adequacy. If internal audit activities provide
assurance to customers, clients, external auditors, regula-
tors, or other parties outside the organization, such assur-
ance activities should be endorsed by the appropriate gov-
erning body. In addition, the autonomy and organizational
status of the activity should be reviewed for compliance
with any existing legal or regulatory requirements.
In reviewing and evaluating the organizational status of
the internal audit activity, the governing body should con-
sider factors that increase and improve independence,
such as:
• The reporting level of the CAE within the organiza-
tion.
• The CAE’s unrestricted access to information
throughout the organization and the governing board.
• The governing board’s involvement in decisions to
hire or remove the CAE and in drafting and approv-
ing an internal audit charter.
• The role of the governing board in influencing the
budget for, and the scope of, internal audit activities
and remuneration and retention of the CAE.
• The active involvement, oversight, review, and
follow-up by the governing board with the internal
audit activity.
IPPF – Practice Guide
Independence and Objectivity
These factors are not intended to be all-inclusive, and
should be considered in relation to the parties that expect
to derive assurance from the internal auditors’ activities.
When internal audit has sufficient organizational status
and autonomy, parties both inside and outside the orga-
nization can have increased confidence in internal audit’s
ability to manage threats to independence with respect to
the work that it performs. Therefore, the CAE is free from
significant threats that may affect any individual auditor’s
ability to make independent decisions regarding audit en-
gagements and reports.
Activities Supporting Independence
The following list is not intended to be exhaustive. Rather,
it is intended to illustrate the range of mitigating factors
and safeguards that may reduce or eliminate threats to
independence.
Organizational Position and Policies
The auditor and/or audit activity’s organizational position,
internal audit charter, and policy statements at various
levels addressing auditor/audit client relations may bolster
the auditor’s position in the organization and create bar-
riers for audit clients to influence or intimidate auditors.
Other documents that could be used to promote inter-
nal audit’s status in the organization are the organization’s
code of ethics, the audit activity’s mission statement, au-
dit reports and other official communications from the
audit activity, an audit website, and the audit committee
charter.
Environment — Strong Organizational
Governance System
A supportive environment in the organization as a whole
encourages auditors to audit and report without restric-
tion and fear of retaliation for negative opinions or critical
findings. A significant component of a supportive environ-
ment is the audit committee, board, or other governing
body, which is crucial in ensuring auditor independence.
www.theiia.org/guidance / 6

Audit Charter
A strong governing body and internal audit charter that
clearly outline internal audit’s responsibilities, authori-
ties and reporting relationship, unrestricted access to
information, people, and records can help promote inde-
pendence. Effective governing body oversight, including
responsibilities for hiring, evaluating and compensating,
and terminating the CAE, can improve independence.
Hiring and Compensation Practices
Hiring practices also can be a safeguard for indepen-
dence. For example, screening can ensure that potential
employees do not have conflicts of interests that threaten
the internal audit activity’s independence. For example,
determining whether applicants own stock in the organi-
zation, are related to people who work for or have busi-
ness relationships with the organization, or have served in
some official capacity previously or provided significant
services to the organization in the past. Compensation
practices also can be structured so that the auditors’ pay
is not dependent on the performance of the organization-
al units they review.
Outsourcing
When internal structure and mechanisms cannot be ef-
fectively used to manage threats to independence, out-
sourcing to an external service provider can help promote
independence of internal audit activities.
Objectivity
Factors Threatening Objectivity
To make unbiased performance and reporting decisions,
internal auditors must be able to manage threats to ob-
jectivity. This ability is also an important signal to govern-
ing boards, shareholders, and external parties that inter-
nal audit activities can be relied on to provide assurance
IPPF – Practice Guide
Independence and Objectivity
about control, compliance, and other relevant matters.
Social Pressure
Social pressure threats may arise when an auditor is ex-
posed to, or perceives that he or she is exposed to, pres-
sures from external parties. For example, a perception
that external auditors or regulators expect a certain num-
ber of findings to be generated, or that management ex-
pects each engagement should produce major findings,
can put undue pressure on internal auditors. This situ-
ation also may occur when the auditor, for example, has
inadvertently or mistakenly raised issues in the past when
there were no problems. Also, pressure from audit clients
could drive the auditor to overlook suspicious items. An-
other form of social pressure could occur when an audit
team member is reluctant to oppose a generally held view
on the part of the audit team itself or from clients who
indicate that “this is the way we have always done it” (a
phenomenon labeled as “groupthink” in behavioral litera-
ture).
Economic Interest
This threat may arise when the auditor has an economic
stake in the performance of the organization. An auditor
may fear that significant negative findings, such as dis-
covery of illegal acts, could jeopardize the entity’s future;
hence, the auditor’s own interests as an employee. Or, an
auditor may have stock options or other financial interests
that may be threatened by negative audit findings. This
threat also arises when the auditor audits the work or de-
partment of an individual who may subsequently make
decisions that directly affect the auditor’s future employ-
ment opportunities or salary.
Personal Relationship
This threat may arise when an auditor is a close friend or
relative of the manager or an employee of the audit client.
The auditor may be tempted to overlook, soften, or delay
reporting negative audit findings to avoid embarrassing
the friend or relative.
www.theiia.org/guidance / 7

Familiarity
This threat may arise because of an auditor’s long-term
relationship with the audit client. Familiarity may lead an
auditor to lose objectivity during an audit by making the
auditor overly sympathetic to the client. Alternatively, fa-
miliarity may lead an auditor to prejudge an audit client
on the basis of previous problems (or nonproblems) and
assume a posture consistent with the prejudgment rather
than taking a fresh, objective look.
Cultural, Racial, and Gender Biases
This threat may arise from cultural, racial, or gender bi-
ases. For example, in a multidivisional organization, a
domestically based auditor may be biased or prejudiced
against audit clients located in certain foreign locations.
Or, an auditor may be unduly critical of different practices
and customs or of an audit client managed or staffed by
employees of a particular race or gender.
Cognitive Biases
This threat may arise from an unconscious and uninten-
tional psychological bias in interpreting information de-
pending on a person’s role in a situation. For example, if
someone takes a critical audit perspective, he or she may
overlook positive information. Conversely, if someone
takes a positive facilitative perspective, he or she may dis-
count negative information. In addition, an auditor may
come with certain preconceived notions and tend to see
evidence confirming such notions.
Self-review
Self-review threats may arise when an auditor reviews his
or her own work performed during a previous audit or con-
sulting engagement. For example, an auditor may audit a
department repeatedly or in consecutive years, or the au-
ditor may provide consulting services in connection with a
system implementation that he or she subsequently must
audit. Furthermore, the auditor may provide recommen-
dations for operational improvements and subsequently
review processes that were changed in accordance with
IPPF – Practice Guide
Independence and Objectivity
those recommendations. All of these examples represent
situations in which the auditor could conceivably become
less critical or observant of errors or deficiencies due to
the difficulty of maintaining objectivity when reviewing
his or her own work.
Intimidation Threat
Intimidation threats arise when an auditor is deterred
from acting objectively by threats — actual or perceived
— or being overtly or covertly coerced by audit clients or
other interested parties.
Advocacy Threat
Advocacy threats arise from auditors acting biased in pro-
moting or advocating for or against the audit client to the
point that subsequent objectivity may be compromised.
Managing Threats to Objectivity
The following list is not intended to be exhaustive. Rather,
it is intended to illustrate the range of mitigating factors
that may reduce or eliminate threats to objectivity.
Incentives (Rewards, Discipline)
A system of rewards and disciplinary processes within
both the internal audit activity and in the entire organi-
zation can reduce threats to objectivity. For example, an
environment that rewards critical and objective thinking
or penalizes bias or prejudice can encourage objectivity
in the face of these types of threats. Incentive pay, addi-
tional time off, flexible work schedules, and other positive
rewards can be used to encourage and reward objective
thinking.
Likewise, penalties that impact performance reviews, de-
lay promotions or other advancement, or require addition-
al training could be used to discourage lack of objectivity.
Naturally, how such reward and discipline programs are
structured and managed is critical and must be conducted
in a professional and balanced manner to be viewed as
positive and supportive.
www.theiia.org/guidance / 8

Use of Teams
Assigning another team member to an audit can diffuse
or eliminate potential threats to objectivity by bringing
an additional perspective to the audit. This additional
perspective can counterbalance potential threats due to
familiarity, personal relationships, self-review, or other
threats to objectivity on the part of one or more audit
team members. In addition, appropriate assignments
within teams can be made to maximize the mitigating ef-
fects of the team approach.
Rotation/Reassignment
Rotating audit assignments can reduce the degree of fa-
miliarity and self-review. There are different types of ro-
tation, including rotating all the staff from one audit to
another so that new staff always performs the audit; rotat-
ing some of the staff; and keeping the audit staff on a re-
peated audit but rotating the work performed by the staff.
Training
Training in appropriate methods and approaches im-
proves objectivity. Further, training also can help auditors
recognize potential threats to objectivity, so that they can
avoid or effectively manage them in a timely fashion.
Supervision/Review
Close supervision of auditors and careful review of their
work can encourage staff to approach audit issues objec-
tively, since they are accountable for their judgments. Re-
search indicates that accountability is an important factor
in improving judgments and reducing biases in an audit.
Quality Assessment
Internal and external reviews of the internal audit activ-
ity, its services, processes, and procedures can help en-
sure that threats to objectivity are effectively managed
and professionalism is maintained. Ongoing monitoring
and periodic reviews can help ensure that processes are
in place and that the audit staff carries out their activities
in accordance with designated policies and procedures.
IPPF – Practice Guide
Independence and Objectivity
Hiring Practices
Hiring practices also can improve the likelihood that per-
sonnel are free from biases and are able to render objec-
tive judgments when conducting internal audit engage-
ments. For example, screening can ensure that potential
employees do not have conflicts of interests that threaten
their objectivity. Also, determining whether applicants
have relatives that work for the organization, own stock
in the organization, have family members with business
relationships with the organization, or have served pre-
viously in some official capacity or provided significant
services to the organization can help ensure objectivity.
Outsourcing
Outsourcing internal audit activities to a third party may
be appropriate when there are known or perceived con-
flicts of interest that would impair the staff ’s judgment or
create potential biases.
Combinations of Threats to Objectivity
There could be circumstances in which several catego-
ries of threats are present at the same time. For example,
many internal auditors provide control self-assessment
services that involve working with audit client represen-
tatives and facilitating their review of risks and controls.
A number of threats can arise in these circumstances,
such as self-review threats if an auditor acts as a facilita-
tor and subsequently is assigned to review the controls
that were the subject of the assessment exercise. Also,
social pressure threats may arise if the facilitating audi-
tor feels pressure to not “breach the trust” placed in the
self-assessment process by the participants who candidly
reveal system weaknesses. In this context, an auditor may
be concerned that future self-assessment exercises would
be undermined by negative audit findings. Furthermore,
when an auditor takes on a facilitating role, he or she may
become too close to some audit clients by developing
personal relationships that could make it difficult to be
critical of those clients. Or, the auditor may develop un-
conscious cognitive biases because of the positive facilita-
www.theiia.org/guidance / 9

tive role adopted in the self-assessment process by inter-
preting information about the audit clients more positively
than objectively and seeking confirmatory information.
While the auditor only may be dealing with individu-
al threats in some cases, there will be multiple threats,
mitigating factors, and management tools used to address
residual threats in many situations. Therefore, a compre-
hensive and integrated approach in identifying, assessing,
and managing potential threats is recommended.
Threats to Objectivity at the Activity Level
Some internal auditors have suggested that certain activi-
ties, such as consulting services and control self-assess-
ment services, performed by the internal audit activity
may threaten the activity’s objectivity and result in role
conflict. For example, if an activity provides extensive
management consulting services, threats to objectivity
may arise in the form of self-review threats and familiar-
ity threats at the unit level. Self-review threats may arise
when internal audit is involved in the implementation of
an entitywide management information system and sub-
sequently is engaged in reviewing the same system.
Providing consulting services does not in and of itself nec-
essarily compromise objectivity, particularly if the auditor
is involved primarily in an advisory capacity (internal audit
should not be involved in a decision making capacity) and
there is no reason to presume that the auditor’s objectivity
is automatically compromised. A professional internal au-
ditor and internal audit activity, within the context of the
framework described herein, should be able to recognize
potential threats to objectivity in subsequent audit assign-
ments, consider mitigating factors, and take appropriate
action to reduce or eliminate residual threats to objectiv-
ity.
Unresolved Threats to Objectivity
There may be circumstances in which threats to objectiv-
ity remain unresolved because no mechanisms are avail-
IPPF – Practice Guide
Independence and Objectivity
able to address unmitigated threats, and the engagement
cannot be outsourced. The guide specifies that these
unresolved threats should be disclosed to the audit com-
mittee or similar independent bodies so that the auditor’s
recommendations are reviewed in the appropriate con-
text. This disclosure also may be included in the audit
report as appropriate. In some situations, audit committee
members or top management may, in fact, be the prob-
lem. Therefore, the best alternative may be to decline to
conduct the audit. If the problem is systemic, the internal
auditor should evaluate how the effect of remaining with
the organization will impact his or her professionalism and
the underlying commitment to integrity.
Considerations for Assurance
and Consulting Engagements
Assurance engagements include those services designed
to provide an objective examination of evidence for the
purpose of providing an independent assessment on gov-
ernance, risk management, and control processes for the
organization. Examples may include financial, perfor-
mance, compliance, system security, and due diligence
engagements.
Consulting engagements include advisory and related cli-
ent service activities — the nature and scope of which are
agreed to by the client — and are intended to add value
and improve an organization’s governance, risk manage-
ment, and control processes without the internal auditor
assuming management responsibility. Examples include
counsel, advice, facilitation, and training.
As previously noted, providing consulting services does
not in and of itself necessarily compromise objectivity,
particularly if the auditor is involved in an advisory ca-
pacity and there is no reason to presume that his or her
objectivity is automatically compromised. A professional
www.theiia.org/guidance / 10

internal auditor and internal audit activity, within the con-
text of the framework described herein, should be able
to recognize potential threats to objectivity in subsequent
audit assignments related to previous consulting services,
consider mitigating factors, and take appropriate action to
reduce or eliminate residual threats to objectivity. Inter-
nal auditors should remember Standard 1130.A1, which
states: “Internal auditors must refrain from assessing spe-
cific operations for which they were previously respon-
sible. Objectivity is presumed to be impaired if an inter-
nal auditor provides assurance services for an activity for
which the internal auditor had responsibility within the
previous year.”
Considerations for
Rotational Audit Assignments
Rotational audit assignments can create unique challeng-
es and may require special considerations when evaluat-
ing independence and objectivity. These special consider-
ations will vary depending on the nature of the rotational
audit assignment. Examples of some typical rotational au-
dit assignments include:
• Individuals can be employed as part of an audit staff
on a temporary basis and later return to another de-
partment, operating unit, or subsidiary of the orga-
nization. These assignments can run from very short
engagements, such as two to three weeks, to extended
time periods that can last from two to three years.
• Interns or management trainees employed by the
organization may be assigned to the internal audit
activity as part of their training and development.
• The CAE position in some organizations may be sub-
ject to rotational assignments. These type of assign-
ments usually last longer — often at least two years
— but can run as long as five or more years depend-
ing on the organization’s needs.
IPPF – Practice Guide
Independence and Objectivity
The examples described above generally involve rotational
assignments “into” the internal audit activity. Here again,
internal auditors are reminded about Standard 1130.A1
that governs assessing activities for which auditors were
previously responsible. Rotational assignments also can
be structured so that internal auditors rotate “out” of the
internal audit activity for some time period. Internal audi-
tors at all levels — staff, management, or even the CAE
— may rotate out of internal audit and be assigned to an-
other department, business unit, or subsidiary of the or-
ganization. Generally, independence and objectivity con-
cerns will need to be evaluated only when the individual
rotates back into the internal audit activity.
Internal auditors seeking guidance involving situations in
which the internal auditor may be assigned audit work re-
lated to areas where they were previously employed should
refer to the guidance contained in Standard 1130 (see the
appendix). This guidance is generally directed to auditors
who have joined or “rotated into” the internal audit ac-
tivity on a permanent basis. Internal auditors who may
eventually rotate back to other areas of the organization
(i.e., those who have joined the internal audit activity on a
temporary basis or for a rotational assignment) may need
to take additional actions to help ensure independence
or objectivity. Rotational auditors may face challenges or
threats to their independence or objectivity that cause
them to fear their chances of returning to the area from
which they rotated may be jeopardized. These challenges
or threats can come from outside parties the auditors deal
with when performing audit assignments or the threats
may be self-imposed.
The following list presents considerations or actions that
may need to be taken for auditors on rotational assign-
ments.
• If the CAE has rotated into the internal audit activ-
ity and is expected to return to an operating unit or
other subsidiary of the organization, possible safe-
guards could include:
www.theiia.org/guidance / 11

– Ensuring the CAE is aware of IIA standards
related to independence and objectivity and the
Code of Ethics.
– Ensuring that the audit committee is aware of this
arrangement, preferably by documenting a discus-
sion in the audit committee minutes.
– Assigning a third party to oversee the audit work
performed in the area to which the CAE will
return.
– Requiring the CAE to recuse himself or herself
from the matters that present a problem and
delegate all required activities in that area, includ-
ing board reporting, to a deputy CAE or audit
manager when the internal audit function is large
enough.
– Including an independent party (e.g., another
executive or manager) to observe or participate in
meetings between the CAE and acting manage-
ment of the area to which the CAE will return
in situations involving problems, audit issues,
personnel issues, or other major discussions.
– Considering a special review of interactions (e.g.,
reports, significant meetings, etc.) between the
CAE and the area to which he or she will return
when a decision is made if the area to which the
CAE will return is unknown or to be decided
later.
• For staff auditors and audit managers who may have
rotated into internal audit and will be rotating back
to some other operating unit or subsidiary, possible
safeguards could include:
– Ensuring the auditor who has rotated into the
internal audit activity is aware of IIA standards
related to independence and objectivity and the
Code of Ethics.
– Refraining from assigning rotating staff, if possi-
ble, to audit areas to which they will return. This
is more easily accomplished in larger audit shops.
IPPF – Practice Guide
Independence and Objectivity
Audit shops with limited resources may need to
take other precautions.
– Providing additional oversight and review of the
work performed by auditors who may be auditing
an area to which they eventually will return.
– Ensuring appropriate disclosures are included in
audit reports.
– Ensuring appropriate discussions have been held
with the audit committee, management, and the
area to be audited.
• For organizations that run “rotational” audit shops,
where some portion of the audit staff are expected
to eventually rotate back out to some other area of
the organization, the following safeguards can be
considered:
– Ensuring all auditors are aware of IIA standards
related to independence and objectivity and the
Code of Ethics.
– Ensuring that “career” audit managers and super-
visors review the work of rotational auditors.
– Refraining from assigning rotational auditors, if
possible, to areas where they may return.
– Ensuring appropriate disclosures are made and
that appropriate discussions have been held with
the audit committee and management.
Frameworks for Evaluating
Independence and Objectivity
Independence and objectivity are necessary for effective
internal audit services. Each of these must be managed
effectively for internal audit activities to comply with the
IPPF. This section provides a process and frameworks for
managing threats to both independence and objectivity.
These frameworks focus directly on the goals of indepen-
dence and objectivity at the organizational, engagement,
www.theiia.org/guidance / 12
 IPPF – Practice Guide
Independence and Objectivity

and personal levels by requiring internal auditors to identify threats to their independence or objectivity. Further, internal
auditors are required to assess and mitigate those threats, and assess whether they can be independent and objective given
the steps they have taken to mitigate the threats identified.

The independence framework recognizes that independence is primarily an organizational and structural issue. The ob-
jectivity framework recognizes that objectivity is primarily a state of mind. The assessment of threats to independence
or objectivity — and their mitigation or management — is largely a process of self-assessment by internal auditors. The
frameworks rely heavily on the professionalism of CAEs and individual auditors. Internal auditors must accept the respon-
sibility to manage and disclose threats to their own independence or objectivity.

The following table presents a process diagram for managing threats to independence or objectivity.

PROCESS FOR MANAGING THREATS TO INDEPENDENCE OR OBJECTIVITY

Assess Determine
Assess Identify Assess Proactively
Identify Presence of Reporting and Review and
Significance of Mitigating Residual Manage
Threat Unresolved Disclosure Monitoring
Threat Factors Threat Residual Threat
Threats Implications

—> —> —> —> —> —> —> —>

Identify threat. The first responsibility of auditors within the
managed independence or objectivity process is to identify
possible threats to independence or objectivity. Any situa-
tions or circumstances that may cause internal auditors to
question their ability to act freely or without bias must be
identified as a threat. Even seemingly insignificant threats
to independence and objectivity should be identified dur-
ing this stage. Threats may arise from, but are not limited
to, issues relating to reporting or organizational deficien-
cies or to personal, financial, or task relationships. Threats
identified by auditors should be conveyed to the CAE so
that he or she can proactively manage the threats.
Assess significance of threat. The second stage of the pro-
cess requires auditors to assess the significance of the
threats to independence or objectivity identified in the
previous stage. Assessing significance requires those per-
forming internal audit services to consider whether threats
might compromise their independence or objectivity and
whether seemingly insignificant threats could intensify
over time. The assessment of the significance of threats
must be considered both in the context of immediate cir-
cumstances and expected or reasonably possible changes
in future circumstances.
Identify mitigating factors. After identifying and assessing
the significance of threats to independence or objectivity,
internal auditors should identify specific mitigating factors
that may alleviate the threats. Mitigating factors could in-
clude, but are not limited to, audit committee support, job
security issues, reputation capital, and legal/professional
penalties. Internal auditors should take care to identify
relevant mitigating factors in determining whether the
threat can be mitigated, and if so, how to best mitigate
the risk of compromised independence or objectivity.
Assess residual threat. After identifying mitigating factors
for related threats to independence or objectivity, an in-
ternal auditor must then determine whether these factors
have sufficiently mitigated the threats to allow the audi-

www.theiia.org/guidance / 13

tors to perform their audit work so the risk of ineffective
audits is minimal. The internal auditor must be cautious
to avoid assuming that the factors have adequately miti-
gated all of their independence or objectivity risks, and
should make this assessment from the perspective of per-
sons relying on the auditor’s judgments. In cases where
significant residual threats exist, or if the internal auditor
is not entirely sure of his or her own independence or ob-
jectivity, the assessment should be made or reviewed by
the CAE or, when necessary, senior management and/or
the audit committee.
Proactively manage residual threat. Threats to independence
or objectivity that are not sufficiently offset by mitigating
factors should be appropriately managed by auditors (to
the extent possible) to ensure audits can be performed
without interference and bias. Suggested tools to manage
residual threats to independence or objectivity include,
but are not limited to, strong audit charters, third-party
reviews, separation of audit duties, or contracting work to
another party.
Assess presence of unresolved threats. In this stage, audi-
tors must review any remaining threats that could not be
resolved adequately through the identification of mitigat-
ing factors or management efforts. Should the auditor
determine that significant unmitigated and unmanaged
threats to independence or objectivity remain, he or she,
in conjunction with appropriate parties, should then as-
sess whether it is still possible or practical to perform the
work. In many cases, it may be advisable to inform likely
users of the services about the unresolved threats prior to
beginning audit work. If, after advisement and consulta-
tion, the decision is that the work should be performed
despite unresolved threats to independence or objectivity,
reporting implications should be considered carefully.
IPPF – Practice Guide
Independence and Objectivity
Determine reporting and documentation implications. Identi-
fied mitigating factors and steps taken to manage threats
to independence or objectivity must be documented ad-
equately to provide an accurate record of auditors’ efforts
to achieve independence and objectivity. This record will
provide valuable information to the organization’s gov-
erning body and to professional quality assurance review
teams. Further, if the decision is made to undertake work
in the presence of material, unresolved threats to inde-
pendence or objectivity, auditors should report the de-
tails of the situation to the appropriate level (e.g., senior
management, the audit committee, or the board of direc-
tors or its equivalent). Unresolved threats also should be
disclosed in audit reports. Such communication prevents
users from unknowingly deriving unwarranted assurance
from work that was performed in the presence of a sig-
nificant unresolved threat to independence or objectivity.
Review and monitoring. For every audit engagement, the
CAE should conduct an overall review of the audit activity
and related staffing to determine whether independence
and objectivity were effectively managed. This would re-
quire the acceptance of engagements compatible with the
role of the internal audit activity in the organization. In
addition, the CAE should review and monitor the pro-
cess for managing threats to independence or objectivity
for individual audit engagements. Audit committees or
other similar bodies also can be part of the monitoring
and review process. Finally, the internal audit profession
requires quality assessments of internal audit activities.
These assessments should include the process to ensure
compliance with independence and objectivity standards.
The following table presents a framework for managing
threats to independence at all levels of auditor involve-
ment.
www.theiia.org/guidance / 14
 IPPF – Practice Guide
Independence and Objectivity

MANAGED INDEPENDENCE FRAMEWORK

Level Issues

I. Individual • Management of auditor independence

• Reporting relationship of the auditor

II. Engagement • Review auditor independence

• Access to information
• Freedom from influence or control by audit client

III. Internal Audit Activity • Ensure independence is managed (including third-party outsourcing)
• Organizational placement
• Strong charters

IV. Organization • Management interest in, and support of, independence

• Human resources policies (e.g., hiring, firing, promoting)
• Level of audit committee involvement

V. Profession • Standards-setting, education, and enforcement

• Active promotion of independence management
• Monitoring of profession-level results
• Certification

FOUNDATION: NEED FOR INDEPENDENCE

Level I depicts individual internal auditor-level issues. A gagements. The CAE may want to consider outsourcing
key component of independence is the reporting relation- an engagement if independence from audit clients cannot
ship of the internal auditor. be managed to an appropriate degree.

Level II depicts engagement-level issues. At this level,
freedom from undue influence or control by the audit cli-
ent is critical.
Level III depicts issues at the level of the internal audit
activity. The CAE is responsible for reporting any unmiti-
gated residual threats to independence to the audit com-
mittee or other appropriate parties, and for ensuring that
independence is appropriately managed on individual en-
Level IV depicts organization-level issues. Policies should
be established to ensure that auditors are free to conduct
audits and report results without interference. Ultimately,
the CAE should be actively involved with the audit com-
mittee or similar bodies to ensure the highest level of in-
dependence of the audit activity.
Level V depicts the profession level and encompasses
activities by professional bodies, such as The IIA. These

www.theiia.org/guidance / 15
 IPPF – Practice Guide
Independence and Objectivity

professional bodies can ensure that standards and guidance — which will enhance the internal auditor’s ability to manage
independence and guide organizations in establishing appropriate and adequate internal audit independence — are pro-
mulgated. In financial services and some other regulated industries, higher thresholds for accountability may necessitate
government review of independence documents. In other environments, regulatory encouragement and endorsement
often provide additional reinforcement on compliance with professional requirements.

The following table presents a framework for managing threats to objectivity at all levels of auditor involvement.

MANAGED OBJECTIVITY FRAMEWORK

Level Issues

I. Individual • Management of auditor objectivity

• Management of professionalism

II. Engagement • Review auditor objectivity

• Review auditor professionalism and the audit process

III. Internal Audit Activity • Rotation of employees on jobs

• Ensure objectivity is managed (including third-party outsourcing)
• Review hiring practices

IV. Organization • Management interest in objectivity

• Human resources policies (hiring, firing, promoting)
• Quality assurance reviews

V. Profession • Standards-setting, education, and enforcement

• Active promotion of objectivity management
• Monitoring of profession-level results
• Certification

FOUNDATION: NEED FOR OBJECTIVITY

Level I depicts individual internal auditor-level issues and
is the point at which threats to objectivity are identified
and proactively managed. It is also at this level that in-
ternal auditor professionalism (i.e., competence, integrity,
and the use of due care) is fostered. This professionalism
in turn cultivates objectivity.
Level II depicts engagement-level issues. The engagement
level is where a review of individual auditor objectivity and
related threats would take place, as well as the standard
review of audit practices, procedures, and judgments. Ap-
propriate supervision of the audit staff and review of audit
work can help encourage results that are bias-free.

www.theiia.org/guidance / 16
 IPPF – Practice Guide
Independence and Objectivity

Level III depicts issues at the level of the internal audit

activity. This is the point at which the CAE takes steps
to enhance objectivity, such as rotation of auditors on
engagements. The CAE also would be responsible for
reporting any unmitigated residual threats to objectivity
to the audit committee or other appropriate parties and
assuring that objectivity is appropriately managed on all
engagements.

Level IV depicts organization-level issues. The internal

audit activity must be given the freedom to appropriately
manage threats to objectivity. Management also should
actively support internal audit. Policies should be estab-
lished to ensure that auditors are not penalized for surfac-
ing problems and identifying issues in the organization.

Level V depicts the profession level and encompasses

activities by professional bodies, such as The IIA. These
professional bodies can ensure that standards and guid-
ance — which will enhance the internal auditor’s ability to
manage objectivity and offer certifications to enhance pro-
fessionalism and strengthen auditor objectivity — are pro-
mulgated. They also can help ensure process quality and
controls for objectivity through quality assurance peer re-
views. In some environments, regulatory encouragement
and endorsement often provide additional reinforcement
on compliance with professional requirements. Further,
educational programs can be offered to focus on enhanc-
ing objectivity and help auditors identify and understand
threats to objective judgments.

www.theiia.org/guidance / 17
 IPPF – Practice Guide
Independence and Objectivity

Author:
Steven E. Jameson, CIA, CFSA, CCSA, CPA, CBA, CFE

Contributors and Reviewers:

Douglas J. Anderson, CIA

Jacques R. Lapointe, CIA, CGAP

Sam M. McCall, PhD, CIA, CGAP, CPA, CGFM

Maria E. Mendes, CIA, CCSA

Melinda M. Miguel

Patricia A. MacDonald

James Rose, CIA

www.theiia.org/guidance / 18

Appendix
IPPF Guidance on Independence and
Objectivity
The Institute of Internal Auditors’ International Standards
for the Professional Practice of Internal Auditing (Stan-
dards) provides the following guidance related to indepen-
dence and objectivity.
1100 – Independence and Objectivity (Standard)
The internal audit activity must be independent, and in-
ternal auditors must be objective in performing their work.
Interpretation:
Independence is the freedom from conditions that threaten
the ability of the internal audit activity to carry out internal
audit responsibilities in an unbiased manner. To achieve the
degree of independence necessary to effectively carry out the
responsibilities of the internal audit activity, the chief audit
executive has direct and unrestricted access to senior man-
agement and the board. This can be achieved through a du-
al-reporting relationship. Threats to independence must be
managed at the individual auditor, engagement, functional,
and organizational levels.
Objectivity is an unbiased mental attitude that allows in-
ternal auditors to perform engagements in such a manner
that they believe in their work product and that no qual-
ity compromises are made. Objectivity requires that internal
auditors do not subordinate their judgment on audit matters
to others. Threats to objectivity must be managed at the indi-
vidual auditor, engagement, functional, and organizational
levels.
1110 – Organizational Independence (Standard)
The chief audit executive must report to a level within
the organization that allows the internal audit activity to
fulfill its responsibilities. The chief audit executive must
confirm to the board, at least annually, the organizational
independence of the internal audit activity.
IPPF – Practice Guide
Independence and Objectivity
Interpretation:
Organizational independence is effectively achieved when
the chief audit executive reports functionally to the board.
Examples of functional reporting to the board involve the
board:
• Approving the internal audit charter;
• Approving the risk-based internal audit plan;
• Receiving communications from the chief audit execu-
tive on the internal audit activity’s performance relative
to its plan and other matters;
• Approving decisions regarding the appointment and
removal of the chief audit executive; and
• Making appropriate inquiries of management and the
chief audit executive to determine whether there are
inappropriate scope or resource limitations.
– 1110.A1 – The internal audit activity must be free
from interference in determining the scope of inter-
nal auditing, performing work, and communicating
results.
Practice Advisory 1110-1:
Organizational Independence (Jan. 1, 2009)
1. Support from senior management and the board as-
sists the internal audit activity in gaining the coop-
eration of engagement clients and performing their
work free from interference.
2. The chief audit executive (CAE), reporting function-
ally to the board and administratively to the organi-
zation’s chief executive officer, facilitates organiza-
tional independence. At a minimum the CAE needs
to report to an individual in the organization with
sufficient authority to promote independence and to
ensure broad audit coverage, adequate consideration
of engagement communications, and appropriate
action on engagement recommendations.
www.theiia.org/guidance / 19

3. Functional reporting to the board typically involves
the board:
• Approving the internal audit activity’s overall
charter.
• Approving the internal audit risk assessment and
related audit plan.
• Receiving communications from the CAE on the
results of the internal audit activities or other
matters that the CAE determines are necessary,
including private meetings with the CAE without
management present, as well as annual confirma-
tion of the internal audit activity’s organizational
independence.
• Approving all decisions regarding the performance
evaluation, appointment, or removal of the CAE.
• Approving the annual compensation and salary
adjustment of the CAE.
• Making appropriate inquiries of management
and the CAE to determine whether there is audit
scope or budgetary limitations that impede the
ability of the internal audit activity to execute its
responsibilities.
4. Administrative reporting is the reporting relationship
within the organization’s management structure that
facilitates the day-to-day operations of the internal
audit activity. Administrative reporting typically
includes:
• Budgeting and management accounting.
• Human resource administration, including per-
sonnel evaluations and compensation.
• Internal communications and information flows.
• Administration of the internal audit activity’s poli-
cies and procedures.
1120 – Individual Objectivity (Standard)
Internal auditors must have an impartial, unbiased atti-
tude and avoid any conflict of interest.
IPPF – Practice Guide
Independence and Objectivity
Interpretation:
Conflict of interest is a situation in which an internal audi-
tor, who is in a position of trust, has a competing professional
or personal interest. Such competing interests can make it
difficult to fulfill his or her duties impartially. A conflict of
interest exists even if no unethical or improper act results. A
conflict of interest can create an appearance of impropriety
that can undermine confidence in the internal auditor, the
internal audit activity, and the profession. A conflict of inter-
est could impair an individual’s ability to perform his or her
duties and responsibilities objectively.
Practice Advisory 1120-1:
Individual Objectivity (Jan. 1, 2009)
1. Individual objectivity means the internal auditors
perform engagements in such a manner that they
have an honest belief in their work product and that
no significant quality compromises are made. Inter-
nal auditors are not to be placed in situations that
could impair their ability to make objective profes-
sional judgments.
2. Individual objectivity involves the chief audit execu-
tive (CAE) organizing staff assignments that prevent
potential and actual conflict of interest and bias,
periodically obtaining information from the internal
audit staff concerning potential conflict of interest
and bias, and, when practicable, rotating internal
audit staff assignments periodically.
3. Review of internal audit work results before the
related engagement communications are released as-
sists in providing reasonable assurance that the work
was performed objectively.
4. The internal auditor’s objectivity is not adversely
affected when the auditor recommends standards
of control for systems or reviews procedures before
they are implemented. The auditor’s objectivity is
considered to be impaired if the auditor designs,
installs, drafts procedures for, or operates such
systems.
www.theiia.org/guidance / 20

5. The occasional performance of non-audit work
by the internal auditor, with full disclosure in the
reporting process, would not necessarily impair
objectivity. However, it would require careful con-
sideration by management and the internal auditor
to avoid adversely affecting the internal auditor’s
objectivity.
1130 – Impairment to Independence or Objectivity
(Standard)
If independence or objectivity is impaired in fact or ap-
pearance, the details of the impairment must be disclosed
to appropriate parties. The nature of the disclosure will
depend upon the impairment.
Interpretation:
Impairment to organizational independence and individual
objectivity may include, but is not limited to, personal con-
flict of interest, scope limitations, restrictions on access to
records, personnel, and properties, and resource limitations,
such as funding.
The determination of appropriate parties to which the
details of an impairment to independence or objectivity
must be disclosed is dependent upon the expectations of
the internal audit activity’s and the chief audit executive’s
responsibilities to senior management and the board as de-
scribed in the internal audit charter, as well as the nature
of the impairment.
– 1130.A1 – Internal auditors must refrain from
assessing specific operations for which they were
previously responsible. Objectivity is presumed to be
impaired if an internal auditor provides assurance
services for an activity for which the internal audi-
tor had responsibility within the previous year.
– 1130.A2 – Assurance engagements for functions
over which the chief audit executive has responsibil-
ity must be overseen by a party outside the internal
audit activity.
IPPF – Practice Guide
Independence and Objectivity
– 1130.C1 – Internal auditors may provide consult-
ing services relating to operations for which they
had previous responsibilities.
– 1130.C2 – If internal auditors have potential
impairments to independence or objectivity relating
to proposed consulting services, disclosure must be
made to the engagement client prior to accepting
the engagement.
PA 1130-1: Impairment to Independence or
Objectivity (Jan. 1, 2009)
1. Internal auditors are to report to the chief audit
executive (CAE) any situations in which an actual or
potential impairment to independence or objectivity
may reasonably be inferred, or if they have questions
about whether a situation constitutes an impairment
to objectivity or independence. If the CAE deter-
mines that impairment exists or may be inferred, he
or she needs to reassign the auditor(s)
2. A scope limitation is a restriction placed on the in-
ternal audit activity that precludes the activity from
accomplishing its objectives and plans. Among other
things, a scope limitation may restrict the:
• Scope defined in the internal audit charter.
• Internal audit activity’s access to records, personnel,
and physical properties relevant to the performance
of engagements.
• Approved engagement work schedule.
• Performance of necessary engagement procedures.
• Approved staffing plan and financial budget.
3. A scope limitation, along with its potential effect,
needs to be communicated, preferably in writing, to
the board. The CAE needs to consider whether it
is appropriate to inform the board regarding scope
limitations that were previously communicated to
and accepted by the board. This may be necessary
particularly when there have been organization,
board, senior management, or other changes.
www.theiia.org/guidance / 21

4. Internal auditors are not to accept fees, gifts, or
entertainment from an employee, client, customer,
supplier, or business associate that may create the
appearance that the auditor’s objectivity has been
impaired. The appearance that objectivity has been
impaired may apply to current and future engage-
ments conducted by the auditor. The status of
engagements is not to be considered as justification
for receiving fees, gifts, or entertainment. The re-
ceipt of promotional items (such as pens, calendars,
or samples) that are available to employees and the
general public and have minimal value do not hinder
internal auditors’ professional judgments. Internal
auditors are to report immediately the offer of all
material fees or gifts to their supervisors.
PA 1130.A1-1: Assessing Operations for Which
Internal Auditors Were Previously Responsible (Jan.
1, 2009)
Persons transferred to, or temporarily engaged by, the in-
ternal audit activity should not be assigned to audit those
activities they previously performed or for which they
had management responsibility until at least one year has
elapsed. Such assignments are presumed to impair objec-
tivity, and additional consideration should be exercised
when supervising the engagement work and communicat-
ing engagement results.
PA 1130.A2-1: Internal Audit’s Responsibility for
Other (Non-audit) Functions (Jan. 1, 2009)
1. Internal auditors are not to accept responsibility
for non-audit functions or duties that are subject
to periodic internal audit assessments. If they have
this responsibility, then they are not functioning as
internal auditors.
2. When the internal audit activity, chief audit execu-
tive (CAE), or individual internal auditor is respon-
sible for, or management is considering assigning,
an operational responsibility that the internal audit
activity might audit, the internal auditor’s inde-
IPPF – Practice Guide
Independence and Objectivity
pendence and objectivity may be impaired. At a
minimum, the CAE needs to consider the following
factors in assessing the impact on independence and
objectivity:
• Requirements of the Code of Ethics and the Stan-
dards.
• Expectations of stakeholders that may include the
shareholders, board of directors, management, legis-
lative bodies, public entities, regulatory bodies, and
public interest groups.
• Allowances and/or restrictions contained in the inter-
nal audit charter.
• Disclosures required by the Standards.
• Audit coverage of the activities or responsibilities
undertaken by the internal auditor.
• Significance of the operational function to the orga-
nization (in terms of revenue, expenses, reputation,
and influence).
• Length or duration of the assignment and scope of
responsibility.
• Adequacy of separation of duties.
• Whether there is any history or other evidence that
the internal auditor’s objectivity may be at risk.
3. If the internal audit charter contains specific restric-
tions or limiting language regarding the assignment
of non-audit functions to the internal auditor, then
disclosure and discussion with management of such
restrictions is necessary. If management insists on
such an assignment, then disclosure and discussion
of this matter with the board is necessary. If the
internal audit charter is silent on this matter, the
guidance noted in the points below are to be consid-
ered. All the points noted below are subordinate to
the language of the internal audit charter.
4. When the internal audit activity accepts operational
responsibilities and that operation is part of the
internal audit plan, the CAE needs to:
www.theiia.org/guidance / 22
 IPPF – Practice Guide
Independence and Objectivity

• Minimize the impairment to objectivity by using a

contracted, third-party entity or external auditors to
complete audits of those areas reporting to the CAE.
• Confirm that individuals with operational respon-
sibility for those areas reporting to the CAE do not
participate in internal audits of the operation.
• Ensure that internal auditors conducting the as-
surance engagement of those areas reporting to the
CAE are supervised by, and report the results of the
assessment, to senior management and the board.
• Disclose the operational responsibilities of the inter-
nal auditor for the function, the significance of the
operation to the organization (in terms of revenue,
expenses, or other pertinent information), and the
relationship of those who audited the function.
5. The auditor’s operational responsibilities need to be
disclosed in the related audit report of those areas
reporting to the CAE and in the internal auditor’s
standard communication to the board. Results
of the internal audit may also be discussed with
management and/or other appropriate stakeholders.
Impairment disclosure does not negate the require-
ment that assurance engagements for functions over
which the CAE has responsibility need to be over-
seen by a party outside the internal audit activity.

www.theiia.org/guidance / 23
About the Institute
Established in 1941, The Institute of Internal
Auditors (IIA) is an international professional
association with global headquarters in Altamonte
Springs, Fla., USA. The IIA is the internal audit
profession’s global voice, recognized authority,
acknowledged leader, chief advocate, and princi-
pal educator.
About Practice Guides
Practice Guides provide detailed guidance for
conducting internal audit activities. They include
detailed processes and procedures, such as tools
and techniques, programs, and step-by-step ap-
proaches, as well as examples of deliverables.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category of
guidance, compliance is not mandatory, but it
is strongly recommended, and the guidance is
endorsed by The IIA through formal review and
approval processes. For other authoritative guid-
ance materials provided by The IIA, please visit
our website at www.theiia.org/guidance.
Disclaimer
The IIA publishes this document for informa-
tional and educational purposes. This guidance
material is not intended to provide definitive an-
swers to specific individual circumstances and as
such is only intended to be used as a guide. The
IIA recommends that you always seek indepen-
dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
anyone placing sole reliance on this guidance.
Copyright
Copyright ® 2011 The Institute of Internal
Auditors. For permission to reproduce, please
contact The IIA at guidance@theiia.org.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice Guide

INTEGRATED AUDITING

July 2012
 IPPF – Practice Guide
Integrated Auditing

Table of Contents

Executive Summary......................................................................................... 1

Introduction ................................................................................................... 1

Integrated Auditing...........................................................................................

1. Why use an integrated audit methodology?........................................... 2

2. Creating an integrated audit plan......................................................... 4
3. Conducting an integrated audit............................................................. 6
4. Integrated auditing in small audit activities.......................................... 6
Appendix : Integrated audit effectiveness checklist........................................ 8

Authors and Reviewers................................................................................... 9

www.globaliia.org/standards-guidance / C

Executive Summary
Historically, internal audits were associated with gain-
ing information about financial systems and the financial
records of an organization or a business. However, now
audits include non-financial subject areas, such as safety,
security, information systems performance, and environ-
mental concerns. With nonprofit organizations and gov-
ernment agencies, there has been an increasing need for
performance audits, examining success in satisfying mis-
sion objectives. As a result, there are audit professionals
who specialize in security audits, information systems au-
dits, and environmental audits. Integrating this knowledge
base into a single audit produces a more effective outcome
through a holistic approach. Decisions on risk evaluation
require an increased focus by auditors to broaden their
perspectives and think outside the box. The purpose of
this Practice Guide is to increase the internal auditor’s
awareness of integrated auditing and provide guidance on
how to approach an integrated audit.
Key sections in this guidance provide information to ex-
plain:
• Differences between an integrated audit approach
and a non-integrated audit approach.
• Advantages of an integrated audit approach.
• Situations when a non-integrated audit approach
may be more effective that an integrated approach.
• How to create an integrated audit plan.
• Consideration of the skills or specialized knowledge
needed to conduct an integrated audit.
• Integrated auditing in small audit activities.
The appendix in the guidance is a checklist of the key
questions a CAE should ask to ensure that the internal
audit activity is effectively using an integrated audit ap-
proach.
IPPF – Practice Guide
Integrated Auditing
Introduction
The International Professional Practices Framework
(IPPF) is the conceptual framework that organizes au-
thoritative guidance promulgated by The Institute of In-
ternal Auditors (IIA). The IPPF includes the Definition of
Internal Auditing, Code of Ethics, International Standards
for the Professional Practice of Internal Auditing (Stan-
dards), and strongly recommended guidance such as this
Practice Guide.
When performing integrated audit engagements, internal
auditors should consider the following standards outlined
in the IPPF:
• Standard 1200: Proficiency and Due Professional
Care.
• Standard 1210: Proficiency.
• Standard 2010: Planning.
• Standard 2200: Engagement Planning.
• Standard 2210: Engagement Objectives.
• Standard 2230: Engagement Resource Allocation.
• Standard 2240: Engagement Work Program.
The chief audit executive (CAE) should consider an in-
tegrated audit approach as part of the overall methodol-
ogy used by the internal audit activity. The objective is to
achieve a more effective and efficient audit engagement.
Current IPPF guidance provides a solid foundation for
this approach. This guide will discuss areas that enhance
the audit engagement by providing guidance on areas that
may differ between a prior traditional and current inte-
grated audit approach.
www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Integrated Auditing
1. Why use an integrated audit methodology?
What are the differences between an integrated audit
approach and a non-integrated audit approach?
An integrated audit differs from a non-integrated audit in
terms of scope and overall complexity. A traditional au-
dit and an integrated audit differ in scope and depth and
breadth of coverage. For example, a traditional audit may
focus on financial or operational aspects while an inte-
grated audit will take a more global approach that looks
at several aspects including, but not limited to, financial,
operational, IT, regulatory, compliance, environmental,
and fraud.
The complexity of an integrated audit is directly related to
its broader nature, which may require:
• The use of multiple audit techniques to accomplish
the desired outcome.
• Increased use of external resources or increased
knowledge of staff and additional skill sets.
• Enhanced project management skills to ensure coor-
dination and effective completion of the audit.
• A balanced approach to risk identification and rat-
ing, especially with unfamiliar areas that have not
been traditionally reviewed.
• Increased oversight and creativity to think outside
the box by the auditor, and communication among
all parties involved in the engagement.
• Changes in the current staffing model.
The internal audit activity should consider the use of mul-
tiple audit techniques when performing an integrated au-
dit to efficiently and effectively accomplish the desired
outcome of the engagement. Examples of these audit
techniques can include, but are not limited to, continu-
ous auditing, sampling, surveys, and data analysis. Many
of these are used in traditional audits but it is not com-
2 / www.globaliia.org/standards-guidance
mon practice to use them in tandem. The primary goal is
to think outside the box and consider use of appropriate
techniques to more efficiently drive the outcome of the
audit.
An integrated audit will require increased knowledge to
ensure appropriate risk identification and evaluation oc-
curs. The inclusion of personnel from various depart-
ments, external consultants, increased audit research,
training, and potential changes to the current staffing mod-
el may be required to enhance the audit team’s expertise.
Increased audit research and training could add time to
the audit and could increase costs. The audit team should
become familiar with available Internet audit resources
and training, which will provide the desired information
and help mitigate the increased costs. Understanding and
using available resources in other departments could be
an effective way to bring expertise to the audit without
increased costs. One suggestion is for the internal audit
activity to maintain an inventory of organization person-
nel who could be used as experts to supplement existing
audit resource knowledge. The audit team itself will be re-
quired to have the skill set to consolidate the information
gathered into a comprehensive risk assessment. Decisions
regarding risk evaluation will require coordination among
all parties to ensure appropriate risk ratings.
The more holistic view of an integrated audit requires the
auditor to modify his or her perspective and think beyond
the traditional audit scope. A crucial role in the success
of an integrated audit is the lead auditor (or auditor-in-
charge) due to the higher requirements regarding quali-
fications and audit project management capabilities. The
lead auditor should have a full understanding of the po-
tential risk of the audit activity under all aspects of the
audit scope. The lead auditor will be required to have suf-
ficient soft skills to ensure effective teamwork among the
audit staff and others who will provide expertise to the
engagement.

As noted, an integrated audit may require additional re-
sources to provide the knowledge base for risk identifica-
tion and evaluation. The lead auditor is responsible for
ensuring coordination among all areas and a balanced ap-
proach to risk identification and rating. The lead auditor
plays a pivotal role in the successful outcome of the en-
gagement plan. The lead auditor should ensure communi-
cation among all parties involved and timely completion of
audit activities. Increased project management skills are
required, and the use of a scheduling tool is suggested to
monitor completion.
Increased expertise may require modification of the audit
staffing plan. This could include hiring staff with specific
expertise in regulatory compliance or environmental engi-
neering. The type of expertise is organization and audit-
scope dependent.
The overall complexity of an integrated audit is manage-
able if the right personnel are involved. This includes the
willingness of departments within an organization to share
expertise and the knowledge and skill set of the lead audi-
tor. The willingness to commit the appropriate resources
is required to ensure successful outcomes of these larger,
broader scope audits.
What are the advantages of an integrated audit ap-
proach?
Adopting an integrated audit approach can increase the
internal audit activity’s credibility, resulting in increased
relevance of its work and a greater opportunity to be seen
as an essential participant in major projects from the out-
set. Many find that auditors increase their confidence and
become more proficient in other facets of the organiza-
tion’s operations, increasing their effectiveness. Other ad-
vantages include increased coverage, improved reporting
and more effective risk assessments and audit planning.
IPPF – Practice Guide
Integrated Auditing
When is a traditional audit approach more effective
than an integrated audit approach?
The adoption of an integrated audit strategy does not
mean that limited scope audits will no longer be used.
Risk assessments may suggest that the audit of high risk in
a single element should be the priority. This might result
in a more narrow scope audit. Examples are an audit of
compliance with regulatory requirements for loan docu-
mentation or an audit of the completeness and accuracy
of management information.
Certain constraints may limit the effectiveness of an in-
tegrated audit approach, including resource or budget
constraints. Where the audited activity is carried out by
a small team, it may be necessary to limit the number of
auditors involved in an assignment to avoid disruption to
day-to-day business activity.
In summary, various audit approaches should be consid-
ered. The CAE should determine the best approach based
on the organization, activity to be audited, and available
resources. Use of multiple audit approaches could com-
plement each other.
www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Integrated Auditing

2. Creating an integrated audit plan What additional dimensions to the audit are there?
For an organization to embrace integrated auditing, the • Extended risk identification and risk evaluation.
corporate governance framework should be sufficiently • Identification of controls over the broader scope
mature. The board1 should be satisfied that the internal area.
audit activity has sufficient technical and managerial skills
• Additional resources required, headcount and exper-
to undertake an integrated audit. These skills will include
tise, to execute the integrated audit plan.
technical abilities, and interpersonal and management
skills required to perform a broader scope audit. • Approval by the CAE to complete the integrated
audit plan.

1. There is a growing trend for boards to request audits of legal issues related to contracts, regulatory compliance, or other stakeholder concerns.
An integrated audit approach may be most effective.

2. Boards and senior management may require continuous monitoring in the organization to enable assurance across the organization, and for this
assurance to be provided in real time. An integrated audit may be the most efficient and effective approach.

3. There is a growing requirement for assurance in areas, such as IT governance and cloud computing. Assurance in these areas could be outside of the
expertise of the traditional audit department, yet could be addressed in an integrated audit.

Figure 1

Figure 1 provides examples where an integrated audit For example, is the research and development function
should be considered. producing new designs and products? Is process control
equipment and software properly safeguarded? Are finan-
Step One: Review the risk management cycle. cial instruments being appropriately tested? Are regula-
tory issues being addressed? Is sufficient lobbying being
Ask the following questions: undertaken where appropriate? Is reputation being safe-
guarded? Are there reviews of these areas taking place,
• Does the existing risk management process have and are they included in the assurance passed to senior
sufficient reach to capture all significant risks – i.e., management and the board?
events that could prevent the organization’s objec-
tives from being achieved? The answers to these or similar questions could indicate
• For the audit universe being considered, is the risk risks not addressed by the internal audit activity. When
map facing the whole organization? This will include risks of this breadth are identified, an audit of these areas
areas previously seen as outside the scope, capabil- could require a specialized level of knowledge that could
ity, or expertise of the internal audit function. be incorporated into an integrated audit plan.

1
As defined in the Standards glossary, “A board is an organization’s governing body, such as a board of directors, supervisory board, head of an agency or legislative body, board of governors or
trustees of a nonprofit organization, or any other designated body of the organization, including the audit committee to whom the chief audit executive may functionally report.”

4 / www.globaliia.org/standards-guidance

Step Two: Overview of internal controls.
Having identified the broader risk universe, internal audit
should review controls related to these risks.
For example, within the organization there may be dupli-
cation of control processes within the dispatch of goods
for sale, such as verification of paperwork, electronic ac-
cess systems, manual supervision, and closed caption
television (CCTV) surveillance. It is possible that all of
these individual controls may be tested separately such as
verification of paperwork (under a review of accounts pay-
able), testing of electronic access (under a review of the
facilities department), sample testing of manual supervi-
sion (in a review of the dispatch department), and CCTV
use (in a review of the security function).
Integrated auditing, in this example, would require that
the audit process focus on controlling the dispatch and
recording of the items rather than individual transaction
audit and systems audits.
Step Three: Identify the level of expertise required.
The CAE should consider the expertise that would not
normally fall within the historical internal audit approach.
The expertise needed to perform the review may exist
within the organization but not be part of the internal
audit activity, or an expertise gap may be identified that
should be outsourced.
Step Four: Consider methods and timing.
Map out the methods and timing of the audit coverage
required with the new, enlarged list of risks. This is a
straightforward process of calculating the man-hours re-
quired for each task.
IPPF – Practice Guide
Integrated Auditing
Step Five: Calculate resources.
Calculate the resources required, in terms of existing ca-
pacity within the internal audit activity and within the or-
ganization, and any new capacity that would be required,
such as persons qualified to review specific areas. An out-
put of this calculation will be the component cost of per-
forming the integrated audit.
Step Six: Prioritize auditable activities within the audit
plan.
It is important that the criteria used to compare and eval-
uate risks in all areas across the organization to be ad-
dressed in the integrated audit program have a common
scoring system.
Step Seven: Combine the costs.
The cost of the integrated audit plan should be deter-
mined. This is a simple process of combining the costs
identified in Step Five with the prioritized list of audits
identified in Step Six.
Step Eight: Seek board approval.
The CAE should be prepared to answer the following
questions when presenting an integrated audit plan as
part of the overall set (scheduled) of audits presented to
the board for approval:
• Does the integrated audit approach give greater as-
surance to the board and senior management. Can
this be demonstrated?
• Is the integrated audit plan deliverable?
• What is the cost? Is there a cost of audit vs. assur-
ance equation metric that demonstrates the benefit
of this approach?
www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Integrated Auditing
3. Conducting an integrated audit
Issues for the Lead Auditor
During audit planning, the lead auditor should understand
all facets of the audit plan and what skills or specialized
knowledge may be required to execute it. The lead auditor
should build a team with the combined knowledge and
experience to assess the risks and controls relevant to the
activity under review. In building such a team, the lead
auditor should consider whether increasing the team’s lev-
el of specialized skills or knowledge is needed to improve
the quality of the audit.
The team leader should supervise the work of the spe-
cialist to confirm there is sufficient evidence of any er-
rors identified or procedural/control deficiencies reported.
The team leader can promote development of internal
auditors by having audit staff work closely with the spe-
cialist to assure a transfer of skills and knowledge to the
audit team. The expectations of the work to be performed
by the specialist should be communicated clearly by the
team leader.
Staffing an integrated audit team
Effective audit team member selection including those
with specialized skills or knowledge is necessary to achieve
a positive outcome from an integrated audit. Smaller audit
activities may not have staff with specific audit specializa-
tions to ensure adequate staffing of the audit team. Co-
sourcing, guest auditors, or the use of internal or external
specialists are common solutions to this challenge. Spe-
cialists will complement the skill sets and organizational
knowledge of existing staff. All team members should un-
derstand their role and how it relates to the audit and risks
of the activity under review.
Competencies of the integrated audit activity
The CAE has options for staffing the audit department to
ensure it has the skills, knowledge, and specialties neces-
sary for successful integrated audits.
6 / www.globaliia.org/standards-guidance
Internal auditors should be provided opportunities to ob-
tain the knowledge and skills necessary to undertake any
type of audit. IIA Standard 1210: Proficiency states all
internal auditors should have the knowledge, skills, and
other competencies needed to perform their individual
responsibilities. However, the cost and time to train all
internal auditors in all aspects could be prohibitive for
many organizations. The best use of resources may be to
use internal auditors and specialists in those areas of work
they are trained to perform and are most competent in
executing.
Internal auditors with a broad range of skills may be a
retention risk because of their increased marketability.
Excessive staff turnover may lead to a cycle of retraining
to replace lost staff. This possibility should not prevent
organizations from adopting an aggressive training strategy
to broaden the activity’s skill and knowledge base. CAEs
need to consider their retention strategy to prevent loss
of staff. Training on new skills can be part of a positive
retention strategy.
4. Integrated auditing in small audit activi-
ties
Many smaller audit activities are structured to suit the
nature and scale of the businesses that they serve. Such
organizations may include the following common charac-
teristics:
• One to five auditors.
• Productive internal audit hours below 7,500 a year.
• Limited level of cosourcing or outsourcing.
A smaller audit activity may not have the infrastructure to
support an integrated audit program/plan relative to what
a larger function might be able to support.
To effectively leverage integrated auditing within a small
audit shop, broader consideration should be given to how
integrated auditing may be leveraged to support the risk
management objectives of the organization.

IIA Standard 2000: Managing the Internal Audit Activ-
ity requires that the CAE effectively manage the internal
audit activity to ensure it adds value to the organization.
By leveraging a risk-based model, engagement planning
performed through an integrated risk assessment lens can
afford a smaller audit activity the opportunity for greater
efficiency and support effective risk coverage within the
audit program and objectives. The concept of integrated
auditing may often include resources external to the de-
partment possessing subject matter or technical audit
expertise to better support engagement planning and
scoping across multiple risk areas. In some cases, these
resources may be sourced from within the organization,
provided objectivity of resources is maintained. In other
cases, resources possessing the needed subject or tech-
nical expertise to guide engagement scope development
may be externally sourced. Department staff should work
with sourced specialists and leverage learning opportuni-
ties where possible. In cases where training dollars may
support needed staff skills or knowledge for multiple en-
gagements, such opportunities should be provided.
Development of risk-based audit procedure checklists,
scoping mechanisms, and common testing methodologies
to frame engagements best suited to an integrated model
will drive efficient execution and are useful. Common
considerations in the planning stage should include en-
gagement complexity, engagement duration, staffing, and
the value of such checklists (i.e., potential for engagement
recurrence). Such material could drive the development
of integrated audit work program templates, which will
lessen the time needed by staff to effectively complete
engagements and meet engagement objectives.
Smaller audit activities may choose to staff an engagement
based on the underlying risk coverage of the areas being
examined. CAEs are encouraged to be more involved in
higher risk or complex engagements.
Assignment of audit procedures and coordination of com-
IPPF – Practice Guide
Integrated Auditing
pletion is essential within a smaller audit activity. Com-
munication among the team members is critical to ensure
that the engagement is performed in the most efficient
and effective manner. Because many small audit activities
are in smaller organizations, auditees may have many ar-
eas of responsibility and be subject to multiple priorities.
The emphasis in such an environment should be effective
client and data management to support timely engage-
ment completion and related reporting.
The engagement execution process will be the same as
that of other engagements performed in accordance with
the Standards. Consideration may need to be given by the
CAE in reporting effectively on the results of work per-
formed. Engagement-specific reporting should be defined
if required as part of engagement planning. This should
include expected content and format of communications,
guidance regarding to whom the communications should
be addressed, and whether others outside of the func-
tion should be consulted prior to finalization and release.
Integrated audit engagements include the consideration
of multiple risk areas; any reported findings will likely
require a broader audience for socialization and related
coordination to secure needed management action plans.
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Integrated Auditing
APPENDIX:
Integrated audit effectiveness checklist
The following are key questions the CAE should ask to
ensure that the internal audit activity is effectively using
an integrated audit approach. An effective integrated
audit approach would encompass all areas of coverage for
the audit. These areas of coverage can include, but not
be limited too, financial, operational, IT, environmental,
fraud, and compliance.
1. Annual Audit Plan
a. Does the audit plan incorporate coverage of all high
risk areas?
b. Is each auditable activity defined to ensure it covers
areas within its scope?
c. Is the risk assessment performed in an integrated
manner? For example, do the risk assessment risk
factors ensure coverage of high risk areas?
d. Is the description of each factor included?
2. Written Communication
a. Does your written issue sheet identify the root cause
through analysis of areas within the scope of the
auditable activity?
b. Do recommendations ensure inclusion of areas or
factors that would affect the root cause?
c. Is the overall opinion, if one is used, reflective of the
observations made and considered in alignment with
the framework identified in planning?
3. Audit Plan (Engagement)
a. Does coverage for the audit include an overall
framework?
b. Does the staffing model complement the engage-
ment scope?
c. Do team members understand how their work ac-
tivities interrelate and affect the audit objectives and
scope?
8 / www.globaliia.org/standards-guidance
d. Do conclusions on specific audit tests address
the control framework setup in the audit planning
phase?
e. Do engagement team members periodically meet
to ensure all members understand what they are
intending to accomplish, and do their conclusions
align with the framework established during plan-
ning?
f. Throughout the audit, are team members aware of
the interrelationships of various controls to effec-
tively and properly assess the impact of any deficien-
cies?
g. Was an integrated audit approach considered?
h. If the team decided an integrated audit approach
would not facilitate the achievement of the stated
engagement objectives, are the reasons noted?
4. Staffing Model
a. Does the staffing model meet the needs of the spe-
cific audit project?
b. For the current year annual audit plan, is knowl-
edgeable external or internal staffing available for
the audit team’s support? If not, is training planned
to broaden the knowledge of the audit team prior to
audit initiation?
5. Post-engagement Assessments
a. Do the self-assessments, peer reviews, and depart-
ment quality standards ensure integrated engage-
ment objectives are achieved and align with the
planning framework?
b. Does the assessment include discussions/feedback
on how team members learned from the integrated
audit process (e.g., operational auditors understand-
ing IT controls)?
c. Do management survey responses indicate that the
integrated approach provides value-added results.
 IPPF – Practice Guide
Integrated Auditing

Authors:
James Reinhard, CIA, CPA, CISA

Brad Ames, CPA, CISA

Andrew Robertson

Rita Thakkar, CIA, CPA, CA

Ryon Pulsipher, CPA

David Bentley

Reviewers:
Steve Hunt, CIA, CISA, CRMA, CGEIT, CRISC, CBM

Steven Jameson, CIA, CCSA, CFSA, CRMA, CPA, CFE

www.globaliia.org/standards-guidance / 9
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120606
 IPPF – Practice Guide

Interaction
with the Board

August 2011
 IPPF – Practice Guide
Interaction with the Board

Table of Contents

Executive Summary...................................................................................... 1

Introduction.................................................................................................. 1

1000 – Purpose, Authority, and Responsibility............................................ 1

Internal Auditing’s Relationship with the Board......................................... 3

A. Frequent Communication with Board Members Between Meetings ........ 3

B. Communicating Sensitive Matters........................................................... 4

C. International and Industry Considerations............................................... 5

D. CAE Turnover........................................................................................... 5

Communicating through a Risk-based Audit Plan...................................... 5

Board Reporting .......................................................................................... 6

A. Key Focus Areas...................................................................................... 6

B. System of Internal Control....................................................................... 7

C. Status of Audit Plan and Audit Resources............................................... 7

D. Distribution of Audit Reports................................................................... 7

E. Fraud/Investigations............................................................................... 7

F. Open Audit Issues.................................................................................... 8

G. Quality Assessments............................................................................... 8

H. Board Education Opportunities............................................................... 8

Administration and Coordination of Board Activities................................ 8

www.theiia.org/guidance / B

Executive Summary
Boards and internal auditors have interlocking goals. A
strong working relationship between the two is essential
for the internal audit activity to fulfill its responsibilities
to not only the board, but also senior management, share-
holders, and other stakeholders, as appropriate. The chief
audit executive (CAE) often reports directly to the board,
depending on the organization’s governance structure. An
effective internal audit activity provides the board assur-
ance and suggests improvement opportunities related to
the organization’s governance, risk management, and re-
lated internal controls. Board responsibilities encompass
activities that are beyond the scope of this guide, and in
no way is this guide intended to be a comprehensive de-
scription of those responsibilities.
There are several activities, primarily accomplished
through the CAE, that are key to an effective relationship
between the board and the internal audit activity:
• Maintaining effective communication with the board
and the chair, including communicating openly and
candidly with the board.
• Developing a risk-based audit plan that meets the
relevant objectives of the board charter and com-
municating the internal audit activity’s performance
relative to the plan.
• Formally and informally reporting to the board regu-
larly and timely.
• Assisting the board in ensuring that its charter,
activities, and processes are appropriate to fulfill its
responsibilities.
• Ensuring that internal auditing’s charter, role, and
activities are clearly understood and responsive to
the needs of the board.
• Assisting the board in understanding changes in the
regulatory and business environment relating to
IPPF – Practice Guide
Interaction with the Board
governance, risk management, compliance, and
related internal controls.
Introduction
The purpose of this practice guide is to assist the chief
audit executive (CAE) in meeting the requirements of the
International Professional Practices Framework (IPPF)
as it relates to interacting and communicating with the
board. The IPPF’s Glossary defines the board as “an or-
ganization’s governing body, such as a board of directors,
supervisory board, head of an agency or legislative body,
board of governors or trustees of a nonprofit organization,
or any other designated body of the organization, includ-
ing the audit committee to whom the chief audit execu-
tive may functionally report.”
The IPPF outlines the following International Standards
for the Professional Practice of Internal Auditing (Stan-
dards), the Practice Guides, and the Practice Advisories
pertaining to interacting and communicating with the
board:
1000 – Purpose, Authority, and
Responsibility
The purpose, authority, and responsibility of the internal
audit activity must be formally defined in an internal au-
dit charter, consistent with the Definition of Internal Au-
diting, the Code of Ethics, and the Standards. The chief
audit executive must periodically review the internal au-
dit charter and present it to senior management and the
board for approval.
1100 – Independence and Objectivity
The internal audit activity must be independent, and
internal auditors must be objective in performing their
work. This can be achieved through a dual-reporting re-
lationship.
www.theiia.org/guidance / 1

1110 – Organizational Independence
The CAE must report to a level within the organization
that allows the internal audit activity to fulfill its respon-
sibilities. The CAE must confirm to the board, at least
annually, the organizational independence of the internal
audit activity.
1111 – Direct Interaction with the Board
The CAE must communicate and interact directly with
the board.
Practice Guide: Chief Audit Executive – Appoint-
ment, Performance Evaluation and Termination.
The CAE will have a high degree of interaction with se-
nior management and the board and thus needs to dem-
onstrate the right attributes and skills for the position.
1300/1310 – Quality Assurance and Improvement
Program
The CAE must develop and maintain a quality assurance
and improvement program that covers all aspects of the
internal audit activity. The quality assurance and im-
provement program must include both internal and exter-
nal assessments.
2020 - Communication and Approval
The CAE must communicate the internal audit activity’s
plans and resource requirements, including significant in-
terim changes, to senior management and the board for
review and approval. The CAE must also communicate
the impact of resource limitations.
Practice Advisory 2020-1 – Communication and Ap-
proval
1. The CAE will submit annually to senior manage-
ment and the board for review and approval a
summary of the internal audit plan, work schedule,
staffing plan, and financial budget. This summary
will inform senior management and the board of the
scope of internal audit work and of any limitations
IPPF – Practice Guide
Interaction with the Board
placed on that scope. The CAE will also submit all
significant interim changes for approval and infor-
mation.
2. The approved engagement work schedule, staffing
plan, and financial budget, along with all significant
interim changes, are to contain sufficient informa-
tion to enable senior management and the board to
ascertain whether the internal audit activity’s objec-
tives and plans support those of the organization and
the board and are consistent with the internal audit
charter.
Standard 2060 – Reporting to Senior Management
and the Board
The CAE must report periodically to senior management
and the board on the internal audit activity’s purpose, au-
thority, responsibility, and performance relative to its plan.
Reporting must also include significant risk exposures and
control issues, including fraud risks, governance issues,
and other matters needed or requested by senior manage-
ment and the board.
Practice Advisory 2060-1 – Reporting to Senior Man-
agement and the Board
The frequency and content of reporting are determined
in discussion with senior management and the board and
depend on the importance of the information to be com-
municated and the urgency of the related actions to be
taken by senior management or the board.
2420 – Quality of Communications
Communications must be accurate, objective, clear, con-
cise, constructive, complete, and timely.
Practice Advisory 2420-1 – Quality of
Communications
1. Gather, evaluate, and summarize data and evidence
with care and precision.
2. Derive and express observations, conclusions, and
www.theiia.org/guidance / 2

recommendations without prejudice, partisanship,
personal interests, and the undue influence of others.
3. Improve clarity by avoiding unnecessary technical
language and providing all significant and relevant
information in context.
4. Develop communications with the objective of mak-
ing each element meaningful but succinct.
5. Adopt a useful, positive, and well-meaning content
and tone that focuses on the organization’s objec-
tives.
6. Ensure communication is consistent with the orga-
nization’s style and culture.
7. Plan the timing of the presentation of engagement
results to avoid undue delay.
2440 – Disseminating Results
The CAE must communicate results to the appropriate
parties.
Practice Advisory 2440-2 – Communicating Sensi-
tive Information Within and Outside the Chain of
Command
Once the internal auditor has deemed the new informa-
tion substantial and credible, he or she would normally
communicate the information — in a timely manner — to
senior management and the board.
Internal Auditing’s Relationship
with the Board
A strong relationship between internal auditing and the
board enhances the internal audit activity’s ability to ac-
complish the objectives defined in the audit charter. The
CAE generally is the primary conduit for developing and
maintaining that relationship; however, other members
IPPF – Practice Guide
Interaction with the Board
of the internal audit activity also may contribute through
participation at board meetings and in preparing materi-
als for the board. Furthermore, the entire internal audit
activity contributes to the relationship by thoroughly and
professionally executing projects and analyzing the results
of those projects. A strong relationship is based on trust
and credibility that should grow and strengthen through
timely and relevant interactions and communications.
The CAE and board should establish a clear understand-
ing of the expectations of the internal audit activity. These
expectations are formally presented in the board and inter-
nal audit activity charters and annual plans, which should
be periodically reviewed and approved. Most boards have
additional expectations that evolve based on company per-
formance, industry trends, and perspectives held by each
board member. The CAE should understand these expec-
tations so that he or she can take the appropriate steps
to meet them. The tasks and responsibilities of a CAE
from one organization to another vary widely based on the
organization’s governance structure and the nature of the
CAE’s functional reporting relationship to the board.
A. Frequent Communication with Board
Members Between Meetings
Clear, relevant, and frequent communication between the
CAE and members of the board is essential. Due to the
complexity and significance of today’s business and re-
lated risks, frequent discussions with the chair and other
members of the board may need to supplement regular
formal board meetings and communications. Depending
on the organizations and individuals involved, it may be
best for the communications to follow a predefined pro-
tocol, such as:
• Regular meetings with individual board members
with a pre-set agenda.
• More frequent meetings between the board chair
and CAE depending on the issues facing the organi-
zation and the preferences of the chair.
www.theiia.org/guidance / 3

• Periodic communications on relevant issues.
In many organizations, the relationship between the CAE
and board members is very cohesive, which tends to lead
to more ad-hoc communications — not just about critical
issues but also less pressing issues as well. Many CAEs
find the interaction with board members on routine busi-
ness issues to be helpful to building a relationship as a
trusted business advisor and in maintaining awareness of
what’s going on in the organization.
• Regardless of the communication media used, basic
guidelines include:
• Make sure information is timely, relevant, fact based,
balanced, objective, and complete.
• Consider formality and tone of communications to
ensure they are appropriate.
• Avoid making presumptuous comments without suf-
ficient facts.
• Consider the repercussions that commentary on
control weaknesses and other management failures
can create.
• Document communications if required for profes-
sional or business reasons.
• Do not wait until there is a need to address a sensi-
tive or contentious issue to start building a strong
relationship with the board.
• Manage potential conflict between the board and
management in accordance with the responsibilities
established in the internal audit charter.
Standard 2420 – Quality of Communications and the re-
lated Practice Advisory 2420-1 – Quality of Communica-
tions provides guidance for good communications to the
board whether in a formal meeting setting or a less formal
face-to-face meeting.
B. Communicating Sensitive Matters
The necessity to deal with sensitive issues such as senior
management’s failure to manage strategic and/or opera-
IPPF – Practice Guide
Interaction with the Board
tional risk, as well as ethically questionable behaviors and
actions (including fraud) could arise at any time. Con-
sequently, the CAE must possess highly developed oral
and written communication skills to convey information
to all concerned stakeholders in a timely and appropri-
ate fashion. Effective communication of sensitive issues
depends on the establishment of effective formal and in-
formal communication channels and strong relationships
with management and board members that are based on
trust and credibility.
Depending on the facts and circumstances of the sensi-
tive issue, the CAE should consider consulting with key
members of management such as the general counsel
(head of legal department). The following basic guidelines
should be considered:
• Facts and details are available and documented.
• Findings can be verified and opinions and conjecture
are clearly articulated as such.
• Communication is timely and urgent (and truly of a
sensitive nature).
The CAE may be faced with a situation where manage-
ment attempts to delay reporting of an issue, leaves out
some or all of the critical elements, or disagrees that the
issue should be reported to the board. The CAE should
carefully consider the significance of such issues and de-
termine to what extent the issue should be elevated. The
CAE should also consider his or her obligations with re-
spect to the IIA’s Code of Ethics, the internal audit char-
ter, the organization’s code of conduct, and applicable
laws and regulations. The best approach will depend on
the sensitivity and complexity of the issue, the culture of
the organization, the governance structure, and applicable
laws/regulations.
When it is determined that a sensitive issue should be
elevated, it is essential that the CAE communicate di-
rectly with the board chair or similar person of author-
ity depending on the governance structure. Communica-
www.theiia.org/guidance / 4

tion, especially on significant or sensitive issues, is best
handled when based on a professional, trusted relation-
ship with the chair and other board members. The CAE
should prepare documentation of the communication that
includes relevant support. The CAE should recognize that
formal or informal discussions of sensitive issues with in-
dividuals other than the chair might jeopardize the CAE’s
credibility with the chair and indirectly with other mem-
bers of the board and management.
The Practice Advisory 2440-2 – Communicating Sensitive
Information Within and Outside the Chain of Command
provides additional guidance.
C. International and Industry Considerations
Governance and ownership structures differ from coun-
try to country and among industries. In some countries,
there exists a two tier board system that differentiates be-
tween the supervisory function (supervisory board) and
the operative management function (board of manage-
ment). In such cases, the internal audit activity may not
report directly to the board, but to the owner or even to
senior management, such as the chief executive officer or
financial officer or chief operating officer. Although basic
organizational structures vary, the principles and practices
outlined in this Practice Guide are still relevant. Most
statements referring to the “board” in this practice guide
should then be interpreted as the executive to whom the
CAE reports (disciplinary / administratively). In addition,
there should be a defined reporting relationship to the su-
pervisory board. In most cases, the audit committee is the
subcommittee of the supervisory board. Reporting to the
audit committee should be coordinated with the executive
to whom the CAE reports (if not the CEO) and the CEO.
The CAE should also ensure that the IIA activity appro-
priately coordinates with other internal functions, such
as regulatory compliance, law, human resources, security
and others.
IPPF – Practice Guide
Interaction with the Board
D. CAE Turnover
The board typically has oversight of the turnover of the
CAE, if not the responsibility to approve/direct the depar-
ture of a CAE and the hiring of a replacement. The role of
the board in this activity helps ensure the CAE’s indepen-
dence and that he or she has the competencies necessary
to perform in the position.
When first appointed to this position, or exiting this po-
sition, the CAE should work closely with the board to
ensure complete transparency as to the reasons for the
change.
The Practice Guide: Chief Audit Executive – Appointment,
Performance Evaluation and Termination provides addi-
tional guidance.
Communicating through a
Risk-based Audit Plan
One of the most important aspects of interacting with the
board is gaining their confidence that the internal audit
activity is fully engaged with senior management across
the organization to monitor and mitigate risks, alert to
emerging risks, aligned with stakeholders on risk view, and
has an audit plan that demonstrates how Internal Audit
is assisting the board in meeting their responsibilities for
oversight of risk management, compliance, and related in-
ternal controls.
An audit plan can be a framework and mechanism for
communication to the board as the CAE should provide
the board with regular updates on its work and the status
of the audit plan. The board should approve the audit plan
and contribute to its development.
The CAE should use risk assessment techniques in devel-
oping the internal audit activity’s plan and in determining
www.theiia.org/guidance / 5

priorities for allocating internal audit resources. Risk as-
sessment is used to select areas to include in the internal
audit activity’s plan. Also, the CAE should seek guidance
on what the board and the company considers important
to assist in assessing risks, prioritizing projects and allocat-
ing audit resources.
A significant part of laying the groundwork for prepara-
tion of a risk-based audit plan is having an understanding
of the risk appetite of your primary stakeholders – gener-
ally the board and senior management. Risk appetite is
the level of risk that the stakeholders are willing to accept
in the course of doing business. It is a key factor in de-
veloping a risk-based audit plan. Understanding the risk
appetite can be achieved by reviewing the organization’s
risk management philosophy or risk policy; holding dis-
cussions with the group responsible for risk management,
the board, and senior management; and, with respect to
financial reporting risk, meeting with the chief financial
officer and the external auditor. The CAE incorporates
these inputs, develops the audit plan, and presents the
proposed audit plan to management for review and the
board for approval.
Regularly, e.g. quarterly, brief discussions with the board
on risk themes, their continued relevance, and emerging
risks should be held. A review/update of the audit plan
may be necessary to ensure that it continues to include
the most relevant risks. The board should also understand
which significant risks are not addressed, and whether
sufficient resources are available to meet requirements.
In short, the board needs to understand how Internal Au-
dit is assisting the board to meet its responsibilities.
For further information on leveraging Enterprise Risk Man-
agement into the audit planning process, see PA 2010-2:
Using the Risk Management Process in Internal
Audit Planning (July 2009) and PA 2050-2: Assur-
ance Maps (July 2009).
IPPF – Practice Guide
Interaction with the Board
Board Reporting
The board, like everyone else, has limited time and in-
creasing responsibilities. The CAE’s communication,
handouts, and reports to the board should be risk-focused.
A good guideline for interacting with the board is to un-
derstand where its interests lie and to set expectations to
report on those areas on an exception basis. Additionally,
the reporting requirements of the internal audit charter
should be considered.
For formal board meetings, all parties can be better served
if read-only materials are relevant, complete, and risk-
based, leaving the face-to-face meeting time for further
discussions of meaningful items or questions.
Listed below are areas to consider for formal board com-
munications.
A. Key Focus Areas
Key focus areas are a combination of critical matters that
warrant board attention — the risk themes established
during audit planning, any emerging risk themes that
come up during the year, and issues related to special as-
signments. The CAE should ensure that communications
are appropriately calibrated to enable the board to under-
stand the severity or significance of issues.
The board should be kept current on what has been done:
results to date, improvement plans, progress against im-
provement plans, current assessment of the risk area, and
what has been planned in all key areas/themes.
Although this document advocates limiting reporting to
the board to significant items and on an exception basis,
the board needs insight into what is going on throughout
the organization, even in lower risk areas. Today’s develop-
ing trend may be tomorrow’s emerging risk issue. Trend
analysis of audit results can often reveal areas where man-
agement attention is warranted, and only a slight change
www.theiia.org/guidance / 6

in emphasis may stop a trend from becoming an emerging
issue.
B. System of Internal Control
One of the elementary measures of the fundamental
soundness of an organization is the maturity and efficacy
of the system of internal control. Similar to trends, in-
ternal auditing’s analysis of and thoughts on the system
of internal control can serve to both keep the board in-
formed and provide the impetus for management to draft
and implement improvements. It is particularly important
for management, through effective monitoring activities,
to ensure that the system of internal control continues to
operate effectively over time. Internal audit should report
to the board on the effectiveness of monitoring activities
undertaken by management.
The CAE should understand if the board values an opin-
ion on governance, risk management, and internal con-
trols and the scope of work required to provide such as-
surance.
C. Status of Audit Plan and Audit Resources
The CAE should discuss the status of the audit plan with
the board on a regular basis. The CAE should inform
the board of changes to the audit plan and the rationale
behind them. The CAE and the board should establish
an understanding regarding changes to the plan and the
protocol for seeking board approval of such changes.
Generally changes to the audit plan should be expected,
depending on the dynamics of each organization and
changes in its industry and operating environment.
The audit plan may contemplate internal auditing’s par-
ticipation in organization initiatives in an advisory or
consulting capacity. In such cases, the board should be
aware of the scope of these projects, and the CAE should
determine the most appropriate content for reporting to
the board. Such reporting should consider addressing the
nature of these services in the context of the internal au-
IPPF – Practice Guide
Interaction with the Board
diting activity’s charter and the impact on independence
and objectivity.
The CAE should also discuss the internal audit activity’s
ability to complete the audit plan, including whether in-
ternal auditing has appropriate resources and whether
management has imposed any scope limitations on the
work of the internal auditors. Additionally, the CAE
should provide the board with visibility into qualifica-
tions of the audit personnel so it can evaluate whether
adequate resources are allocated to the activity.
D. Distribution of Audit Reports
The decision to distribute audit reports to the board de-
pends on board preferences. The CAE should, however,
provide the board with an explanation of the scope and
findings of the audits performed. This could be accom-
plished by providing the board with the audit reports, an
executive summary of each audit, or a summary of the
findings on a periodic basis. The CAE should consider
the input of senior management and consult with the
board to determine the most appropriate approach to pro-
viding this information.
E. Fraud/Investigations
Fraud/Investigations are often the responsibility of the in-
ternal audit activity. In such a situation, internal auditing
should bring to the attention of the board fraud/investiga-
tions of a significant nature, or those including personnel
who are critical to the control structure. The CAE should
understand the board’s expectations regarding the types
of investigations and depth of information that should be
communicated.
The board should be aware (similar to Key Focus Areas)
of the nature of a potential incident, what is being done
to investigate and understand both the impact of the in-
cident and ultimately what allowed it to occur, corrective
action plans and implementation progress, and disciplin-
ary actions.
www.theiia.org/guidance / 7

F. Open Audit Issues
Although management is generally responsible for resolv-
ing issues, in accordance with IIA Standard 2500 – Moni-
toring Progress, the internal audit activity should monitor
the resolution of open audit issues. Significant open audit
issues that are not expected to be resolved on schedule,
or have fallen behind their due date, should be reported
to the board along with a recovery plan and a view as to
the viability of the recovery plan. Future meetings should
include a report on monitoring of the progress of the im-
provement plan.
G. Quality Assessments
The internal audit activity should develop an appropriate
internal assessment program and should identify appro-
priate Key Performance Indicators (KPIs). KPIs of the in-
ternal audit activity provide a platform to discuss issues
relative to the internal audit activity and potentially gain
board support in making necessary changes. Establish-
ment of KPIs should be done in a group that includes se-
nior management, as well as the board, and there should
be consensus that the KPIs chosen are meaningful and
appropriate.
In addition to being a driver in the discussion of issues
relative to the department, KPIs are relevant in the evalu-
ation of the CAE’s performance. Once the KPIs are un-
derstood and agreed to by the board, frequent reporting of
actual versus desired performance with detailed explana-
tions is essential. In cases where the relevant KPIs cannot
be met, timely notification to the board should be pre-
pared and include:
• Type of performance indicator involved.
• Discrepancy between desired performance and ac-
tual performance.
• Reason for the divergence.
• Plans for closing the gap.
The KPIs should provide some indication as to improve-
IPPF – Practice Guide
Interaction with the Board
ments being made to the internal audit activity resulting
from the KPI analysis. Also, results of the external and
internal assessments (as referred to in IIA Standard 1300)
should be communicated to the board, and the CAE
should indicate how the recommendations will be imple-
mented. Additional information on developing and using
KPIs as part of an internal assessment program (IIA Stan-
dard 1311) can be found in the Practice Guide, Measur-
ing Internal Audit Effectiveness and Efficiency.
H. Board Education Opportunities
The CAE can play a critical role in ensuring that the board
is aware of current topics to help it accomplish its obliga-
tions as described in its charter. The CAE should consider
the needs of the board by helping it stay current on issues
that impact its ability to accomplish its duties, such as
assisting the board in understanding changes in the regu-
latory and business environment relating to governance,
risk management, compliance, and related controls. The
CAE should consider providing the board with relevant
educational materials to help it understand the risks of
its environment (e.g., industry risks, regulatory changes,
accounting rule changes).
Administration and
Coordination of Board Activities
The CAE may play a direct role as a valued adviser to the
board by assisting with its administrative and governance
responsibilities, reviewing its activities, and suggesting
enhancements. Examples of activities that the CAE can
undertake, depending on the governance structure of the
organization, are:
• Encourage the board to conduct periodic reviews of
its activities and practices to evaluate whether its
activities are a) accomplishing the board’s charter,
and b) consistent with leading practices. This may
www.theiia.org/guidance / 8
 IPPF – Practice Guide
Interaction with the Board

involve facilitating a self-assessment using surveys, • Provide information on the coordination with and
benchmarking against external guidelines, etc. oversight of other control, assurance, and monitoring
• Review the charter for the board at least annually functions (e.g., risk management, compliance, secu-
and advise the board whether the charter addresses rity, business continuity, legal, ethics, environmental,
all the responsibilities expected by relevant regula- and external auditing).
tory bodies.
• Maintain a planning agenda for board meetings that
details all required activities to ascertain whether
they have been completed and facilitates report-
ing to the board annually that it has completed all
required duties.
• Draft the board meeting agenda for the board chair,
or equivalent, facilitate distribution of the material
to the board members, and review or prepare the
minutes of the board meetings.
• Meet periodically with the board chair, or equiva-
lent, to discuss whether the materials and informa-
tion being furnished to the board are meeting its
needs.
• Work with the board to determine if any educational
or informational sessions or presentations would be
helpful; for example, sessions on risk and controls
for new board members or updates on regulatory
changes impacting board responsibilities.
• Inquire of the board whether the frequency of the
meetings and the time allotted to the board are suf-
ficient.
• Review with the board the functional and adminis-
trative reporting lines of the internal audit activity
to ensure that the organizational structure in place
allows adequate independence for internal auditors
in accordance with IIA Standard 1110.
• Assist the board in evaluating the adequacy of the
audit personnel and budget, and the scope and re-
sults of the internal audit activities, to ensure there
are no staffing, budgetary or scope limitations that
impede the ability of internal auditing to execute its
responsibilities.

www.theiia.org/guidance / 9
 IPPF – Practice Guide
Interaction with the Board

Authors:
Richard A. Schmidt, CIA

Kevin D, Lacy, CIA

Erich Schumann, CIA

Reviewers and Contributors

Douglas J. Anderson, CIA

James Rose, CIA

Steven E. Jameson, CIA, CCSA, CFSA

www.theiia.org/guidance / 10
About the Institute
Established in 1941, The Institute of Internal
Auditors (IIA) is an international professional
association with global headquarters in Altamonte
Springs, Fla., USA. The IIA is the internal audit
profession’s global voice, recognized authority,
acknowledged leader, chief advocate, and princi-
pal educator.
About Practice Guides
Practice Guides provide detailed guidance for
conducting internal audit activities. They include
detailed processes and procedures, such as tools
and techniques, programs, and step-by-step ap-
proaches, as well as examples of deliverables.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category of
guidance, compliance is not mandatory, but it
is strongly recommended, and the guidance is
endorsed by The IIA through formal review and
approval processes. For other authoritative guid-
ance materials provided by The IIA, please visit
our website at www.theiia.org/guidance.
Disclaimer
The IIA publishes this document for informa-
tional and educational purposes. This guidance
material is not intended to provide definitive an-
swers to specific individual circumstances and as
such is only intended to be used as a guide. The
IIA recommends that you always seek indepen-
dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
anyone placing sole reliance on this guidance.
Copyright
Copyright ® 2011 The Institute of Internal
Auditors. For permission to reproduce, please
contact The IIA at guidance@theiia.org.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 Internal Audit and the
Second Line of Defense
 Practice Guide / Internal Audit and the Second Line of Defense

Table of Contents
Table of Contents .................................................................................................................................. 2
Executive Summary ............................................................................................................................... 3
Introduction ............................................................................................................................................ 3
Business Significance and Related Risks ........................................................................................... 3
Related IIA Standards ........................................................................................................................ 4
Definition of Key Concepts ................................................................................................................. 5
Overview of Good Governance .............................................................................................................. 7
The Three Lines of Defense Model .................................................................................................... 7
Independence and Objectivity ............................................................................................................ 8
Role of the CAE ..................................................................................................................................... 9
Organizational Governance and Three Lines of Defense ................................................................... 9
Identifying Gaps and Potential Conflicts Within the Three Lines of Defense ....................................... 9
Internal Audit and Second Line of Defense Responsibilities .................................................................. 9
Second Line of Defense Functions ..................................................................................................... 9
Internal Audit and Second Line of Defense Activities........................................................................ 10
Safeguards to Maintain Independence and Objectivity......................................................................... 11
Discussions on Dual Responsibilities ............................................................................................... 11
Safeguards to Maintain Independence and Objectivity ..................................................................... 11
Transition Plan ..................................................................................................................................... 13
Management’s Acceptance of Risks to Independence and Objectivity ................................................. 14
Resources ........................................................................................................................................... 15
Related IIA Guidance ....................................................................................................................... 15
Authors ................................................................................................................................................ 15

2
 Practice Guide / Internal Audit and the Second Line of Defense

Executive Summary
As governance and monitoring functions collaborate more closely to avoid duplication of effort,
internal audit may be asked to take on responsibilities for risk management, compliance,
regulatory oversight, and other governance activities.
The chief audit executive (CAE) plays a critical role in navigating between internal audit’s
traditional role and assuming responsibilities for risk management, compliance, and other
governance functions. The CAE should be held accountable for preserving independence and
objectivity, communicating with management and the board, and confirming management’s
acceptance of risk to internal audit’s independence and/or auditor objectivity. To navigate
through these competing challenges, internal auditors can look to The IIA’s guidance on
effective risk management and control, and promulgated standards related to independence
and objectivity.

Introduction
In January 2013, The IIA issued the Position Paper, The Three Lines of Defense in Effective
Risk Management and Internal Control. The position paper outlines risk and control
responsibilities within organizations and states that if dual responsibilities are assigned to a
single person or department, consideration should be given to separating these functions at a
later time. However, business constraints or other considerations may limit total separation
among governance functions. This practice guide provides guidance to ensure independence
and objectivity are not compromised in situations where internal audit may be responsible for
second line of defense functions.
This guidance is not applicable where country and/or industry-specific standards may prohibit
internal audit from performing second line of defense activities.

Business Significance and Related Risks

When following the Three Lines of Defense model, responsibilities among various functions of
the organization are generally classified as follows:

 First line of defense: operational management functions that own and manage risks.
 Second line of defense: risk management and compliance functions that monitor
risks.
 Third line of defense: an internal audit function that provides independent assurance.
When internal audit is also responsible for second line of defense functions, such as risk
management and compliance, it is essential to implement safeguards to protect independence
and/or objectivity and to routinely validate that the safeguards are operating effectively.

3
 Practice Guide / Internal Audit and the Second Line of Defense

Management and the board should clearly understand the risks and appropriate controls
needed when internal audit undertakes second line of defense functions.

Related IIA Standards

The following standards from the International Standards for the Professional Practice of
Internal Auditing (Standards) relate to internal audit assuming second line of defense
functions. Additional related IIA guidance documents are identified in Resources.

1100 – Independence and Objectivity

The internal audit activity must be independent, and internal auditors must be objective in
performing their work.

1110 – Organizational Independence

The chief audit executive must report to a level within the organization that allows the internal
audit activity to fulfill its responsibilities. The chief audit executive must confirm to the board, at
least annually, the organizational independence of the internal audit activity.

1120 – Individual Objectivity

Internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest.

1130 – Impairment to Independence or Objectivity

If independence or objectivity is impaired in fact or appearance, the details of the impairment
must be disclosed to appropriate parties. The nature of the disclosure will depend upon the
impairment.
1130.A1 – Internal auditors must refrain from assessing specific operations for which
they were previously responsible. Objectivity is presumed to be impaired if an internal
auditor provides assurance services for an activity for which the internal auditor had
responsibility within the previous year.
1130.A2 – Assurance engagements for functions over which the chief audit executive
has responsibility must be overseen by a party outside the internal audit activity.
1130.C1 – Internal auditors may provide consulting services relating to operations for
which they had previous responsibilities.
1130.C2 – If internal auditors have potential impairments to independence or objectivity
relating to proposed consulting services, disclosure must be made to the engagement
client prior to accepting the engagement.

4
 Practice Guide / Internal Audit and the Second Line of Defense

1322 – Disclosure of Nonconformance

When nonconformance with the Definition of Internal Auditing, the Code of Ethics, or the
Standards impacts the overall scope or operation of the internal audit activity, the chief audit
executive must disclose the nonconformance and the impact to senior management and the
board.

2050 – Coordination
The chief audit executive should share information and coordinate activities with other internal
and external providers of assurance and consulting services to ensure proper coverage and
minimize duplication of efforts.

2100 – Nature of Work

The internal audit activity must evaluate and contribute to the improvement of governance, risk
management, and control processes using a systematic and disciplined approach.

2500 – Monitoring Progress

The chief audit executive must establish and maintain a system to monitor the disposition of
results communicated to management.
2500.A1 – The chief audit executive must establish a follow-up process to monitor and
ensure that management actions have been effectively implemented or that senior
management has accepted the risk of not taking action.
2500.C1 – The internal audit activity must monitor the disposition of results of consulting
engagements to the extent agreed upon with the client.

2600 – Communicating the Acceptance of Risks

When the chief audit executive concludes that management has accepted a level of risk that
may be unacceptable to the organization, the chief audit executive must discuss the matter
with senior management. If the chief audit executive determines that the matter has not been
resolved, the chief audit executive must communicate the matter to the board.

Definition of Key Concepts

Assurance Functions – Functions that provide assurance on the effectiveness of governance,
risk management, and control.
Assurance Services – An objective examination of evidence for the purpose of providing an
independent assessment on governance, risk management, and control processes for the
organization. Examples may include financial, performance, compliance, system security, and
due diligence engagements.1

1 The International Profession Practices Framework (IPPF), pp. 42-43. 2013.

5
 Practice Guide / Internal Audit and the Second Line of Defense

Board – The highest level of governing body charged with the responsibility to direct and/or
oversee the activities and management of the organization. Typically, this includes an
independent group of directors (e.g., a board of directors, a supervisory board, or a board of
governors or trustees). If such a group does not exist, the “board” may refer to the head of the
organization. “Board” may refer to an audit committee to which the governing body has
delegated certain functions.2
Chief Audit Executive – Chief audit executive (CAE) describes a person in a senior position
responsible for effectively managing the internal audit activity in accordance with the internal
audit charter and the Definition of Internal Auditing, the Code of Ethics, and the Standards. The
chief audit executive or others reporting to the chief audit executive will have appropriate
professional certifications and qualifications. The specific job title of the chief audit executive
may vary across organizations.3
Impairment – Impairment to organizational independence and individual objectivity may include
personal conflict of interest, scope limitations, restrictions on access to records, personnel, and
properties, and resource limitations (funding).4
Independence – The freedom from conditions that threaten the ability of internal audit to carry
out internal audit responsibilities in an unbiased manner.5
Internal Audit Activity – A department, division, team of consultants, or other practitioner(s) that
provides independent, objective assurance and consulting services designed to add value and
improve an organization's operations. The internal audit activity helps an organization
accomplish its objectives by bringing a systematic, disciplined approach to evaluate and
improve the effectiveness of governance, risk management, and control processes.6, 7
Objectivity – An unbiased mental attitude that allows internal auditors to perform engagements
in such a manner that they believe in their work product and that no quality compromises are
made. Objectivity requires that internal auditors do not subordinate their judgment on audit
matters to others.8

2 Ibid.
3 Ibid.
4 Ibid.
5 Ibid.
6 Ibid.
7 Note: the terms “internal audit” and “internal audit activity” are used interchangeably in this practice guide.
8 Ibid.

6
 Practice Guide / Internal Audit and the Second Line of Defense

Overview of Good Governance

The Three Lines of Defense Model

The Three Lines of Defense model9, as illustrated in Figure 1, describes responsibilities for
effective risk management and control as follows:

 Management is primarily responsible for monitoring and controlling processes, and

is the first line of defense in risk management.
 The second line of defense consists of separately established risk, control, and
compliance oversight functions that ensure properly designed processes and
controls are in place within the first line of defense and are operating effectively. The
nature and types of these functions are dependent on many factors including
industry and organizational maturity.
 Functions, such as internal audit, that provide independent assurance over
processes and controls are considered the third line of defense.

Figure 1

Assuming effectiveness, each line of defense contributes to healthy organizational governance

by ensuring objectives are achieved in the context of the social, regulatory, and market
environments. Both the second and third lines provide oversight and/or assurance over risk

9 The IIA’s Position Paper, The Three Lines of Defense in Effective Risk Management and Control, 2013.

7
 Practice Guide / Internal Audit and the Second Line of Defense

management. The key differences between the second and third lines of defense are the
concepts of independence and objectivity.

Independence and Objectivity

Standard 1100 states that the internal audit activity must be independent, and internal auditors
must be objective in performing their work. Conditions that threaten the ability of any
organizational function, including internal audit, to perform its responsibilities in an unbiased
manner have the potential to compromise independence and objectivity.

According to the interpretation of Standard 1110, organizational independence is effectively

achieved when the chief audit executive reports functionally to the board, which includes board
approval of the appointment, remuneration, and removal of the chief audit executive. Leaders
in the second line of defense typically report functionally to organizational management and as
a result, the second line of defense is not considered independent.

Benefits can be derived by an organization when the second and third lines of defense
collaborate. Standard 2050 states that the chief audit executive should share information and
coordinate activities with other internal and external providers of assurance and consulting
services to ensure proper coverage and minimize duplication of efforts. The IIA’s Practice
Guide, Coordinating Risk Management and Assurance, provides guidance to the CAE on
effective coordination and reporting so that resources are used effectively and key risks are not
missed or misjudged.

Boards and management rely on internal audit to provide assurance on the adequacy of
governance, risk management, and controls. This reliance is enhanced by internal audit’s
independence and internal auditors’ objectivity. As governance and risk management activities
expand, additional safeguards and controls are needed to maintain independence and
objectivity.

8
 Practice Guide / Internal Audit and the Second Line of Defense

Role of the CAE

Organizational Governance and Three Lines of Defense

In accordance with Standard 2100, internal audit must evaluate and contribute to the
improvement of governance, risk management, and control processes using a systematic and
disciplined approach. If certain second line of defense functions are deemed critical to
monitoring and/or providing assurance on the effectiveness of risk management and internal
control, the CAE must evaluate the effectiveness of those functions relative to this objective.
The scope of the evaluation will be driven by risk and the extent of reliance placed on these
functions.

The IIA’s Practice Guide, Reliance by Internal Audit on Other Assurance Providers, provides
guidance to the CAE on an approach for relying on the assurance provided by other internal or
external assurance functions, which is useful for assessing the effectiveness of the function.

Identifying Gaps and Potential Conflicts Within the Three Lines of Defense

When assessing second line of defense functions, the CAE may identify gaps, conflicts, or
duplication of efforts. Consistent with Standard 2100, the CAE should work with stakeholders
to recommend enhancements that improve governance, risk management, and internal
controls. Outcomes may include collaborating between organizational areas to reduce overlap
between functions and segregating responsibilities to properly maintain independence and
objectivity. The following sections provide guidance to the CAE on maintaining independence
and objectivity in situations where internal audit assumes second line of defense
responsibilities.

Internal Audit and Second Line of Defense Responsibilities

Second Line of Defense Functions

Many organizations have asked or required the CAE to assume additional second line of
defense responsibilities. This is often due to the size or maturity of the organization, or the
result of new risk management or compliance initiatives undertaken by the organization. If not
managed properly, objectivity, which is crucial to providing assurance to management and the
board, could be impaired.

Regulatory standards and widely adopted industry practices may require specific second line
of defense activities, such as risk management coordination or compliance review. For
example, second line of defense responsibilities could be related to requirements for the

9
 Practice Guide / Internal Audit and the Second Line of Defense

financial services industry, independent audits of quality management systems (ISO 9001),
European Commission’s Eco-Management and Audit Scheme (EMAS) to evaluate and report
environmental performance, and United States Occupational Safety and Health
Administration’s (OSHA) enforcement of work-related health and safety rules.

Internal Audit and Second Line of Defense Activities

Responsibilities may become blurred across internal audit and second line of defense
functions, even in organizations with robust risk management and governance programs and
resources to support both. The CAE may be asked to assume second line of defense activities
in situations such as:

 New regulatory requirement: A new regulation requires substantial effort associated

with new policies, procedures, testing, and risk management activities.
 Change in business: An organization may enter into a new geographical market or
new business segment and be subject to new regulations or risk management
activities.
 Resource constraints: An organization may experience resource constraints or
changes in staff, such as when the leader of a second line of defense function
leaves the organization.
 Efficiency: Management and/or the board may determine it is more efficient for
internal audit to perform compliance or other second line of defense functions.

Internal audit may be the preferred choice due to its expertise in applying risk management
and governance principles in existing, new, and emerging areas. As an example, management
across many organizations asked internal audit to take the lead compliance role when
Sarbanes-Oxley legislation became required for U.S. public companies. The blending of
internal audit with second line of defense activities may also occur without additional regulatory
requirements or resource constraints, as management may determine that internal audit is the
best fit for certain activities, such as where:

 The organization is small and cannot support distinct control and assurance functions.
 Management and the board do not believe the degree of risk warrants separate
functions for certain second and third line of defense activities.
 Internal audit has the necessary skill set or relevant expertise for specific risk
management and/or compliance responsibilities.
 Management and/or the board do not understand or appropriately value the importance
of an independent and objective third line of defense.
 Internal audit responds to cost-cutting pressures or other factors, and assumes
responsibilities for the good of the organization.

10
 Practice Guide / Internal Audit and the Second Line of Defense

If second line of defense responsibilities are assumed by internal audit, the CAE should
communicate the risks to management and the board. It is important for the CAE,
management, and the board to understand the risks involved with assuming such duties,
regardless of whether it will be a temporary or long-term arrangement. Either way, proper
safeguards and controls need to be agreed upon, implemented, and periodically validated to
ensure that internal audit’s objectivity is properly maintained.

Safeguards to Maintain Independence and Objectivity

Corporate governance arrangements vary considerably among organizations, depending on
factors such as the size of the organization, industry sector, availability of resources, culture,
risk tolerance, make-up of the board, and the relative risk and importance of certain second
line of defense activities to the entity. The effectiveness of internal audit’s primary function —
to provide independent, objective assurance and consulting services — should be protected.
Any impairment to independence and/or objectivity needs to be elevated and evaluated.

Discussions on Dual Responsibilities

Standard 1110 requires confirmation to the board, at least annually, about the status of the
internal audit function regarding organizational independence. Standard 1130 requires the
disclosure of any impairment, in fact or appearance, to appropriate parties. The nature of the
disclosure will depend on the impairment and should state the following:

 Situation.
 Consequences and risks to internal audit’s independence and objectivity.
 Safeguards.
 Transition plan, if applicable.

Safeguards to Maintain Independence and Objectivity

If management and the board accept the risk of internal audit assuming second line of defense
activities, safeguards and controls need to be put in place to ensure independence and
objectivity are not compromised. The safeguards noted below should be considered for each
second line of defense activity assigned to internal audit.

 Discussion of risks with management and the board.

 Acceptance and ownership of the risks by management.
 Clear definition and assignment of roles for each activity where second line of defense
activities overlap with third line of defense activities, including the following documented
components:
o Impact and risks to the organization and internal audit.

11
 Practice Guide / Internal Audit and the Second Line of Defense

o Roles, responsibilities, and segregation of duties.

o Controls put in place to validate that agreed upon safeguards are operating
effectively.
o Determination of whether the assignment is temporary or long-term.
 If temporary, a transition plan is needed (see next section).
o Documented acceptance and approval by senior management and the board.
o Second line of defense activities performed by internal audit should be
referenced in the charter and/or included in the board update, at least annually.
 Periodic (at least annual) evaluation of reporting lines and responsibilities by
management and the board.
 The nature of internal audit’s roles should be clearly stated in the audit charter.
 Periodic independent assessment of internal audit’s second line of defense roles and
the efficacy of the independence, objectivity, and assurance provisions.
o The CAE should include a review of internal audit’s second line of defense roles,
in conjunction with its quality assurance and improvement program or on a more
frequent basis, depending on the level of risk.
 Where safeguards to maintain internal audit’s independence and objectivity are not
possible, the Standards requires that responsibility for performing the second line of
defense activity be reassigned elsewhere in the organization or outsourced to a third-
party provider.

Internal audit should take care to avoid activities that compromise their independence and/or
objectivity, including:

 Setting the risk appetite.

 Owning or managing risks.
 Assuming responsibilities for accounting, business development, and other first line
of defense functions.
 Making risk response decisions on management’s behalf.
 Implementing or assuming accountability for risk management or governance
processes.
 Providing assurance on second line of defense activities performed by internal audit.

12
 Practice Guide / Internal Audit and the Second Line of Defense

Transition Plan
If the assignment of second line of defense responsibilities to internal audit is deemed to be
temporary, a formal transition plan to relieve internal audit from such responsibilities should be
developed, discussed with management and the board, and implemented.

The transition plan should consider matters such as:

 Organizational/structural needs: Internal audit may need to adjust reporting

relationships as individuals or groups cease their role in second line of defense
activities. If these responsibilities are moving elsewhere in the organization, structural
changes may be required to ensure independence and objectivity.
 Resources: Resources may be required to train individuals elsewhere in the
organization for second line of defense duties or to transition internal audit staff to these
roles.
 Timeline and tasks: Responsibilities and target dates for key milestones should be
documented.
 Maintaining independence during transition: In accordance with Standard 1130.A1,
individuals must refrain from assessing specific matters for which they were previously
responsible for a period of at least one year. This would apply to individuals who have
been involved in second line of defense activities while working within internal audit.
 Monitoring progress: The CAE should monitor progress of the transition plan.
 Transparency: Ongoing communication with management and the board regarding
adherence to the transition plan and schedule. Significant changes or delays should be
evaluated and approved by the board.

Internal audit’s audit plan may include provisions to validate the completeness and
effectiveness of the transition of second line of defense duties to the identified resources (a
third party may need to lead this audit effort due to independence and objectivity implications).
During the development and implementation of the transition plan, the CAE, along with senior
management and the board, should consider the long-term organizational structure to ensure
proper tone at the top; appropriateness of corporate governance programs; statutory,
regulatory, and other mandatory compliance requirements; risk management culture;
alignment with the three lines of defense approach; and the size and complexity of the
organization.

13
 Practice Guide / Internal Audit and the Second Line of Defense

Management’s Acceptance of Risks to Independence and

Objectivity
Organizations may opt to keep certain second line of defense responsibilities integrated within
internal audit. This may occur in smaller organizations, as well as areas where management
has concluded there is minimal risk or impact to the organization. The decision to integrate
second and third lines of defense responsibilities as a longer-term strategy should be
thoughtful, deliberate, and based on a risk analysis and substantial discussion with
management and the board.

Management’s acceptance of risks associated with blending internal audit with second line of
defense activities may be regarded as suitable for a period of time, but it should not be
regarded as permanent. Changes to the business, regulatory landscape, and underlying risks
(either the inherent risks or application of risks on the business) can overwhelm the resources
allocated to risk management. An evaluation, including a refresh of the risk analysis, should
occur with management and the board at least annually to evaluate internal audit’s current role
in performing second line of defense activities.

The overlap of second and third line of defense activities is an excellent focus area for a quality
assurance and improvement program. Internal audit should reassess the risks to
independence and objectivity, communicate these to management, consider transition plans,
and obtain management’s acceptance of these risks on a periodic basis. The CAE may also
ask external assessors to include such matters in the scope of their assessments.

As governance and risk management activities continue to evolve, internal audit may be asked
or required by management to assume second line of defense responsibilities. Management
and the board should evaluate, discuss, and accept the associated risks before blending these
duties. The CAE should ensure that appropriate safeguards and controls, identified in this
guidance, are implemented and periodically validated to maintain internal audit’s
independence and objectivity.

14
 Practice Guide / Internal Audit and the Second Line of Defense

Resources
Related IIA Guidance
Following are IIA resources that may be useful for internal auditors to reference when faced with taking
on responsibilities for risk management, compliance, regulatory oversight, and other governance
activities.

Practice Advisory 2050-1: Coordination

Practice Advisory 2500.A1-1: Follow-up Process

The IIA’s Practice Guide, Coordinating Risk Management and Assurance, 2012

The IIA’s Practice Guide, Reliance by Internal Audit on Other Assurance Providers, 2011

The IIA’s Position Paper, Three Lines of Defense in Effective Risk Management and Control, 2013.

Authors
Caroline Glynn, CIA

Douglas Hileman, CRMA, CPEA

Hans-Peter Lerchner, CIA

Thomas Sanglier, CIA, CRMA

15
 Practice Guide / Internal Audit and the Second Line of Defense

About The IIA

The Institute of Internal Auditors (The IIA) is the internal audit profession’s most widely recognized advocate, educator,
and provider of standards, guidance, and certifications. Established in 1941, The IIA today serves more than 180,000
members from more than 170 countries and territories. The association’s global headquarters are in Altamonte
Springs, Fla. For more information, visit www.globaliia.org or www.theiia.org.

About Supplemental Guidance

Supplemental Guidance is part of The IIA’s International Professional Practices Framework (IPPF) and provides
additional recommended (non-mandatory) guidance for conducting internal audit activities. While supporting the
Standards, Supplemental Guidance is not intended to directly link to achievement of conformance with the Standards.
It is intended instead to address topical areas, as well as sector-specific issues, and it includes detailed processes and
procedures. This guidance is endorsed by The IIA through formal review and approval processes.

Practice Guides
Practice Guides are a type of Supplemental Guidance that provide detailed guidance for
conducting internal audit activities. They include detailed processes and procedures, such as
tools and techniques, programs, and step-by-step approaches, as well as examples of
deliverables. As part of the IPPF guidance, conformance with Practice Guides is recommended
(non-mandatory). Practice Guides are endorsed by The IIA through formal review and approval
processes.
A Global Technologies Audit Guide (GTAG) is a type of Practice Guide that is written in
straightforward business language to address a timely issue related to information technology
management, control, or security.
For other authoritative guidance materials provided by The IIA, please visit our website at
www.globaliia.org/standards-guidance or www.theiia.org/guidance.

Disclaimer
The IIA publishes this document for informational and educational purposes and is not intended to provide definitive
answers to specific individual circumstances. As such, is only intended to be used as a guide. The IIA recommends
that you always seek independent expert advice relating directly to any specific situation. The IIA accepts no
responsibility for anyone placing sole reliance on this guidance.

Copyright
Copyright ® 2016 The Institute of Internal Auditors.
For permission to reproduce, please contact guidance@theiia.org.

January 2016

16
 IPPF – Practice Guide

Internal Auditing
and Fraud

December 2009
 IPPF – Practice Guide

Table of Contents
Introduction.................................................................................................................................................................... 1
Executive Summary....................................................................................................................................................... 2
Definition of Fraud........................................................................................................................................................ 4
Fraud Awareness............................................................................................................................................................. 5
A. Reasons for Fraud................................................................................................................................................... 5
B. Examples of Fraud.................................................................................................................................................. 7
C. Potential Fraud Indicators...................................................................................................................................... 8
Typical Roles & Responsibilities for Fraud.............................................................................................................. 10
Internal Audit Responsibilities During Audit Engagement................................................................................... 13
A. Conducting Audit Engagements........................................................................................................................... 13
B. Internal Auditor Skepticism.................................................................................................................................. 13
C. Communicating With the Board........................................................................................................................... 14
Fraud Risk Assessment................................................................................................................................................ 16
A. Identifying Relevant Fraud Risk Factors............................................................................................................... 16
B. Identifying Potential Fraud Schemes and Prioritizing Them Based on Risk.......................................................... 17
C. Mapping Existing Controls to Potential Fraud Schemes and Identifying Gaps.................................................... 17
D. Testing Operating Effectiveness of Fraud Prevention and Detection Controls..................................................... 17
E. Documenting and Reporting on the Fraud Risk Assessment................................................................................ 18
Fraud Prevention and Detection............................................................................................................................... 19
A. Fraud Prevention.................................................................................................................................................. 19
B. Fraud Training...................................................................................................................................................... 20
C. Fraud Detection................................................................................................................................................... 21
Fraud Investigation...................................................................................................................................................... 23
A. Investigation Process............................................................................................................................................. 23
B. Internal Auditing’s Role in Investigations.............................................................................................................. 23
C. Conducting the Investigation............................................................................................................................... 24
D. Reporting Fraud Investigations............................................................................................................................. 25
E. Resolution of Fraud Incidents............................................................................................................................... 26
F. Communications of Fraud Incidents..................................................................................................................... 26
G. Analysis of Lessons Learned................................................................................................................................. 27
Forming an Opinion on Internal Controls Related to Fraud................................................................................ 29
Appendix A – Reference Material............................................................................................................................. 30
Appendix B – Questions To Consider....................................................................................................................... 32
Appendix C – Fraud Risk Assessment Template...................................................................................................... 33

Introduction
The purpose of this Practice Guide is to increase the internal
auditor’s awareness of fraud and provide guidance on how
to address fraud risks on internal audit engagements.
The International Professional Practices Framework
(IPPF) outlines the following International Standards for
the Professional Practice of Internal Auditing (Standards)
pertaining to fraud and the internal auditor’s role in detect-
ing, preventing, and monitoring fraud risks and addressing
those risks in audits and investigations.
IIA Standard 1200: Proficiency and Due
Professional Care
1210.A2 – Internal auditors must have sufficient knowl-
edge to evaluate the risk of fraud and the manner in which
it is managed by the organization, but are not expected to
have the expertise of a person whose primary responsibil-
ity is detecting and investigating fraud.
IIA Standard 1220: Due Professional Care
1220.A1 – Internal auditors must exercise due professional
care by considering the:
• Extent of work needed to achieve the engagement’s
objectives.
• Related complexity, materiality, or significance of
matters to which assurance procedures are applied.
• Adequacy and effectiveness of governance, risk
management, and control processes.
• Probability of significant errors, fraud, or non-
compliance.
• Cost of assurance in relation to potential benefits.
IPPF – Practice Guide
IIA Standard 2060: Reporting to Senior
Management and the Board
The chief audit executive (CAE) must report periodically
to senior management and the board on the internal audit
activity’s purpose, authority, responsibility, and perfor-
mance relative to its plan. Reporting must also include
significant risk exposures and control issues, including
fraud risks, governance issues, and other matters needed
or requested by senior management and the board.
IIA Standard 2120: Risk Management
2120.A2 – The internal audit activity must evaluate the
potential for the occurrence of fraud and how the organi-
zation manages fraud risk.
IIA Standard 2210: Engagement Objectives
2210.A2 – Internal auditors must consider the probabil-
ity of significant errors, fraud, noncompliance, and other
exposures when developing the engagement objectives.
In addition, see Appendix A – Reference Material which
lists IPPF Practice Advisories that discuss fraud.
www.theiia.org/guidance / 1
INTERNAL AUDITING AND FRAUD
Executive Summary
Fraud negatively impacts organizations in many ways
including financial, reputation, psychological and social
implications. According to various surveys, monetary
losses from fraud are significant. However, the full cost of
fraud is immeasurable in terms of time, productivity, and
reputation including customer relationships. Depending
on the severity of the loss, organizations can be irrepa-
rably harmed due to the financial impact of fraud activity.
Therefore, it is important for organizations to have a
strong fraud program that includes awareness, prevention,
and detection programs, as well as a fraud risk assessment
process to identify fraud risks within the organization.
Frauds can be committed by an employee at any level
within an organization, as well as by those outside the
organization. There are three common characteristics of
most frauds:
• Pressure or incentive — the need the fraudster is
trying to satisfy by committing the fraud.
• Opportunity — the fraudster’s ability to commit
the fraud.
• Rationalization — the fraudster’s ability to justify
the fraud in his or her mind.
An effective fraud management program includes:
• Company ethics policy — “tone at the top” from
senior management.
• Fraud awareness — understanding the nature,
causes, and characteristics of fraud.
• Fraud risk assessment — evaluating the risk of
various types of fraud.
2 / The Institute of Internal Auditors
Ongoing reviews — an internal audit activity that
•
considers fraud risk in every audit and performs
appropriate procedures based on fraud risk.
• Prevention and detection — efforts taken to reduce
opportunities for fraud to occur and persuading
individuals not to commit fraud because of the
likelihood of detection and punishment.
• Investigation — procedures and resources to fully
investigate and report a suspected fraud event.
An effective internal audit activity can be extremely help-
ful in addressing fraud. Although management and the
board are ultimately responsible for fraud deterrence,
internal auditors can assist management by determining
whether the organization has adequate internal controls
and fosters an adequate control environment.
There are various approaches that the CAE may use in con-
sidering fraud while conducting internal audit activities:
• Auditing management controls over fraud. This
includes policies, awareness practices, tone at the
top, board and senior management governance (the
control environment), as well as related practices,
such as risk assessment, assessing the adequacy
of preventive and detected controls in managing
fraud risk within organizational tolerances, incident
management, investigations, and recovery prac-
tices. Internal auditing should allocate resources to
fraud-related activities in line with the risk of fraud
relative to other organizational risks.
• Auditing to detect likely fraud by testing high-
risk processes, with the intention of looking for
indicators of fraud, within the organization and
with external business relationships. For example,
testing payroll for phantom employees, or test-
ing vendor invoices for overcharges, matching
vendor addresses with employee addresses to
 IPPF – Practice Guide

detect fictitious vendors, or reviewing databases

for duplicate transactions.

• Considering fraud as part of every audit. For exam-

ple, brainstorming about fraud risk, evaluating
fraud controls, designing procedures that consider
the fraud risk, or evaluating errors to determine
whether they could be an indication of fraud. The
cumulative results may provide perspective on
whether management’s awareness and risk man-
agement programs have been implemented effec-
tively across the organization.

• Consulting assignments help management iden-

tify and assess risk and determine the adequacy of
the control environment for process reviews, new
business ventures, or IT applications. Facilitation
of management’s self-assessment is another exam-
ple of evaluating fraud risk, ensuring controls are
in place to mitigate those risks, and who is moni-
toring results.

This document will discuss fraud and provide general

guidance to help internal auditors comply with profes-
sional Standards. To learn more about detecting and con-
trolling fraud, see Appendix A — Reference Material.

www.theiia.org/guidance / 3
INTERNAL AUDITING AND FRAUD

Definition of Fraud
Fraud encompasses a wide range of irregularities and illegal
acts characterized by intentional deception or misrepre-
sentation. The Institute of Internal Auditors’ (IIA’s) IPPF
defines fraud as:

“Any illegal act characterized by deceit, concealment,

or violation of trust. These acts are not dependent upon
the threat of violence or physical force. Frauds are per-
petrated by parties and organizations to obtain money,
property, or services; to avoid payment or loss of ser-
vices; or to secure personal or business advantage.”

Another definition of fraud from the publication “Managing

the Business Risk of Fraud: A Practical Guide,” sponsored
by The IIA, the American Institute of Certified Public
Accountants, and the Association of Certified Fraud
Examiners, states:

“Fraud is any intentional act or omission designed to

deceive others, resulting in the victim suffering a loss
and/or the perpetrator achieving a gain.”

Frauds are characterized by intentional deception or mis-

representation. This practice guide may refer to certain
actions as “fraud,” which may also be legally defined and/
or commonly known as corruption.

4 / The Institute of Internal Auditors


Fraud Awareness
Increased levels of fraud, a heightened regulatory environ-
ment, and pointed questions from internal and external
auditors and boards of directors have caused companies
to increase vigilance in their efforts to address fraud.
Even amidst a culture of heightened awareness, however,
an organization may be the victim of fraud and yet be
unaware of this reality. Fraudulent schemes are often
ongoing crimes that can last for months or even years
before detection, making it difficult to measure the losses
associated with fraud. Many fraud schemes are not publi-
cized or even detected, making it difficult to measure the
losses associated with fraud. Fraud losses that are known
and confirmed make clear that the cost is high. The true
cost of fraud, however, is even higher than just the loss of
money, given its impact on time, productivity, reputation,
and customer relationships.
Corruption — the misuse of entrusted power for private
gain — and fraud have adversely impacted numerous
organizations. The high cost of corporate governance,
associated fines, and penalties have been a direct result of
corporate frauds. Business executives have been involved
in litigation, and in extreme circumstances, faced jail sen-
tences when their global operations were not in compli-
ance with legal and regulatory requirements.
Fraud has negatively impacted organizations in different
ways, including financial, reputational, psychological, and
social. Organizations have been forced to cease operations
due to the impact of financial and reputation damages,
and the psychological and social effects have been espe-
cially devastating to the employees of the organizations.
Victims of fraud also suffer mental and emotional harm
and stress-related physical effects in addition to their
financial losses. The victims have felt robbed of not only
their money, but also their security, self-esteem, and dig-
nity. The bottom line is that fraud left unchecked can be
detrimental to any organization.
IPPF – Practice Guide
Fraud can range from minor employee theft and unpro-
ductive behavior to misappropriation of assets, fraudulent
financial reporting, or Ponzi schemes used to defraud inves-
tors. However, the risk of fraud can be reduced through
a combination of prevention, detection, and deterrence
measures. Most fraudulent schemes can be avoided with
basic internal controls and effective audits and oversight.
Unfortunately, fraud can be difficult to detect because it
often involves concealment through falsification of docu-
ments or collusion among members of management,
employees, or third-parties.
A. Reasons for Fraud
Most frauds begin small and continue to grow as the
scheme remains undetected. For example, perpetrators
often view initial stealing as temporary borrowings that
will be fixed before anyone notices the problem. The bor-
rowing accelerates and the perpetrators take positions that
are indefensible or develop a scheme for the concealment
and attempt to avoid discovery. As the fraud continues to
grow, hopefully, it will be detected by a fellow employee,
management, or an internal or external auditor.
Perpetrators primarily exploit inadequate internal controls
for their own gain, resulting in substantial damage to the
organization. The typical fraudster is a male of middle
age, employed by the organization for a number of years.
He often works in the financial department and typically
commits the deed on his own terms, driven by a desire
for money and opportunity. Many studies indicate that
most frauds are committed by members of management.
Managers generally have access to confidential infor-
mation, enabling them to override internal controls and
inflict greater damage to the organization than lower level
staff members. Fraud perpetrators tend to be in positions
of trust, educated, heads of households, and members of
community organizations who are motivated by a personal
need and are able to rationalize their actions.
www.theiia.org/guidance / 5
INTERNAL AUDITING AND FRAUD
Without minimizing individualized circumstances of each
fraudulent scheme, the following are three common char-
acteristics of frauds.
• Pressure or incentive represents a need that an
individual attempts to satisfy by committing fraud.
Often, pressure comes from a significant financial
need or problem. This may include the need to
keep one’s job or earn a bonus. In publicly traded
companies, there may be pressure to meet or beat
analysts’ estimates. For example, a large bonus
or other financial award can be earned based on
meeting certain performance goals. The fraudster
has a desire to maintain his or her position in the
organization and to retain a certain standard of
living to compete with perceived peers.
• Opportunity is the ability to commit fraud and
not be detected. Since fraudsters do not want to
be caught in their actions, they must believe that
their activities will not be detected. Opportunity
is created by weak internal controls, poor man-
agement, lack of board oversight, and/or through
the use of one’s position and authority to override
controls. Failure to establish adequate procedures
to detect fraudulent activity also increases the
opportunities for fraud to occur. A process may
be designed properly for typical conditions, how-
ever, a window of opportunity may arise creating
circumstances for the control to fail. Persons in
positions of authority may be able to create oppor-
tunities to override existing controls because
subordinates or weak controls allow them to cir-
cumvent the established controls.
|| Opportunity often occurs because the fraud-
ster knows what the auditor will do — the
when, what, and how much of the auditor’s
procedures. For example, if the fraudster
knows that the auditor always tests only large
transactions in December, the fraudster can
6 / The Institute of Internal Auditors
commit the fraud on smaller transactions in
other months.
• Rationalization is the ability for a person to jus-
tify a fraud, a crucial component in most frauds.
Rationalization involves a person reconciling his/
her behavior (e.g., stealing) with the commonly
accepted notions of decency and trust. For exam-
ple, the fraudster places himself or herself as
the priority (self-centered), rather than the well-
being of the organization or society as a whole.
The person may believe committing fraud is justi-
fied in the context of saving a family member or
loved one so he/she can pay for high medical bills.
Other times, the person simply labels the theft as
“borrowing,” and intends to pay the stolen money
back at a later time. Some people will do things
that are defined as unacceptable behavior by the
organization, yet are commonplace in their cul-
ture or were accepted by previous employers. As
a result, they can rationalize their behavior as the
rules don’t apply to them.
|| Management might reduce rationalization
through its actions, for example, by imple-
menting fair work and pay practices, equi-
table and consistent treatment of employees,
and tone at the top (management modeling
the behavior expected of employees).
Gaining insight into the motivations of a fraudster and
recognizing the threat that exposes every organization are
the first steps in establishing and implementing an effec-
tive and sustainable fraud risk management system. Of
the three elements, opportunity is the one that organiza-
tions can influence the most. Organizations need proce-
dures and internal controls that avoid putting employees
in positions to commit fraud and that detect fraudulent
activities if they occur.

Although internal auditors may not know the exact motive or
rationalization leading to fraud, they need to identify oppor-
tunities for fraud. Internal auditors also need to understand
fraud schemes and scenarios, as well as be aware of the
signs that point to fraud and how to prevent it.
B. Examples of Fraud
Fraud is perpetrated by a person knowing that it could
result in some unauthorized benefit to him or her, to the
organization, or to another person, and can be perpe-
trated by persons outside or inside the organization. Some
common fraud schemes include:
• Asset misappropriation involves stealing cash or
assets (supplies, inventory, equipment, and infor-
mation) from the organization. In many cases, the
perpetrator tries to conceal the theft, usually by
adjusting the records.
• Skimming occurs when cash is stolen from an
organization before it is recorded on the orga-
nization’s books and records. For example, an
employee accepts payment from a customer, but
does not record the sale.
• Disbursement fraud occurs when a person causes
the organization to issue a payment for fictitious
goods or services, inflated invoices, or invoices for
personal purchases. For example, an employee can
create a shell company and then bill the employer
for nonexistent services. Other examples include
fraudulent health care claims (billings for services
not performed, unbundled billings instead of bun-
dled billings), unemployment insurance claims
by people who are working, or pension or social
security claims for people who have died.
• Expense reimbursement fraud occurs when an
employee is paid for fictitious or inflated expenses.
For example, an employee submits a fraudulent
IPPF – Practice Guide
expense report claiming reimbursement for per-
sonal travel, nonexistent meals, extra mileage, etc.
• Payroll fraud occurs when the fraudster causes
the organization to issue a payment by making
false claims for compensation. For example, an
employee claims overtime for hours not worked or
an employee adds ghost employees to the payroll
and receives the paycheck.
• Financial statement fraud involves misrepresent-
ing the financial statements, often by overstating
assets or revenue or understating liabilities and
expenses. Financial statement fraud is typically
perpetrated by organization managers who seek
to enhance the economic appearance of the orga-
nization. Members of management may benefit
directly from the fraud by selling stock, receiving
performance bonuses, or using the false report to
conceal another fraud.
• Information misrepresentation involves provid-
ing false information, usually to those outside
the organization. Most often this involves fraud-
ulent financial statements, although falsifying
information used as performance measures can
also occur.
• Corruption is the misuse of entrusted power for
private gain. Corruption includes bribery and other
improper uses of power. Corruption is often an
off-book fraud, meaning that there is little finan-
cial statement evidence available to prove that the
crime occurred. Corrupt employees do not have to
fraudulently change financial statements to cover
up their crimes; they simply receive cash payments
under the table. In most cases, these crimes are
uncovered through tips or complaints from third-
parties, often via a fraud hotline. Corruption often
involves the purchasing function. Any employee
www.theiia.org/guidance / 7
INTERNAL AUDITING AND FRAUD
authorized to spend an organization’s money is a
possible candidate for corruption.
• Bribery is the offering, giving, receiving, or solic-
iting of anything of value to influence an out-
come. Bribes may be offered to key employees
or managers such as purchasing agents who have
discretion in awarding business to vendors. In
the typical case, a purchasing agent accepts kick-
backs to favor an outside vendor in buying goods
or services. The flip side of offering or receiv-
ing anything of value is demanding it as a con-
dition of awarding business, termed economic
extortion. Another example is a corrupt lending
officer who demands a kickback in exchange for
approving a loan. Those paying bribes tend to be
commissioned salespeople or intermediaries for
outside vendors.
• A conflict of interest occurs where an employee,
manager, or executive of an organization has an
undisclosed personal economic interest in a trans-
action that adversely affects the organization or
the shareholders’ interests.
• A diversion is an act to divert a potentially profit-
able transaction to an employee or outsider that
would normally generate profits for the organiza-
tion.
• Unauthorized or illegal use or theft of confiden-
tial or proprietary information to wrongly benefit
someone.
• Related-party activity is a situation where one party
receives some benefit not obtainable in a normal
arm’s length transaction.
• Tax evasion is intentional reporting of false infor-
mation on a tax return to reduce taxes owed.
8 / The Institute of Internal Auditors
C. Potential Fraud Indicators
Fraudsters often display certain behaviors or char­acteristics
that may serve as warning signs or red flags. For example,
some perpetrators act unusually irritable, some suddenly
start spending lavishly, and some be­come increasingly
secretive about their activities. However, the presence
of those symptoms does not in and of itself signify that a
fraud is occurring or will occur in the future.
Red flags may relate to time, frequency, place, amount,
or personality. Red flags include overrides of controls by
management or officers, irregular or poorly explained man-
agement activities, consistently exceeding goals/objectives
regardless of changing business conditions and/or com-
petition, preponderance of non-routine transactions or
journal entries, problems or delays in providing requested
information, and significant or unusual changes in cus-
tomers or suppliers. Red flags also include transactions
that lack documentation or normal approval, employees
or management hand-delivering checks, customer com-
plaints about delivery, and poor IT access controls such as
poor password controls.
Personal red flags include living beyond one’s means; con-
veying dissatisfaction with the job to fellow employees;
unusually close association with suppliers; severe personal
financial losses; addiction to drugs, alcohol or gambling;
change in personal circumstances; and developing outside
business interests. In addition, there are fraudsters who
consistently rationalize poor performance, perceive beat-
ing the system to be an intellectual challenge, provide
unreliable communications and reports, and rarely take
vacations or sick time (and when they are absent, no one
performs their work).
These red flags are often indicators of misconduct, and an
organization’s manage­ment and internal auditors need to
be trained to understand and identify the potential warn-
ing signs of fraudulent conduct. While none of these mean
an employee is actually committing fraud, a combination
 IPPF – Practice Guide

of these factors could indicate a need for inquiries and

heightened audit attention.

Awareness of fraud schemes is developed through periodic

assessment by management and internal auditors, train-
ing of employees, and frequent communication between
management and employees.

www.theiia.org/guidance / 9
INTERNAL AUDITING AND FRAUD
Typical Roles/Responsibilities
for Fraud Prevention/Detection
An oversight function is important to effectively prevent
or deter fraud. Oversight can take many forms and can be
performed by many within and outside the organization,
under the overall oversight of the board of directors.
Board of Directors
The board of directors has responsibility for effective and
responsible corporate fraud governance. The role of the
board is to oversee and monitor management’s actions to
manage fraud risks. Specifically, the board evaluates man-
agement’s identification of fraud risks, implementation of
anti-fraud measures, and creation of the tone at the top.
Since the board is the organization’s highest authority, it is
responsible for setting the tone for fraud risk management
within an organization. The board can implement poli-
cies that encourage ethical behavior, including processes
for employees, customers, and external business relation-
ship (EBR) partners to report instances where those poli-
cies are violated. The board may monitor the organization’s
fraud risk management effectiveness by appointing one
executive-level member of management to be responsible
for coordinating fraud risk management and reporting to
the board. To set the appropriate tone at the top, the board
of directors needs proper governance. This encompasses
all aspects of board governance, including independent
board members who exercise control over board informa-
tion, agenda, access to management and outside advisers,
and who independently carry out the responsibilities of the
nominating/governance, compensation, audit, and other
committees.
Audit Committee
An audit committee of the board of directors is the
independent eyes and ears of the investors and other
10 / The Institute of Internal Auditors
stakeholders. The committee’s role is to evaluate manage-
ment’s identification of fraud risks and the implementa-
tion of anti-fraud measures, and to provide the tone at
the top that fraud will not be accepted in any form. The
audit committee hires external auditors to report on the
financial statements of the organization and provide rec-
ommendations on internal control. The external auditors
report to the audit committee and not to management.
The audit committee usually has oversight of the inter-
nal audit activity. IIA Standard 2060: Reporting to the
Board and Senior Management states that “the CAE
must report periodically to senior management and to
the board on the internal audit activity’s purpose, author-
ity, responsibility, and performance relative to its plan.
Reporting must include significant risk exposures and
control issues, including fraud risks, governance issues,
and other matters needed or requested by senior man-
agement and the board.”
The audit committee is responsible for overseeing con-
trols to prevent or detect management fraud. In this role,
the audit committee is responsible for overseeing senior
management’s compliance with appropriate financial
reporting and for preventing senior management over-
ride of controls or other inappropriate influence over the
reporting process.
Management
Management is responsible for overseeing the activities of
employees and typically does so by implementing and moni-
toring processes and internal controls. In addition, manage-
ment assesses the vulnerability of the entity to fraudulent
activity. Fraud can occur in any organization, but the degree
and detail involved in the risk assessment may correspond
with the size and complexity of the organization.
Management is responsible for establishing and main-
taining an effective internal control system at a reason-
able cost. In addition, management’s discussions with

investigators and legal counsel play an important role in
developing controls over the investigation process, includ-
ing developing policies and procedures for effective fraud
investigations and for handling the results of investiga-
tions, reporting, and communications.
Legal Counsel
The roles and responsibilities of the in-house counsel
will often be governed by the laws of each jurisdiction. A
lawyer generally acts in the best interest of the organiza-
tion and also is required to preserve client confidences.
The discovery of fraud can bring these two ethical duties
into a potential conflict. When faced with constituents in
an organization who intend to engage in fraud, a lawyer
can urge reconsideration, advise the constituents to seek
a separate legal opinion, or refer the matter to a higher
authority within the organization. The in-house counsel
may decide to resign upon learning about potential or
ongoing fraud, especially if the counsel’s work product is
used to further the fraud. If counsel resigns, the general
counsel or outside counsel can document the measures
taken to notify the wrongdoing members of the organiza-
tion of the illegality of their 1) intended or ongoing con-
duct, 2) the consequences of that conduct, and 3) the
counsel’s attempt to deter the conduct.
Internal Auditors
Internal auditors evaluate risks faced by their organizations
based on audit plans with appropriate testing. Internal
auditors need to be alert to the signs and possibilities
of fraud within an organization. While external auditors
focus on misstatements in the financial statements that
are material, internal auditors are often in a better position
to detect the symptoms that accompany fraud. Internal
auditors usually have a continual presence in the organiza-
tion that provides them with a better understanding of the
organization and its control systems. Specifically, internal
auditors can assist in the deterrence of fraud by exam-
ining and evaluating the adequacy and the effectiveness
IPPF – Practice Guide
of internal controls. In addition, they may assist manage-
ment in establishing effective fraud prevention measures
by knowing the organization’s strengths and weaknesses
and providing consulting expertise.
The importance an organization attaches to its internal
audit activity is an indication of the organization’s com-
mitment to effective internal control and fraud risk man-
agement. The internal auditor’s roles in relation to fraud
risk management could include initial or full investiga-
tion of suspected fraud, root cause analysis and control
improvement recommendations, monitoring of a report-
ing/whistleblower hotline, and providing ethics training
sessions. If assigned such duties, internal auditing has a
responsibility to obtain sufficient skills and competencies,
including knowledge of fraud schemes, investigation tech-
niques, and laws.
Internal auditors may conduct proactive auditing to search
for misappropriation of assets and information misrepre-
sentation. This may include the use of computer-assisted
audit techniques, including data mining, to detect par-
ticular types of fraud. Internal auditors also can employ
analytical and other procedures to find unusual items and
perform detailed analyses of high-risk accounts and trans-
actions to identify potential fraud.
At the appropriate time when enough information has
been obtained, the CAE should keep senior management
and the audit committee informed of special investiga-
tions in-progress and completed.
External Auditors
The organization’s external auditors have a responsibility
to comply with professional standards and to plan and per-
form the audit of the organization’s financial statements to
obtain reasonable assurance about whether the financial
statements are free of material misstatement and whether
the misstatements were caused by error or fraud. Whenever
the external auditor has determined there is evidence that
www.theiia.org/guidance / 11
INTERNAL AUDITING AND FRAUD

fraud may exist, the external auditor’s professional stan-
dards typically require that the matter be brought to the
attention of an appropriate level of management. The
external auditor typically reports fraud involving senior
management directly to those charged with governance
(e.g., the audit committee).
Loss Prevention Manager
The loss prevention (LP) manager (or company security
group) deals with areas of business risk such as crimes,
disasters, accidents, and waste, which have the capabili-
ties to cause business failure. As the organization’s secu-
rity expert, the LP manager is in an advantageous position
to lead risk communications between other risk and line
managers. By identifying and understanding potential and
actual patterns within the business, the LP manager can
provide valuable insights to management on judging the
effectiveness of the organization’s risk management pro-
cesses. The LP manager usually works closely with inter-
nal auditors to identify areas of weak internal controls
within the organization.
Fraud Investigators
open dialogue. Also, a fraud investigator’s work done at
the direction of legal counsel may constitute protected
attorney work product.
The lead investigator usually determines the knowledge,
skills, and other competencies needed to carry out the
investigation effectively and assigns competent and appro-
priate people to the team. This process could include
assurance that there is no potential conflict of interest
with those being investigated or with any other employees
of the organization.
Other Employees
Every employee has a role to play in fighting fraud.
Employees are the eyes and ears of the organization,
and they should be empowered to maintain a workplace
of integrity. Employees can report suspicions of fraud to
an employee hotline, the internal audit department, or a
member of management. To deter and detect fraud and
abuse, many experts believe an employee hotline that is
appropriately monitored is the single most cost-effective
fraud detection and deterrence measure.

Fraud investigators are usually responsible for the detec-

tion and investigation of fraud, and the recovery of assets.
They also perform a role in fraud prevention. Senior man-
agement and the audit committee need to support the
investigators to let all stakeholders know the business
entity is ready to respond quickly and appropriately to
fraud risks. The organizational alignment of a fraud inves-
tigation unit (FIU) can vary. If a FIU is based within a
corporate security department, it may be beneficial for
them to work closely with or be involved in internal audit
activities so the FIU employees will have access to inter-
nal and independent auditor findings. Fraud investigators
often work closely with legal counsel to bring legal action
against the perpetrator. Communications between fraud
investigators and the legal counsel are likely to be con-
sidered confidential (e.g., privileged) to enable free and

12 / The Institute of Internal Auditors


Internal Audit Responsibilities
During Audit Engagement
To the degree that fraud may be present in activities
covered in the normal course of audit work, the Standards
state that internal auditors have the following responsibili-
ties with respect to fraud detection:
• Due Professional Care (Standard 1220).
• Risk Management (Standard 2120).
• Engagement Objectives (Standard 2210).
However, most internal auditors are not expected to have
knowledge equivalent to that of a person whose primary
responsibility is detecting and investigating fraud. Also, audit
procedures alone, even when carried out with due profes-
sional care, do not guarantee that fraud will be detected.
A well-designed internal control system should help pre-
vent or detect material fraud. Tests conducted by internal
auditors improve the likelihood that important fraud indi-
cators will be detected and considered for further testing.
A. Conducting Audit Engagements
In conducting audit engagements, the internal auditor
should:
• Consider fraud risks in the assessment of internal
control design and determination of audit steps to
perform. Internal auditors are not expected to detect
fraud, but internal auditors are expected to obtain
reasonable assurance that business objectives for
the process under review are being achieved and
material control deficiencies — whether through
simple error or intentional effort — are detected.
The consideration of fraud risks is documented in
the workpapers, as well as linkage of fraud risks to
specific audit work.
IPPF – Practice Guide
Have sufficient knowledge of fraud to identify red
•
flags indicating fraud may have been committed.
This knowledge includes the characteristics of
fraud, the techniques used to commit fraud, and
the various fraud schemes and scenarios associ-
ated with the activities reviewed.
• Be alert to opportunities that could allow fraud,
such as control deficiencies. If significant control
deficiencies are detected, additional tests con-
ducted by internal auditors could be used to iden-
tify whether fraud has occurred.
• Evaluate whether management is actively retaining
responsibility for oversight of the fraud risk man-
agement program, that timely and sufficient cor-
rective measures have been taken with respect to
any noted control deficiencies or weaknesses, and
that the plan for monitoring the program continues
to be adequate for the program’s ongoing success.
• Evaluate the indicators of fraud and decide whether
any further action is necessary or whether an inves-
tigation should be recommended.
• Recommend investigation when appropriate.
Appendix B includes some questions internal auditing
may routinely consider in its evaluation of an ongoing
fraud risk management program.
B. Internal Auditor Skepticism
Professional skepticism is an attitude that includes a ques-
tioning mind and a critical assessment of audit evidence.
An objective, skeptical internal auditor neither assumes
that management or employees are dishonest nor assume
unquestioned honesty.
In all audit work, the exercise of professional skepti-
cism is paramount. Inadequate professional skepticism
www.theiia.org/guidance / 13
INTERNAL AUDITING AND FRAUD
is frequently cited as a significant reason why material
fraud has not been detected. Internal auditors play a
critical role in the success or failure of fraud risk man-
agement. With their intimate knowledge of the workings
of an entity, internal auditors are in a unique position to
identify many of the indicators of fraud. When internal
auditors act with skepticism and they focus on the effec-
tiveness of internal controls, the likelihood that they will
notice the common characteristics of fraud is increased,
and they might uncover possible fraudulent activity if and
where it exists.
To allow internal auditors to exercise skepticism, IIA
Standard 1111: Direct Interaction with the Board states
that the CAE must communicate and interact directly
with the board. In addition, Standard 1120: Individual
Objectivity states that internal auditors must have an
impartial and unbiased attitude, which is consistent with
exercising skepticism. The audit committee’s oversight
and support of the internal audit activity helps the inter-
nal auditor maintain independence and objectivity as well
as keep an attitude of skepticism.
C. Communicating With the Board
The relationship between the CAE and the board of
directors includes both reporting and oversight functions.
Internal auditors, through the unique role they play, are
well positioned to elevate the importance of fraud preven-
tion and detection programs with management and the
board. Staying aware of what is happening in their specific
industry and organization will enhance internal auditors’
ability to address fraud risks with the board.
In discussions with the board, the CAE may include:
• All fraud audits performed.
• The fraud risk assessment process.
14 / The Institute of Internal Auditors
• Fraud or conflicts of interest and results of moni-
toring programs concerning compliance with law,
code of conduct, and/or ethics.
• The internal audit activity’s organizational struc-
ture as it pertains to addressing fraud.
• Coordination of fraud audit activity with external
auditors.
• Overall assessment of the organization’s control
environment.
• Productivity and budgetary measures of internal
audit's fraud activities.
• Benchmarking comparisons of internal audit’s
fraud activities with other organizations.
• Role of internal audit in fraud investigations.
The CAE may have a different opinion from senior man-
agement and the board about the right time to inform
them of serious issues including fraud. A solution for
addressing this timing concern is for the CAE to have dis-
cussions with senior management and the board before
issues arise concerning what they need to know, when
they need to know it, and how the communication will
be made. Conducting this discussion is evidence that the
CAE is complying with IIA Standard 2060: Reporting to
Senior Management and the Board. The following illus-
tration depicts an example of a document that could be
prepared to clarify the nature and timing of a CAE’s com-
munication with the board regarding fraud matters.
 IPPF – Practice Guide

When Events Should be

Sample Audit Committee Event Matrix Reported to the
Audit Committee

Annual Summary
At Next Meeting

Annual Report
Immediately
Event Magnitude

1 Defalcations, fraud, theft:

Not involving senior management
Major control breakdown More than $10,000 X
Involving collusion More than $10,000 X
Minor Under $10,000 X

Involving senior management All X

2 Denial of IA access to people or data All X

3 Violation of Ethics Policy

Senior management All X
Middle management All X

4 Discussion of replacement of the CAE All activity in advance X

www.theiia.org/guidance / 15
INTERNAL AUDITING AND FRAUD
Fraud Risk Assessment
All organizations are exposed to fraud risk in any process
where human involvement is required. An organiza-
tion’s exposure to fraud is a function of the fraud risks
inherent in the business, the extent to which effective
internal controls are present either to prevent or detect
fraud, and the honesty and integrity of those involved in
the process.
Fraud risk is the probability that fraud will occur and
the potential consequences to the organization when it
occurs. The probability of a fraudulent activity is based,
typically, on how easy it is to commit fraud, the moti-
vational factors leading to fraud, and the organization’s
fraud history.
A fraud risk assessment is often a critical component
of an organization’s larger enterprise risk management
program. The fraud risk assessment is a tool that assists
management and internal auditors in systematically
identifying where and how fraud may occur and who
may be in a position to commit fraud. A review of poten-
tial exposures represents an essential step in alleviating
the board’s and senior management’s concerns about
fraud risks and their ability to meet organizational goals
while promoting public confidence in the health of an
organization. A fraud risk assessment concentrates on
fraud schemes and scenarios to determine the presence
of internal controls and whether or not the controls can
be circumvented.
An important role of management is to provide oversight
for the successful completion of a fraud risk assessment
so that management has a better understanding of fraud
risks and the controls in place to mitigate those risks.
Organizations will need to reach their own conclusions
with respect to the cost of controlling a risk compared to
the benefits of mitigating or eliminating that risk.
16 / The Institute of Internal Auditors
A fraud risk assessment generally includes five key steps:
1. Identify relevant fraud risk factors.
2. Identify potential fraud schemes and prioritize them
based on risk.
3. Map existing controls to potential fraud schemes and
identify gaps.
4. Test operating effectiveness of fraud prevention and
detection controls.
5. Document and report the fraud risk assessment.
The scope of the fraud risk assessment may vary widely
depending on the organization’s size, complexity, or indus-
try. For example, an online business that has few employ-
ees with limited inventory and little cash on hand would
likely have different fraud risks than an organization with
numerous physical locations and a large employee base
with access to inventory and/or cash. One organization
may complete an enterprisewide assessment and include
all business areas in the assessment, while another organi-
zation may limit its focus to the most important business
risk area. An organization with several subsidiaries may
complete a separate assessment for each subsidiary or a
combined assessment.
A. Identifying Relevant Fraud Risk Factors
The first step is to gather information about the organiza-
tion’s business activities to gain an understanding of fraud
risks, including external business relationship partners.
This process includes review of documentation of previ-
ous frauds and suspected frauds committed against or on
behalf of the organization, evaluation of related frauds at
similar organizations, and review of the organization’s per-
formance measures over the past few years compared with
competitors. For example, inconsistent patterns between
non-financial measures and financial measures, excessive

use of licensed software, and use of other’s intellectual
property may indicate possible fraud.
B. Identifying Potential Fraud Schemes and
Prioritizing Them Based on Risk
Fraud, by definition, entails intentional misconduct designed
to evade detection. As such, a fraud risk assessment team
needs to engage in strategic reasoning to anticipate both
the fraud scheme and the individuals within and outside
the organization who could be in a position to perpetrate
each scheme. A fraud risk assessment team is typically
composed of individuals from the internal audit activity,
finance, legal, IT, security, and potentially other functions
depending on the nature of the organization.
The fraud risk assessment team identifies potential fraud-
ulent schemes using brainstorming, management inter-
views, analytical procedures, and review of prior frauds.
During this process, the fraud risk assessment team
reviews the organization’s activities, schemes relevant to
the industry, geography, and programs, always consider-
ing the basic characteristics of fraud (pressure/incentive,
opportunity, and rationalization), asking:
• Where are the opportunities for fraud?
• What is the level of pressure management is under
that would lead it to override internal controls?
• Are there any consequences if management fails
to reach goals?
Specific fraud areas should be identified without con-
sideration of existing or effectiveness of internal controls
(which is done later). The evaluation considers whether
the fraud could be committed by an individual alone or
requires collusion among employees or external persons.
The following factors are considered when prioritizing
fraud risks:
IPPF – Practice Guide
• Monetary impact.
• Impact to the organization’s reputation.
• Loss of productivity.
• Potential criminal/civil actions including potential
regulatory noncompliance.
• Integrity and security over data.
• Loss of assets.
• Location and size of operations/units.
• Company culture.
• Management/employee turnover.
• Liquidity of assets.
• Volume and/or size of transactions.
• Outsourcing.
C. Mapping Existing Controls to Potential
Fraud Schemes and Identifying Gaps
The fraud risk assessment team identifies preventive and
detective controls in place to address each fraud risk and
to assess the likelihood and significance of each poten-
tial fraud. Entity-level anti-fraud controls such as the
existence of a whistleblower hotline and whistleblower
protection policy, board oversight, results of continuous
monitoring, code of conduct, and the tone of manage-
ment’s communications regarding their tolerance for
fraud risk are important elements in this exercise. The
risk of management’s override of controls needs to be
explicitly considered and the cost/benefit for controlling
that risk should be evaluated.
D. Testing Operating Effectiveness of Fraud
Prevention and Detection Controls
Internal auditing typically plays an important role in
assessing the operating effectiveness of internal controls.
Internal auditors consider not only the existence of the
internal control, but also the effectiveness of the inter-
nal control through periodic testing of the control. For
example, an organization may implement a security policy
over network passwords, which requires passwords to
be changed every 30 days; however, the network system
www.theiia.org/guidance / 17
INTERNAL AUDITING AND FRAUD

access controls do not block user access if the password is
not changed as required. In this case, the internal control
is present, but is not operationally effective.
E. Documenting and Reporting on the Fraud
Risk Assessment
Refer to Appendix C for an example of a fraud risk assess-
ment. This template can be adapted for an enterprisewide
fraud risk assessment by including other major business
areas/units within the framework.

Organizations need to document the process that iden-

tifies and evaluates fraud risk. Key elements that would
likely be documented in a fraud risk assessment for each
significant business area include:

• The types of fraud that have some chance of

occurring.

• The inherent risk of fraud considering the avail-

ability of liquid and saleable assets, organiza-
tional morale and employee turnover, the history
of fraud and losses, and other specific business
area indicators.

• The adequacy of existing anti-fraud programs,

monitoring, and preventative controls.

• The potential gaps in the organization’s fraud con-

trols, including segregation of duties.

• The likelihood of a significant fraud occurring.

• The business impact/significance of a fraud.

According to IIA Standard 2060: Reporting to Senior

Management and the Board, the CAE must report peri-
odically to senior management and to the board signifi-
cant risk exposures and control issues, including fraud
risks. Management and the CAE update the board
periodically on the status and results of the fraud risk
assessment. These updates report on the effectiveness
of existing anti-fraud programs, as well as remediation
efforts pursued by management to address gaps identi-
fied during the assessment.

18 / The Institute of Internal Auditors


Fraud Prevention and Detection
Fraud can occur at various levels in an organization;
therefore, it is important to establish appropriate preven-
tive and detective techniques. Although fraud prevention
and detection are related concepts, they are not the same.
Fraud prevention entails implementing policies and pro-
cedures, employee training, and management communi-
cation to educate employees about fraudulent activities.
On the other hand, fraud detection entails activities and
programs designed to identify fraud or misconduct that is
occurring or has occurred. The interrelationship between
fraud prevention, detection, and investigation is shown in
the chart below.
Organizations can never eliminate the risk of fraud. There
are always people who are motivated to commit fraud, and
an opportunity can arise for someone in any organization
to override internal controls or to collude with others to
circumvent internal controls. Although every organiza-
tion is susceptible to fraud, it is not cost-effective to try
to eliminate all fraud risk. An organization may choose to
Preventive
controls
Potential fraud, Potential fraud,
waste, and abuse waste, and abuse
IPPF – Practice Guide
design its controls to detect, rather than prevent fraud
risks. If the cost of designing, implementing, and monitor-
ing internal controls against fraud exceeds the estimated
impact of the risk, it may not be cost-effective to imple-
ment the internal controls.
To understand and assess the opportunity for fraud to
occur in an organization, one needs to gain an understand-
ing of the corporate culture. Corporate culture provides
a holistic and comprehensive view of the overall manage-
ment philosophy and control environment. A strong ethi-
cal corporate culture alone will not protect an organization
from fraud. While cultivating an ethical culture is a criti-
cal first step, reducing fraud risk also requires training and
education, strong policies and procedures to implement
and monitor internal controls, procedures to detect fraud
risk indicators on a timely basis to investigate fraud, and
prosecution when appropriate.
A. Fraud Prevention
Fraud prevention involves those actions taken to discour-
age the commission of fraud and limit fraud exposure
when it occurs. Instilling a strong ethical culture and
Lessons learned influence future
use of preventive controls
Detection and Investigations
monitoring and prosecutions
Potential fraud
www.theiia.org/guidance / 19
INTERNAL AUDITING AND FRAUD
setting the correct tone at the top are essential elements
in preventing fraud. A strong principal mechanism for
preventing fraud is effective and efficient internal con-
trols, including controls related to screening customers,
vendors, and external business relationship partners. An
organization with effective internal controls deters fraud-
sters from the temptation to commit fraud. Management
is primarily responsible for establishing and maintaining
internal controls in an organization. The Committee of
Sponsoring Organizations of the Treadway Commission
(COSO) presented a framework for assessing and improv-
ing internal control systems to fight fraud. COSO iden-
tified five components in its Internal Control–Integrated
Framework: control environment, risk assessment, control
activities, information and communication, and monitor-
ing that may serve as the premise for the design of controls
to fight fraud. The elements are deeply intertwined and
overlapping in their nature and provide a natural interac-
tive process to promote the type of environment in which
fraud will not be tolerated at any level.
Control environment — Elements of a strong control
environment help prevent fraud including the following:
• A code of conduct, ethics policy, or fraud policy to
set the appropriate tone at the top.
• Ethics and whistleblower hotline programs to
report concerns.
• Hiring and promotion guidelines and practices.
• Oversight by the audit committee, board, or other
oversight body.
Risk assessment — Establishing a fraud risk assess-
ment process that considers fraud risk factors and fraud
schemes.
• Involving appropriate personnel in the fraud risk
assessment process.
20 / The Institute of Internal Auditors
• Performing fraud risk assessments on a regular
basis.
Control activities — Policies and procedures for busi-
ness processes, including appropriate authority limits and
segregation of incompatible duties.
Information and communication — Promoting the
importance of the fraud risk management program and
the organization’s position on fraud risk both internally and
externally through corporate communications programs.
• Designing and delivering fraud awareness training.
• An affirmation or certification process to confirm
employees have read and understand corporate
policies and that the employees are in compliance
with the policies.
Monitoring — Providing periodic evaluation of anti-
fraud controls.
• Using independent evaluations of the fraud risk
management program by internal auditing or
other groups.
• Implementing technology to aid in continuous
monitoring and detection activities.
B. Fraud Training
Fraud training is usually a key factor in the deterrence
of fraud. Training can cover the organization’s expecta-
tions for employees’ conduct, the procedures and stan-
dards necessary to implement internal controls, and
employee roles and responsibilities to report miscon-
duct. Employees need to understand the ethical behavior
expected of them to act accordingly within the organiza-
tion. New employee orientations can present the orga-
nization’s mission, values and code of conduct, types
of fraud, responsibility to report violations of ethical

behavior and impropriety, and details of the hotline or
other ways to report potential fraud.
Employee fraud training needs to be tailored to the orga-
nization and the employee’s position within the organiza-
tion. Although generic fraud training can be helpful, it is
more effective to identify the top fraud risk areas in the
organization and develop training so that employees in
key positions can better understand their role in the orga-
nization’s fraud detection program. Fraudsters may even
attend the training, which can benefit the organization,
as they may be deterred by seeing the organization’s fraud
risk management process in action.
Periodic training throughout an employee’s career rein-
forces fraud awareness and the cost of fraud to the orga-
nization. Regardless of the method used to produce and
disseminate the training material, one key goal is to test
the employee’s comprehension of the fraud training. This
can be done through online surveys that not only con-
firm attendance, but also offer quick exams to determine
whether employees have gained the necessary knowledge
from the training.
C. Fraud Detection
Detective controls are designed to provide warnings or
evidence that fraud is occurring or has occurred. Effective
internal controls are one of the strongest deterrents to
fraudulent behavior and fraudulent actions. Simultaneous
use of preventive and detective internal controls enhances
any fraud risk management program’s effectiveness.
Although detective internal controls may provide evi-
dence that fraud exists, detective internal controls are not
intended to prevent fraud.
Fraud detection methods need to be flexible, adaptable,
and continuously changing to meet the changes in the
risk environment. While preventive measures are appar-
ent and readily identifiable, detective controls may not be
as apparent (i.e., they operate in the background).
IPPF – Practice Guide
Organizations often rely on employees to report suspicious
activity through an anonymous whistleblower hotline. Using
employee feedback capitalizes on the fact that many employ-
ees within the organization want to share what they know
about organizational issues. An effective way for an organi-
zation to learn about existing fraud is to provide employees,
suppliers, and other stakeholders with a variety of methods
for reporting their concerns about illegal or unethical behav-
ior. Ways to collect this information include:
• Code of conduct confirmation — When employ-
ees sign an annual code of conduct outlin-
ing their responsibilities in the prevention and
detection of fraud, they can be asked to report
any known violations.
• Whistleblower hotline — This can take the form of
a telephone hotline or Web-based reporting system
where the whistleblower can remain anonymous.
• Exit interviews — Conducting exit interviews of
terminated employees or those who have resigned
can help identify fraud schemes. They may also
help determine whether there are issues regarding
management’s integrity, and may provide informa-
tion regarding conditions conducive to fraud.
• Proactive employee survey — Routine employee
surveys can be conducted to solicit employee
knowledge of fraud and unethical behavior
within the organization. A proactive survey could
elicit anonymous information from employees,
which would aid organizations in catching fraud
sooner than if they wait for employees to volun-
teer such information.
All of these methods can use traditional telephone inter-
views, Web forms, e-mails, faxes, and face-to-face meetings.
Other methods for fraud detection include surprise audits
in high fraud risk areas by either internal auditing, external
www.theiia.org/guidance / 21
INTERNAL AUDITING AND FRAUD

auditing, or management; continuous monitoring of criti-

cal data and related trends to identify unusual situations
or variances; and routine and/or ad hoc matching of public
data and/or proprietary data against relevant transactions,
vendor lists, employee rosters, and other data.

22 / The Institute of Internal Auditors


Fraud Investigation
Organizations investigate for possible fraud when there
is a concern or suspicion of wrongdoing within the orga-
nization. Suspicions can result from a formal complaint
process, informal complaint process such as tips, or
an audit, including an audit designed to test for fraud.
Investigating a fraud is not the same as auditing for fraud,
which is an audit designed to proactively detect indica-
tions of fraud in those processes or transactions where
analysis indicates the risk of fraud to be significant.
A fraud investigation consists of gathering sufficient
information about specific details and performing those
procedures necessary to determine whether fraud has
occurred, the loss or exposures associated with the fraud,
who was involved, and how it happened. An important
outcome of investigations is that innocent persons are
cleared of suspicion.
Investigations attempt to discover the full nature and
extent of the fraudulent activity, not just the event that
may have initiated the investigation. Investigation work
includes preparing, documenting, and preserving evidence
sufficient for potential legal proceedings.
Internal auditors, lawyers, investigators, security per-
sonnel, and other specialists from inside or outside the
organization usually conduct or participate in fraud
investigations.
Investigations and the related resolution activities need
to be carefully managed in accordance with laws. Local
laws may direct how and where investigations are con-
ducted, disciplinary and recovery practices, and investi-
gative communications. It is in the best interest of the
company, both professionally and legally, to work effec-
tively with the organization’s legal counsel and to become
familiar with the relevant laws in the country the fraud
investigation occurs.
IPPF – Practice Guide
A. Investigation Process
Management is responsible for developing controls over
the investigation process, including developing policies
and procedures for effective investigations, preserving
evidence, handling the results of investigations, report-
ing, and communications. Such standards are often docu-
mented in a fraud policy; internal auditors may assist in
the evaluation of the policy. Such policies and procedures
need to consider the rights of individuals, the qualifica-
tion of those authorized to conduct investigations, and
the relevant laws where the frauds occurred. The policies
should also consider the extent to which management will
discipline employees, suppliers, or customers, including
taking legal measures to recover losses and civil or crimi-
nal prosecution. It is important for management to clearly
define the authority and responsibilities of those involved
in the investigation, especially the relationship between
the investigator and legal counsel. It is also important
for management to design and comply with procedures
that minimize internal communications about an ongoing
investigation, especially in the initial phases.
The policy needs to specify the investigator’s role in
determining whether a fraud has been committed. Either
the investigator or management will decide if fraud has
occurred and management will decide whether the organi-
zation will notify outside authorities. A judgment that fraud
has occurred may in some jurisdictions be made only by
law enforcement or judicial authorities. The investigation
may simply result in a conclusion that organization policy
was violated or that fraud is likely to have occurred.
B. Internal Auditing’s Role in Investigations
The role of the internal audit activity in investigations needs
to be defined in the internal audit charter, as well as in the
fraud policies and procedures. For example, internal audit-
ing may have the primary responsibility for fraud investi-
gations, may act as a resource for investigations, or may
refrain from involvement in investigations. Internal auditing
www.theiia.org/guidance / 23
INTERNAL AUDITING AND FRAUD
may refrain from involvement because it is responsible for
assessing the effectiveness of investigations or it lacks the
appropriate resources to be involved in investigations. Any
of these roles can be acceptable as long as the impact of
these activities on internal auditing’s independence is rec-
ognized and handled appropriately.
To maintain proficiency, fraud investigation teams have a
responsibility to obtain sufficient knowledge of fraudulent
schemes, investigation techniques, and applicable laws.
There are national and international programs that pro-
vide training and certification for investigators and foren-
sic specialists.
If the internal audit activity is responsible for the investiga-
tion, it may conduct an investigation using in-house staff,
outsourcing, or a combination of both. In some cases,
internal auditing may also use nonaudit employees of the
organization to assist. It is often important to assemble
the investigation team without delay. If the organization is
likely to need external experts, the CAE may pre-qualify
the service provider[s] so external resources are quickly
available when needed.
In organizations where primary responsibility for the
investigation function is not assigned to the internal audit
activity, the internal audit activity may still be asked to
help gather information and make recommendations for
internal control improvements.
C. Conducting the Investigation
An investigation plan is developed for each investigation,
following the organization’s investigation procedures or
protocols. The lead investigator determines the knowl-
edge, skills, and other competencies needed to carry
out the investigation effectively and assigns competent,
appropriate people to the team. This process includes
obtaining assurance that there is no potential conflict of
interest with those being investigated or with any of the
employees in the organization.
24 / The Institute of Internal Auditors
The plan should consider the following investigative
activities:
• Gathering evidence through surveillance, inter-
views, or written statements.
• Documenting and preserving evidence, consider-
ing legal rules of evidence, and the business uses
of the evidence.
• Determining the extent of the fraud.
• Determining the techniques used to perpetrate
the fraud.
• Evaluating the cause of the fraud.
• Identifying the perpetrators.
At any point during this process, the investigator may con-
clude that the complaint or suspicion was unfounded and
then the investigator follows the organization’s process to
close the case.
The specific procedures employed in each investigation
will differ based on the specific situation and the goals of
the investigative team. The common investigative proce-
dures include:
• Obtaining evidence: The collection and prepa-
ration of evidence is critical to understanding
the fraud or misconduct, and it is needed to sup-
port the conclusions reached by the investigation
team. The investigation team may use computer
forensic procedures or computer-assisted data
analysis based on the nature of the allegations,
the results of the procedures performed, and the
goals of the investigation. All reports, documents,
and evidence obtained should be recorded chron-
ologically in an inventory or log. Some examples
of evidence include:

|| Letters, memos, and correspondence, both
in hard copy or electronic form (such as
e-mails or information stored on personal
computers).
|| Computer files, general ledger postings, or
other financial or electronic records.
|| IT or system access records.
|| Security and time keeping logs, such as secu-
rity camera videos or access badge records.
|| Internal phone records.
|| Customer or vendor information both in the
public domain and maintained by the organiza-
tion, such as contracts, invoices, and payment
information.
|| Public records such as business registra-
tions with government agencies or property
records.
|| News articles, internal and external Web sites,
such as social networking sites.
• Interviewing: The investigator will interview
individuals such as witnesses and facilitating
personnel. Typically, the accused individual is
interviewed after most applicable evidence has
been obtained. Many investigators prefer to
approach the accused with sufficient evidence
that will support the goal to secure a confes-
sion. Generally the accused is interviewed by
two people: 1) an experienced investigator and
2) another individual who takes notes during
the interview and later functions as a witness if
needed. In addition, it is essential that all infor-
mation obtained from the interview is rendered
correctly.
IPPF – Practice Guide
Investigative activities need to be coordinated with man-
agement, legal counsel, and other specialists, such as
human resources and insurance risk management, as
appropriate throughout the investigation.
Investigators need to be knowledgeable and cognizant of
the rights of persons within the scope of the investigation
and the reputation of the organization itself. The inves-
tigator has responsibility to ensure that the investigation
process is handled in a consistent and prudent manner.
The level and extent of complicity in the fraud through-
out the organization needs to be assessed. This assess-
ment can be critical to not destroying or tainting crucial
evidence, and to avoid obtaining misleading information
from persons who may be involved.
The investigation needs to adequately secure evidence
collected, maintaining chain of custody procedures appro-
priate for the situation.
D. Reporting Fraud Investigations
Reporting fraud investigations consists of the various oral,
written, interim, or final communications to senior man-
agement and/or the board regarding the status and results
of fraud investigations. Reports can be preliminary and
ongoing throughout the investigation.
A written report or other formal communication may be
issued at the conclusion of the investigation phase. It may
include the reason for beginning an investigation, time
frames, observations, conclusions, resolution, and correc-
tive action taken (or recommendations) to improve con-
trols. Depending on how the investigation was resolved, the
report may need to be written in a manner that provides
confidentiality for some of the people involved. In writing
the report, the investigator needs to consider the needs
of the board and management while complying with legal
requirements and restrictions, and the organization’s poli-
cies and procedures.
www.theiia.org/guidance / 25
INTERNAL AUDITING AND FRAUD
Additional considerations concerning fraud reporting are:
• Submitting a draft of the proposed final com-
munications on fraud to legal counsel for review.
In cases where the organization is able to invoke
attorney-client privilege, and has chosen to do so,
the report is addressed to legal counsel.
• Notifying senior management and the board timely
when significant fraud or erosion of trust occurs.
• The results of a fraud investigation may indicate
that fraud had a previously undiscovered adverse
effect on the organization’s financial position
and its operational results for one or more years
for which financial statements have already been
issued. Senior management and the board need to
be informed of such a discovery so they can decide
on the appropriate reporting, usually after consult-
ing with the external auditors.
If internal auditing conducts the investigation, IIA Standard
2400: Communicating Results provides information appli-
cable to necessary engagement communications.
E. Resolution of Fraud Incidents
Resolution consists of determining what actions will
be taken by the organization once a fraud scheme and
perpetrator[s] have been fully investigated, and evidence
has been reviewed. Management and the board are respon-
sible for resolving fraud incidents — not the internal audit
activity or the investigator.
Resolution may include all or some of the following:
• Providing closure to persons who were initially
under suspicion but were found to be innocent.
• Providing closure to those who reported a concern.
26 / The Institute of Internal Auditors
• Disciplining an employee in accordance with the
organization’s policies, employment legislation, or
employment contracts.
• Requesting voluntary financial restitution from an
employee, customer, or supplier.
• Terminating contracts with suppliers.
• Reporting the incident to law enforcement, regu-
latory bodies, or similar authorities; encouraging
them to prosecute the fraudster; and cooperating
with their investigation and prosecution.
• Entering into civil litigation or similar legal pro-
cesses to recover the amount taken.
• Filing an insurance claim.
• Filing a complaint with the perpetrator’s profes-
sional association.
• Recommending control enhancements.
F. Communications of Fraud Incidents
In addition to fraud reporting mentioned above, the two
types of communications that may result from an investi-
gation are public communications and planned internal
communications.
Management or the board determines whether to inform
entities outside the organization after consultation with indi-
viduals such as legal counsel, human resources personnel,
and the CAE. The organization may have a responsibility to
notify government agencies of certain types of fraudulent
acts. These agencies include law enforcement, regulatory
agencies, or oversight bodies. Additionally, the organization
may be required to notify the organization’s insurers, bank-
ers, and external auditors of instances of fraud. Any com-
ments made by management to the press, law enforcement,

or other external parties are best coordinated through legal
counsel. Typically, only authorized spokespersons make
external announcements and comments.
An important decision in this process is the decision to
prosecute the wrongdoer. This decision is made by man-
agement and the board, usually based on the input of legal
counsel. While internal auditors do not make these deci-
sions, they may indicate to management and the board
that prosecutions discourage future fraud by reinforcing
the repercussions of fraudulent behavior and thus serve
as a fraud deterrent.
Internal communications are a strategic tool used by man-
agement to reinforce its position relating to integrity, to
demonstrate that it takes appropriate action (including
prosecution if appropriate) when organization policy is
violated, and to show why internal controls are important.
Such communications may take the form of a newsletter
article, a memo from management, or the situation may
be used as an example in the organization’s fraud train-
ing program. These communications generally take place
after the case has been resolved internally, and they do not
specify the names of perpetrators or other specific inves-
tigation details that are not necessary for the message or
that contravene laws. An investigation and its results may
cause significant stress or morale issues that may dis-
rupt the organization, especially when the fraud becomes
public. Management may plan employee sessions and/or
team building strategies to rebuild trust and camaraderie
among employees.
G. Analysis of Lessons Learned
After the fraud has been investigated and communicated,
it is important for management and the internal audit
activity to step back and consider the lessons learned.
For example:
• How did the fraud occur?
• What controls failed?
IPPF – Practice Guide
• What controls were overridden?
• Why wasn’t the fraud detected earlier?
• What red flags were missed by management?
• What red flags did internal audit miss?
• How can future frauds be prevented or more
easily detected?
• What controls need strengthening?
• What internal audit plans and audit steps need to
be enhanced?
• What additional training is needed?
Both management and internal auditors may hold lessons
learned sessions. The dynamic feedback within these ses-
sions needs to stress the importance of acquiring up-to-
date information on fraudsters and fraud schemes that
can help internal auditors and the anti-fraud community
engage in best practices to prevent losses.
______________________________________________
Management’s fraud policies and procedures define who
has authority and responsibility for each aspect of the pro-
cess. The internal audit activity may be involved as advis-
ers to the process, as long as the impact of these activities
on internal auditing’s independence is recognized and
handled appropriately. In addition to advising manage-
ment, internal auditors may become involved in investiga-
tions by:
• Monitoring the investigation process to help
the organization follow relevant policies, proce-
dures, and applicable laws and statutes (where
internal auditing was not responsible for con-
ducting the investigation).
• Locating and/or securing the misappropriated or
related assets.
• Supporting the organization’s legal proceedings,
insurance claims, or other recovery actions.
www.theiia.org/guidance / 27
INTERNAL AUDITING AND FRAUD

• Evaluating and monitoring the organization’s inter-

nal and external post-investigation reporting and
communication plans and practices.

• Monitoring the implementation of recommended

control enhancement.

Internal auditors typically assess the facts of investigations

and advise management relating to remediation of control
weaknesses that lead to the fraud. Internal auditors may
design steps in audit programs or develop “auditing for
fraud” programs to help disclose the existence of similar
frauds in the future.

28 / The Institute of Internal Auditors

 IPPF – Practice Guide

Forming an Opinion on Internal

Controls Related to Fraud

The internal auditor may be asked by management or the

board to issue an opinion on the organization’s system of
internal controls related to fraud. See the following publi-
cations for more information on this topic:

• The IIA’s Practice Advisories in the 2410 series.

• The IIA’s Practice Guide, Practical Considerations

Regarding Internal Auditing Expressing an Opinion
on Internal Controls.

www.theiia.org/guidance / 29
INTERNAL AUDITING AND FRAUD
Appendix A – Reference
Material
The Institute of Internal Auditors (IIA), Practice
Advisory 1210-1: Proficiency, www.theiia.org.
The IIA, Practice Advisory 1210.A1-1: Obtaining
External Service Providers to Support or Complement
the Internal Audit Activity, www.theiia.org.
The IIA, Practice Advisory 1220-1: Due Professional
Care, www.theiia.org.
The IIA, Practice Advisory 2030-1: Resource
Management, www.theiia.org.
The IIA, Practice Advisory 2060-1: Reporting to Senior
Management and the Board, www.theiia.org.
The IIA, Joining the Fight Against Corruption, 2009,
www.theiia.org.
The IIA, The Role of Internal Auditing in Preventing
and Detecting Misuse, Fraud, and Bribery, Patty Miller,
February 2007.
The IIA, SOX Section 404: A Guide for Management by
Internal Controls Practitioners, second edition, The IIA,
2008, www.theiia.org.
The IIA Research Foundation, Using Non-Financial
Measures to Assess Fraud Risk, Brazel, Jones, and
Zimbelman, August 2008, www.theiia.org.
Internal Auditor Magazine, “Fraud Risk Assessment,”
Jonny Frank, April 2004, www.internalauditoronline.org.
30 / The Institute of Internal Auditors
Internal Auditor Magazine, “4 Steps to a Successful
Fraud Risk Assessment,” Paul Zikmund, February 2008,
www.internalauditoronline.org.
Internal Auditor Magazine, “The Risk Matrix Revisited,”
Larry Hubbard, April 2009, www.internalauditoronline.
org.
Internal Auditor Magazine, Focusing on Fraud issue,
October 2009, www.internalauditoronline.org.
Public Accounting
American Institute of Certified Public Accountants
(AICPA), “The Auditor’s Responsibility for Fraud and
the Importance of Professional Skepticism,” 2008,
www.aicpa.org.
Deloitte, Fraud & the Regulatory Environment, Stefan
DuChene, March 2006, https://www.tmaccalgary.
com/presentation/Stefan%20DuChene.ppt
KPMG LLP, Profile of a Fraudster Survey 2007, www.
us.kpmg.com.
KPMG LLP, Fraud Risk Management: Developing
a Strategy for Prevention, Detection, and Response,
2006, www.us.kpmg.com.
PricewaterhouseCoopers (PwC), Internal Audit 2012:
A Study Examining the Future of Internal Auditing and
the Potential Decline of a Controls-centric Approach,
2007, www.pwc.com.
Association Certified Fraud Examiners
(ACFE)
The Association of Certified Fraud Examiners (ACFE)/
American Institute of Certified Public Accountants
(AICPA), Fraud Tools, www.acfe.com.
 IPPF – Practice Guide

ACFE, 2008 ACFE Report to the Nation on

Occupational Fraud & Abuse, 2008, www.acfe.com.

ACFE, “How Fraud Hurts You and Your Government

Organization,” http://www.acfe.com/resources/fraud-
tools.asp?copy=video.

ACFE “Sample Fraud Policy,” http://www.acfe.com/

documents/sample_fraud_policy.pdf.

Joint Papers

The IIA, ACFE, and AICPA, Managing the Business

Risk of Fraud: A Practical Guide, 2008, www.theiia.org.

The IIA, ACFE, Information System Accountability

and Control Auditors, Financial Executives Institute,
Institute of Management Accountants, and Society
of Human Resource Professionals, Management
Anti-Fraud Programs and Controls: Guidance to Help
Prevent, Deter, and Detect Fraud, 2002.

Miscellaneous

Howard Silverstone and Howard Davia, Fraud 101:

Techniques and Strategies for Prevention (Second Edition),
2005.

www.theiia.org/guidance / 31
INTERNAL AUDITING AND FRAUD
Appendix B – Questions To
Consider
Conducting timely and appropriate discussions about
fraud with all levels of the organization, including the
audit committee, demonstrates the proactive role the
internal audit activity is taking in this area. Some of
questions that internal auditors may ask about fraud on
a regular basis include:
1. Does the organization have a fraud governance struc-
ture in place that assigns responsibilities for fraud
investigations?
2. Does the organization have a fraud policy in place?
3. Has the organization identified laws and regulations
relating to fraud in jurisdictions where it does business?
4. Does the organization’s fraud management program
include coordination with internal auditing?
5. Does the organization have a fraud hotline?
6. Does the audit charter describe internal auditing’s
roles and responsibilities relating to fraud?
7. Has responsibility for fraud detection, prevention,
response, and awareness been assigned within the
organization?
8. Do management and the CAE update the audit com-
mittee on fraud?
9. Does management promote fraud awareness and
training within the organization?
10. Does management lead fraud risk assessments and
include internal auditing in the assessment process?
32 / The Institute of Internal Auditors
11. Are the results of fraud risk assessments considered
in the audit planning process?
12. Are periodic fraud awareness and training programs
provided to all employees?
13. Are automated tools available to those responsible for
preventing, detecting, and investigating fraud?
14. Has management identified the types of potential
fraud risks in its areas of responsibility?
15. Do management and the CAE know where to obtain
guidance on fraud from professional organizations?
16. Do management and internal auditors know their pro-
fessional responsibilities relating to fraud?
17. Has management incorporated appropriate controls
to prevent, detect, and investigate fraud?
18. Does management have the appropriate skill sets in
place to perform fraud investigations?
19. Do management and the internal audit activity peri-
odically assess the effectiveness and efficiency of fraud
controls?
20. Are fraud investigation workpapers and supporting
documents appropriately secured and retained?
Note: This list is not a checklist. It does not include all
questions that may be needed to assess fraud risks in a
given organization, nor contain necessary follow-up ques-
tions that depend on the answers to previous questions.
Accordingly, auditors may use this as a start to create their
own tools and to brainstorm fraud risks.
 IPPF – Practice Guide

Appendix C – Fraud Risk Assessment Template

This table serves as an illustrative template of a fraud risk assessment. Customization or adjustment is needed to adapt it
for your organization’s fraud risk assessment.

Owner Fraud Risks Controls Monitoring Likelihood Impact

Construction Collusion between • Qualify contractors prior to bidding • Construction M M

Department contractor and (financial solvency, reputation). Department
subcontractor. • Formal competitive bidding proce- • Procurement
• Bid rigging. dures are used when selecting a • Legal
general contractor (GC). Example:
• Bribes/kick-
Sealed Bids. • Internal Auditing
backs.
• Subcontractor selection: For all
work exceeding $ limit, competitive
bidding is required by GC.
• Bid Confirmation Letters are sent to
subcontractors to ensure integrity
of bid process.
• Perform background check that
includes searching for past fraud
or ethical violations. Also, have GC
sign Ethics Statement.
• Display fraud hotline number
onsite.
• Periodic internal audits are com-
pleted of selected projects to
determine contract compliance and
search for irregularities.

www.theiia.org/guidance / 33
INTERNAL AUDITING AND FRAUD

Owner Fraud Risks Controls Monitoring Likelihood Impact

Construction Design & build • Execute construction contract with • Construction M H

Department defects (inferior detailed scope of work (specifica- Department
material used & tions). • Legal
construction not • Periodic site visitations by archi-
performed per • Internal Auditing
tects, local building inspectors,
specifications).
engineers, commission agents, and
• Reputation risk owner’s construction representa-
(injury or fatality tives are made to ensure job is on
at site). schedule and built per specifica-
tions and code.
• Display fraud hotline number
onsite.
• Periodic internal audits are com-
pleted of selected projects to
determine contract compliance and
search for irregularities.

34 / The Institute of Internal Auditors

 IPPF – Practice Guide

Owner Fraud Risks Controls Monitoring Likelihood Impact

Construction Contractor over- • Management reviews & approves • Construction M M

Department billing: invoices. Department
• Price. • Cost tracking is performed to moni- • Capital Appropriation
tor each project’s expenditures and Committee
• Quantity.
determine reasons for significant • Legal
• Duplicate variances from capital budget.
charges. • Estimator
• Research cost overruns thoroughly
• Fictitious and obtain approval before adjust- • Controllers
billings. ing contract price. • Internal Auditing
• Purchase dis- • Any changes to scope of work
counts not cred- include a written change estimate
ited. with management review and
• Related-party approval before work begins.
transactions. • Owner’s construction estimators
review cost increases or credits for
accuracy and competitiveness.
• Contract states related party
transaction or affiliates must be
disclosed and approved by owner.
Credit reports are obtained or
Internet searches randomly
performed.
• Display fraud hotline number
onsite.
• Periodic internal audits are com-
pleted of selected projects to
determine contract compliance and
search for irregularities.

www.theiia.org/guidance / 35
INTERNAL AUDITING AND FRAUD

Owner Fraud Risks Controls Monitoring Likelihood Impact

Construction Failure to perform. • Signed & notarized Release of • Construction M L

Department Contractor Lien is required before Department
releasing funds to contractor. • Controllers
• Procure Performance Bond in case • Internal Auditing
contractor does not fulfill their
contract obligations.
• A portion of the contractor’s pay-
ment due (retainage) is not paid to
contractor until 100 percent of work
is completed and final contractor
lien releases received.
• Display fraud hotline number
onsite.
• Periodic internal audits are com-
pleted of selected projects to
determine contract compliance and
search for irregularities.

Construction Theft or diversion • Owner assigns a project manager • Construction H L

Department of materials/equip- onsite to monitor job. Department
ment from job site. • The owner’s onsite representative • Internal Auditing
oversees procedures for controlling
equipment and onsite materials.
• Hire onsite security guards.
• Display fraud hotline number
onsite.
• Periodic internal audits are com-
pleted of selected projects to
determine contract compliance and
search for irregularities.

36 / The Institute of Internal Auditors

 IPPF – Practice Guide

Authors
• Gregory S. Dubis, CIA, CCSA, CISA, CFE

• Abraham D. Akresh CPA, CGFM

• Princy Jain: CIA, CCSA, CFE and CA (India)

• Lynn Morley, CIA, CGA

• Theresa M. Phipps, CPA

• Richard A. Schmidt, CPA, CIA, CFE

Reviewers and Contributors

• Douglas J. Anderson, CIA, CPA

• Steve Hunt, CIA, CISA, CGEIT, CBM

• Ken Askelson, CIA, CPA, CITP

• Rich Lanza, CPA, CFE, PMP

• Peter Millar

• Marilyn Prosch, Ph.D.

• Donald E. Sparks, CIA, CISA, ARM

www.theiia.org/guidance / 37
About the Institute
Established in 1941, The Institute of Internal
Auditors (IIA) is an international professional
association with global headquarters in Altamonte
Springs, Fla., USA. The IIA is the internal audit
profession’s global voice, recognized authority,
acknowledged leader, chief advocate, and princi-
pal educator.
About Practice Guides
Practice Guides provide detailed guidance for
conducting internal audit activities. They include
detailed process and procedures, such as tools and
technique, programs, and step-by-step approaches,
as well as examples of deliverables. Practice Guides
are part of the IIA’s International Professional
Practices Framework. As part of the Strongly
Recommended category of guidance, compliance
is not mandatory, but it is strongly recommended
and the guidance is endorsed by The IIA through
formal review and approval process.
For other authoritative guidance materials provided
by The IIA, please visit our Web site, www.theiia.
org/guidance.
Disclaimer
The IIA publishes this document for informational
and educational purposes. This guidance mate-
rial is not intended to provide definitive answers
to specific individual circumstances and as such
is only intended to be used as a guide. The IIA
recommends that you always seek independent
expert advice relating directly to any specific situa-
tion. The IIA accepts no responsibility for anyone
placing sole reliance on this guidance.
Copyright
The copyright of this position paper is held by The
IIA. For permission to reproduce, please contact
The IIA at guidance@theiia.org.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 IPPF – Practice guide

MeasurINg
INterNal audIt
eFFeCtIVeNess
aNd eFFICIeNCY

deCeMber 2010
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

Table of Contents
Executive Summary ........................................................................................1

Introduction ...................................................................................................1

Defining Internal Audit Effectiveness and Efficiency ...................................... 2

Internal and External Stakeholders ................................................................ 3

Internal Audit Performance Metrics/Measures of

Effectiveness and Efficiency .......................................................................... 4
• Establishing the Performance Measurement Process ......................... 4
• Categories of Performance Information for Internal Auditing.............. 5
• Characteristics of Performance Measures:
Quantitative vs. Qualitative ................................................................ 6
• Specifi c Measures .............................................................................. 6

Monitor and Reporting Results ....................................................................... 7

Appendix A: Reference Material ..................................................................... 8

Appendix B: Questions that Should be Answered to Adequately Gauge

and Provide to Varied Stakeholders Reasonable Assurance of Internal
Audit Quality .................................................................................................. 9

Appendix C: Examples of Internal Audit Effectiveness

and Efficiency Metrics.................................................................................. 10

Appendix D: Example of Reporting Internal Audit Effectiveness

and Effi ciency Dashboard............................................................................. 13

Appendix E: Example of Customer Survey Sent After Internal Audit

is Completed ................................................................................................ 14

Authors / Reviewers and Contributors .......................................................... 16

www.theiia.org/guidance / B

executive summary
Internal auditing plays a critical role in the governance
and operation of an organization. When effectively imple-
mented, operated, and managed, it is an important ele-
ment in helping an organization achieve its objectives.
Organizations that effectively use internal auditing are
better able to identify business risks and process and sys-
tem inefficiencies, take appropriate corrective action, and
ultimately support continuous improvement. To maintain
and enhance internal auditing’s credibility; however, its
effectiveness and efficiency must be monitored.
Establishing performance measures is critical in deter-
mining if an audit activity is meeting its goals and objec-
tives, consistent with the highest quality practices and
standards. This practice guide provides guidance to inter-
nal audit activities on measuring their effectiveness and
efficiency and the level of customer service they provide
to stakeholders.
The first step is to identify key performance measures for
activities that stakeholders believe add value and improve
the organization’s operations. Examples of stakeholders
include the board, executive management, external gov-
ernment bodies and regulators, the external auditor, as
well as the internal audit activity itself.
Sources to consider when identifying key performance ef-
fectiveness and efficiency measurements of the internal
audit activity include The IIA’s International Professional
Practices Framework (IPPF), the internal audit charter
and mission, applicable laws and regulations, and audit
strategies and plans.
Effectiveness and efficiency measurements can be quan-
titative and qualitative. In addition to compliance with
The IIA’s International Standards for the Professional
Practice of Internal Auditing (Standards), audit activity
performance measures may include:
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
• Level of contribution to the improvement of risk
management, control, and governance processes.
• Achievement of key goals and objectives.
• Evaluation of progress against audit activity plan.
• Improvement in staff productivity.
• Increase in efficiency of the audit process.
• Increase in number of action plans for process im-
provements.
• Adequacy of engagement planning and supervision.
• Effectiveness in meeting stakeholders’ needs.
• Results of quality assurance assessments and inter-
nal audit activity’s quality improvement programs.
• Effectiveness in conducting the audit.
• Clarity of communications with the audit client (of-
ten referred to as “auditee”) and the board.
Once key effectiveness and efficiency measurements and
targets have been identified, a monitoring process and
a method of reporting to stakeholders should be estab-
lished (e.g., format, timing, and metrics). It is important
for the internal audit activity to obtain feedback from
key stakeholders on audit effectiveness and make adjust-
ments where needed.
Introduction
The IIA’s International Professional Practices Framework
(IPPF) defines internal auditing as “an independent, ob-
jective assurance and consulting activity designed to add
value and improve an organization’s operations. It helps
an organization accomplish its objectives by bringing a
systematic, disciplined approach to evaluate and improve
the effectiveness of risk management, control, and gover-
nance processes.”
The following International Standards for the Professional
Practice of Internal Auditing (Standards) are relevant is
measuring the effectiveness and efficiency of the internal
audit activity.
www.theiia.org/guidance / 1

1300 – Quality Assurance and Improvement
Program
The chief audit executive must develop and maintain a
quality assurance and improvement program that covers
all aspects of the internal audit activity.
Interpretation:
A quality assurance and improvement program is designed
to enable an evaluation of the internal audit activity’s con-
formance with the Definition of Internal Auditing and the
Standards and an evaluation of whether internal auditors
apply the Code of Ethics. The program also assesses the ef-
ficiency and effectiveness of the internal audit activity and
identifies opportunities for improvement.
1310 – Requirements of the Quality Assurance
and Improvement Program
The quality assurance and improvement program must
include both internal and external assessments.
1311 – Internal Assessments
Internal assessments must include:
• Ongoing monitoring of the performance of the inter-
nal audit activity; and
• Periodic reviews performed through self-assessment
or by other persons within the organization with suf-
ficient knowledge of internal audit practices.
1312 – External Assessments
External assessments must be conducted at least once
every five years by a qualified, independent reviewer or re-
view team from outside the organization. The chief audit
executive must discuss with the board:
• The need for more frequent external assessments;
and
• The qualifications and independence of the external
reviewer or review team, including any potential
conflict of interest.
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
Additional guidance on applying the Standards is found
in:
• Practice Advisory 1300-1: Quality Assurance and
Improvement Program.
• Practice Advisory 1310-1: Requirements of the
Quality Assurance and Improvement Program.
• Practice Advisory 1311-1: Internal Assessments.
• Practice Advisory 1312-1: External Assessments.
This practice guide suggests using the analysis of per-
formance measures as an element in conducting these
internal/external reviews. It provides examples to be con-
sidered when measuring an internal audit department’s
effectiveness and efficiency for various internal and ex-
ternal customers. The examples should not be considered
the only factors to use. Also see Appendix A for additional
reference material on this topic.
defining Internal audit
effectiveness and efficiency
A general description of effectiveness and efficiency is “the
degree (including quality) to which established objec-
tives are achieved.” The same description can be used
for internal audit effectiveness and efficiency. Internal au-
diting should establish performance metrics and related
measurement criterion appropriate to its environment/
organization to measure the degree (including quality)
of achievement of objectives for which the internal audit
activity is established. (See Appendix B for examples of
questions that could help determine internal audit qual-
ity.) Internal audit effectiveness and efficiency should be
monitored and assessed periodically as part of the inter-
nal audit process.
www.theiia.org/guidance / 2

Internal and external
stakeholders
Typically, the key stakeholders for the internal audit
activity are divided into internal and external.
Internal stakeholders may include:
• Board of directors (or a committee such as the audit
committee).
• Senior management.
• Operations and support management.
• Internal auditors.
External stakeholders may include:
• Regulatory bodies and standard setters.
• External auditors.
• Third-party vendors.
• Third-party customers.
The internal audit activity should identify all relevant
stakeholders and their respective interests in the work
of or support from the internal audit activity and should
solicit feedback from each of these stakeholders as appro-
priate. Specific feedback will provide insight into:
• The purpose and responsibility of internal auditing
and whether that is understood by different levels
within the organization.
• Adequacy of internal audit independence and
objectivity.
• Target deliverables and expectations of the internal
audit activity.
• Current or planned business priorities and correla-
tion of those with the activity’s scope, as appropriate.
• Current shortcomings, if any, of the internal audit
activity.
IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency
• Quality and sufficiency of communication from the
activity.
• Current level of satisfaction, or lack thereof, with the
frequency and nature of engagements planned and
performed.
• Current level of satisfaction, or lack thereof, with the
internal audit activity’s resources.
• Changing needs of business, related risks, and ability
of internal auditing to provide assurance and consult-
ing services.
Considerations in identifying relevant stakeholders and
their satisfaction include:
• The extent of regulation of the organization and
internal audit activity.
• Internal auditing’s relationship with key internal and
external stakeholders and establishment of function
expectations and objectives with these groups.
• Consideration of the authority and relevancy of the
stakeholder to the internal audit activity.
• The activity’s internal feedback from key individuals,
groups, or standard setters that will help further opti-
mize the activity’s quality, scope, and effectiveness.
• The nature of the organization (e.g., public or pri-
vately held and levels of management/management
hierarchies).
• Types of engagements performed by the internal
audit activity.
• Specific stakeholders identified within the internal
audit activity’s charter.
• Applicable content of the board’s charter.
www.theiia.org/guidance / 3
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

Internal audit Performance Metrics/Measures of

effectiveness and efficiency
Internal auditing must effectively demonstrate its value as a key component of the organization’s governance framework.
The audit activity can lead by example with strong, relevant, and reliable performance measures.

Establishing the Performance Measurement Process

To create effective performance measures, the chief audit executive (CAE) needs to establish a process for:
• Identifying critical performance categories such as stakeholder satisfaction, internal audit processes, and innovation
and capabilities.
• Identifying performance category strategies and measurements. Strategies should be pursued in compliance with
IIA Standards, other applicable professional standards, and applicable laws and regulations and should ensure
stakeholder satisfaction. The use of performance measures can be an element of the internal audit activity’s internal
assessment process to comply with The IIA’s Standards.
• Routinely monitoring, analyzing, and reporting performance measures.

The process could follow these types of steps:

Define Internal Audit Effectiveness

• Review relevant IPPF guidance including Standards.
• Review the strategic plans of the internal audit activity and organization.
• Review the board, audit committee, and internal audit activity charters.
• Assess basic, expected, and targeted/preferred internal audit activity deliverables.
• Formulate an initial definition of internal audit effectiveness and efficiency.
• Define agreement from key stakeholders of the definition of effectiveness and efficiency.
▼
Identify Key Internal and External Stakeholders
• Determine key internal and external stakeholders for the activity and organization.
• Determine who directly or indirectly relies upon the internal audit activity’s work.
• Determine who benefits, directly or indirectly, from the internal audit activity’s work.
• Consider who supports the internal audit activity.
▼
Develop Measurements of Internal Audit Effectiveness
• Understand key stakeholders’ expectations of the internal audit activity.
• Understand what internal audit attributes, deliverables, and capabilities key stakeholders value and related
shortcomings or advancements in these areas.

www.theiia.org/guidance / 4
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

• Develop measurement tools such as a balanced scorecard to document relevant attributes of effectiveness and
efficiency and related performance against these.
• Agree upon effectiveness and efficiency metrics with key stakeholders.
▼
Monitoring and Reporting Results
• Establish an agreed upon format and frequency for reporting that considers the organization’s size, nature, and
governance structure.
• Establish a periodic review of such monitoring and reporting to ensure relevance, efficiency, and effectiveness.
• Use the results of reporting to shape and guide internal audit activities.
• Align internal audit activities to the defined measures of internal audit effectiveness and efficiency.

Categories of Performance Information for Internal Auditing

The internal audit activity should identify key performance measurement categories such as stakeholder satisfaction, audit
processes, and internal audit innovation and capabilities. Audit processes could include risk assessment, planning, and au-
dit methodologies. Innovation and capabilities could include effective use of technology, training, and industry knowledge.

When developing performance measures, the internal audit activity should consider:
• How effective are the performance measures linked to the internal audit activity’s strategy?
• Do performance measures include both leading and lagging indicators?
• Do performance measures reflect the mandate and role of the activity?
• How effectively are performance measures used for continuous improvement?
Performance metrics can be established along dimensions, interests, and perspectives of a variety of key stakeholders.
Each perspective would include related measures.

Audit Committee

IIA Standards
Management/ Departmental Outcomes and Priorities Internal Audit
Auditees Legislation/Policy Processes

Innovation and
Capabilities

Source: Adapted from A Balanced Scorecard Framework for Internal Auditing Departments, by Mark Frigo, copyright
The IIA Research Foundation, Altamonte Springs, FL, 2002 used with permission.

www.theiia.org/guidance / 5
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

Characteristics of Performance Measures: Specific Measures

Quantitative vs. Qualitative
Both quantitative and qualitative metrics are important in
demonstrating an internal audit activity’s performance to
key stakeholders, and both can be benchmarked against
accepted standards, prior performance, and/or agreed-
upon expectations.
• Quantitative performance metrics are often based on
existing or obtainable data and are easily understood
(e.g., percentage of completed vs. planned audits).
They often require less effort to collect and are read-
ily comparable to the same metrics in other organiza-
tions.
• Qualitative metrics are often based on the collection
of unique information through more time intensive
methods such as survey research or interviews. They
offer a broad view of performance on a range of
topics that can provide depth to quantitative metrics.
In addition to compliance with the Standards, internal
auditing’s performance measurement objectives may in-
clude: level of contribution to the improvement of risk
management and control and governance processes;
achievement of key goals and objectives assigned; evalua-
tion of progress against audit plan; staff productivity; cost-
efficiency of the audit process, number of action plans
for process improvements; effectiveness in meeting the
needs of stakeholders; and the sufficiency of quality as-
surance reviews.
Following is an example of a balanced scorecard type
approach that an internal audit activity could use.
Each of these measures would need to be carefully and
fully defined so they could be used in a consistent, trans-
parent, and sustainable manner.

Audit Committee:
• Satisfaction survey
• Risk concerns
Management/ • Plan input Internal Audit
Auditees: Processes:
• Satisfaction survey • Risk coverage
• Average number of • Percent completed vs.
recommendations IIA Standards planned audits
per audit Departmental Outcomes and Priorities • Number of
• Percent of
recommendations
Legislation/Policy recommendations/audits
• Actual vs. planned costs
implemented by • Elapsed audit time start
corrective action date to finish
• Cost savings • Conformance to policy
• Changes to processes Innovation and Capabilities: and Standards
• Staff experience • Quality assurance
• Training hours/auditor techniques developed
• Percentage of staff holding relevant designations
• Number of innovative improvements implemented
• Number of process improvements
• Percentage of surprise risk events

www.theiia.org/guidance / 6
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

Monitoring and reporting
results
Internal auditing’s effectiveness and efficiency should be
reported to its stakeholders periodically. The CAE should
obtain feedback from key stakeholders on internal audit-
ing’s effectiveness and efficiency in reporting (e.g., for-
mat, timing, metrics) and make efforts to align reporting
to their needs.
Consistent processes are needed for gathering, summa-
rizing, and analyzing measurement data. Responsibility
for performing and validating measurement data should
be established similar to any other audit engagement.
The CAE may consider periodic benchmarking of its cur-
rent metrics and criteria with those being used by peer
organizations. This can help ensure current and appropri-
ate criteria are in place for measuring internal auditing’s
effectiveness and efficiency.

Contents: What should be reported varies based on stake-

holder requirements and the organization’s specific needs.
A good practice is to survey key stakeholders to determine
their needs and expectations, which then helps define the
criteria upon which internal auditing should be measured
(see Appendix E, Survey Example). Appendix C provides
examples of effectiveness and efficiency measurement
criterion.

type of reporting: The CAE should evaluate stakeholders

to whom reporting is required and customize the report-
ing package to their individual needs.

Frequency: The frequency of reporting should be based

on stakeholder needs. Quarterly reporting on internal au-
dit effectiveness and efficiency could be a good starting
point.

Format: Standards for reporting internal audit effective-

ness and efficiency should be similar to standards followed
for reporting other audit-related information. There are
many formats for reporting, including Word, PowerPoint,
dashboards based on automated tools, and e-mail. The
chosen format should be tailored to meet stakeholders’
specific needs. For example, reporting to the board might
be less frequent and in less detail to meet its needs in
overseeing the activities of internal auditing. Reporting to
management would likely be much more detailed. Refer
to Appendix D for a dashboard reporting example.

www.theiia.org/guidance / 7
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

appendix a:
reference Material
Quality Assessment Manual, by The IIA (IIA Research
Foundation, 2009).

The IIA’s Global Auditing Information Network (GAIN),

which enables organizations to compare their audit
department’s size, experience, expertise, and other metrics
against the aggregated averages of similar-sized organiza-
tions in their industry.

A Balanced Scorecard Framework for Internal Auditing

Departments, by Mark Frigo (IIA Research Foundation,
2002).

Internal Auditing: Assurance & Consulting Services, by Kurt

Reding, Paul Sobel, Urton Anderson, Michael Head, Srid-
har Ramamoorti, Mark Salamasick, and Chris Riddle (IIA
Research Foundation, 2007).

Essentials: An Internal Audit Operations Manual, by Archie

Thomas (IIA Research Foundation, 2009).

Performance Auditing: A Measurement Approach, by Ronell

Raaum and Stephen Morgan (IIA Research Foundation,
2009).

Best Practices: Value-Added Approaches of Four Innovative

Auditing Departments, by James Roth (IIA Research Foun-
dation, 2000).

Internal Audit Effectiveness: Pushing the Right Buttons,

by David Lukeman (IIA Midlands District Society –
PriceWaterhouseCoopers, March 21, 2007).

www.theiia.org/guidance / 8
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

appendix b: 12. Do members of the team participate in professional

development training?

Questions that Should be Answered to
Adequately Gauge and Provide to Varied
Stakeholders Reasonable Assurance of
Internal Audit Quality
Source: www.theiia.org/guidance/quality. Under Advocacy,
click on The Audit Committee: Internal Audit Oversight
13. Have team members acquired professional
designations that demonstrate their competency?
14. Has the internal audit activity obtained an
independent external quality assessment within
the past five years?

1. Does the internal audit activity have a quality assur-

ance and improvement program?

2. Has the activity performed its work in accordance

with its charter?

3. Do the internal auditors adhere to The IIA’s Code of

Ethics?

4. Are internal audits conducted in conformance with

The International Standards for the Professional
Practice of Internal Auditing?

5. Does the activity operate effectively and efficiently?

6. Is the staff size adequate?

7. Are the existing skill sets appropriate?

8. Does the activity contribute to the improvement

of organizational operations, and is it perceived by
stakeholders to add value?

9. Does the activity have the tools and other resources

it needs?

10. Does the activity engage in ongoing internal reviews

and analysis of supervision, documentation, poli-
cies, and procedures?

11. Does the activity engage in periodic reviews that

include customer surveys, risk assessments, work-
paper reviews, analysis of performance metrics, and
best-practice benchmarking?

www.theiia.org/guidance / 9
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

appendix C:
Examples of Internal Audit Effectiveness and Efficiency Metrics

PerForMaNCe MeasureMeNt Measures oF eFFICIeNCY

Measures oF eFFICIeNCY Measures oF eFFeCtIVeNess
CategorY aNd eFFeCtIVeNess

basic Measures • Number of audits scheduled. • Client satisfaction ratings. • Training/CPE hours.
• Number of audit completed. • Staff satisfaction ratings. • Staff turnover/retention.
• Timeliness of performance • Number of signifi cant audit
feedback. findings.
• Staff utilization – direct vs. • Percent of recommendations
indirect time. implemented.
• Completed audits per auditor. • Number of repeat fi ndings.
• Actual hours vs. budgeted • Number of open audit fi ndings
hours. past planned corrective action
• Audit report cycle time: date.
elapsed time from open- • Number of unsatisfactory
ing conference to fieldwork internal audit opinions.
completion and elapse time
from fi eldwork completion to
fi nal report.
• Number of internal audit
reports issued vs. planned
internal audits.

service to stakeholders • Responsiveness to special • Delivery of high quality • Client survey scores (see
requests. service. example survey letter in
• Average response time to • Management of auditee Appendix E).
management request. expectations. • Senior management survey
• Number of control self- • Building strong relationships. scores.
assessment (CSA) sessions • Number of management • Audit committee survey
conducted. requests. scores.
• Number of auditors per 1,000 • Number of committees and • Number of positive and
employees. task forces audit is involved negative feedback about
• Number of auditors per $1 in. audits/auditors.
million of revenue/$1 million • Amount of identified cost
of assets. savings and percent of
• Completed vs. planned audits. recoveries.
• Cost savings as a percentage
of department budget.

www.theiia.org/guidance / 10
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

PerForMaNCe MeasureMeNt Measures oF eFFICIeNCY

Measures oF eFFICIeNCY Measures oF eFFeCtIVeNess
CategorY aNd eFFeCtIVeNess

Knowledge of business • Applying that knowledge to

help solve complex client
issues.
• Development of deep industry
knowledge.
• Developing and contributing
best practices, emerging is-
sues, and industry trends.
• Best practices benchmarked.

technical development • Development of relevant

technical knowledge:
• Internal auditing.
• Accounting.
• Regulatory.
• Business.
• Compliance with audit
methodology set.

Innovation • Use of technology in audits. • Enhanced audit process.

• Creativity and effi ciency. • Number of best practices
• Number of internal audit identified and communicated
improvement teams and time within an organization or
spent (by team). internal audit activity.
• Number of hours spent in
industry or other specialized
training.
• Involvement in professional
organizations (e.g., IIA, audi-
tor roundtables).
• Thought leadership.

www.theiia.org/guidance / 11
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

PerForMaNCe MeasureMeNt Measures oF eFFICIeNCY

Measures oF eFFICIeNCY Measures oF eFFeCtIVeNess
CategorY aNd eFFeCtIVeNess

People development • Number of coaching sessions • Average months in position. • Assistance in recruiting by
in a year. • Number of staff rotations in team members (participation
• Tracking of development plan and out of the internal audit in review of resume, interview
(plan vs. actual). activity. etc.).

• Achievement of minimum • Average years of audit experi-

training hours required. ence.
• Percent of auditors with
professional certifi cations.
• Percent of auditors with
advanced degrees.
• Training hours per auditor.
• Auditor turnover.
• Number/percent of auditors
transferred/promoted to other
functions in the organization
vs. the number that left the
company.

www.theiia.org/guidance / 12
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

appendix d:
Example of Reporting Internal Audit Effectiveness and Efficiency Dashboard

quaNtItatIVe Measures
area Measure target actual
q1 q2 q3 q4
Budget management. Budget vs. actual.
Delivering the annual audit plan. Percent of audit plan delivered during the year.
CustoMer serVICes
area Measure target actual
q1 q2 q3 q4

Number/types of ad-hoc requests Record to be kept of ad-hoc nonroutine requests by

received for nonroutine work. the management.

staFF satIsFaCtIoN aNd deVeloPMeNt

area Measure target actual
q1 q2 q3 q4
Staff training hours/year. Actual training hours vs. budget.
Staffi ng plan (hiring). Plan vs. actual hired.
audIt delIVerY/eFFICIeNCY
area Measure target actual
q1 q2 q3 q4
Audit reviews completed within
Budget vs. actual.
budget and to agreed target date.
Revise the audit methodology. Plan vs. actual revision.
relatIoNshIP WIth thIrd PartIes
area Measure target actual
q1 q2 q3 q4
Use of subject matter experts.
Use of SMEs for specialized work.
(SMEs)

www.theiia.org/guidance / 13
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

appendix e:
Example of Customer Survey Sent After Internal Audit is Completed

Re: Internal Audit Feedback Survey

Dear XXXXX:

We recently performed an internal audit in your area. To continue to improve the level of service we provide
our customers, we would appreciate your candid feedback on the attached Internal Audit Feedback Survey.
We value the opinions of our clients and stakeholders and will use your feedback to continually evaluate the
quality of our audit services. Please send the completed survey back to me by (date).

If you have any questions, please do not hesitate to call me at (phone number).

Sincerely,

CAE or Auditor

INterNal audIt FeedbaCK surVeY

AUDIT REPORT TITLE: __________________________________________

BUSINESS OWNER: _____________________________________________

The rating scale provided below is from 5 (strongly agree) to 1 (strongly disagree).

5 4 3 2 1 Not done
strongly agree Neither disagree strongly
audIt qualItY agree agree nor disagree
disagree
1 Opening conference was held and all questions/comments were
adequately addressed.
2 The fi nal audit objectives and scope were agreed to.

www.theiia.org/guidance / 14
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

3 The audit team was knowledgeable about your business.

4 The audit was completed within the timeframe communicated.

5 The audit was conducted efficiently and effectively with minimal

disruption to your business.
6 The audit was conducted in a professional and courteous man-
ner.
7 The audit team kept you informed of key issues throughout the
audit.
8 All of your key business concerns/risks were addressed during the
audit.
9 The closing conference allowed both sides to adequately discuss
and address all comments.
10 The audit report was accurate and fi ndings clearly communi-
cated.
11 The audit report fairly refl ected your team’s comments and cor-
rective action.
12 The overall audit provided value to your area.

Feel free to comment on any of the above questions.

What suggestions do you have to improve future audit quality?

Thank you for completing the above survey! Please return by (Date).

www.theiia.org/guidance / 15
 IPPF – Practice guide
Measuring Internal audit
effectiveness and efficiency

authors
Gregory S. Dubis, CIA, CCSA

Princy Jain, CIA, CCSA

Amipal Manchanda

Rita Thakkar, CIA

reviewers and Contributors

Douglas J. Anderson, CIA

James Rose, CIA

Steven E. Jameson, CIA, CCSA, CFSA

www.theiia.org/guidance / 16
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for information-
Auditors (IIA) is an international professional as- al and educational purposes. This guidance mate-
sociation with global headquarters in Altamonte rial is not intended to provide definitive answers
Springs, Fla., USA. The IIA is the internal audit to specific individual circumstances and as such
profession’s global voice, recognized authority, ac- is only intended to be used as a guide. The IIA
knowledged leader, chief advocate, and principal recommends that you always seek independent
educator. expert advice relating directly to any specific situ-
ation. The IIA accepts no responsibility for anyone
About Practice Guides placing sole reliance on this guidance.
Practice Guides embody an IIA statement to assist
a wide range of interested parties, including those Copyright
not in the internal audit profession, in understand- The copyright of this position paper is held by The
ing significant governance, risk, or control issues IIA. For permission to reproduce, please contact
and in delineating the related roles and responsi- The IIA at guidance@theiia.org.
bilities of internal auditors on a significant issue.
Practice Guides are part of The IIA’s International
Professional Practices Framework. As part of the
Strongly Recommended category of guidance,
compliance is not mandatory, but it is strongly
recommended and the guidance is endorsed by
The IIA through formal review and approval pro-
cess. For other authoritative guidance materials
provided by The IIA please visit our Web site,
www.theiia.org/guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice Guide

Quality Assurance and

Improvement Program

March 2012
 IPPF – Practice Guide
Quality Assurance and Improvement Program

Table of Contents

Executive Summary......................................................................................... 1
Introduction.................................................................................................... 2
What is Quality?........................................................................................ 2
Quality in Internal Audit............................................................................ 2
Conformance or Compliance?.................................................................... 2
Embedding Quality in Systems and Processes........................................... 3
Overview of a Quality Assurance and Improvement Program (QAIP)............... 3
Quality Assessments................................................................................. 5
Internal Assessments................................................................................ 5
External Assessments............................................................................... 7
Assessment Scale..................................................................................... 9
Developing and Implementing a QAIP........................................................... 10
Considerations in Developing a QAIP....................................................... 10
Quality Responsibilities........................................................................... 10
Continuous Improvement......................................................................... 10
Sample Approach – Program Sections Within an Internal Audit Activity.. 11
Reporting on the Quality Program............................................................ 12
Review of the QAIP.................................................................................. 13
APPENDIX A: Reference Material................................................................... 14
APPENDIX B: Engagement Supervision, Working Papers, and
Working Paper Quality Reviews..................................................................... 15
APPENDIX C: QAIP Components.................................................................... 17
APPENDIX D: Sample Element Self-assessment Methodology....................... 20
APPENDIX E: Sample Template for Performing Self-assessments................. 22
APPENDIX F: Definition of Internal Auditing................................................... 24
APPENDIX G: Code of Ethics......................................................................... 25
Authors and Reviewers................................................................................. 26

www.globaliia.org/standards-guidance / C

Executive Summary
The IIA’s International Professional Practices Framework
(IPPF) defines a quality assurance and improvement pro-
gram (QAIP) as:
An ongoing and periodic assessment of the entire spectrum
of audit and consulting work performed by the internal
audit activity. These ongoing and periodic assessments are
composed of rigorous, comprehensive processes; continu-
ous supervision and testing of internal audit and consult-
ing work; and periodic validations of conformance with
the Definition of Internal Auditing, the Code of Ethics,
and the Standards. This also includes ongoing measure-
ments and analyses of performance metrics (e.g., internal
audit plan accomplishment, cycle time, recommendations
accepted, and customer satisfaction). If the assessments’ re-
sults indicate areas for improvement by the internal audit
activity, the chief audit executive (CAE) will implement
the improvements through the QAIP.
The following International Standards for the Professional
Practice of Internal Auditing (Standards) are relevant to the
development of a QAIP:
• 1300: Quality Assurance and Improvement Program.
• 1310: Requirements of the Quality Assurance and
Improvement Program.
• 1311: Internal Assessments.
• 1312: External Assessments.
• 1320: Reporting on the Quality Assurance and
Improvement Program.
• 1321: Use of “Conforms with the International
Standards for the Professional Practice of Internal
Auditing.”
• 1322: Disclosure of Non-conformance.
Additional guidance on applying these Standards can be
found in the following IIA Practice Advisories:
IPPF – Practice Guide
Quality Assurance and Improvement Program
• 1300-1: Quality Assurance and Improvement Pro-
gram.
• 1310-1: Requirements of the Quality Assurance and
Improvement Program.
• 1311-1: Internal Assessments.
• 1312-1: External Assessments.
• 1312-2: External Assessment – Self-assessment with
Independent Validation.
• 1312-3: Independence of the External Assessment
Team in the Private Sector.
• 1312-4: Independence of the External Assessment
Team in the Public Sector.
• 1321-1: Use of “Conforms with the International
Standards for the Professional Practice of Internal
Auditing.”
All CAEs are required to develop a QAIP that includes
both internal and external assessments. Internal assess-
ments will include both ongoing monitoring and periodic
self-assessment. External assessments may be either a full
external assessment or a self-assessment with indepen-
dent validation.
Under the QAIP, quality should be assessed at both an
individual audit engagement level as well as at a broader
internal audit activity level. A well-developed QAIP will
ensure that quality is built in to, rather than on to, the
way the internal audit activity operates. In other words, an
internal audit activity should not need to assess whether
each individual engagement conforms to the Standards.
Rather, engagements should be undertaken in accordance
with an established methodology that promotes quality
and, by default, conformance with the Standards.
This document provides guidance on the key elements
of a QAIP. It covers those elements required for confor-
mance with the Standards as well as elements that consti-
tute better practice. QAIPs need to be tailored to the spe-
cific needs of each internal audit activity and, therefore,
www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Quality Assurance and Improvement Program

may come in a myriad of forms. However, this document Quality in Internal Audit
provides a generic framework for developing a QAIP that
Quality in internal audit is guided by both an obligation
could be applied regardless of the size or nature of the
to meet customer expectations as well as professional
internal audit activity.
responsibilities inherent in conforming to the Standards
(described in the Context section). While predominantly
Introduction complementary, it is a challenge for the CAE to achieve
both these requirements.
What is Quality?
Quality is not absolute. The quality of a product or service
Internal auditing is an independent, objective assurance and
is the degree to which the product or service meets the
consulting activity designed to add value and improve an
customer’s expectations — the degree to which it is fit for
organization’s operations.
purpose.
(Extract from the IPPF Definition of Internal Auditing)
Delivering quality requires a systematic and disciplined
approach as professionals — quality does not just happen.
Standards 1300 through 1312 specifically require the
It is the combination of the right people, the right sys-
CAE to develop a QAIP incorporating both internal (self)
tems, and a commitment to excellence. It is driven by the
assessments and external assessments. However, beyond
leaders of the organization who are responsible for setting
these specific standards, internal audit as a profession
the “tone at the top.”
should maintain a formal, structured approach to quality.
This includes operating with proficiency and due profes-
Quality has both retrospective and forward-looking ele-
sional care, undertaking continuing professional develop-
ments. It includes an analysis of the degree to which
ment, and conforming to a set of recognized standards.
existing products and services are fit for purpose and
Each of these allows internal audit to differentiate itself
conform with standards, the efficiency of the service de-
from non-professional areas.
livery process, as well as an assessment of the degree to
which current practices will meet emerging stakeholder
Under the IPPF, the CAE may state that the internal au-
expectations.
dit activity conforms with the Standards only if the results
of the QAIP support this statement. When non-confor-
Given the different elements of quality, recognizing who
mance with the Definition of Internal Auditing, the Code
the customers and stakeholders are is a key step in the
of Ethics, or the Standards impacts the overall scope or
quality process. For an internal audit activity, this could
operation of the internal audit activity, the CAE must dis-
include the board, senior management, the external audi-
close the non-conformance and the impact to senior man-
tor, and operational managers. It also could include cus-
agement and the board.
tomers and stakeholders of the broader organization such
as shareholders, oversight organizations, regulators, and
government agencies.
Conformance or Compliance?
Conformance with standards is a technical term borrowed
from the quality management discipline. It is not about
complying with the letter of the standard. Someone who is

2 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Quality Assurance and Improvement Program

in conformance with a standard is expected to achieve the activity itself.

spirit of the standard. This is consistent with a principles- • The effectiveness2�of continuous improvement activi-
based approach.1 ties and adoption of best practices.
• Whether the internal audit activity adds value, im-
Embedding Quality in Systems
proves the organization’s operations, and contributes
and Processes
to the attainment of objectives.
Quality in internal audit begins with the structure and
To achieve comprehensive coverage of all aspects of the
organization of the audit activity. Quality should be
internal audit activity, a QAIP must effectively be applied
built in to, and not on to, the way the activity conducts
at three fundamental levels (or perspectives):
its business — through its internal audit methodology,
policies and procedures, and human resource practices.
• Internal Audit Engagement Level (self-assess-
Each of these should be premised on a common under-
ment at the audit, engagement, or operational level):
standing of quality and stakeholder perception of value.
Ultimately, the QAIP should measure whether internal The engagement supervisor (possibly a manager or
audit is meeting its own objectives, as well as those of the CAE) is responsible for providing assurance that:
the broader organization. – Appropriate processes have been used to translate
audit plans into specific, appropriately resourced
Overview of a Quality audit engagements.

Assurance and Improvement – Planning, fieldwork conduct, and reporting/com-

municating results conform to the Definition of
Program (QAIP) Internal Auditing, the Code of Ethics, and the
Standards.
A QAIP should conclude on the quality of the internal au-
– Appropriate mechanisms are established and used
dit activity and lead to recommendations for appropriate
to follow-up management actions in response to
improvements. It enables an evaluation of:
audit recommendations.
• Conformance with the Definition of Internal Audit- – Post-engagement client surveys, lessons learned,
ing, the Code of Ethics, and the Standards. self-assessments, and other mechanisms to sup-
• The adequacy of the internal audit activity’s charter, port continuous improvement are completed.
goals, objectives, policies, and procedures. • Internal Audit Activity Level (self-assessment at
• The contribution to the organization’s governance, the internal audit activity or organizational level):
risk management, and control processes. The CAE is responsible for providing assurance that:
• Completeness of coverage of the entire audit universe. – Written policies and procedures, covering both
• Compliance with applicable laws, regulations, and technical and administrative matters, are formally
government or industry standards to which the inter- documented to guide audit staff in consistent
nal audit activity may be subject. conformance with the Definition of Internal Au-
diting, the Code of Ethics, and the Standards.
• The risks affecting the operation of the internal audit
1
Chartered Institute of Internal Auditors UK and Ireland, Professional guidance for internal auditors – Quality assurance and improvement programmes, 2007
2
Consideration could be given to The IIA’s Practice Guide, Measuring Internal Audit Effectiveness.

www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Quality Assurance and Improvement Program

– Audit work conforms to written policies and – The CAE must ensure that the internal audit
procedures. activity undergoes an external assessment (either
– Audit work achieves the general purposes and re- an independent external assessment or a self-
sponsibilities described in the internal audit charter. assessment with independent validation) at least
once every five years by an independent assessor
– Audit work conforms to the Definition of Internal or assessment team from outside the organization
Auditing, the Code of Ethics, and the Standards. that is qualified in the practice of internal audit-
– Internal audit work meets stakeholder expecta- ing as well as the quality assessment process.
tion. – External assessors express an opinion on the
– The internal audit activity adds value and im- entire spectrum of assurance and consulting work
proves the organization’s operations. performed (or that should have been performed)
by the internal audit activity, including its confor-
– Resources for the internal audit activity are ef-
mance with the Definition of Internal Auditing,
ficiently and effectively utilized.
the Code of Ethics, and the Standards. Assessors
• External Perspective (independent external assess- also conclude on the efficiency and effectiveness
ment of the entire internal audit activity including of the internal audit activity in carrying out its
individual engagements): charter and meeting the expectations of stake-
holders.

Quality Assurance and Improvement Program (QAIP) Framework

Continuous
Improvement of IA
Processes

Reporting & Follow Up

Quality Built Into an IA Activity

Internal Audit Activity

Findings Observations &
Improvement of QAIP

Recommendations
Continuous
Professional Practice

Communication
Governance

External Assessment
Ongoing Monitoring

Periodic Self
Assessment

Quality Assurance Over

Entire IA Activity
Diagram 1

4 / www.globaliia.org/standards-guidance

Diagram 1 on page 4 provides a framework for embed-
ding quality assurance and continuous improvement into
an internal audit activity. The framework considers three
separate activities or sections within an internal audit ac-
tivity: governance, professional practice, and communica-
tion. These activities are discussed further in the “Sample
Approach — Program Sections Within an Internal Audit
Activity” section on page 11 and in Appendix C — QAIP
Components.
The QAIP framework assumes that quality is built in to
(and not on to) the structure of the internal audit activity
and that quality assessments are undertaken over the en-
tire activity. As per the Standards, quality assessments take
the form of ongoing monitoring, periodic self-assessment,
and external assessment. Each of these types of assess-
ments is discussed further in the “Quality Assessments”
section below.
The framework is intended as guidance only. CAEs may
develop their own QAIP structure; however, the common
elements of all QAIPs are that they:
• Cover all aspects of the internal audit activity.
• Enable an evaluation of conformance with the Defi-
nition of Internal Auditing, the Code of Ethics, and
the Standards.
• Assess the efficiency and effectiveness of the inter-
nal audit activity.
• Identify opportunities for improvement.
Quality Assessments
Assessments, whether internal self-assessments or exter-
nal assessments, should include coverage of the entire
internal audit activity. Using the model presented in Dia-
gram 1 on page 4, this would include the quality of the
governance activities and structures, professional prac-
tices, and communication processes. The main elements,
3
The term “periodic reviews,” used by The Institute of Internal Auditors in the IPPF, has been replaced by “periodic self-assessment” throughout this practice guide.
IPPF – Practice Guide
Quality Assurance and Improvement Program
along with some of the key objectives to be assessed, have
been included in Appendix C — QAIP Components.
Internal Assessments
Internal quality assessments are comprised of two interrelat-
ed parts: ongoing monitoring and periodic self-assessment3.
Ongoing Monitoring
Ongoing monitoring provides assurance that the pro-
cesses in place are working effectively to ensure qual-
ity is delivered on an audit-by-audit basis. It is primarily
achieved through continuous monitoring activities includ-
ing engagement planning and supervision, standard work-
ing practices, working paper procedures and signoffs, and
report reviews. Additional mechanisms include:
• Acquiring feedback from audit clients and other
stakeholders.
• Assessing audit engagement readiness prior to
fieldwork by looking for items like pre-approval of
the audit scope, innovative best practices, budgeted
hours, and assigned staff (expertise).
• Using checklists or internal audit automation to give
assurance on whether processes adopted by the in-
ternal audit activity (e.g., internal audit policies and
procedures manuals) are being followed.
• Using measures of project budgets, timekeeping
systems, and audit plan completion to determine if
appropriate time is spent on different aspects of the
audit process, as well as high risk and complex areas.
• Analyzing other performance metrics to measure
stakeholder value.
Any weaknesses or areas for improvement should be ad-
dressed on an ongoing basis, as they are identified, and
the results of ongoing monitoring must be reported to the
board at least annually.
www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Quality Assurance and Improvement Program
Periodic Self-assessment
A periodic self-assessment has a different but interrelated
focus to ongoing monitoring. Periodic self-assessments fo-
cus on evaluating:
• Conformance with the internal audit charter, The
IIA’s Definition of Internal Auditing, the Code of
Ethics, and the Standards.
• The quality of the audit work, including adherence to
the internal audit methodology for selected engage-
ments.
• The quality of supervision.
• The infrastructure, including the policies and proce-
dures, supporting the internal audit activity.
• The ways the internal audit function adds value to
the organization.
• The achievement of performance standards/indicators.
Periodic self-assessments should be conducted through:
• Working paper reviews for conformance with the
Definition of Internal Auditing, the Code of Ethics,
the Standards, and internal audit policies and proce-
dures by staff not involved in the respective audits.
• Self-assessment of the internal audit activity with
objectives/criteria established as part of the QAIP
(See Appendix C for further definition of the key
components of governance, professional practice,
and communication).
• Review of internal audit performance metrics and
benchmarking of best practices.
• Periodic activity and performance reporting to the
board and other stakeholders as deemed necessary.
A well-designed periodic self-assessment program pro-
vides the CAE with information related to confor-
mance with the Standards (Attribute and Performance
6 / www.globaliia.org/standards-guidance
Standards). The QAIP should document and define a
systematic and disciplined approach to the periodic self-
assessment process, including how to accomplish the
periodic self-assessments and define the scope of activ-
ity for each interim year between the external quality as-
sessments. This complement of ongoing monitoring and
periodic self-assessments provides an effective structure
for continuous assessment of internal audit conformance
and improvement opportunities.
The main objectives of periodic self-assessments are:
• To identify the quality of ongoing performance and
opportunities for improvement in internal audit pro-
cesses and procedures.
• To check and validate the objectives and criteria
used in the QAIP to determine whether they are still
up to date, adequate, and valid.
Periodic self-assessments may include in-depth interviews
and surveys of stakeholder groups, as well as benchmark-
ing the internal audit activity’s practices and performance
metrics against relevant best practices.
Following a self-assessment, an action plan should be de-
veloped to address any identified areas for improvement.
This plan should include proposed timelines for actions.
The result of the periodic self-assessments and the level
of conformance to the Standards must be reported to the
board at the completion of the self-assessment.
Periodic self-assessments are generally conducted by se-
nior members of the internal audit activity, quality man-
agement staff with IPPF expertise (where a quality or
quality management department exists), CIAs, or other
competent audit professionals assigned elsewhere in the
organization. Whenever possible, it is advantageous to in-
clude internal audit staff on a rotational basis in quality
assessment activities. This provides a useful training op-
portunity for internal audit staff.

Appendix B contains further information on internal as-
sessment processes including engagement supervision,
working papers, and quality assurance file reviews.
“Quality means doing it right when no one is looking.”
– Henry Ford
External Assessments
External assessments must be conducted at least once ev-
ery five years by an independent assessor or assessment
team from outside the organization that is qualified in the
practice of internal auditing as well as the quality assess-
ment process.
There are two approaches to the conduct of external
assessments:
• A full external assessment involves the use of a quali-
fied, independent assessor or assessment team to
conduct the full assessment.
• A self-assessment with independent (external) vali-
dation involves the use of a qualified, independent
assessor or assessment team to conduct an indepen-
dent validation of the self-assessment completed by
the internal audit activity.
Further detail and guidance on external assessments can
be found in IIA Practice Advisories:
• 1312-1: External Assessments.
• 1312-2: External Assessments: Self-Assessment with
Independent Validation.
Regardless of the approach, external assessors express an
opinion on the entire spectrum of assurance and consulting
work performed (or that should have been performed) by
the internal audit activity, including its conformance with
the Definition of Internal Auditing, the Code of Ethics, and
the Standards. Assessors also conclude on the efficiency
and effectiveness of the internal audit activity in carrying
IPPF – Practice Guide
Quality Assurance and Improvement Program
out its charter and meeting the expectations of stakehold-
ers. The external assessment report also should include, as
appropriate, recommendations on how management can be
improved and how the internal audit activity can add value
to the organization. Following an external assessment, an
action plan should be developed to address any opportuni-
ties identified. The results of external assessments must be
reported to the board or audit committee.
Independence is critical to assuring an objective external
assessment. Specific issues to consider have been high-
lighted in the following IIA Practice Advisories:
• 1312-3: Independence of the External Assessment
Team in the Private Sector.
• 1312-4: Independence of the External Assessment
Team in the Public Sector.
An external assessment may be undertaken by individu-
als or organizations with specific expertise in the external
quality assessment process (such as an IIA Institute or a
service provider) or through a peer review process.
Peer Review
Peer review arrangements can provide a cost-effective ap-
proach to meeting the requirements of Standard 1312,
particularly for small internal audit activities. However,
peer reviewers are required to meet the independence
and qualifications criteria specified in the Standard. The
following briefly outlines some of the key considerations
(further details are available in the four previously identi-
fied practice advisories):
• All members of the assessment team who perform
the external assessment are to be independent of
that organization and its internal audit activity per-
sonnel. Real, potential, and perceived conflicts of
interest should be considered.
• Individuals from within the same private sector
organization but from another department or from a
related organization (such as a parent organization,
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Quality Assurance and Improvement Program
an affiliate in a group of entities, or an entity with
regular oversight) are not considered independent for
purposes of conducting an external assessment.
• Within the public sector, individuals working in
separate internal audit activities in a different entity
within the same tier of government may be consid-
ered independent for purposes of conducting exter-
nal assessments, as long as they do not report to the
same CAE.
• Two organizations may not review each other mutually.
Reciprocal external assessment teaming arrangements be-
tween three or more organizations (e.g., within an indus-
try or other affinity group, regional association, or govern-
ment departments) may be structured in a manner that
achieves the independence objective as described in the
following diagram:
Organization
1 The CAE considers the relative skills and experience of
Organization Organization
3 2
Diagram 2
8 / www.globaliia.org/standards-guidance
Self-assessment with Independent Validation for
Small Internal Audit Activities
Self-assessments with independent validation provide a
valuable alternative for meeting the requirements of Stan-
dard 1312 for some internal audit activities. In particu-
lar, small internal audit activities and activities that have
recently undergone a full external assessment may find
these useful. While they have some limitations — in that
the validator does not have the opportunity to provide as
comprehensive an overview of the internal audit activity
as an external assessor would for a full external assess-
ment — they offer the following benefits:
• Validations of self-assessments should be less expen-
sive than full external assessments.
• Self-assessments offer opportunities for staff devel-
opment.
• Self-assessments may be able to be linked more
closely to the periodic monitoring element of internal
assessments.
the team or assessor chosen to undertake the self-assess-
ment. The assessor or team prepares a self-assessment
report that includes judgement on conformance to the
Standards, which is provided to the validator.
Linkage to the QAIP
A fully functioning QAIP includes ongoing monitoring
to ensure quality on an audit-by-audit basis, and periodic
self-assessment to ensure conformance to the Standards
and other rules and regulations. With such a process in
place, the external assessment should effectively become
an opportunity to obtain new ideas from the assessor or
assessment team on ways to improve overall internal audit
quality, efficiency, and effectiveness. The focus can move
from conformance to new and innovative ways to better
service their stakeholders and provide meaningful results.
There should not be any surprises since the periodic self-
assessment should provide insight into conformance on
an on-going basis.
 IPPF – Practice Guide
Quality Assurance and Improvement Program

Assessment Scale • IIA Capability Model for the Public Sector:�6 Initial/
Infrastructure/Integrated/Managed/Optimizing.
A QAIP should include a rating scale to assess the lev-
el of conformance of the internal audit activity with the • DIIR (IIA–Germany) Guideline for Conducting a
Standards. Different options are available when decid- Quality Assessment:7� 3–Satisfactory/2–Room for Im-
ing which assessment scale better suits particular needs. provement/1–Significant Improvement Needed/
Some of those options include: 0–Unsatisfactory/Not Applicable).
A comparison of the first two of these assessment scales is
• IIA Quality Assessment Manual Scale:4 Does Not provided in the following diagram.
Conform/Partially Conforms/Generally Conforms.
• The IIA’s Assessment Scale — IIA Path to Quality:5�
Introductory/Emerging/Established/Progressive/
Advanced. Diagram 3

Assessment Scales
Generally Conforms Effectiveness
Opportunities
And QA Manual
Partially Conforms For Assessment Scale
Improvement Efficiency
Does Not Conform Of IAA
Innovates Best Practices
Leading Strategic Partner
Leader in IA Profession
Beyond Conforming Emphasizes Best Practice
Leveraging Anticipates Change
Expanding Roles
Generally Conforms
Conforming Conforming External Assessment
Continuous Improvement

Partially Conforms
Emerging Self Assessment
Non-Conforming Action Plans Path to Quality
Beginning
Innovates
Does Not Conform (Maturity Model) Scale
New Internal Audit Activity QAIP

The Standards do not require one particular assessment scale be used. Rather, the Standards require that the degree of
conformance with the IPPF be assessed. The CAE or the external reviewer may choose the QA Manual Assessment Scale,
the Path to Quality scale, IIA–Germany’s scale, or any other scale that assesses levels of conformance.
4
The Institute of Internal Auditors’ Quality Assessment Manual for the Internal Audit Activity, 6th Edition.
5
The Institute of Internal Auditors, The Path to Quality — Maturity Model for Implementing a QA&IP.
6
The Institute of Internal Auditors Research Foundation, Internal Audit Capability Model (IA-CM) for the Public Sector.
7
Deutsches Institut für Interne Revision e.V. (IIA–Germany), Guidelines for Conducting a Quality Assessment (QA), September 2007.

www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Quality Assurance and Improvement Program

Developing and Implementing the allocation of appropriate resources, as well as within

a QAIP
Considerations in Developing a QAIP
There are numerous ways to develop a QAIP, and the de-
sign should be appropriate to the size, structure, and na-
ture of the internal audit activity.
A key aspect to developing a QAIP is to determine:
• The role of internal audit management and staff in
the quality process.
• The activities that are covered through ongoing
monitoring, periodic self-assessment, or external as-
sessments.
• The frequency of self-assessments and external as-
sessments.
• The level of quality, or maturity, desired by the inter-
nal audit activity and expected by its stakeholders.
the documented QAIP.
Responsibility for specific QAIP activities should take
into account the qualifications and experience of staff.
It is important that all staff is fully acquainted with the
QAIP, and that specific staff responsible for activities,
such as periodic self-assessments, have appropriate cred-
ibility and authority within the internal audit activity.
Continuous Improvement
The primary objective of a QAIP is to promote continuous
improvement. This should occur in a planned, method-
ological manner. The Deming Cycle8, or Plan, Do, Check,
Act Model, provides a structure that may be useful in es-
tablishing the QAIP.
Deming Cycle

 “Quality is never an accident; it is always the result Plan

of intelligent effort.”
– John Ruskin

Quality Responsibilities
The CAE is responsible for developing the QAIP and
should lead by example by embedding quality into the
Act Do
internal audit activity. However, the entire internal audit
activity is responsible for delivering quality. Internal audi-
tors, as professionals, should be committed to delivering
quality services.

Allocating specific responsibilities for developing, deliver-

Check Diagram 4
ing, and monitoring the QAIP will vary for each internal
audit activity. Regardless, these accountabilities should be
articulated in audit planning documentation to allow for To embed continuous improvement, one of the first tasks
is to put into practice a performance measurement frame-
8
http://www.balancedscorecard.org/TheDemingCycle/tabid/112/Default.aspx

10 / www.globaliia.org/standards-guidance

work. Regular reporting on the defined quality metrics
should provide information about the status of those mea-
sures and any deviation from the standards set, thus al-
lowing timely corrective action to be taken, if required.
The measures adopted should be checked regularly to de-
termine whether they are generating quality as planned
(e.g., by carrying out ongoing monitoring or periodic self-
assessments). These should assess existing processes and
investigate the extent to which internal audit is complying
with the set standards, as well as the possible existence of
quality shortfalls. The defined quality criteria should be
reviewed in terms of their appropriateness and continuing
validity, and undergo further development as required.
“It is not enough to do your best. You must know
what to do, and then do your best.”
– Edwards Deming
Use should be made of the knowledge and ideas of staff,
whose suggestions for improvement should be actively
sought. Suggestions and requests made by audit clients,
or comparisons made with other comparable audit groups
in other organizations, should be utilized. A mechanism to
record the input of all auditors and stakeholders should be
established to prevent ideas from being lost.
Using the Deming Cycle, the QAIP continuous improve-
ment process contains four key elements that operate in
an interactive manner:
• Formal documentation of standards and expected
practices (PLAN).
• Development activities to define quality and build
staff awareness of standards and expectations (DO).
• Various forms of assessment and review to measure
product or process quality (CHECK).
• Undertaking improvement initiatives and document-
ing lessons learned (ACT).
IPPF – Practice Guide
Quality Assurance and Improvement Program
Recommendations for improvement need to be captured
and formalized. This summary action plan should be con-
tinuously updated with new recommendations, status of
actions underway, and items completed.
Follow-up action should be taken to ensure appropri-
ate improvements are implemented. This could occur
through periodic self-assessments and should be reported
to the board. All QAIP efforts should include appropriate
and timely modification of resources, technology, process-
es, and procedures as indicated by monitoring and assess-
ment activities.
Sample Approach — Program Sections With-
in an Internal Audit Activity
A standards-based approach to a QAIP would utilize the
IPPF as the basis of the QAIP and identify how each of
the Standards could be assessed using ongoing monitor-
ing, periodic self-assessment, or external assessments.
While this type of approach provides the internal audit
activity and its stakeholders with assurance regarding
the activity’s conformance to the Standards, it is limited
in terms of its ability to measure the performance of the
internal audit activity against stakeholder and customer
expectations. An alternative approach would be to base
the QAIP around program sections or areas. This would
allow for consideration of stakeholder expectations along-
side requirements under the Standards.
The following diagram (Diagram 5), which structures the
QAIP around the three specific activities identified in
the QAIP framework, provides an example of a program-
based approach. These three activities are governance,
professional practice, and communication. The main el-
ements in each activity, along with some key objectives
of the assessment, have been described in Appendix C.
Professional judgement should be used to determine the
applicability of these elements for each particular organi-
zation, as well as to identify any additional elements.
www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Quality Assurance and Improvement Program

Program Based QAIP Structure

Internal Audit Activity

Governance Professional Practice Communication

IA Charter Roles and Responsibilities Communicating Results
IPPF Risk-based Audit Planning Follow Up
Legislation Other Assurance Providers Stakeholder Communications
Independence & Objectivity Audit Engagement Planning
Risk Management Performing the Engagement
Resourcing Proficiency &
Due Professional Care
Quality Assurance

Diagram 5

Assessment Methodology draft criteria, and preliminary methodology, has been

For each of the elements, objectives and criteria should
be identified along with the methodology or documenta-
tion, which should be examined to determine the level of
conformance with the Definition of Internal Auditing, the
Code of Ethics, the Standards, and stakeholder expecta-
tions. Once the documentation has been examined and
an assessment of the objective completed, a rating should
be determined using the assessment scale adopted by the
organization. Any deficiency or recommendation should
be documented at this point and appropriate action taken
to implement any action plan.
An example of the methodology which could be used for
the assessment of the elements, including the objective,
provided in Appendix D. In addition, a sample template
which could be used to document findings and observa-
tions of each element has been provided in Appendix E.
Reporting on the Quality Program
The results of ongoing monitoring must be communicated
annually to the board and other appropriate stakeholders.
Further, the results of any periodic self-assessments or ex-
ternal assessments, and the level of conformance with the
Standards, must be reported to the board after their com-
pletion. The QAIP and the resulting action plan (some-
times referred to as a management action plan) should be
made available to external assessors and be robust enough
for external reliance.

12 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Quality Assurance and Improvement Program

“Program Section” Assessment Methodology

Internal Audit Activity

Governance Professional Reporting

Practice

Program Program Program Program Program Program elements are also

Elements Elements Elements Elements Elements assessed for Governance and
Reporting sections

An objective is defined
Objective for each element

Criteria are identified for each

Criterion 1 Criterion 2 Criterion 3 objective (the number of these
may vary)

A QA process
Methodology Methodology Methodology Methodology Methodology Methodology (methodology) is
QA Process QA Process QA Process QA Process QA Process QA Process developed for each
criterion

Assessment Assessment Assessment Assessment Assessment Assessment

Quality Assessment Results

Diagram 6
QA results are captured back into continuous improvement and reported to stakeholders

Review of the QAIP • Follow-up actions from previous assessments and/or

reviews.
The QAIP also should be reviewed at least annually and
individual sections of the program should be updated • Other changes that could impact the quality man-
throughout the year as required. The inputs to the review agement system.
include, but should not be limited to: • Recommendations for improvement.
• New and revised standards, policies, and procedures.
• Results from quality assessments.
• Customer (user) feedback.
• Status of resulting action plans.

www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Quality Assurance and Improvement Program

Appendix A: Internal Audit Capability Model (IA-CM) For the Public

Reference Material
The IIA’s Practice Guide, Assisting Small Internal Audit
Activities in Implementing the International Standards for
the Professional Practice of Internal Auditing, April 2011.
http://www.theiia.org/guidance/standards-and-guidance/
ippf/practice-guides/assisting-small-internal-audit-activi-
ties-in-implementing-the-international-standards-for-the-
professional-practice-of-internal-auditing/
Essentials: An Internal Audit Operations Manual, IIA
Research Foundation, 2009.
http://www.theiia.org/bookstore/product/essentials-
internal-auditing-operations-manual-1070.cfm
Guidelines for Conducting a Quality Assessment (QA),
September 2007, DIIR - Deutsches Institut für Interne
Revision e.V. (IIA–Germany)
http://www.diir.de/fileadmin/zertifizierung/qa/downloads/
QA-Guideline-english.pdf
IIA Guidance & Resources, Quality Web page.
http://www.theiia.org/guidance/quality/
IIA Standard 1312: External Quality Assessments:
Results, Tools, Techniques and Lessons Learned –
Download PDF, IIA Research Foundation, 2007.
http://www.theiia.org/bookstore/product/iia-standard-
1312-external-quality-assessments-results-tools-tech-
niques-and-lessons-learned-2007-1399.cfm
Sector, IIA Research Foundation, 2009.
http://www.theiia.org/bookstore/product/internal-audit-
capability-model-iacm-for-the-public-sector-1422.cfm
International Professional Practices Framework (IPPF),
The Institute of Internal Auditors, January 2011.
http://www.theiia.org/bookstore/product/international-
professional-practice-framework-2011-1533.cfm
http://www.theiia.org/bookstore/product/international-
professional-practice-framework-2011-cdrom-1534.cfm
Path to Quality — Maturity Model for Implementing a
QA&IP, The Institute of Internal Auditors.
http://www.theiia.org/guidance/quality/the-external-qual-
ity-assessment-process/path-to-quality/
Professional guidance for internal auditors – Quality assur-
ance and improvement programmes, Chartered Institute
of Internal Auditors UK and Ireland, 2007.
www.iia.org.uk/download.cfm?docid=4CCF8AEF-
3D39-49B7
Quality Assessment Manual for the Internal Audit
Activity, 6th Edition, IIA Research Foundation, 2009.
http://www.theiia.org/bookstore/product/quality-assess-
ment-manual-6th-edition-1392.cfm
http://www.theiia.org/bookstore/product/quality-assess-
ment-manual-6th-edition-cdrom-1396.cfm

Implementing the International Professional Practices

Framework, Updated 3rd Edition, IIA Research
Foundation, 2011.
http://www.theiia.org/bookstore/product/implementing-
the-international-professional-practices-framework-3rd-
edition-1423.cfm

14 / www.globaliia.org/standards-guidance

Appendix B:
Engagement Supervision, Working Papers,
and Working Paper Quality Reviews
Engagement Supervision
Adequate supervision is the most fundamental element of
any quality control process. Supervision is a process that
begins with planning and continues throughout the per-
formance and communication phases of the engagement.
Engagement supervision is intended to ensure that internal
audit staff at all levels are appropriately supervised through-
out audit engagements to monitor progress, assess quality,
and provide coaching. The extent of supervision will de-
pend on the experience and training of the individual audi-
tor and the size of the internal audit activity. Particular care
should be taken to ensure that all work by trainee auditors
is subject to comprehensive supervision. The work of out-
side resources, such as consultants, also should be super-
vised and monitored. Supervision should include:
• Ensuring conformance with the Definition of Inter-
nal Auditing, the Code of Ethics, the Standards, and
the organization’s policies and procedures.
• Providing suitable instructions at the outset of an
audit engagement.
• Approving audit objectives, scope, and work plans
prior to the commencement of fieldwork.
• Ensuring audits are conducted as planned or that
variations are approved.
• Ensuring that appropriate audit techniques are used.
• Ensuring that audit findings, conclusions, and rec-
ommendations are adequately supported by relevant,
reliable, and sufficient evidence.
• Ensuring that appropriate working papers have been
prepared and maintained.
• Ensuring that reports are accurate, objective, clear,
concise, and timely.
IPPF – Practice Guide
Quality Assurance and Improvement Program
• Ensuring that work is achieved within resource bud-
gets (time and expense control), or that variations are
approved.
• Ensuring that internal audit staff are trained and
developed, and employee performance evaluations
are completed.
Working Papers
Engagement working papers generally:
• Provide the principal support for engagement com-
munications.
• Aid in the planning, performance, and review of
engagements.
• Document whether the engagement objectives were
achieved.
• Facilitate third-party reviews.
• Provide a basis for evaluating the internal audit activ-
ity’s audit program.
• Provide support in circumstances such as discus-
sions with management, fraud cases, and lawsuits.
• Aid in the professional development of internal audit
staff.
• Demonstrate the internal audit activity’s confor-
mance with the Definition of Internal Auditing, the
Code of Ethics, and the Standards.
Working Paper Quality Reviews
Quality assurance at the engagement level is provided pri-
marily by the audit team, through their exercise of due pro-
fessional care during the audit engagement. Quality checks
and management oversight should be carried out continu-
ally during the audit engagements to ensure conformance
with the Definition of Internal Auditing, the Code of Eth-
ics, the Standards, and internal policies and procedures.
Working paper quality reviews should be performed on se-
lected audits as part of both the ongoing monitoring and
periodic self-assessment processes. The objectives of the
www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Quality Assurance and Improvement Program
review of completed files is to establish that sufficient,
relevant work was performed to substantiate the findings
contained in the internal audit reports, and that the infor-
mation was effectively reported to the engagement client
on a timely and factual basis. The reviewer also will verify
that agreed upon procedures have been performed in an
efficient and effective manner. The review may include,
but is not limited to:
• Ensuring that the audit engagement, audit objec-
tives, criteria, and approach were appropriate.
• Ensuring that conclusions and recommendations
were reached based on relevant and sufficient
evidence.
• Ensuring reports were accurate, objective, clear,
concise, and timely.
• Ensuring that appropriate supervision was provided
throughout the audit process and that responsibility
was delegated to the appropriate individual.
• Reviewing the audit policies and procedures used for
each engagement to ensure conformance with ap-
plicable planning, performance, and communication
standards.
Working paper quality reviews should be conducted after
the lead internal auditor and designated supervisor have
completed their review of the working papers.
The same professional care should be taken with working
paper quality reviews as with other internal audit efforts,
including adequately planning the review, documenting
findings, developing supportable recommendations, and
soliciting engagement client comments.
Working paper quality reviews should be performed on a
regular, ongoing basis. The review should consist of en-
suring that the audit report is free of defects, as well as
a detailed review of the audit comments and supporting
working papers to certify the accuracy of statements made
and the appropriateness of conclusions reached. The re-
viewer should be able to quickly find supporting evidence,
16 / www.globaliia.org/standards-guidance
approvals, rationale for changes, and evidence of supervi-
sory review.
Equally important, the reviewer should document evi-
dence of the quality assurance review. Although time-con-
suming, these procedures bring credibility and confidence
to those circumstances where internal auditors are called
on to explain their work. The quality assurance reviewer
should ensure that all schedules are footed and all appro-
priate sign‑offs are present. The quality assurance review-
er should check to make sure that the entire report and
working papers are in conformance with the Standards.
The reviewer is encouraged to make suggestions that will
improve the quality of the audit report and working papers
without significantly increasing time consumption. This
could include action plans and links back to the Continu-
ous Improvement element of the Deming Cycle.
In addition to the internal working paper quality reviews,
a sample of working paper files should be independently
reviewed as part of the external quality assessment.
Considerations for Small Internal Audit Activities
Working in a small internal audit activity presents spe-
cific challenges with regards to engagement supervision
and working paper reviews. These challenges are further
compounded in a sole auditor activity.
In sole auditor activities, the internal auditor may seek as-
sistance from other parts of the organization to undertake
quality assurance activities, provided this does not impact
the independence of internal audit. The internal auditor
also may look to peers in other organizations for support.
Using checklists can assist in providing assurance over au-
dit quality.
The IIA Practice Guide, Assisting Small Internal Audit
Activities in Implementing the International Standards for
the Professional Practice of Internal Auditing, provides fur-
ther guidance regarding quality assurance in small audit
activities.

Appendix C:
QAIP Components
Section I: Governance
The main elements, along with some of the key objectives,
to be assessed in the Governance section include:
• Internal Audit Charter:
– Internal audit’s purpose, authority, and responsi-
bility are formally defined in a charter, consistent
with the Definition of Internal Auditing, Code of
Ethics, and the Standards.
– The internal audit strategy is aligned with the
organizational strategy.
– The internal audit activity’s charter provides as-
surance that the internal audit activity will add
value and improve the organization’s operations.
– The internal audit activity’s charter, mission state-
ment, goals, and similar documents are imple-
mented in an effective manner.
• International Professional Practices Framework
(IPPF):
– The internal audit activity is in conformance with
the Definition of Internal Auditing, Code of
Ethics, and the Standards.
• Legislation:
– The internal audit activity is in compliance with
other applicable laws, regulations, or policies.
• Independence and Objectivity:
– The internal audit activity’s structure, objectiv-
ity, roles and responsibilities, and key governance
processes are appropriate for managing the func-
tion.
– The internal audit activity is independent and
objective in the performance of its work.
IPPF – Practice Guide
Quality Assurance and Improvement Program
– The organizational status of the internal audit
activity is sufficient to permit accomplishment of
the objectives.
– Broader organizational governance arrangements
provide assurance regarding auditor indepen-
dence and objectivity.
• Risk Impacting the Internal Audit Activity:
– Risks impacting the internal audit activity have
been identified and managed.
• Resourcing:
– The appropriate level of financial and IT re-
sources are available to the internal audit activity
to enable it to achieve its objectives in an efficient
and effective manner.
Section II: Professional Practice
The main elements, along with some of the key objectives,
to be assessed in the Professional Practice section include:
• Roles and Responsibilities:
– Roles and responsibilities of staff within the inter-
nal audit activity are formally documented.
– The internal audit activity has fulfilled its respon-
sibilities in regards to governance, risk manage-
ment, and control.
• Risk-based Audit Planning:
– The audit planning process is aligned with the
organization’s strategic objectives.
– The perspectives of senior management and the
board are considered in audit planning.
– The process of audit planning ensures that all
activities of the organization are considered for
audit, subjected to a risk assessment, ranked in
order of priority, and that appropriate audit objec-
tives for each audit selected have been estab-
lished. This may include documentation of an
audit universe.
www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Quality Assurance and Improvement Program
• An effective annual planning process exists including
appropriate processes for the reporting of progress
toward achieving the established plan.
• Coordination with Other Assurance Providers:
– Internal audit activities are coordinated with
those of other assurance providers.
• Audit Engagement Planning:
– Risks relevant to the activity under review are
assessed. The engagement objectives reflect the
results of the assessment.
– Appropriate resources are allocated for audit work
to identify significant issues.
– Work programs to achieve the engagement objec-
tives are developed.
• Performing the Engagement:
– Engagement processes, including identifying
information, analysis, and evaluation, ensure that
the steps in the audit program developed at the
end of the planning phase are completed in an
effective and efficient manner.
– Audit techniques, including the use of internal
audit automation and computer assisted auditing
techniques, are used as appropriate to provide
assurance that work is performed efficiently and
effectively.
– The evidence gathered substantiates the audit
findings and establishes the cause and effect of
issues identified as needing improvement.
– Information acquired when the audit is conduct-
ed is described and retained in working papers to
clearly document the audit process and identify
findings.
– Audit records are appropriately maintained.
– Audits are appropriately supervised for profes-
sional development and to provide assurance that
due professional care is applied.
18 / www.globaliia.org/standards-guidance
• Proficiency and Due Professional Care:
– The internal audit activity collectively possesses
or sources the knowledge, skills, and other com-
petencies to perform its responsibilities.
– Internal auditors display due professional care in
the performance of their responsibilities.
– Continuing professional development is provided
to allow internal auditors to enhance their knowl-
edge, skills, and other competencies.
– Management and leadership development is em-
bedded within the internal audit activity.
• Quality Assurance:
– A QAIP is in place that covers all aspects of the
internal audit activity and the QAIP effectiveness
is continuously monitored.
– Internal audit has processes in place to track and
record progress toward established objectives,
plans, and budgeted resources.
Section III: Communication
The main elements, along with some of the key objectives,
to be assessed in the Communication section include:
• Audit Engagement Reports:
– The final report presents the purpose, scope, and
significant findings, including the causes and
effects, conclusions, recommendations, and the
engagement client’s action plans to address the
issues outlined.
– An effective process is in place to ensure that
the audit results are presented to the appropriate
level of management timely for discussion and
response.
– Reports are provided to and/or are reviewed by
senior management and the board.
– The form and content of audit communications
meet stakeholder expectations.
 IPPF – Practice Guide
Quality Assurance and Improvement Program

– The phrase “conducted in accordance with the

Standards” is utilized only under appropriate cir-
cumstances.
• Follow-up Phase:
– An appropriate follow-up process to ensure that
management actions have been effectively imple-
mented has been established and is being main-
tained.
• Stakeholder Communications:
– The internal audit activity’s communication prac-
tices inform the board and appropriate stakehold-
ers of work undertaken.
– A performance management and measurement
process is in place to ensure that the effective-
ness of the internal audit activity is optimized and
recognized.
– Engagement client satisfaction with the audit
process is measured by the internal audit activity,
including the level of professionalism demon-
strated by the internal auditors and opportunities
for improvement.
– The extent of satisfaction of other stakeholders
with the internal audit process and products is
measured (this may include a self-assessment
questionnaire and a satisfaction survey for en-
gagement clients).
– The role and services offered by internal audit are
understood by stakeholders and considered to be
value-added.

www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Quality Assurance and Improvement Program

Appendix D:
Sample Element Self-assessment Methodology

Example Section II — Professional Practice

Element: Risk-based Audit Planning

Objective: An effective annual planning process exists including appropriate processes for the reporting of progress toward the established plan.
(Refer to objective on page 22.)

Draft Criteria Preliminary Methodology IIA Standard

A process is in place and is used to develop the annual
internal audit plan to verify that:
• All organizational components, programs, and
activities were considered.
• Senior management was involved in the process.
• The plan was prepared timely and distributed to the
appropriate levels of management.
In consultation with internal audit, determine the audit plan
development process used (obtain any process documentation
available).
Review any minutes or follow-up correspondence/confirmations
of planning process meetings and verify:
• Attendance by all parties to the process.
• Input was requested from all stakeholders.
• The plan from the previous fiscal year was reviewed to identify
any engagements not yet completed for consideration for the
current year’s plan. 2010
• A formal risk analysis and assessment of all suggested
projects was performed and documented.
• Organizational components, programs, and activities were
considered.
• A draft annual plan was presented to senior management and
the board and subsequently approved.
• The distribution list for the draft annual plan as well as the
approved audit plan.

Note: Tool 19 in the Quality Manual may be useful as a source of potential criteria.

20 / www.globaliia.org/standards-guidance

Element: Risk-based Audit Planning
Draft Criteria
A process for selection of engagements to be conducted is
documented and includes criteria such as:
• Past audit coverage and results.
• Materiality.
• Significance to management.
• Risk (based on a standardized methodology).
• Auditability.
• Engagements not completed from the previous year’s plan.
• Organizational priorities.
• Opportunities for improvement.
• Legislative or other mandated obligations.
For each audit selected for the plan, the plan provides:
• A clear indication of the objective and scope.
• An estimate of resource requirements, in terms of direct
time, to conduct the engagements.
• The number of auditors and the skills required.
The process for tracking the progress made in support of the
annual plan results in reports that:
• Provide an objective statement describing each
engagement, and indicate the status by showing key
deliverable dates, designated contacts, as well as relevant
narrative comments.
• Are timely, accurate, and disseminated to the appropriate
levels of management.
Reports prepared on the results achieved in support of the
annual plan are appropriately used for decision making, and
resources are appropriately utilized.
IPPF – Practice Guide
Quality Assurance and Improvement Program
IIA
Preliminary Methodology
Standard
Review last year’s plan and results.
Review annual report on progress made from previous fiscal
year.
Review documented risk analysis and assessment to
determine criteria applied.
Confirm that justification was documented for engagements 2010
cancelled or deferred that were either brought forward from
last year’s plan or were proposed in the current year process. 2050
Review approved annual plan to determine engagements to
be conducted.
Review the process used to ensure that a formal risk
analysis and assessment of all suggested projects was
performed and documented.
Review the annual plan to confirm that all required details
have been incorporated.
Compare the details approved to the relevant details on a
2030
sample of audit planning memorandums, and document any
variances.
Determine that variances were accounted for and approved.
Through interviews, determine and document the process for
reporting on progress against the annual plan.
Compare monthly status reports to the annual plan.
2020
Review documentation on presentations made to senior
management and the board. 2060
Assess effectiveness of the process in achieving the criteria
addressed.
Interview members of senior management and the board to
determine the utilization of monthly status reports content. 2020
Review minutes or emails regarding any pertinent meetings. 2060
www.globaliia.org/standards-guidance / 21
IPPF – Practice Guide
Quality Assurance and Improvement Program

Appendix E:
Sample Template for Performing Self-assessments

Title Instructions/Description Assessment/Remarks

QAIP Objective The objectives as identified in each component of the QAIP should be listed
here. Additional objectives also may be added as necessary.

For example (using Appendix D):

An effective annual planning process exists including appropriate processes

for the reporting of progress toward the established plan.

QAIP Criteria The audit criteria from the QAIP for each objective should be listed here.
Additional criteria also may be added. Criteria should be clear, relevant,
reliable, and complete. Ensure that they are reasonable and attainable and
that they provide a basis for developing observations and conclusions.

For example (using Appendix D):

A process is in place and is used to develop the annual internal audit plan to
verify that:
• All organizational components, programs, and activities were considered.
• Senior management was fully involved in the process.
• The plan was prepared timely and distributed to the appropriate levels of
management.

Quality Assessment Quality assessment procedures or methodologies should be developed

Procedure/ for each QAIP criteria. These methodologies are the procedures that an
Methodology assessor should perform to verify whether criteria are met.

22 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Quality Assurance and Improvement Program

Title Instructions/Description Assessment/Remarks

Control Point By establishing a control point, an assessor would be able to know which
of these criteria or procedures are more important than the others, and
prioritize the criteria, quality assessment procedures, and results.

Using the list of criteria above, identify which of the criterion are critical for
the achievement of this objective.

For example:

It is critical that all organizational components, programs and activities have

been considered in the development of a risk-based audit plan, otherwise
the plan may be inaccurate as a result of not considering all potential risk
elements. However, although important, even if the plan was not prepared
on a timely basis and was not distributed to the appropriate levels of
management once approved, the organization could still have a reasonably
effective annual planning process in place.

Working Paper File It is necessary to keep track of the working paper file references when
Reference performing the quality assessment on the internal audit activity. By
doing so, the assessor would be able to ensure that the working papers
file is appropriately maintained and administered in support of the audit
observations and findings.

Criteria Met By performing the quality assessment procedures identified, the assessor
will be able to determine if the criteria have been met. The assessor should
simply qualify the response by using Yes, No, or Partially.

Assessor’s Comments An assessor should provide comments for any unmet or partially met
criteria.

Assessment/Rating Provide an assessment of the objective/criteria based on the assessment

scale adopted by the organization.

www.globaliia.org/standards-guidance / 23
IPPF – Practice Guide
Quality Assurance and Improvement Program

Appendix F:
Definition of Internal Auditing
Internal auditing is an independent, objective assurance
and consulting activity designed to add value and improve
an organization’s operations. It helps an organization ac-
complish its objectives by bringing a systematic, disci-
plined approach to evaluate and improve the effectiveness
of risk management, control, and governance processes.

24 / www.globaliia.org/standards-guidance

Appendix G:
Code of Ethics
Principles
Internal auditors are expected to apply and uphold the
following principles:
1. Integrity
The integrity of internal auditors establishes trust and
thus provides the basis for reliance on their judgment.
2. Objectivity
Internal auditors exhibit the highest level of professional
objectivity in gathering, evaluating, and communicating
information about the activity or process being examined.
Internal auditors make a balanced assessment of all the
relevant circumstances and are not unduly influenced by
their own interests or by others in forming judgments.
3. Confidentiality
Internal auditors respect the value and ownership of infor-
mation they receive and do not disclose information with-
out appropriate authority unless there is a legal or profes-
sional obligation to do so.
4. Competency
Internal auditors apply the knowledge, skills, and experi-
ence needed in the performance of internal audit services.
Rules of Conduct
1. Integrity
Internal auditors:
1.1. Shall perform their work with honesty, diligence,
and responsibility.
1.2. Shall observe the law and make disclosures expect-
ed by the law and the profession.
IPPF – Practice Guide
Quality Assurance and Improvement Program
1.3. Shall not knowingly be a party to any illegal activity,
or engage in acts that are discreditable to the profes-
sion of internal auditing or to the organization.
1.4. Shall respect and contribute to the legitimate and
ethical objectives of the organization.
2. Objectivity
Internal auditors:
2.1. Shall not participate in any activity or relationship
that may impair or be presumed to impair their un-
biased assessment. This participation includes those
activities or relationships that may be in conflict
with the interests of the organization.
2.2. Shall not accept anything that may impair or be pre-
sumed to impair their professional judgment.
2.3. Shall disclose all material facts known to them that,
if not disclosed, may distort the reporting of activi-
ties under review.
3. Confidentiality
Internal auditors:
3.1. Shall be prudent in the use and protection of infor-
mation acquired in the course of their duties.
3.2. Shall not use information for any personal gain or
in any manner that would be contrary to the law or
detrimental to the legitimate and ethical objectives
of the organization.
4. Competency
Internal auditors:
4.1. Shall engage only in those services for which they
have the necessary knowledge, skills, and experi-
ence.
4.2. Shall perform internal audit services in accordance
with the International Standards for the Professional
Practice of Internal Auditing.
4.3. Shall continually improve their proficiency and the
effectiveness and quality of their services.
www.globaliia.org/standards-guidance / 25
IPPF – Practice Guide
Quality Assurance and Improvement Program

Authors:
Sally-Anne Pitt, CIA, CGAP

Gibby Armstrong, CIA

Jacques Lamothe, CIA

Judy Grobler, CIA

Max Haege

Reviewers:
Archie Thomas, CIA

Shannon Sumner

Bonnie Glasier, CIA

Takuya Morita, CIA

David MacCabe, CIA, CGAP

James Alexander, CIA

Carlos Reyes Balza, CIA, CRMA

Don Sparks, CIA

Narendra Aneja, CIA

Steve Jameson, CIA, CCSA, CFSA, CRMA

Erich Schumann, CIA

26 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2012 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

120606
 – Practice Guide

Reliance by
Internal Audit on Other
Assurance Providers

DECEMBER 2011
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

Table of Contents

Executive Summary......................................................................................... 1
Introduction.................................................................................................... 1
P rinciples for Relying on the Work of Internal or External
Assurance Providers....................................................................................... 4
Relying on Internal Assurance Providers......................................................... 6
Relying on External Assurance Providers....................................................... 10
Appendix A: Services Provided by External Assurance Provider..................... 13
Appendix B: Guide for Internal Auditors to Assess the
Reliability of Other Assurance Providers........................................................ 17
Glossary ...................................................................................................... 21
About the Authors and Reviewers................................................................. 26

www.globaliia.org/standards-guidance / B

Reliance by Internal Audit on Other Assurance Providers
Executive Summary
Chief audit executives (CAEs) are charged with providing
assurance on the adequacy of governance, risk manage-
ment, and related internal controls. This gives manage-
ment and an organization’s governing body, including the
audit committee, an assessment of risk, governance, and
control processes and practices across the organization,
rather than a series of audit reports on individual areas of
the organization. Since the risk profile is in a perpetual
state of change, internal audit functions are challenged in
meeting this expectation using traditional, point-in-time,
or cycle audit methods and resources.
Ever-increasing compliance requirements and business
complexity have driven companies to establish or procure
other risk management and assurance functions. They
are charged with measuring and reporting risk, identify-
ing control gaps, tracking remediation, and concluding
whether control processes are operating effectively in spe-
cific areas. Examples of some internal assurance providers
are identified as environmental compliance groups, qual-
ity management functions that focus on manufacturing
activities, internal control teams that assess controls over
financial reporting, and IT governance groups. External
assurance providers are often engaged to communicate
an opinion to another auditor regarding specific control
objectives operated by a service provider. These activities
provide assurance on the areas they assessed and recom-
mendations to strengthen the related controls, often in
areas that are within the scope of internal audit’s work.
This practice guide provides guidance to the CAE and in-
ternal audit leadership on an approach for relying on the
assurance provided by other internal or external assurance
functions. A continuum of five principles determines the
extent of reliance:
1. Purpose.
2. Independence and Objectivity.
3. Competence.
IPPF – Practice Guide
4. Elements of Practice.
5. Communication of Results and Remediation.
The principles are interdependent. To illustrate, the CAE
would place higher value on assurance providers who
commit to a common purpose, convey objective expertise,
and practice rigor and monitoring to shorten the time to
management action. The results of these other assurance
providers can be integrated with the work of internal audit
to communicate a comprehensive opinion to key stake-
holders. The guidance gives a process for valuing the work
of others and assessing the reliability of assurance pro-
viders. In turn, good coordination attracts greater reliance
on internal audit decreasing the cost of compliance and
increasing the efficiency for providing assurance.
Introduction
1.1 Introduction
Internal audit is charged by the International Standards for
Professional Practice of Internal Auditing (Standards) with
providing assurance on the adequacy of governance, risk
management, and related controls. In many organizations,
management has established (or engaged a third party to
provide) other assurance functions — such as in the ar-
eas of IT projects, manufacturing quality, environmental
health and safety, controls over financial reporting, and
other regulatory compliance. The purpose of this practice
guide is to provide ideas and ways to leverage the work
of other assurance providers, whether the assurance is
provided internally within the organization or externally
to minimize duplication of work and disruption to the op-
eration, provide enhanced coverage, and conserve audit
resources for high-risk processes.
Standard 2050: Coordination
The chief audit executive should share information and coordinate
activities with other internal and external providers of assurance
and consulting services to ensure proper coverage and minimize
duplication of efforts.
www.globaliia.org/standards-guidance / 1

Reliance by Internal Audit on Other Assurance Providers
An added value to the organization of coordinating the
activities of the various assurance providers is limiting du-
plicate work. Multiple audits or examinations of the same
risks and testing of the same controls by multiple assur-
ance providers is an unnecessary burden on process own-
ers and an inefficient use of resources. If one assurance
provider, such as internal audit, can rely on the work of
another, the value is clear.
1.2 Who are assurance providers?
IIA Practice Advisory 2050-2: Assurance Maps describes
three classes of assurance providers, differentiated by the
stakeholders they serve, their level of independence from
the activities over which they provide assurance, and the
robustness of that assurance:
A. Those who report to management and/or are part
of management (management assurance), including
individuals who perform control self-assessments,
quality auditors, environmental auditors, and other
management- designated assurance personnel.
B. Those who report to the board, including internal
audit.
C. Those who report to external stakeholders (such as
external audit assurance, which is a role traditionally
fulfilled by the independent/statutory auditor).
The IIA defines assurance as an objective examination of
evidence for the purpose of providing an independent as-
sessment on governance, risk management, and control
processes. The level of assurance desired, and who should
provide that assurance, will vary depending on the risk
and stakeholder expectations. The scope of the internal
audit function covers the entire organization, including
risk management processes (both their design and oper-
ating effectiveness), and the management of those risks
classified as “key” or significant (including the effective-
ness of the related controls).
1.3 Benefits
The IIA’s Standards define an internal audit activity as:
IPPF – Practice Guide
“A department, division, team of consultants, or other
practitioner(s) that provides independent, objective assur-
ance and consulting services designed to add value and
improve an organization’s operations. The internal audit
activity helps an organization accomplish its objectives by
bringing a systematic, disciplined approach to evaluate
and improve the effectiveness of governance, risk man-
agement, and control processes.”
It is noteworthy that this definition emphasizes objective
assurance and does not reference an expectation for de-
livering audit reports or ensuring compliance. Tradition-
ally, internal auditors spend a significant amount of time
performing direct inspection audits, but there are other
ways to provide assurance. The typical organization has
a number of different groups who provide risk manage-
ment, compliance, and assurance activities independently
of one another. In many cases these groups are testing
controls deeper and with greater frequency than the inter-
nal auditor. Without effective coordination and reporting,
work can be duplicated or key risks may be missed or mis-
judged. By adopting a more integrated assurance model
that includes the internal auditor relying on the work of
others, several benefits accrue to the organization. These
include:
• More precise assurance by involving greater subject
matter expertise in audit activities. For example,
reliance on an environmental compliance group with
specialized knowledge and certifications in the field
of environmental regulations may improve the level
of insight into operations and the quality of assur-
ance provided.
• Reduced redundancy of effort (audit once, audit
well) and ‘audit fatigue’ for the organization.
• Expanded coverage of the enterprise without increas-
ing direct audit hours. (Reliance on others may allow
internal audit to reduce the hours spent in that area
and allocate them to other risk areas.)
• Shortened time to management action. For example,
the other assurance provider may have continuous
www.globaliia.org/standards-guidance / 2

Reliance by Internal Audit on Other Assurance Providers
monitoring methods in place, or management may
have integrated responses to issues detected by other
assurance groups into routine business processes.
• Strategic collaboration, transparency, and better gov-
ernance for meeting organizational objectives result-
ing in predictable compliance. When all the groups
involved in assurance cooperate and share informa-
tion, insights, and best practices, the quality of the
whole effort is likely to rise.
Reliance on other assurance groups may enable the CAE
to redirect scarce audit resources to other areas of sig-
nificant risk to the enterprise. For example, the audit plan
may be expanded to include additional strategic risks, or
risks in connection with mergers and acquisitions, major
IT and other initiatives and capital programs, and research
and development processes.
The IIA’s Practice Guide, Coordinating Risk Management
and Assurance, advises the CAE to help in the creation
of an assurance map for the organization to create a more
connected assurance and governance community. Assur-
ance maps help identify duplication and overlap in assur-
ance coverage, define scope boundaries and roles for vari-
ous assurance providers and determine gaps in assurance
coverage that need to be addressed.
1.4 Risk
Relying on other assurance providers, however, can add
audit risks such as:
• Missing a control weakness or deficiency and reach-
ing the wrong conclusion due to defects in the work
or coverage of the other assurance provider.
• Failing to identify issues that are not shared by the
other assurance provider due to their lack of inde-
pendence from management.
• Raising as an exception and issuing a matter out of
context that would not ordinarily be considered sig-
nificant by internal audit, due to differences in risk
assessment processes.
IPPF – Practice Guide
Since external and internal assurance providers and the
internal auditor may have different purposes, it is impor-
tant to manage expectations beforehand regarding the
purpose of the review, the objectivity and competence of
the evaluator, the rigor of the assessment and testing pro-
cesses, and the timeliness of the conclusion.
1.5 Opportunity
Other sources or forms of assurance can advance innova-
tive models for communicating assurance as an alterna-
tive to the traditional inspect-and-report model. Practices
such as continuous monitoring, self-reported issues, and
macro-assurance planning are designed to assess and
strengthen internal controls by identifying issues prompt-
ly and reducing the time to management action:
• Continuous Monitoring: Monitoring controls to de-
tect potential failures, or transactions to identify pos-
sible errors and defects, enables management to see
and respond to risk early, as it emerges. Continuous
monitoring reduces the time to action, sustains the
resolution, and extends assurance. When manage-
ment has continuous monitoring practices in place,
internal audit may be able to assess the programs and
then rely on them as part of a continuous auditing or
assurance program.
• Self-reported Issues: This practice empowers man-
agement to raise issues and track remediation to
advance corrective action. Internal auditors gain
comfort when management promptly addresses root
causes for the self-reported issues.
• Macro-assurance: Pervasive themes can be high-
lighted by comparing and trending common issues
raised by the governance community. Coordinating
principle-based assessments performed by other as-
surance providers in sequence with internal audit en-
gagements could give an over-arching macro-opinion
across multiple entities or processes.
In addition, efficiency and effectiveness of overall assur-
ance activities may be improved when common tools are
www.globaliia.org/standards-guidance / 3

Reliance by Internal Audit on Other Assurance Providers
used by the internal auditor and other assurance provid-
ers. For example, multiple assurance functions can use
an integrated platform to manage the assessment process,
share results, and track remediation of significant issues.
The sharing of schedules and plans, and the results of as-
sessments, can avoid duplicate work. It also can highlight
areas of increased risk. For example, multiple compliance
issues raised by other assurance groups (such as noncom-
pliance with trade compliance regulations) may indicate
a need to address entity-level controls (such as the avail-
ability of experts in trade compliance regulations).
Principles for Relying on the
Work of Internal or External
Assurance Providers
2.1 Prior Guidance
The CAE can look to several authoritative sources for
guidance on how the internal auditor may rely on the
work of others. The IIA’s Practice Guide, Formulating and
Expressing Internal Audit Opinions (April 2009), defines
other assurance providers and provides guidance for a
CAE to assess their competency, independence, and ob-
jectivity.
According to The IIA’s Practice Advisory 2050-3: Relying
on the Work of Other Assurance Providers, the decision to
rely on the work of other assurance providers can be made
for a variety of reasons:
• To address areas falling outside of the competence of
the internal audit activity.
• To gain knowledge transfer from other assurance
providers.
• To efficiently enhance coverage of risk beyond the
audit plan.
IPPF – Practice Guide
2.2 Five Principles in Determining Reliance
The extent of reliance to be placed on the other internal
or external assurance providers depends on the following
five principles:
1. Purpose: The assurance provider is clear in purpose
and committed to providing assurance on a specified risk
area and their work is relevant to internal audit’s objec-
tives and scope. This is a fundamental principle which
must be in place before proceeding further with an evalu-
ation to determine reliability. For internal providers, the
purpose should be established in a charter or other similar
documentation. For external providers this should be pro-
vided for in a contract or statement of work.
2. Independence & Objectivity: The professional judg-
ment of the assurance provider is impartial, without in-
appropriate interference from others. The assurance pro-
vider should demonstrate a sufficient degree of objectivity
in the course of its work. Although internal assurance
providers often report to management and thus are not
truly independent, they can be relied on when they dem-
onstrate appropriate objectivity and competence.
3. Competence: The assurance provider is knowledge-
able of the risks to the organizational processes, how con-
trols are designed to operate in response to the risks, and
what constitutes a weakness or deficiency. Characteristics
of proficiency for internal or external assurance providers
include organizational process expertise, education level,
professional experience, relevant professional certifica-
tions, continuing education, and the assurance provider’s
reputation for sound judgment.
4. Elements of Practice: The assurance provider has
established policies, programs, and procedures and fol-
lows them. In execution, assurance work is appropriately
planned, supervised, documented, and reviewed. Results
are based on persuasive evidence sufficient to support the
level of assurance. They also should have the authority to
access sufficient information to reach a conclusion.
www.globaliia.org/standards-guidance / 4

Reliance by Internal Audit on Other Assurance Providers
5. Communication of Results & Impactful Reme-
diation: The assurance provider communicates results
and ensures management takes timely action. Weak-
nesses and deficiencies are reported to the person directly
responsible for taking corrective actions and to the mem-
bers of management that have oversight responsibilities.
Ongoing monitoring ensures the resolution is sustained
as intended. Rigorous process and persuasive and reliable
communication results in prompt corrective action. In
turn, management action validates an effective assurance
process that internal audit can place greater reliance on.
High Reliance
Elements of Practice
Competency
Objectivity
Impact
Level
of Risk
Purpose
Low Reliance
Assessment of each factor plus consideration
of risk determines reliability
The application of these principles is further described in
this diagram. The upward arrows depict a continuum. As
the assurance provider puts these principles into practice,
the CAE can place higher reliance on the provider’s work.
Purpose: When the assurance provider is committed and
its purpose is aligned with internal audit’s objectives, au-
ditors will find the work more relevant.
Objectivity: The assurance provider can demonstrate
credibility and deliver value to the internal auditor even
where independence is lacking. The assurance provider’s
competence, elements of practice and impact are key
IPPF – Practice Guide
factors in balancing lower objectivity and establishing
reliance.
Competence: Assurance providers can bring a high level
of expertise relevant to the specific business process while
exercising sufficient objectivity. Although internal auditors
provide a high degree of objectivity, they may not have the
depth of knowledge needed to provide the desired level of
assurance in certain organizational processes or technical
areas.
Elements of Practice: The external and internal assur-
ance providers’ discipline to practice standard procedures
is directly related to their capability for timely and persua-
sive conclusions. Consistency and rigor in practice should
raise the internal auditor’s confidence in the assurance
provider’s work.
Impact: Internal assurance providers who are in close
proximity to the business process may communicate risk
and influence management to remediate control deficien-
cies quickly, perhaps more quickly than would a tradi-
tional internal audit. By monitoring risk and responding
promptly, internal assurance providers may shorten the
time to management action.
These principles are interdependent and operate at differ-
ent levels, proportionate to risk. The internal auditor must
evaluate each of these principles in relation to each other
and to the overall risk of the relevant processes to arrive at
a decision on whether to and how much to rely on another
source of assurance provided outside of internal audit. For
example, an assurance activity that has a clear purpose
and is found to be objective and competent, but does not
effectively communicate results or affect constructive
change, would likely lead the CAE to rely on it to a much
lesser extent. It also is important to note the positive role
the internal audit function can play in raising the perfor-
mance bar for other assurance providers through sharing
of best practices and insight into risk management, con-
trols, and audit principles.
www.globaliia.org/standards-guidance / 5

Reliance by Internal Audit on Other Assurance Providers
Relying on Internal
Assurance Providers
3.1 Who are Internal Assurance Providers?
Internal assurance providers (other than the indepen-
dent internal audit function) are groups that may report
to the board, management, or are part of management.
These members of the governance community may con-
duct control self-assessments, continuous monitoring
and compliance inspections, quality audits, or a variety
of other activities by other names which are designed to
provide assurance of achievement of some key organiza-
tional objectives or requirements. Organizationally, these
individuals and groups may report to the legal department
(common for regulatory compliance functions); finance
(common for financial reporting control focused or regu-
latory compliance functions); information security (com-
mon for security functions under the chief information
officer); environmental, health and safety; or to any op-
erational unit that has decided to invest in a compliance
program. All of these are groups the CAE should consider
when developing audit plans with the potential to rely on
their work.
3.2 Considerations for Internal
Assurance Provider
The International Accounting Standards Board (IASB) is
an independent accounting standard-setter with the ob-
jective of establishing globally accepted financial report-
ing standards based on clear accounting principles. The
IASB gives guidance on using the work of component
auditors, internal auditors, and auditor’s experts in Inter-
national Standard on Auditing (IAS) Nos. 600, 610, and
620, respectively. IAS 610 describes the following factors
that primarily affect the external auditors’ determination
for using the work of internal auditors:
1 Auditing Standard No. 5: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements; PCAOB Release No. 2007-005A; AU
Section 322 — The Auditor’s Consideration of the Internal Audit Function in an Audit of Financial Statements
IPPF – Practice Guide
• Objectivity.
• Technical competence.
• Due professional care.
• Regular communication.
IAS 620, Using the Work of an Auditor’s Expert, names
competence, capability, and objectivity as essential factors
when considering reliance on the work of others’ exper-
tise. Competence relates to the nature and level of exper-
tise of the auditor’s expert. Capability relates to the ability
to exercise that competence in carrying out the engage-
ment. Objectivity relates to the possible effects that bias,
conflict of interest, or the influence of others may have on
the expert’s judgment.
Similarly, the U.S. Public Company Accounting Oversight
Board (PCAOB), a private corporation that oversees the
auditors of public companies in the United States, has
provided guidance1 to external auditors on relying on the
work of others. The same principles and considerations
should be applied in relation to internal audit relying on
the work of others. The level of reliance should be based
on a careful evaluation of the competence, practices, and
objectivity of the persons whose work the auditor plans to
rely. A higher degree of competence and objectivity results
in greater reliance.
For purposes of relying on the work of others, the PCAOB
defines competence as the attainment and maintenance
of a level of understanding and knowledge that enables a
person to perform assigned tasks. Objectivity means the
ability to perform those tasks impartially and with intel-
lectual honesty. When assessing the internal assurance
provider’s competence, the CAE should evaluate such
factors as:
• Educational level and professional experience of
staff.
www.theiia.org/guidance / 6

Reliance by Internal Audit on Other Assurance Providers
• Professional certification and continuing education.
• Audit policies, programs, and procedures.
• Supervision and review of staff activities.
• Quality of workpaper documentation, reports, and
recommendations.
• Evaluation of staff performance.
Assessing the objectivity of other assurance providers can
be a challenge as most of these groups report to manage-
ment and not an independent body such as the audit
committee of the board of directors, supervisory board, or
head of an agency. There are several factors the CAE may
consider when determining if the assurance group dem-
onstrates sufficient objectivity to be relied on:
• The reporting lines for the other assurance group and
the level of management to which they report.
• Whether the scope of work, including the tests per-
formed or the assessment and reporting of the other
assurance provider are inappropriately influenced by
management.
• Policies and practices preventing the assurance
provider from auditing areas where the individuals
involved have current or recent operational responsi-
bilities.
• The internal auditor’s assessment of the quality of
work performed by the assurance function, including
fact-based conclusions, reporting, and follow-up to
identified issues.
3.3 Know When to Rely and Not to Rely
Before investing any significant time in evaluating a par-
ticular internal assurance function, the CAE can consider
some key factors to determine the extent of potential reli-
ance. These include:
• A charter or similar statement of clear objectives and
well-defined responsibilities.
• Objective reporting relationships and/or conflicting
operational duties.
IPPF – Practice Guide
• Sufficient expertise regarding the organizational
process and risk.
• Disciplined, repeatable processes.
• Communication of results, risks, or control concerns
and remediation tracking.
It also is critical to understand the scope of assurance work
performed by an internal assurance provider and how it
may fit into the internal auditor’s assurance objectives and
audit plans. Even though internal audit can bring value to
the enterprise through objective quality reviews of inter-
nal assurance and compliance functions, there is limited
value if this work does not extend coverage and help the
CAE provide greater assurance to its stakeholders.
3.4 A Process for Relying on the Work
of Others
The internal auditor should develop a consistent process
for how it will place reliance on the work of others. The
following is a basic approach that has been successful for
some internal audit functions. It involves the basic steps
of identification, evaluation, adjustment, and monitoring.
Identify
Monitor Evaluate
Adjust
Identify — Locate internal assurance groups and deter-
mine maturity and priority based on preliminary assess-
ment. In large, complex enterprises this can be a chal-
lenge. If an organization has an enterprise risk management
process, this can be a good single source for identifying
additional groups. As other assurance providers are identi-
www.globaliia.org/standards-guidance / 7

Reliance by Internal Audit on Other Assurance Providers
fied, the internal auditor also must consider how their
scope fits into internal audit’s own view of the overall risk
and control environment and the potential benefits for in-
tegrating these assurance activities. Priorities should be
based on a measurable value to the organization. This val-
ue includes expanding coverage and minimizing fatigue
caused by redundant audit activities.
Evaluate — Perform an evaluation of individual groups
to determine the extent the internal auditor can rely on
the work of others. This is the most critical and time-con-
suming phase of the reliance model, where internal au-
dit carefully considers the competency and objectivity of
the assurance work performed by others. This evaluation
also can bring value to the enterprise by providing rec-
ommendations to improve the effectiveness of assurance
activities. As the evaluation is concluded, there should be
a clear communication of how internal audit intends to
use the assurance work on an ongoing basis. Additional
guidance is provided below on how to evaluate the assur-
ance provider.
Adjust — Modify audit plans and scope to eliminate du-
plicative testing and expand risk coverage. To realize the
full value from a more integrated assurance model, careful
consideration must be carried out to determine how these
other activities can be used to bolster the independent as-
Low Reliance
• Program commitment • Common purpose
• Broad expertise • Process expertise
• Assess and report risk • Inspection discipline
• Point-in-time
conclusion
IPPF – Practice Guide
surance internal audit provides management, and where
there are opportunities to reduce internal audit’s own test-
ing. Internal audit should communicate expectations, ob-
jectives, and responsibilities in a memo of understanding
with other assurance providers regarding the portion of
their work that will be relied on.
Monitor — Maintain close communication with each
group, sharing risk assessments, audit plans, and results.
It is important to establish strong communication and
sharing protocol following the evaluation of the assurance
providers. This will help ensure the most efficient and ef-
fective use of internal audit resources as well as maintain
confidence in relying on the work of the other providers.
A re-evaluation of the assurance providers should be per-
formed on a periodic basis (see section 3.6).
3.5 Reliance Continuum: Levels of Value
The value the internal auditor can derive from an effective
partnership with other assurance groups will vary. There
is a continuum of reliance moving from one side of the
spectrum, where the auditor determines the work of the
other assurance provider is useful but places little reli-
ance, moving across the spectrum to where an assurance
provider is fully relied on.
High Reliance
• Common purpose • Integral purpose/priority
• Process expertise • Technical expertise
• Repeatable testing • Rigorous practice
• Issue tracking • Sustained remediation
• Analytics • Continuous monitoring
• Communicate emerging
risk
www.globaliia.org/standards-guidance / 8

Reliance by Internal Audit on Other Assurance Providers
At a minimum, an effective assurance or compliance
function should be regularly assessing and communicat-
ing risk for its area of responsibility. If the risk assessment
process is determined to be sound, it can provide valu-
able information to help the internal auditor develop audit
plans and priorities.
More robust assurance functions, which begin to incor-
porate periodic testing of controls, may allow the internal
auditor to rely on their conclusions at a particular point
in time. As these assessments become more frequent and
extensive, the internal auditor may be able to place more
reliance and further reduce the depth or frequency of its
own testing.
Finally, where an effective assurance program is coupled
with reliable monitoring mechanisms embedded at the
control level, the internal auditor may place the maximum
degree of reliance and confidence in the activity.
3.6 Importance of Periodic Evaluation of the
Other Assurance Provider
Where internal audit will rely to any measurable extent
on the work of other assurance providers, regular assess-
ments should be made of the assurance providers’ pro-
grams. This is a critical element for internal audit to in-
clude in any reliance model to mitigate the risks described
earlier (see section 1.4). These assessments should ad-
dress the continued adequacy of the assurance providers’:
• Objectivity.
• Competence.
• Practices.
• Communication that enacts change.
The assessment should include performing tests suffi-
cient to provide objective evidence supporting the reliance
placed by internal audit. Opportunities for improving the
work of the other assurance provider should be reported,
consistent with standard internal audit practices.
IPPF – Practice Guide
Considerations for the CAE – A Case Study
Complex and business critical processes compel an approach for rely-
ing on other assurance providers:
A global provider of computer products and services relies on a
complex and multichannel sales process involving thousands of
third-party distributors around the world. Effectively managing this
mix of sales channels can be a competitive advantage and is es-
sential for the long-term success of the business. Management has
implemented numerous control processes to mitigate a range of risks
inherent in this area. Some examples of risk include compliance (e.g.,
doing business with restricted parties), financial (e.g., unprofitable
sales discounting), and operational (e.g., non-standard and inefficient
processes).
Based on management’s assessment of the risks and identified control
weaknesses, management has invested in a compliance program that
includes regular self-assessments by trained, objective assessors
outside of internal audit, who test the operating effectiveness of key
controls, report findings, and recommend corrective actions. Internal
audit provided consultation to help management develop the control
framework and key compliance program elements with the intent to
rely on this work. This model promoted management ownership of risk
and control and more frequent monitoring and testing of controls than
the internal audit function could realistically provide due to resource
constraints and other enterprise risks to be monitored.
Once the compliance program was implemented and stabilized,
internal audit performed a review to validate that it was operating
as intended, providing factual and objective assurance and driving
positive change in the business. As part of the review, internal audit
also connected the compliance program scope with the audit plan and
determined how and when the work would be leveraged, and agreed
with management on how the two groups would communicate on a
regular basis, share information, and collaborate to form a trusted
partnership.
Internal audit has significantly reduced the frequency and depth of
their control testing, which is now covered by management’s compli-
ance process, and has been able to focus on other areas historically
not audited such as product lifecycle management, strategic sourcing,
and IT project management.
www.globaliia.org/standards-guidance / 9

Reliance by Internal Audit on Other Assurance Providers
Relying on the Work of
External Assurance Providers
4.1 Introduction
A wide variety of external groups provide assurance ser-
vices to organizations worldwide to ensure that internal
controls and risk management procedures are in place
and operating effectively. External assurance providers
also provide these services at third-party service organiza-
tions for the benefit of the service organization and their
respective business clients. The purpose of this section is
to examine some of the services offered by external assur-
ance providers and discuss key areas that the CAE should
consider before placing reliance on their work.
4.2 Who Are External Assurance Providers?
Common external assurance providers include public ac-
counting firms, government auditor general offices, con-
sulting companies, legal firms, security organizations, and
internal audit departments of third-party service provid-
ers. The following provides a description of each.
Public accounting firms – provide many assurance
services such as opining on the fairness and accuracy of
financial statements; performing International Organiza-
tion of Standards (ISO) certification reviews to ensure that
an organization conforms to the requirements specified in
an ISO standard; conducting reviews of compliance with
laws and regulations; assessing the effectiveness of inter-
nal controls over financial reporting; reporting on a service
provider’s privacy program and assessing the protection of
personal information; and attest engagements covering
system security, availability, processing integrity, confiden-
tiality, and privacy.
Government auditor general offices – provide ser-
vices similar to public accounting firms; however, they
are usually government appointed functions that report to
the overall government rather than to shareholders. They
provide many assurance services such as opining on the
IPPF – Practice Guide
fairness and accuracy of financial statements; performing
performance audits to give assurance that appropriate val-
ue for money is being achieved from various activities and
projects; conducting reviews of compliance with laws and
regulations; assessing the effectiveness of internal con-
trols over financial reporting; and attest to engagements
covering system security, availability, processing integrity,
confidentiality, and privacy.
Consulting companies – provide many services simi-
lar to those of public accounting firms mentioned above.
However, they are not licensed or registered to issue an
opinion on the fairness of financial statements.
Legal firms – provide services to help organizations and
third-party service providers to assess compliance with
various laws and regulations in jurisdictions where they
do business. Legal firms also bring a wealth of knowledge
when assisting organizations in completing privacy and le-
gal risk assessments.
Security organizations – provide specialized assurance
services such as validating compliance with requirements
of the Payment Card Industry Data Security Standards
(PCI-DSS) as a qualified security assessor (QSA), con-
ducting network penetration assessments, and perform-
ing system vulnerability assessments for security patches,
viruses, and fixes. They also provide services related to
fraud and IT risk assessments.
The internal audit function of service providers —
like other internal audit departments, provide many audit-
ing and consulting services to ensure that internal con-
trols are working effectively and efficiently, and verify that
management has programs in place to address significant
IT infrastructure risk, application risk, and business pro-
cess risk relevant to the organization.
Internal audit functions of user entities – often the
service organization is contacted by internal audit func-
tions of their customers, user entities, to provide assur-
ance regarding a particular service or organizational pro-
www.globaliia.org/standards-guidance / 10

Reliance by Internal Audit on Other Assurance Providers
cess or to gain visibility throughout a specific time period.
It’s not unusual for the service organization to be audited
by multiple user entities. Analyzing the audit results and
issues raised through assessments conducted by user en-
tities can provide the service organization with common
themes providing a unique view to its capability for carry-
ing out control activities consistently.
Specific services provided by external assurance providers
can be found in appendix A.
4.3 Considerations for the CAE When
Relying on External Assurance Providers
It is important for management and the CAE to under-
stand the relevance of assurance work completed by ex-
ternal assurance providers within the organization. It also
is important for management and the CAE to have the
same understanding if the organization is outsourcing key
business processes to third-party service providers. The
CAE also must assess the impact their assurance work
may have on the internal audit function.
For information on the role of the CAE in sharing information
and coordinating activities with other providers of assurance
and consulting services, refer to The IIA’s Practice Guide on
Co-coordinating Risk Management and Assurance.
Some common questions are outlined below, along with
points for consideration:
1. Are the external assurance providers sufficiently
qualified, objective, and independent to perform
the necessary assurance work? How much reliance
2. What is the impact to the annual internal audit plan
should the CAE place on the work of external assur-
ance providers?
The CAE should:
• Determine if the external assurance provider is
subject to professional performance standards and
guidance such as those prescribed by The IIA, the
International Federation of Accountants (IFAC),
IPPF – Practice Guide
the International Organization of Supreme Audit
Institutions (INTOSAI), and other similar govern-
ing bodies.
• Ensure that the external assurance provider is
in good standing with their respective governing
body and place greater reliance on the work of
compliant external assurance providers compared
to those not subject to professional standards.
• Determine if the external assurance provider is
subject to professional ethics requirements to en-
sure the assurance work is performed by qualified
individuals, and done in an objective and inde-
pendent manner.
• Confirm that due diligence was performed on
the external assurance provider that includes
background checks, financial stability, years in
business, confidentiality agreement, references,
and a review of resumes of provider’s engagement
employees.
• Obtain evidence, as necessary, to confirm that the
individuals performing the work meet competen-
cy and experience requirements, that the work is
performed and supervised consistent with quality
standards, and that the assessment and report are
free from inappropriate influence from manage-
ment. Consideration should be given to whether
the assurance provider performs other consult-
ing work for management which might influence
their assurance activities, including whether there
is either a real or perceived independence and
objectivity issue.
if the CAE either places reliance or does not place
reliance on the work of external assurance providers?
The CAE should:
• Be aware of the scope, objectives, and findings of
the external assurance engagement to determine
the impact to the annual audit plan.
www.globaliia.org/standards-guidance / 11

Reliance by Internal Audit on Other Assurance Providers
• Determine if there is duplication of audit cover-
age as a result of the engagement. Alternatively,
the CAE should determine if there are coverage
gaps in the engagement that may require addi-
tional audit work by internal audit.
• If the engagement is performed at the organization,
determine if there is an opportunity to co source
the engagement, or at a minimum, participate in
the tracking of audit findings and resolutions.
• If the engagement was conducted by the organiza-
tion’s third-party service provider, reach out to the
service provider to obtain information about the
engagement.
• Consider the need for any preliminary audit work
prior to the start of the engagement.
3. Do the objectives and scope of work performed by
external assurance providers address key risks of the
organization?
The CAE should:
• Carefully review and understand the scope and
objectives of the external assurance engagement
before determining the impact it may have on
internal audit.
• Keep in mind that an external assurance engage-
ment typically will not cover all the business risks,
key controls, and concerns.
4. Should internal audit complete additional assurance
work to supplement the work of external assurance
providers?
• An external assurance engagement typically will
not cover all the risks and exposures related to the
organization. As such, the CAE and internal audit
may have to perform additional audit work based
on its risk assessment.
• Consider the scope, objectives, and results of the
engagement before finalizing any additional audit
work.
IPPF – Practice Guide
• Before additional audit work is planned by the
organization’s third-party service provider(s),
identify the right-to-audit clauses contained in the
service agreement with the service provider.
5. Should internal audit reperform audit work com-
pleted by external assurance providers?
• The level of expertise brought to the engagement
and the rigor practiced by the other assurance
provider will determine the extent of diligence
conducted by internal audit to accept their audit
work. In most cases internal audit would not re-
perform testing; rather, the CAE should conduct
a suitable analysis to determine if the audit work
completed was commensurate with the assertions
as intended based on risk, scope, and competence
of the external service providers.
• For specialist reviews like penetration and net-
work vulnerability engagements or income tax
consulting, the CAE should understand that this
area is technical in nature, so the skill set of each
auditor should include a solid background in
network and information security, income taxes,
or the relevant specialty.
6. Should the CAE pursue co sourcing arrangements
with external assurance providers?
• The CAE should consider separate (from manage-
ment) co sourcing arrangements with the external
assurance provider that would provide the ap-
propriate skill sets and add to the efficiency and
effectiveness of the audit engagement.
Co sourcing arrangements may include preliminary au-
dit work prior to the start of the engagement, conduct-
ing some audit work during the engagement under the
supervision of the external service provider, and complet-
ing post-audit work to validate on-going compliance and
remediation efforts.
www.globaliia.org/standards-guidance / 12
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

Appendix As a licensed offering, SysTrust engagements are con-

ducted by certified public accountants (CPAs) or char-
Appendix A: Services Provided by External tered accountants (CAs). Many organizations, particularly
Assurance Provider third-party service providers, request this type of engage-
ment to demonstrate to their clients that they are con-
The types of services offered by external assurance ser-
cerned about protecting the information assets entrusted
vice providers include AICPA/CICA SysTrust, ISO/IEC
to them, and addressing business risks and controls asso-
27002:2005 certifications, SSAE 16/ISAE 3402 reviews,
ciated with complex IT systems. These reports also can be
internal audit cosourcing, PCI-DSS assessments, network
used by the service organization in marketing its services
penetration security assessments, vulnerability manage-
to potential clients/customers.
ment reviews, and many other types of services. A descrip-
tion of some of these common services follows:
ISO/IEC 27002:2005
AICPA/CICA SysTrust The ISO/IEC 27002:2005 – Code of Practice for infor-
mation security management is one of a set of Informa-
For example, in North America, SysTrust is a branded as-
tion Security Management System (ISMS) standards
surance service offering licensed by the American Institute
published by the International Organization for Stan-
of Certified Public Accountants (AICPA) and Canadian
dardization (ISO) and the International Electrotechnical
Institute of Chartered Accountants (CICA) Trust Servic-
Commission (IEC). Through the use of these standards,
es Principles and Criteria (Trust Services). Trust Services
organizations can develop and implement a framework for
are professional attestation and advisory services based on
managing the security of their information assets such as
principles and criteria that address risks and opportuni-
financial information, intellectual property, and customer
ties of IT-enabled systems and privacy programs. Specific
and employee personal information. The ISMS family
areas covered in Trust Services guidance include:2
of standards consists of the following international stan-
dards, under the general title of Information technology
• Security – the system is protected against unauthor-
– Security techniques:3
ized access (both physical and logical).
• Availability – the system is available for operation • ISO/IEC 27000:2009, Information security manage-
and use as committed or agreed. ment systems — Overview and vocabulary.
• Processing integrity – system processing is complete, • ISO/IEC 27001:2005, Information security manage-
accurate, timely, and authorized. ment systems — Requirements.
• Confidentiality – information designated as confi- • ISO/IEC 27002:2005, Code of practice for informa-
dential is protected as committed or agreed. tion security management.
• Privacy – personal information is collected, used, • ISO/IEC 27003, Information security management
retained, disclosed, and destroyed in conformity with system implementation guidance.
the commitments in the entity’s privacy notice and
• ISO/IEC 27004, Information security management
with criteria set forth in generally accepted privacy
— Measurement.
principles issued by the AICPA and CICA.
2 Trust Services Principles and Criteria – An Overview, January, 29, 2009, www.aicpa.org/InterestAreas/InformationTechnology/Resources.
3. ISO/IEC 27000:2009, Information technology – Security techniques – Information security management systems – Overview and vocabulary, First edition 2009-05-01, ISO/IEC.
This material is reproduced from ISO/IEC 27000:2009 with permission from the American National Standards Institute (ANSI) on behalf of the International Organization for
Standardization (ISO). No part of this material may be copied or reproduced in any form, electronic retrieval system or otherwise or made available on the Internet, a public network,
by satellite or otherwise without the prior written consent of the ANSI. Copies of this standard may be purchased from ANSI, 25 West 43rd Street, New York, NY 10036, (212) 642-
4900, http://webstore.ansi.org.

www.globaliia.org/standards-guidance / 13

Reliance by Internal Audit on Other Assurance Providers
• ISO/IEC 27005:2008, Information security risk
management.
• ISO/IEC 27006:2007, Requirements for bodies pro-
viding audit and certification of information security
management system.
• ISO/IEC 27007, Guidelines for information security
management systems auditing.
• ISO/IEC 27011, Information security management
guidelines for telecommunications organizations
based on ISO/IEC 27002.
ISO/IEC 27002 provides guidance on the implementa-
tion of 11 commonly accepted security control objectives
along with best practice controls that can be applied to
achieve the objectives. The standard also includes com-
ments on risk assessment and treatment. Specific areas
covered in the standard include:
• Security policy.
• Organization of information security.
• Asset management.
• Human resources security.
• Physical and environmental security.
• Communications and operations management.
• Access control.
• Information systems acquisition, development, and
maintenance.
• Information security incident management.
• Business continuity management.
• Compliance.
Many organizations, particularly third-party service pro-
viders, who have adopted the ISO/IEC 27002 informa-
tion security management standard, choose to be certified
compliant with the standard through a formal indepen-
dent audit. Third-party service providers often use this
certification to demonstrate to current and future business
4 2011 IAES3402.com, http://isae3402.com/ISAE3402_overview.html
IPPF – Practice Guide
clients that they have good security practices in place to
protect the information assets that are entrusted to them.
ISO does not audit or assess an organization to validate
that its standards are being implemented in conformity
with the requirements. An external independent certifica-
tion body or ISO registrar conducts the audit to deter-
mine if the organization conforms to the requirements
specified in the standard to obtain certification. There are
numerous certification bodies (assurance service provid-
ers) worldwide that carry out certification assessments.
External service providers performing this type of service
include public accounting firms, consulting companies,
and sole practitioners.
SSAE 16/ISAE 3402
Third party assurance reviews are normally performed for
organizations that process financial transactions for their
clients or customers. The resulting report is typically used
by internal and external auditors and can potentially re-
duce the amount of work required in their audits. The
reports describe the service offerings and the control en-
vironment surrounding the processing of customer trans-
actions.
ISAE 3402
The International Standard on Assurance Engagements
No. 3402 (ISAE 3402), Assurance Reports on Controls
at a Service Organization, was issued in December 2009
by the International Auditing and Assurance Standards
Board (IAASB) under the International Federation of Ac-
countants (IFAC). ISAE 3402 was developed to provide
an international assurance standard for allowing public
accountants to issue a report for user organizations and
their auditors (user auditors) on the controls at a service
organization that are likely to impact or be a part of the
user organization’s system of internal control over finan-
cial reporting.4 The effective date for this standard applies
to periods ending on or after June 15, 2011.
www.globaliia.org/standards-guidance / 14

Reliance by Internal Audit on Other Assurance Providers
SSAE 16
Statement on Standards for Attestation Engagements
(SSAE) No. 16, Reporting on Controls at a Service Or-
ganization, was finalized by the Auditing Standards Board
of the AICPA in January 2010. SSAE 16 replaced State-
ment on Auditing Standards (SAS) No. 70, Service Orga-
nizations, as the authoritative guidance for reporting on
controls at service organizations. SSAE 16 was formally
issued in April 2010 with an effective date of June 15,
2011.5 SSAE 16 is based on the IAASB assurance stan-
dard for service auditors ISAE 3402. It should be noted
that the requirements for auditing the financial state-
ments of entities that use service organizations remains
in the auditing standards in a new SAS, Audit Consider-
ations Relating to an Entity Using a Service Organization.
The AICPA is establishing three reporting options to pro-
vide a framework for CPAs to examine controls and to
help management understand related risks. The Service
Organization Control 1 (SOC 1) report addresses con-
trols for financial statement audits with guidance pro-
vided by SSAE 16. SOC 2 reports on controls related
to compliance or operations with guidance provided by
Attestation Standard (AT) Section 101, Attest Engage-
ments. Both SOC 1 and SOC 2 reports are restricted use
reports. SOC 3 reports are the same as a SOC 2 report
but general use.
The AICPA SSAE 16 or ISAE 3402 allows for two
types of reports:
Type I: Reports on controls placed in operation
A service auditor’s report on a service organization’s de-
scription of the controls that may be relevant to a user
organization’s internal controls, whether such were suit-
ably designed to achieve specified control objectives, and
whether they had been placed in operation as of a specific
date. These reports may be useful in providing a user au-
ditor with an understanding of the controls necessary to
plan the audit, as well as design effective tests of controls
5 2011 SSAE16.com, http://ssae16.com/SSAE16_overview.html
IPPF – Practice Guide
and substantive tests at the user organization. However,
they are not intended to provide a basis for reducing as-
sessments of control risk below the maximum.
Type II: Reports on controls placed in operation and
tests of operating effectiveness
A service auditor’s report on a service organization’s de-
scription of the controls that may be relevant to a user
organization’s internal controls, whether such controls
were suitably designed to achieve specified control objec-
tives, whether they had been placed in operation as of a
specific date, and whether the controls that were tested
were operating with sufficient effectiveness to provide
reasonable, but not absolute, assurance that the related
control objectives were achieved during the period speci-
fied. Such reports may be useful in providing the user
auditor with an understanding of the controls necessary
to plan the audit and may also provide the user auditor
with a basis for reducing his or her assessments of control
risk below the maximum.
Some common misconceptions about SSAE 16 reports
the CAE should be aware of include:
1. All SOC reports contain the same control objec-
tives. (Control objectives are defined specifically for
the environment been attested.)
2. SOC reports are “forward-looking” documents.
3. Type I vs. Type II reports don’t really make a dif-
ference to my audit planning. (Type I only covers
control design effectiveness and is point in time.
Type II covers control operating effectiveness for an
opinion period.)
4. Exceptions are not reported. (Any exceptions to the
controls are clearly identified in the test tables even
if it does not rise to the level of being a qualified
report.)
5. Exceptions have no impact on my audit plan.
www.globaliia.org/standards-guidance / 15

Reliance by Internal Audit on Other Assurance Providers
(Further testing or compensating controls should be
considered for exceptions.)
6. Since SOC reports are intended for external auditor-
to-auditor communication, the report is not relevant
to internal audit planning. (Using/relying/further
testing of controls covered in the SOC report should
be discussed at planning.)
7. As a professional courtesy, a copy of the SOC
opinion need only be referenced in the audit plan-
ning file. (A thorough understanding of the scope,
coverage, nature, timing, and extent of testing within
a SSAE 16 engagement is essential.)
The CAE of the organization that utilizes third-party ser-
vice providers should consider adopting the following
practices when evaluating the impact of SSAE 16 engage-
ments to the organization and the audit plan:
• Obtain all relevant SSAE 16 SOC reports.
• Determine the exact nature of the environment in
scope for the report as large service providers can
potentially have many reports.
• Understand “carve-outs” of environments as the
standard allows service providers to exclude areas or
parts of the environment from the scope of work and
resulting audit opinion.
• Review the independent service auditor’s opinion
type (qualified/unqualified).
• Review the date of the report(s) and period(s) cov-
ered.
• Determine whether the report is a Type I or Type II.
• If the SSAE 16 report is older than six months, a
more current report should be requested. If a more
current report is not yet available, then management
and the CAE should consider the need to perform
other audit procedures to obtain comfort over the
controls at the service provider or request a letter
from the service provider to bridge the interim.
• Document the comfort level with the SOC report
IPPF – Practice Guide
and the impact to the organization and the CAE’s
audit plans
• Determine if control risk will be assessed as low,
moderate, or high.
• Gain an understanding and test user control consid-
erations defined in the report.
Payment Card Industry –
Data Security Standard (PCI-DSS)
The Payment Card Industry Data Security Standard (PCI-
DSS) is a set of 12 technical and operational requirements
established by the PCI Security Standards Council (PCI
SSC) to protect cardholder data. The standards apply to
all organizations that store, process, or transmit cardhold-
er data. The PCI SSC also provides guidance for software
developers and manufacturers of applications and devices
used in those transactions. The Council is responsible for
managing the security standards, while compliance with
the standards is enforced by the founding members of the
Council: American Express, Discover Financial Services,
JCB International, MasterCard, and VISA, Inc.
The PCI-DSS Security Audit Procedures (SAPs) con-
tains more than 230 comprehensive requirements. The
auditing responsibility is distributed between merchants,
qualified security assessors (QSAs), approved scanning
vendors (ASVs), and acquirers. PCI SSC allows two ac-
ceptable forms of auditing of the requirements by either
a qualified security assessor (QSA) or internal security as-
sessor (ISA).
QSA companies are organizations that have been quali-
fied by the PCI SSC to perform detailed SAP assessments
and reports on compliance on behalf of the merchant.
The primary reasons merchants may select a QSA rather
than performing the assessment internally may include
transaction volume, breadth of industry knowledge, depth
of technical expertise, and an independent view of the en-
vironment. Other reasons merchants may not use internal
resources may include lack of technical competence, lack
www.globaliia.org/standards-guidance / 16

Reliance by Internal Audit on Other Assurance Providers
of resources, and to focus resources on more strategic vs.
compliance efforts.
ISA is a certification required for organizations performing
internal assessments by their internal audit staff, begin-
ning in 2011. The purpose of the ISA certification is to
ensure internal auditors are provided the same training as
the QSAs to improve the quality, consistency, and compe-
tency of the assessments.
Penetration Tests and Network Vulnerability
Management
Organizations continue to be impacted from malicious
breaches resulting in compromised credit card informa-
tion, social security numbers, medical information, and
other loss of internal and external customer information
at the hands of hacker attacks. Key to proactively com-
bating these attacks within an organization is to ensure
a strong program for penetration tests and vulnerability
assessments.
Penetration testing, sometimes called “ethical hacking,”
mimics the role of a hacker to deliberately attempt to
break into the network infrastructure to determine vulner-
abilities of key components of the company infrastructure
that could lead to a compromise of critical/sensitive infor-
mation. The penetration test should stop short of actually
negatively impacting the environment.
Penetration tests are not only an imperative practice for a
strong information security program, but are required to
comply with several regulations and requirements. For ex-
ample, PCI-DSS requires third-party penetration tests to
be performed annually. Some organizations require annual
penetration testing as a key IT general control to meet
the requirements of the U.S. Sarbanes-Oxley Act of 2002.
External penetration testing provides organizations the
opportunity to have an independent third party determine
the risks (or weak links) in their network and systems.
Vulnerability management is the processes and technolo-
IPPF – Practice Guide
gies that an organization employs to identify, assess, and
remediate IT vulnerabilities — weaknesses or exposures
in IT assets or processes that may lead to a business risk
or security risk. One of the most common attack vectors
today is via weak or insecure web application programs.
Hackers exploit these weaknesses to gain access into the
unsuspecting organization’s network and systems environ-
ment. Awareness and secure coding training is crucial to
help mitigate this risk. All programmers, especially web
application developers, should be properly trained on se-
cure coding techniques.
Penetration tests and vulnerability assessments could po-
tentially disrupt an organization. Therefore, organizations
should determine what is needed to adequately test with
the potential of “breaking” or disrupting a component of
the infrastructure. A strong program for penetration test-
ing and vulnerability management is imperative for an or-
ganization to mitigate internal and external threats.
In conclusion, services offered by external assurance pro-
viders can be leveraged to provide broader coverage of
the organization’s key risks when carefully considered be-
forehand to be relevant to the enterprise. As outlined in
the first principle of “purpose,” both external and internal
assurance providers are committed to reliance and their
work is relevant to the objective of internal audit, which
applies to operational, regulatory, or financial reporting. It
is vital to communicate expectations, objectives, and re-
sponsibilities with the other assurance provider regarding
the portion of their work that will be relied upon.
Appendix B: Guide for Internal Auditors to
Assess the Reliability of Other Assurance
Providers
The following is a sample audit guide for internal audit
to assess the reliability of another internal assurance pro-
vider. These procedures should help the auditor evaluate
the extent the assurance provider meets the principles for
reliance described in section two of this practice guide.
In evaluating the competency and objectivity of the assur-
www.globaliia.org/standards-guidance / 17
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

ance provider, the assessment process is organized around
four major areas:
Governance and Objectives – A charter or objective
statement provides authority and scope of assurance ac-
tivities and establishes intent for internal audit to rely on
the work product of the assurance provider. Adequate
staff is in place (numbers and competency) and objectiv-
ity is provided for.
Assurance Execution – The assurance provider has a
demonstrated performance history of delivering to the
established objectives and producing competent and reli-
able results. Documentation should be maintained as evi-
dence of performance to relevant professional standards.
Reporting and Follow-up – The results of assurance
activities are reported to an appropriate level of manage-
ment and issues are tracked until they are mitigated.

Risk Assessment and Planning – Assurance activities

are guided by appropriate policies and procedures and
should include audit plans that incorporate an assessment
of risk.

Purpose and Governance – A charter or objective statement provides authority and scope of assurance activities and establishes intent
for internal audit to rely on the work product of the assurance provider. Adequate staff is in place (numbers and competency) and
objectivity is provided for.

Characteristic Verification Procedures or Method of Demonstrating

Charter 1. Does the assurance provider have a written charter that includes the following elements: mission and scope of work,
accountability, roles and responsibilities, responsibility, and authority?
2. Is the charter published, easily accessible, and has been communicated to all applicable staff?
3. Is the charter periodically reviewed and updated in accordance with the changing risk environment and approved by an
appropriate leadership level?

Written policies and Does the assurance provider maintain documented policies and procedures that include the following:
procedures 1. Procedures to identify, document, and evaluate the relevant risks and their associated controls.
2. Risk-based procedures to evaluate the effectiveness of internal controls.
3. Procedures to document internal control monitoring and testing procedures including supervisory review.
4. Procedures to report on the effectiveness of internal control to appropriate management.
5. Procedures to monitor and report actions to remediate control weaknesses.

Personnel 1. Obtain staff bios and look for appropriate background, experience, and education to perform audit activities. Evidence
performing may include formal education, direct experience, professional certifications, and relevant training courses.
assurance activities 2. Review and evaluate the assurance provider’s functions/responsibilities beyond their review activities and ensure that
have appropriate these tasks do not impair their independence.
skill and objectivity 3. Evaluate the management supervision process of staff and determine if there is appropriate oversight to ensure the
quality of work.

www.globaliia.org/standards-guidance / 18
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

Performance 1. Does the assurance provider measure its own performance? This could include use of a balanced scorecard, surveys of
measurements key stakeholders, etc.
2. Identify key stakeholders of the assurance provider assurance activity and interview to understand their view of the
value being provided, the areas of focus, quality, and timeliness of reporting, etc.

Risk Assessment and Planning – Assurance activities are guided by appropriate policies and procedures and should include audit plans
that incorporate an assessment of risk.

Characteristic Verification Procedures or Method of Demonstrating

Defined assurance 1. How has the assurance universe been defined? Determine the appropriateness of the size and number of the entities
universe making up the audit universe (e.g., too detailed or general, too many or too few, logical division, etc).

Risk assessment 1. Review the risk assessment process. Understand the key risk components considered. Evaluate if these are reasonable
and comprehensive, considering both qualitative and quantitative factors. Is the risk assessment updated at least
annually?
2. Determine if the assurance provider follows a structured approach to create and document risk-based reviews. Does the
approach include input from an appropriate range and level of business leaders?
3. Interview the audit team and process owners of the associated business units/support functions and assess how risks
are updated for changes such as acquisition, reorganization, change in Job responsibilities, etc.

Assurance plan 1. Obtain the current period and long range audit plan(s). Determine the following:
- How is the assurance plan developed?
- Is it based on results of the risk assessment?
- Are plans reviewed and approved by an appropriate level of leadership?
- Does the plan provide for appropriate coverage of the assurance universe?
- Does the plan include appropriate time for follow-up activities to validate corrective actions of prior issues?
2. Inquire as to how the planning process factors in changes that occur, such as new regulations, organization changes,
etc.
3. Compare current staffing levels with the audit plan to determine if sufficient resources are available (i.e. are they on
track to finish their scheduled reviews).

Assurance Execution – The assurance provider has a demonstrated performance history of delivering to the established objectives and
producing competent and reliable results. Documentation should be maintained as evidence of performance to relevant professional
standards.

Characteristic Verification Procedures or Method of Demonstrating

Engagement Select a sample of assurance engagements and review for the following:
planning 1. Does the engagement have a documented scope, objectives, timeframe, and deliverables?
2. Do the scope and objectives tie to the overall risk assessment and assurance plan?
3. How is the scope determined? Is it based on some preliminary assessment and understanding of risks relevant to the
activity being reviewed?
4. Does the scope appear adequate in light of the identified risks?

www.globaliia.org/standards-guidance / 19
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

Documentation 1. Are work programs documented to achieve engagement objectives? These should establish the procedures for
identifying, analyzing, evaluating, and recording information during the engagement.
2. Is the work performed documented? Review the workpapers and assess whether they are sufficient, relevant, and
reliable in meeting IIA standards.
3. Assess if it is feasible for a third party to re-perform the work based on the audit work papers.
4. Are appropriate samples selected for the controls tested?
5. Are issues or findings adequately documented, with root cause clearly identified?
6. Is there evidence of an appropriate review and approval of assurance work?
7. Are workpapers appropriately secured and retained according to company record retention requirements?

IT considerations 1. Review for evidence of appropriate use of technology in assurance activities, i.e., use of analytical review techniques,
computer aided audit tools (CAATS), etc.
2. Are IT risks and controls adequately considered and addressed in the assurance/audit activities?

Reporting and Follow-up – The results of assurance activities are reported to an appropriate level of management and issues are tracked
until they are mitigated.

Characteristic Verification Procedures or Method of Demonstrating

Reporting 1. Are the results of assurance activities formally reported? Select a sample of assurance reviews completed in the past
12 months and review for the following:
- Are they documented and presented in a standard format?
- Are they provided to an appropriate distribution of leadership?
- Are findings presented in a reasonable time following the review activities?
- Are issues and recommendations clearly presented and rated according to assurance provider procedures?
2. Do findings include elements of effective issues (5 C’s – criteria, condition, cause, consequence, corrective action)?
3. Do all issues have an appropriate owner identified?

Issues are identified 1. Is there a process to monitor issues and status of corrective actions? Is status regularly reported to appropriate
and tracked leadership?
2. Is there a process to validate corrective actions taken in response to audit issues?

www.globaliia.org/standards-guidance / 20

Reliance by Internal Audit on Other Assurance Providers
Glossary
The American Institute of Certified Public Ac-
countants (AICPA) – the voice of the accounting pro-
fession since 1887. The AICPA prides itself on its serv-
ing the certified public accounting (CPA) profession and
the public interest to which it is profoundly committed.
AICPA members work in all sectors of the business and
financial services profession, including public account-
ing, financial planning, tax, business and industry, law,
consulting, education, and government.
http://www.aicpa.org/About/Pages/About.aspx
Assessment – the act of assessing; appraisal; evaluation.
Auditing Standard No. 5 (AS No. 5): An Audit of
Internal Control Over Financial Reporting That Is
Integrated with An Audit of Financial Statements
– Issued by the PCAOB, the report is based on PCAOB
inspections that examined portions of approximately 250
audits of internal control over financial reporting (ICFR)
by the eight largest domestic registered firms in 2007
and 2008. AS No. 5 became effective for audits for fiscal
years ending on or after Nov. 15, 2007, and replaced the
PCAOB’s previous ICFR standard, AS No. 2.
http://pcaobus.org/News/Releases/Pages/09242009_
AS5_Report.aspx
Board – A board is an organization’s governing body, such
as the board of directors, supervisory board, head of an
agency or legislative body, board of governors or trustees
of a nonprofit organization, or any other designated body
of the organization, including the audit committee to
whom the chief audit executive may functionally report.
Chief Audit Executive (CAE) – describes a person in
a senior position responsible for effectively managing the
IPPF – Practice Guide
internal audit activity in accordance with the internal au-
dit charter and the Definition of Internal Auditing, the
Code of Ethics, and the International Standards for the
Professional Practice of Internal Auditing (Standards).
The CAE or others reporting to the CAE will have appro-
priate professional certifications and qualifications. The
specific job title of the CAE may vary across organiza-
tions.
https://www.globaliia.org/standards-guidance/mandatory-
guidance/Pages/Standards-Glossary.aspx
The Canadian Institute of Chartered Accountants
(CICA) – represents Canada’s chartered accountants
(CA) profession both nationally and internationally. CAs
are Canada’s internationally recognized profession of
leaders in senior management, advisory, financial, tax,
and assurance roles.    
http://www.cica.ca/about-the-profession/cica/index.aspx
Compliance Community Member – an individual or
group with responsibility for developing, administering,
and monitoring internal programs to ensure compliance
with applicable federal and state laws and regulations. Al-
ternate titles: compliance manager, risk and compliance
officer.
Continuous Auditing – Continuous auditing is a meth-
od used to perform control and risk assessments auto-
matically on a more frequent basis. Technology is key to
enabling a continuous auditing approach. Traditionally,
internal audit’s testing of controls has been performed
on a retrospective and cyclical basis, often many months
after business activities have occurred. The testing pro-
cedures have often been based on a sampling approach
and included activities such as reviews of policies, proce-
dures, approvals, and reconciliations. Today, however, it
is recognized that this approach only affords internal au-
ditors a narrow scope of evaluation, and is often too late
www.globaliia.org/standards-guidance / 21

Reliance by Internal Audit on Other Assurance Providers
to be of real value to business performance or regulatory
compliance. See GTAG 3: Continuous Auditing: Impli-
cations for Assurance, Monitoring, and Risk Assessment.
Continuous Monitoring – encompasses the processes
that management puts in place to be sure that the policies,
procedures, and business processes are operating effec-
tively. It addresses management’s responsibility to assess
the adequacy and effectiveness of controls. This involves
identifying the control objectives and assurance assertions
and establishing automated tests to highlight activities
and transactions that fail to comply. See GTAG 3.
Co-sourcing – Many CAEs must confront the possibil-
ity of outsourcing some of their work to ensure everything
with which they are tasked is completed in a timely and
competent manner. Co sourcing presents a CAE with
a broad range of outside capabilities to supplement in-
house talent.
Chartered Accountant (CA) – Professional member of
a country’s Institute Of Chartered Accountants. He or she
must work (and be trained) in the office of a practicing
chartered accountant for three years, and pass exhaustive
written tests to qualify. On completing the requirements,
the trainee is awarded the Associate of the Institute of
Chartered Accountants (ACA).
http://www.businessdictionary.com/definition/chartered-
accountant-CA.html
Certified Public Accountant (CPA) – a statutory title
of qualified accountants in the United States for one who
has passed the CPA examination administered by the li-
censing body of the AICPA.
IPPF – Practice Guide
AICPA Board of Examiners (BOE) – a senior com-
mittee of the AICPA that sets policy for the Uniform CPA
Examination in accordance with legal and psychometric
standards as they apply to licensure examinations. Mem-
bers of the BOE are CPA volunteers from every segment
of the profession — public accounting, business and in-
dustry, and the academic community — the majority of
whom currently also have regulatory (state board) experi-
ence.
http://www.aicpa.org/BECOMEACPA/CPAEXAM/EX-
AMOVERVIEW/GOVERNANCE/Pages/default.aspx
Internal Security Assessor (ISA) – A certification
program offered by the Payment Card Industry Securi-
ty Standard Council (PCI SSC), an international orga-
nization that manages the Payment Card Industry Data
Security Standard (PCI-DSS). ISA is designed to help
companies comply with their continually evolving rules
and regulations. The ISA program offers training to mer-
chants, banks, and processors. This certification program
trains select individuals on the basics of implementing
an ongoing security discipline, and works to remove the
“check the box” mentality that can sometimes arise with
compliance programs. ISA program benefits include: an
opportunity for internal auditors to learn the same tech-
niques taught to QSAs; the chance for merchants to verify
their internal staff have a common understanding of the
PCI-DSS requirements; the ability for merchants to hear
the intent of the requirements directly from the Council;
and a potential reduction in compliance costs by teaching
ISAs to develop security strategies before and beyond the
annual PCI-DSS validation.
http://www.scmagazineus.com/how-you-are-changing-
the-pci-standards-in-2010/article/170374/
International Organization of Supreme Audit In-
stitutions (INTOSAI) - a worldwide affiliation of gov-
ernmental entities. Its members are the Chief Financial
Controller/Comptroller General Offices of nations.
www.globaliia.org/standards-guidance / 22

Reliance by Internal Audit on Other Assurance Providers
International Standard on Assurance Engagements
(ISAE) 3402 –deals with assurance engagements un-
dertaken by a professional accountant in public practice
to provide a report for user entities and their auditors on
the controls at a service organization. The service is likely
to be relevant to user entities’ internal control as it relates
to financial reporting.
http://web.ifac.org/download/b014-2010-iaasb-hand-
book-isae-3402.pdf
Information technology–Security techniques–
Code of practice for information security manage-
ment (ISO/IEC 27002:2005) –– an information secu-
rity standard published by the International Organization
for Standardization (ISO) and the International Elec-
tro-technical Commission (IEC) originally as ISO/IEC
17799:2000. ISO/IEC 27002 provides best practice rec-
ommendations on information security management for
use by those responsible for initiating, implementing, or
maintaining Information Security Management Systems
(ISMS). The current standard is a revision of the version
first published by ISO/IEC in 2000, which was a word-
for-word copy of the British Standard (BS) 7799-1:1999.
Key Performance Indicators (KPIs) – KPIs are im-
portant measures of a business’s performance and prog-
ress toward goals (dictionary.com). They are metrics re-
lated to critical success factors.
Key Risk Indicator (KRI) – a measure used in manage-
ment to indicate how risky an activity is. According to The
Committee of Sponsoring Organizations of the Treadway
Commission’s (COSO’s) Guidance on Monitoring Inter-
nal Control Systems, key risk indicators are forward-look-
ing metrics that seek to identify potential problems, thus
enabling an organization to take timely action, if neces-
sary. Reprinted with permission from COSO, copyright
2004-2011. COSO. All rights reserved.
IPPF – Practice Guide
Macro Assurance – Pervasive themes can be highlight-
ed by comparing and trending common issues raised by
the compliance community. Planning principle-based
assessments performed by other assurance providers in
sequence with internal audit engagements to provide an
overarching macro-opinion across multiple entities or
processes.
Other Assurance Provider (internal/external fac-
ing) – Internal Other Assurance Providers are evaluators
who report to management and/or are part of manage-
ment (management assurance), including individuals
who perform control self-assessments, quality auditors,
environmental auditors, and other management-designat-
ed assurance personnel. External Other Assurance Pro-
viders are evaluators who report to external stakeholders
(external audit assurance), a role traditionally fulfilled by
the independent/statutory auditor.
U.S. Public Company Accounting Oversight Board
(PCAOB) – The PCAOB is a nonprofit corporation es-
tablished by the U.S. Congress in 2002 to oversee the
audits of public companies to protect the interests of in-
vestors and further the public interest in the preparation
of informative, accurate, and independent audit reports.
The PCAOB also oversees the audits of broker-dealer
compliance reports under federal securities laws.
http://pcaobus.org/Pages/default.aspx
Payment Card Industry Data Security Standard
(PCI-DSS) – created by the leading credit card compa-
nies to ensure customer data is safeguarded.
Payment Card Industry Security Standards Council
(PCI SSC) – offers robust and comprehensive standards
and supporting materials to enhance payment card data
security. These materials include a framework of speci-
fications, tools, measurements and support resources to
www.globaliia.org/standards-guidance / 23

Reliance by Internal Audit on Other Assurance Providers
help organizations ensure the safe handling of cardholder
information at every step. The keystone is the PCI-DSS,
which provides an actionable framework for developing a
robust payment card data security process — including
prevention, detection, and appropriate reaction to secu-
rity incidents.
https://www.pcisecuritystandards.org/security_standards/
index.php
Penetration Testing – A penetration test is a method of
evaluating the security of a computer system or network
by simulating an attack from a malicious source. The
process involves an active analysis of the system for any
potential vulnerability that could result from poor or im-
proper system configuration, from known and unknown
hardware or software flaws, or operational weaknesses
in process or technical countermeasures. The intent of
a penetration test is to determine the feasibility of an at-
tack and the amount of business impact of a successful
exploit, if discovered.
Qualified Security Assessor (QSA) – The Payment
Card Industry (PCI) QSA designation is conferred by
the PCI Security Standards Council to those individu-
als that meet specific information security education re-
quirements, have taken the appropriate training from the
PCI Security Standards Council, are employees of an Ap-
proved PCI Security and Auditing Firm, and will be per-
forming PCI compliance assessments as they relate to the
protection of credit card data. The term QSA also may be
implied to identify an individual qualified to perform PCI
compliance auditing and consulting. The primary goal of
an individual with the PCI QSA certification is to per-
form an assessment of a firm that handles credit card data
against the high-level control objectives of the PCI Data
Security Standard (PCI-DSS).
Reliance – confident or trustful dependence (dictionary.
com).
IPPF – Practice Guide
Statement of Auditing Standards No. 70 (SAS
70) – SAS 70 is an internationally recognized auditing
standard developed by the American Institute of Certi-
fied Public Accountants (AICPA). SAS 70 demonstrates
that data centers have adequate controls and safeguards
in place to host or process data related to their customer
base. SAS 70 is not a certificate, but an opinion on the
nature of those controls.
http://www.c7dc.com/articles/sas-70-faq.htm.
Self-reported Issues – This practice empowers man-
agement to raise issues and track remediation to advance
corrective action. Auditors gain comfort when manage-
ment promptly address root causes related to the self-
reported issues.
Service Provider – any company that provides the fol-
lowing services to another organization: executes and
maintains accountability of transactions, records transac-
tions and processes information, and impacts the client’s
financial reporting. Typical service companies include
application service providers, claims processors, clear-
inghouses, credit processing companies, and data center
hosting facilities.
http://www.c7dc.com/articles/sas-70-faq.htm
Statement on Standards for Attestation Engage-
ments (SSAE) No. 16 – In April 2010 the AICPA Au-
diting Standards Board (ASB) issued SSAE 16, Reporting
on Controls at a Service Organization. The SSAEs also
are known as attestation standards. SSAE 16 is applicable
when an entity outsources a business task or function to
another entity (usually one that specializes in that task or
function) and the data resulting from that task or function
is incorporated in the outsourcer’s financial statements.
In SSAE 16 an entity that performs a specialized task or
function for other entities is known as a service organiza-
tion and an entity that outsources the task or function to
www.globaliia.org/standards-guidance / 24
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

a service organization is known as a user entity.

http://www.aicpa.org/InterestAreas/Accountin-
gAndAuditing/Resources/SOC/DownloadableDocu-
ments/QAs_Serv_Orgs_Apr_26_2010.pdf

User Entity (Client Organization) – an entity that

outsources a business task or function to another entity
(usually one that specializes in that task or function) and
the data resulting from that task or function is incorpo-
rated in the outsourcer’s financial statements. In SSAE
16 an entity that performs a specialized task or function
for other entities is known as a service organization and
an entity that outsources the task or function to a service
organization is known as a user entity.
http://www.aicpa.org/InterestAreas/Accountin-
gAndAuditing/Resources/SOC/DownloadableDocu-
ments/QAs_Serv_Orgs_Apr_26_2010.pdf

Vulnerability Management – the cyclical practice of

identifying, classifying, remediating, and mitigating vul-
nerabilities. This practice generally refers to software vul-
nerabilities in computing systems.

www.globaliia.org/standards-guidance / 25
 IPPF – Practice Guide
Reliance by Internal Audit on Other Assurance Providers

Authors:
Bradley C. Ames, CPA, CISA

Ken Askelson, CPA, CITP, CIA

Hussain T. Hasan, CISSP, CISM, CGEIT, PCI-QSA

David Strealy, CIA

David Williams, CISA

Reviewers and Contributors

Gary E. Eymer, CIA

Carrie Gilstrap, CISA

Mark Harrison

Steve Hunt, CIA

Steve Jameson, CIA, CCSA, CFSA, CRMA

Donald E. Sparks, CIA, CISA

Steven Stein, CIA, PMP, CISA, CISSP, CFE, CGEIT

www.globaliia.org/standards-guidance / 26
About the Institute
Established in 1941, The Institute of Internal
Auditors (IIA) is an international professional
association with global headquarters in Altamonte
Springs, Fla., USA. The IIA is the internal audit
profession’s global voice, recognized authority,
acknowledged leader, chief advocate, and princi-
pal educator.
About Practice Guides
Practice Guides provide detailed guidance for
conducting internal audit activities. They include
detailed processes and procedures, such as tools
and techniques, programs, and step-by-step ap-
proaches, as well as examples of deliverables.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category of
guidance, compliance is not mandatory, but it is
strongly recommended, and the guidance is en-
dorsed by The IIA through formal review and ap-
proval processes. For other authoritative guidance
materials provided by The IIA, please visit our
website at www.globaliia.org/standards-guidance.
Disclaimer
The IIA publishes this document for informa-
tional and educational purposes. This guidance
material is not intended to provide definitive an-
swers to specific individual circumstances and as
such is only intended to be used as a guide. The
IIA recommends that you always seek indepen-
dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
anyone placing sole reliance on this guidance.
Copyright
Copyright ® 2011 The Institute of Internal
Auditors. For permission to reproduce, please
contact The IIA at guidance@theiia.org.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.theiia.org
 – Practice Guide

Selecting, Using, and

Creating Maturity Models:
A Tool for Assurance and
Consulting Engagements

July 2013
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Table of Contents

Executive Summary.................................................................................. 1

Introduction................................................................................................ 2

Example of Maturity Model Use by Internal Auditors...................... 3

Selecting Maturity Models..................................................................... 4

Building and Using Maturity Models.................................................... 5

A Commonly Accepted Internal Control Environment

Maturity Model........................................................................................ 11

Key Points for Review............................................................................ 13

Maturity Model Examples..................................................................... 14

Additional Resources............................................................................. 26

About the Authors and Reviewers....................................................... 27

www.globaliia.org/standards-guidance
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
Executive Summary
Maturity models establish a systematic basis of measure-
ment for describing the “as is” state of a process. A pro-
cess’s maturity can then be compared to management’s
expectations or contrasted with the maturity of other sim-
ilar processes for benchmarking purposes. Insights also
can be derived from the model for determining improve-
ment options that help a process to satisfy its intended
objectives over time.
A maturity model describes process components that are
believed to lead to better outputs and better outcomes. A
low level of maturity implies a lower probability of success
in consistently meeting an objective while a higher level of
maturity implies a higher probability of success. The or-
ganization’s risk tolerance should be considered when de-
termining the level of maturity that management expects
to have in place.
1 / www.globaliia.org/standards-guidance
Auditors may want to use maturity models as criteria to as-
sess business processes as part of assurance engagements,
thus providing an easy-to-communicate understanding of
the governance, risk, or control environment under review.
In the absence of defined criteria for a process, the audi-
tor can work with management to define adequate criteria
using a maturity model.
This practice guide provides guidance on the uses of ma-
turity models, identifies considerations for their selection,
and provides instructions on how to build them. Care
must be taken to appropriately apply maturity models in
assurance or consulting engagements, including validat-
ing their applicability to the process under review. Com-
ponents of existing maturity models are provided for use
“as is” or as the foundation for a model tailored specifically
to an organization’s process.
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Introduction consistent, or it may not be strategically important enough

to invest in certain processes to consistently achieve level 5.
Organizations may use a maturity model to describe their
developmental state or their processes in relation to estab- Maturity models when appropriately designed provide:
lished expectations of control and management. The clas- • A framework for envisioning the future, the desired
sification mechanisms within a maturity model can help state, and the development of improvement plans.
organizations simplify the determination of when control
• Benchmarks for the organization to compare its pro-
and process management is acceptable, or alternatively to
cesses internally or externally.
identify the actions necessary to improve the maturity of
the organization or process. • A mechanism to provide insight into the improve-
ment path from an immature to a mature process.
Outcome metrics (e.g., financial return, program compli- • A disciplined method that comparatively is easy to
ance, sales, and customer satisfaction) provide in many understand and implement.
cases the ultimate criteria for measuring the success of a
As suggested by the word ”maturity,” an organization’s gov-
process. However, management and auditors may want to
ernance, risk, and control processes evolve over time and
understand how well the processes leading to those out-
may move up or down the maturity scale (the 0 to 5 scale
comes are designed and functioning. Unfortunately, an
noted previously). Standard 2210.A3 of the International
assessment of the adequacy of efforts to achieve a given
Standards for the Professional Practice of Internal Auditing
set of outcomes can be difficult to develop given the many
(Standards) is important for auditors to understand and
variables that drive business performance. An appropri-
apply when using maturity models. It states:
ately constructed maturity model can make such an as-
sessment more consistent and repeatable.
“Adequate criteria are needed to evaluate governance,
risk management, and controls. Internal auditors must
The concept for maturity models grew out of total qual-
ascertain the extent to which management and/or the
ity management programs, which emphasized continuous
board has established adequate criteria to determine
improvement. One of the most well known models is the
whether objectives and goals have been accomplished.
Capability Maturity Model (CMM) developed by Carnegie
If adequate, internal auditors must use such criteria in
Mellon University to help improve software development.
their evaluation. If inadequate, internal auditors must
work with management and/or the board to develop ap-
While many variations of maturity models exist, all models
propriate evaluation criteria.”
generally have levels from 0 to 5 that describe an organiza-
tion, management process, control set, or other element
When using or developing maturity models, the auditor
of an organization’s operations (i.e., they describe inputs
should determine whether “management and/or the board
or processes believed to lead to better execution and im-
has established adequate criteria” in the selection and ap-
proved consistency of outcomes). Level 0 is usually some
plication of the model. This practice guide expands on
variation of nonexistent or ad hoc execution while level 5
this concept in subsequent sections. Generally, however,
is usually considered a high maturity, sustainable, and/or
consider the following two points:
optimized process. Level 5 may not be an organization’s
goal, as the cost to achieve level 5 may at times exceed the
benefits. In other words, management’s risk tolerance may
be high enough to allow for the process to be less exact or

www.globaliia.org/standards-guidance / 2
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

• An auditor planning to use a maturity model in an as- sary to achieve a desired business outcome. How-
surance engagement should first consider whether the ever, an auditor — after understanding the model
model is fit for purpose.1 Assuming the model is used and its design — may not agree with a management
correctly, is its predictive ability relevant to the busi- position that a level 1 process is acceptable for the
ness objective being measured? For instance, a matu- objective of meeting customer needs.
rity model that assesses compliance elements would
not be appropriate to provide a perspective on how
well an operational business objective is managed.
Example of Maturity Model
• An auditor planning to use a maturity model in an Use by Internal Auditors
assurance engagement should independently deter-
Assume that an organization has just established a com-
mine what “maturity level” of the model is adequate
munity investment group to make donations to charities
to meet an objective. For instance, level 5 of a cus-
and other worthwhile causes. The organization expects it
tomer satisfaction maturity model may not be neces-

Potential Implications by Reporting Methodology

Situation
Pass/Fail
Maturity Model Level
Satisfactory/Unsatisfactory
Reporting
Reporting
Organization Needs a Clear Opinion Provides a clear understanding of the auditor’s Unless stated explicitly, readers may not have
opinion. clarity on what is “good enough.” When is
achievement at a certain level acceptable
versus not acceptable?
Management Buy-in Is Important to Yes/no verdicts may be difficult to deliver. They may Focuses discussion on the level of consistent
Cultivate also be counterproductive in terms of the time to execution on a continuum — allowing for
share, negotiate, and confirm the pass/fail opinion discussion of continuous improvement options.
versus the time discussing the actual improvement
options.
Audit of a Complex or Undefined Harder to apply a clear pass/fail approach. Allows for plotting of distribution along a
Process continuum of process expectations.
Compliance Objective Provides a clear opinion on whether compliance is Given the expectation of meeting compliance
met. requirements, anything less than the highest
level of maturity could be misconstrued as a
concern.
Operational Objective More difficult for management and the auditor Allows management an easier role for
to identify the exact process deficiencies that communicating a level of expectation of
constitute a fail versus pass. maturity.
Aspirational/Continuous Improvement May be impossible to create useful pass/fail Allows for a maturity level that all processes can
Objective criteria, as all processes over time may succeed reach yet also includes higher potential levels of
or fail depending on the ease or difficulty of set maturity that drive aspirational performance.
expectations.

1 Pöppelbuß, Jens and Röglinger, Maximilian, “What Makes a Useful Maturity Model? A Framework of General Design Principles for Maturity Models and Its Demonstration in Business Process
Management” (2011).

3 / www.globaliia.org/standards-guidance

Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
will take two years to develop all the policies and proce-
dures necessary to perform as intended. The long-range
vision is for the community investment program to be rec-
ognized as one of the top 100 in the country. After per-
forming an audit planning risk assessment, the chief audit
executive (CAE) has included this subject in the annual
plan six months after the group has been formed.
Potential internal audit objectives could be to evaluate:
• Whether the community investment controls are
compliant with relevant laws and regulations.
• Whether an adequate strategic plan is in place to
identify and evaluate the impact of charities that are
provided donations.
Through the use of a maturity model, the audit function
could validate that current charity evaluation efforts are
adequate (hypothetically, adequate is level 3 maturity,
where an understanding and survey of charity outcomes
is in place) but recommend that a sustained level 4 be in
place (hypothetically, level 4 calls for proactive monitoring
of charity reporting and periodic management validation
of charity results).
This continuum of maturity would be in contrast to a pass/
fail or satisfactory/unsatisfactory rating process. The ma-
turity model lends itself to providing the criteria, the plot-
ting of the current condition, and the recommendation to
move to the next level if such a recommendation is war-
ranted. In the example, the model provides a great method
for assessing a process that is under development (in this
case, the community investment group).
The use of maturity models will not be the best evalua-
tion method for auditors to deploy in all cases. When de-
termining whether to use a maturity model, evaluate the
situations described below and consider the potential im-
plications of different evaluation and reporting methods.
IPPF – Practice Guide
Selecting Maturity Models
Management may have defined a maturity model for its
use within the organization. If so, the internal auditor
could adopt that model as a tool after carefully evaluating
the relevance and adequacy of the model to the assess-
ment or opinion being provided. Alternatively, there are
numerous maturity models available for use from industry
groups and associations. These models also must be as-
sessed as fit for purpose before use.
Maturity models involve a certain level of subjectivity;
therefore, caution is warranted when providing assurance
to management that a process is adequately controlled
based on an assessment driven by a maturity model. The
auditor should ensure the model is fit for purpose and
properly implemented. Models may be used to describe
the “as is” state of the process, provide prescriptive guide-
lines on improvement, or compare one process imple-
mentation to another.1
The use of a maturity model versus other audit tech-
niques and methodologies should not alter the level of
proficiency and due professional care auditors employ.
A maturity model should not be deployed as a checklist,
supplanting the auditor’s responsibility for independently
and objectively identifying unmitigated risk and the po-
tential inadequacy of control. The model should provide
a framework and guide for discussion of governance, risk,
and control maturity.
In selecting a maturity model, auditors should understand
the management objective and the appropriateness of the
model in supporting that management objective. Consid-
er the following:
• What is the desired management outcome? For
example, does management want to assess systems
development lifecycle success, sales process excel-
lence, or environmental safety? What quantitative
metrics or qualitative statements describe the desired
management outcome?
www.globaliia.org/standards-guidance / 4
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
• Is the model under consideration appropriate for
driving the management outcome? The model should
have been built by credible subject matter experts
either inside or outside the organization who un-
derstand the correlation between certain process
functions and the organization’s desired outcome.
The level of diligence in confirming the predictability
of the model will vary — from an internally devel-
oped model created by experienced business leaders
inside the organization to an externally developed
and researched model that considers experiences
across many organizations. Either approach could be
appropriate for a given situation.
The two key factors to control for in the selection of a
model are:
• Would following a model improve the probability
that the outcome would be achieved? Alterna-
tively, would the model encourage actions that are
counterproductive or focus management’s atten-
tion on process improvements that do not corre-
late to driving the desired outcome?
• Would management have a false sense of confi-
dence that the outcome would be achieved if an
assessment — using the model — shows a high
state of process maturity? Although following
the model and increasing a process’s maturity is
expected to improve the chances of a successful
outcome, there still may be substantial risk and
uncertainty that the outcome will be achieved.
Will use of the model provide the appropriate
level of confidence?
Disclose the source of the model. Auditors should disclose
in their report the source of the model, how the model
was constructed, who participated in the construction of
the model, and why the auditor — and management, as
appropriate — believes the selected model is valid for the
process and objective under review.
2 Pöppelbuß, Jens and Röglinger, Maximilian, “What Makes a Useful Maturity Model?
A Framework of General Design Principles for Maturity Models and Its Demonstration in
Business Process Management” (2011).
5 / www.globaliia.org/standards-guidance
Building and Using Maturity
Models
Auditors with the appropriate proficiency, or in conjunc-
tion with management or outside experts, can construct
models that are fit for purpose. Auditors who have limited
experience with maturity models or who want to explore
more detailed research into their design, should consider
reviewing the research paper, What Makes a Useful Ma-
turity Model?2
Building a model involves three steps:
1. Determine the purpose of the model and its
components.
2. Determine the scale.
3. Develop the expectations for each component level.
Using a maturity model involves these additional steps:
1. Set targets for each component.
2. Assess the level of maturity by component.
3. Consider what the model may have missed.
4. Report conclusions.
5. Revisit the model regularly.
For the purposes of this section, start by skimming
Example 3, Public Sector Internal Audit Capability
Maturity Model (see page 24) and then return here to
continue with the discussion on building a model.
Building a Maturity Model
Step 1 – Determine the purpose of the model and
its components.
The objective to be addressed should first be defined
in the same way as if the auditor were going to select a
model that was already built. Auditors should consider
these questions:

Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
• What does management want to assess (e.g., systems
development lifecycle success, sales process excel-
lence, or environmental safety)?
• What business processes are involved?
• Will the model be applied across many different
types of management processes to improve general
compliance, controls, or organizational governance?
• Is internal audit assessing an industry or company
specific set of tasks that require some degree of
specialized process knowledge, tools, techniques,
or skills?
• How can internal audit state the expected outcome
from the process in terms of metrics or a qualitative
statement?
With the objective in mind, the components that drive
that objective are then identified. This is the most impor-
tant part of the model’s development in that the auditor
is identifying the critical elements that — based on the
model builders’ judgment — will improve the probability
of achievement of the objective and outcome.
Auditors will want to document their plan for developing
the model — outlining the research and data gathering
techniques (such as facilitation of subject matter experts)
that help determine which components should be part of
the model. Auditors should consider the following when
selecting components:
• Will the component — if managed consistently —
improve the probability of achieving the outcome?
• If a component is not included, will that negatively
decrease the probability of achieving the outcome?
Use caution here to focus on including the critical few
components that deserve attention, improvement, and
consistent execution versus everything that manage-
ment could be doing to oversee the process.
• Can the model builder evaluate the correlation be-
tween the component and the desired outcome?
Is that correlation based on a study or research com-
IPPF – Practice Guide
paring processes with high and low maturity to the
outcomes across those processes? Alternatively, do
subject matter experts and experienced profession-
als — who could include management and auditors
— believe the component contributes to increas-
ing the probability of achieving the outcome? What
research, evidence, or subject matter expertise can
internal audit rely on in making this determination?
In the reference model — Example 3 — one component
is Professional Practices. One can assume the authors of
that model felt that a higher state of maturity in following
professional practices contributes to the desired outcome
of public sector internal audit functions. This component
apparently was part of the critical few areas that, if left out
or not consistently managed, would be detrimental to the
management objective. Finally, one can assume that re-
search shows a distinction between the level of outcomes
achieved by public sector internal audit functions with-
out high maturity in professional practices and those with
high maturity. That research might be quantitatively driv-
en through statistical correlation or qualitatively driven
through interviews with subject matter experts and CAEs
in the field.
The components will vary based on the management
objective. When compliance is the objective, specific
compliance controls, governance expectations, relevant
regulatory skill sets, and other elements may be important
components of the model. If assessment of the general
control environment is the objective, then basic segrega-
tion of duties, control mapping, and risk assessment con-
cepts may be important components. In an assessment of
an organization’s field sales offices, certain practices on
sales prospect tracking or market analysis may be consid-
ered key components.
Components are those categories of process attributes rel-
evant and necessary to meet — or to at least improve the
likelihood of meeting — the objective being assessed. Turn-
ing back to Example 3, the research study on public sector
internal audit capability found these components relevant:
www.globaliia.org/standards-guidance / 6
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
Services & Role of IA
People Management
Professional Practices
Performance Management & Accountability
Organizational Relationships & Culture
Governance Structures
Practitioners participating in The IIA’s research that cre-
ated model Example 3 determined that an assessment of
the capability of a public sector audit function needed to
consider these six components. These components are the
drivers of success or failure, capability building or capability
destruction, for the internal audit function under review.
Caution: Determining the components could range from an
exercise as simple as a single meeting to gather perspectives
from experienced subject matter experts in the organization
to an extensive fully funded empirical research study that
determines through statistical analysis across many processes
and organizations what components truly impact the desired
outcome under review. Auditors should be clear to assess the
level of predictability they want their model to have. In most
cases, a formal gathering of subject matter experts in the
organization may be adequate for the component selection
necessary to provide insights and improvements to the orga-
nization and some reasonable level of assurance regarding
furthering the process objective.
Step 2 – Determine the scale.
Once the components are identified, the auditor should
determine what scale will be used. The examples that are
shown in this practice guide use a level 0 or level 1 as
the base level going up to level 5 as the highest level of
maturity. Generally the lowest level is an absence of con-
trols and process discipline while level 5 is reserved only
for those very few processes that exhibit an optimized or
best practice execution. In the reference model, Example
7 / www.globaliia.org/standards-guidance
3, the Public Sector Internal Audit Capability Maturity
Model, five levels are used:
Level 5 – Optimizing
Level 4 – Managed
Level 3 – Integrated
Level 2 – Infrastructure
Level 1 – Initial
Caution: When developing the model, the auditor should
carefully consider the words used to title each level. “Best
Practice,” for instance, is a catch phrase that can be misap-
plied and cause confusion. Every level may not need to be
“Best Practice,” as that is beyond the risk tolerance needs of
the organization. The titles should help convey the achieve-
ment expected at each level.
Step 3 – Develop the expectations for each com-
ponent level.
The next step is to define the expectations regarding what
should be in place for a process to have met a given level for
each component being assessed. Example 1, Process Capa-
bility Maturity Model has six components that the model
developers felt are key to general process governance:
• Strategic Planning/Financial Management
• Customer/Stakeholder Expectations
• Risk
• Metrics
• Human Capital
• Process Management and Self-assessment
Using Customer/Stakeholder Expectations, one can re-
view the expectations set for each level. In this grid, each
level builds on the level before — meaning that to achieve
level 4 it is expected that requirements in levels 1-3 have
also been demonstrated.
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5

Reactive Repeatable Defined & Managed Sustained Optimized

Stakeholder Process decision- Key stakeholders are Stakeholder Stakeholder

expectations are making is based identified. feedback is feedback validates
identified or tracked on stakeholder collected via that the process
informally. expectations and Expectations for surveys, focus meets or exceeds
feedback. “critical to quality groups, and stakeholder
satisfaction” are innovative voice expectations.
Customer/ documented. of the customer
Stakeholder methodologies. Proactive initiatives
Expectations Process success are in place
in meeting Rework/mistakes to minimize or
expectations impacting eliminate rework/
and feedback is stakeholder mistakes.
monitored. expectations have
improvement
projects underway.

In this example, the model builders created a progres-
sively higher set of expectations culminating in level 5
Optimized — a process whose stakeholders confirm the
process meets their expectations and management has
proactive efforts to reduce mistakes. In this case, the
model builders built the model with the intention that all
processes should achieve level 3 while only critical pro-
cesses are expected to expend the effort to reach level 5.
To build out this component, the team that created the
model would have considered the range of options for
managing customer and stakeholder expectations and
then created the expectations within each level. Just as
with the determination of which components to use, the
actual requirements within a component may be deter-
mined through in-depth research or through facilitated
conversation with subject matter experts. A maturity
model focused on general processes, such as the one used
in this example, will generally be applicable to any pro-
cess. A maturity model focused on a specific industry or
function may require specific diligence and demonstrated
achievements regarding specialized people, process, and
technology.
Considerations during this step include:
• How well does each level build on the previous level?
• How well do the expectations in each level align to
the expectation to have a process meet a certain level
of maturity — say level 3 versus level 5?
• For the expectations in each box, will a process or
organization that achieves that requirement have a
reasonable chance of achieving the outcome envi-
sioned for that level — say being “Defined and Man-
aged” for level 3 or “Sustained” for level 4?
• Are the expectations for a given level consistent
across components? For instance, are the require-
ments for level 3 for this component — Customer/
Stakeholder Expectations — appropriately equivalent
to the level 3 requirements for Human Capital?
Caution: The same level of diligence that was applied in
determining what key components should exist in the model
should be applied when setting the expectations within each
level of the model. Determine the key requirements versus
everything that could be done.

www.globaliia.org/standards-guidance / 8
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

The auditor’s model should now resemble the model below with specific components and expectations by level inserted.
The auditor may have selected more components or a different number of levels for the model.

LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5

Expectations – Expectations – Expectations – Expectations – Expectations –

Component 1
Component 1 / Level 1 Component 1 / Level 2 Component 1 / Level 3 Component 1 / Level 4 Component 1 / Level 5

Expectations – Expectations – Expectations – Expectations – Expectations –

Component 2
Component 2 / Level 1 Component 2 / Level 2 Component 2 / Level 3 Component 2 / Level 4 Component 2 / Level 5

Expectations – Expectations – Expectations – Expectations – Expectations –

Component 3
Component 3 / Level 1 Component 3 / Level 2 Component 3 / Level 3 Component 3 / Level 4 Component 3 / Level 5

Using a Maturity Model
Step 4 – Set a target for each component.
Once the scale and components are defined, the next step
is to determine the organization’s target maturity level for
each component. Generally speaking, cost/benefit anal-
ysis shows that not all components of a process should
operate at the highest level of maturity. In conjunction
with the assessment of an organization’s risk appetite, the
target maturity for some components may be for instance
to a Level 3 or Level 4. The organization may not want to
expend the resources to move those components to a high
level of maturity and accepts the risk that the process’s
objectives have a higher probability of failure as a result.
Auditors should refer to The IIA’s Standards regarding risk
and communicating risk acceptance for further guidance.
Consider the following contrasting examples:
• Management has built a sales office maturity model
for assessing the process maturity of its 100 sales
offices. Management expects all sales offices to
achieve level 5 (optimized) over time, but allows
each office to prioritize what will be addressed first
across the components being assessed. However, any
component assessed at level 1 or 2 is considered a
red flag, requiring an immediate intervention plan by
regional leadership.
• The organization has adopted a general process gov-
ernance maturity model. All processes are expected
to evaluate their adherence to the model; however,
only level 3 achievement is expected for all processes.
Each management function determines which specif-
ic processes are critical to the organization, and thus
require a 4 or 5 level of maturity. Non-critical pro-
cesses may be specifically excluded from the require-
ment to “deploy the resources to reach the highest
state of maturity” as that would not be an optimized
allocation of resources across the organization.
Caution: Auditors should not assume that managers should
seek to obtain the highest level of maturity for all maturity
model components across all processes being assessed. These
may be too costly or risk adverse for the organization. The
goal of a model is to present the range of possibilities, assess
the current maturity of the process, and then set goals for
improvements where such improvements make sense and are
in alignment with organizational objectives.

9 / www.globaliia.org/standards-guidance

Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
Step 5 – Assess the level of maturity by
component.
Finally, the auditors assess the process itself through ob-
servation, inquiry, re-performance, and other appropriate
tests to validate the current maturity of the process. Most
models are built with the presumption that to achieve a
given level, all the requirements of that level and all lower
levels have been achieved. The task is no different than
any other audit, with the maturity model serving as the
criteria in the assessment.
One method of assessment an audit function could use
would be to have management of the process or function
under review conduct a self-assessment, including a col-
lection of any evidence of performance. The audit func-
tion would then validate that assessment.
Step 6 – Consider what the model may have
missed.
All maturity models are built on the research, understand-
ing, and perspectives gained from the evaluation of previ-
ous business process implementations — not an evalua-
tion of the current execution of the process under review.
Moreover, no model can consider all the circumstances
that may mitigate the risk that an outcome will not be
achieved. Care should be taken not to apply the model as
a simple checklist.
Auditors should always conduct their work in a way that
will allow for the identification of significant risks to the
organization’s objectives. Accordingly, use of a maturity
model does not preclude an auditor from the responsibil-
ity to consider for the specific process under review what
the model may be missing in terms of risk mitigation and
control guidance. Auditors must apply due professional
care in determining the level of analysis beyond just the
application of the model necessary to fulfill their engage-
ment scope. That scope should be documented as noted
in the next step.
IPPF – Practice Guide
Step 7 – Report on conclusions.
As noted previously, the basis for selection of the model as
well as details on how the model was designed should be
clearly disclosed in any reporting for which a model is the
basis of the assessment. The purpose of the model — that
on which the model is providing a perspective — should
be clear. If management has determined the level of ma-
turity that is considered adequate, the auditor should in-
dependently determine whether “management has estab-
lished adequate criteria” in the selection and application
of the model. (See Standard 2210.A3)
Auditors — and management — must be cautious how-
ever not to overstate the probability that a given level of
process maturity will achieve a specified outcome over
time. Any language that purports to guarantee or ensure
achievement of a specific outcome given that the process
has met a given state of maturity should be avoided.
Auditors should determine how the actual output met-
rics of the process under review should be provided in
the report and validated as appropriate. For instance, a
manufacturing process may be assessed at a high level of
maturity but customers continue to reject manufactured
parts. These facts may not invalidate the appropriateness
of the maturity model; however, reporting on simply the
model assessment — a high level of maturity — may be
misleading to a reader without the context of the actual
outcome metrics.
As noted in the previous step, auditors have an obliga-
tion to think outside the model — regardless of how well
constructed it may be — to consider whether the spe-
cific circumstances under review may lead to other gaps
in governance, risk, or control implementation. If that is
the case, the auditor should discuss such gaps in the re-
port. Alternatively, if the engagement scope was to simply
apply the model without any additional consideration of
unmitigated risks, that focused scope should be clearly
disclosed. Here is an example of such a disclosure.
www.globaliia.org/standards-guidance / 10
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

LEVEL 1 LEVEL 2 LEVEL 3 LEVEL 4 LEVEL 5

Expectations – Expectations – Expectations – Expectations – Expectations –
Component 1
Component 1 / Level 1 Component 1 / Level 2 Component 1 / Level 3 Component 1 / Level 4 Component 1 / Level 5
Expectations – Expectations – Expectations – Expectations – Expectations –
Component 2
Component 2 / Level 1 Component 2 / Level 2 Component 2 / Level 3 Component 2 / Level 4 Component 2 / Level 5
Expectations – Expectations – Expectations – Expectations – Expectations –
Component 3
Component 3 / Level 1 Component 3 / Level 2 Component 3 / Level 3 Component 3 / Level 4 Component 3 / Level 5

Purple Arrow = Target Level Orange Arrow = Current Level

“Our evaluation was limited to the application of the ma- ment of the model itself. Was the miss an indication that
turity model to x process. This maturity model was based changes in expectations in a given component at a given
on research conducted by x and enhanced using subject level should be considered to increase the probability of
matter experts identified by management. achieving the objective going forward?

We did not conduct additional analysis designed to iden-

tify additional unmitigated risks that could impact the
probability of the process achieving management’s objec-
tives. If we had conducted such additional analysis, other
gaps may have come to our attention.”
This model (above) shows two colors as an example of
one reporting scheme. One color represents the expect-
ed level of achievement while the other represents the
current level. Where gaps exist, the auditor will want to
work with management to develop recommendations for
improvement.
Step 8 – Revisit the model regularly.
A Commonly Accepted Internal
Control Environment Maturity
Model
Included on page 12 is the internal control environment
maturity model from COBIT 4.1 (Control Objectives
for Information Technology) released by ISACA3. While
ISACA has released subsequent versions of COBIT —
including COBIT 5 — this model still provides a useful
reference for considering the maturity of a control envi-
ronment.

After applying the model, internal audit will want to revisit
how each of the model elements (levels, components, and
expectations) when implemented appears to be achiev-
ing the desired process outcomes. Is the expectation to
achieve a certain level too high? Alternatively, does the
assessment seem too easy and not driving improvements
that raise the bar on expected process resiliency? Over
time, the auditor will want to understand any process
outcome misses and tie that learning into the improve-
ISACA’s development of the model in COBIT 4.1 involved
research of a variety of maturity models. Accordingly, in-
ternal auditors may use the model as a basis for their as-
sessment of the maturity of internal control structures or
development of their own maturity models. The model
uses just one component (Internal Control Environment)
and 6 levels ranging from nonexistent to optimized.

3 COBIT 4.1, 2007 © IT Governance Institute, Appendix 111, p. 186.

All rights reserved. Used with permission.

11 / www.globaliia.org/standards-guidance

Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements
CobIt 4.1
MATURITY LEVEL
0 – Nonexistent
1 – Initial/ad hoc
2 – Repeatable but intuitive
3 – Defined process
4 – Managed and measurable
5 – Optimized
IPPF – Practice Guide
STATUS OF THE INTERNAL CONTROL ENVIRONMENT
There is no recognition of the need for internal control. Control is not part of the organization’s culture
or mission. There is a high risk of control deficiencies and incidents.
There is some recognition of the need for internal control. The approach to risk and control
requirements is ad hoc and disorganized, without communication or monitoring. Deficiencies are not
identified. Employees are not aware of their responsibilities.
Controls are in place but are not documented. Their operation is dependent on knowledge and
motivation of individuals. Effectiveness is not adequately evaluated. Many control weaknesses exist
and are not adequately addressed; the impact can be severe. Management actions to resolve control
issues are not prioritized or consistent. Employees may not be aware of their responsibilities.
Controls are in place and are adequately documented. Operating effectiveness is evaluated
periodically and there are an average number of issues. However, the evaluation process is not
documented. Although management is able to deal predictably with most control issues, some control
weaknesses persist and impacts could still be severe. Employees are aware of their responsibilities
for control.
There is an effective internal control and risk management environment. A formal, documented
evaluation of controls occurs frequently. Many controls are automated and regularly reviewed.
Management is likely to detect most control issues, but not all issues are routinely identified. There is
consistent follow-up to address identified control weaknesses. A limited, tactical use of technology is
applied to automate controls.
An enterprisewide risk and control program provides continuous and effective control and risk issues
resolution. Internal control and risk management are integrated with enterprise practices, supported
with automated real-time monitoring with full accountability for control monitoring, risk management,
and compliance enforcement. Control evaluation is continuous, based on self-assessments and gap
and root cause analyses. Employees are proactively involved in control improvements.
www.globaliia.org/standards-guidance / 12
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Key Points For Review

Given the care that must be taken when applying maturity models, auditors should review these key points over the course
of an engagement.

Key Points for Review

An auditor planning to use a maturity model in an assurance engagement should first consider whether the model is fit for purpose.

An auditor planning to use a maturity model in an assurance engagement should independently determine what “maturity level” of the model is
adequate to meet an objective.

Maturity models involve a certain level of subjectivity; therefore, caution is warranted when providing assurance to management that a process is
adequately controlled based on an assessment driven by a maturity model. Ask yourself these questions when considering using a model.
• Would following a model improve the probability that the outcome would be achieved?
• Would management have a false sense of confidence that the outcome would be achieved if an assessment — using the model — shows a high
state of process maturity?

Auditors should disclose in their report the source of the model, how the model was constructed, who participated in the construction of the model,
and why the auditor — and management, as appropriate — believes the selected model is valid for the process and objective under review.

Auditors should clearly assess the level of predictability they want their model to have.

Auditors should not assume that managers should seek to obtain the highest level of maturity for all maturity model components across all processes
being assessed. These may be too costly or risk adverse for the organization.

Care should be taken not to apply the model as a simple checklist. Auditors should always conduct their work in a way that will allow for the
identification of significant risks to the organization’s objectives. Accordingly, use of a maturity model does not preclude an auditor from the
responsibility to consider for the specific process under review what the model may be missing in terms of risk mitigation and control guidance.

Auditors — and management — must be cautious not to overstate the probability that a given level of process maturity will achieve a specified
outcome over time. Any language that purports to guarantee or ensure achievement of a specific outcome given that the process has met a given
state of maturity should be avoided.

Auditors should determine how the actual output metrics of the process under review should be provided in the report and validated as appropriate.

After applying the model, internal audit will want to periodically revisit how each of the model elements (levels, components, and expectations)
appears to be achieving the desired process outcomes.

13 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Maturity Model Examples Example 1: Process Capability Maturity

The following three models are examples that auditors can
use as provided or leverage in the development of their
own maturity models. The example models each use six
components and five levels of maturity to address their
objectives:
Example 1: Fortune 100 Company Process Capability
Maturity Model
Example 2: Compliance and Ethics Program Maturity
Model
Example 3: Public Sector Internal Audit Capability
Maturity Model
Model
A Fortune 100 company took the concept of the maturity
model and tailored it to the organization’s environment
in the following example. The objective of the model is
to address the overall process capability maturity across
six process components: Strategic Planning/Financial
Management, Customer/Stakeholder Expectations, Risk,
Metrics, Human Capital, and Process Management/Self-
assessment). This framework has been successfully ap-
plied for both high-level process reviews and detailed sub-
process reviews. The model was constructed using input
from experienced audit professionals as well as members
of an internal process consortium.
Management sets a target for each component (level 1
to level 5) and conducts a self-assessment. The internal
audit function then independently audits the process and
opines on the level of maturity. Management and internal
audit agree on the artifacts that demonstrate each level of
maturity.

Level 1 Level 2 Level 3 Level 4 Level 5

Reactive Repeatable Defined & Managed Sustained Optimized

Notes Suggested Minimal ROI hurdle rate

Target Level does not justify all
processes achieving
this level.

General • Process is not • Process is more • Process is fully • Management decision- • Perfect service levels
Description formalized. formalized defined and executed making and continuous are achieved.
• Inconsistent (documented). consistently. improvement projects • Independently verified
execution. • Repeatable execution. • Adequate metrics are are based on data, as best in class.
defined to allow for metrics, and formal
• Management quality assurance/self- • Innovative ideas and
understands overall quality assurance/ techniques are piloted
self-assessment assessment feedback.
process. on an ongoing basis.
capabilities.

www.globaliia.org/standards-guidance / 14
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Process Capability Maturity Model

Level 1 Level 2 Level 3 Level 4 Level 5

Reactive Repeatable Defined & Managed Sustained Optimized

Strategic • Initiatives are • Initiatives are re- • Business unit/ • Strategic planning • 1-3 year strategic
Planning/ identified and evaluated annually. department/ process supports corporate planning initiatives
Financial tasks assigned. • Project milestones are strategic planning strategic plan in terms consistently meet
Management monitored. includes 1-3 year of customer growth, their milestone goals.
initiatives based segment profit margin, • Financial and
• Resources are on stakeholder competitive advantage
allocated and tracked. stakeholder
expectations. and strategic intent expectations are met.
• Financial, process, fulfillment.
• The strategic
human resource, and • Prioritization of plan incorporates
risk management resources and alternatives and
elements are included initiatives is based on options for long-term
in the planning. ROI or governance/ (3-6 year) industry
compliance and regulatory
requirements. changes.

Customer/ • Stakeholder • Process decision- • Key stakeholders are • Stakeholder feedback • Stakeholder feedback
Stakeholder expectations making is based identified. is collected via validates that the
Expectations are identified or on stakeholder • Expectations critical surveys, focus groups, process meets or
tracked informally. expectations and to quality satisfaction and innovative voice exceeds stakeholder
feedback. are documented. of the customer expectations.
methodologies. • Proactive initiatives
• Process success in
meeting expectations • Rework/mistakes are in place to
and feedback is impacting stakeholder minimize or eliminate
monitored. expectations have rework/mistakes.
improvement projects
underway.

Risk • Limited or no • At least annually, a • A comprehensive risk • Management formally • Resource allocation
risk assessment review of process assessment process is articulates risk ROI incorporates risk
occurring. risks is performed. developed that covers tolerance. assessment into the
• Risk is considered strategic, financial, • Specific mitigation prioritization process.
in project plans and compliance, and plans are implemented • Risks are mitigated
initiatives. operational risks. based on the below the risk
• Potential risk hazards assessment and cost/ tolerance goals set by
or opportunities are benefit analysis. management.
formally evaluated for • The risk assessment
likelihood and impact. is reviewed and
updated as appropriate
throughout the year.

15 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Level 1 Level 2 Level 3 Level 4 Level 5

Reactive Repeatable Defined & Managed Sustained Optimized

Metrics • Few or no metrics • Key metrics are • Key metrics with
are identified, identified and target performance
tracked, or measurement indicators are
reported. elements are identified for financial,
accurate. compliance, strategic,
• Methods are in place operational, human
to track and report resources, and
to management on a stakeholder attributes
continuous basis. (balanced scorecard).
• Measurement of
actual performance
to target metrics
is accurate and
communicated to
management and
associates.
• Key metrics, targets, • Key metric targets are
and measurement reached consistently
systems are re- for all areas.
evaluated and validated • Proactive activities
continuously for process are implemented so
changes, resource gaps are not incurred
changes, and corporate between actual and
strategy initiatives. target.
• Specific improvement
initiatives are developed
and prioritized for
metrics not meeting
performance goals.

Human Capital • A resource • The development • A formalized resource • Target metrics on • Key metric targets are
development process is formalized development workforce efficiency reached consistently
process does and documented process is executed and effectiveness for all areas.
not exist or is for all levels of consistently. are identified and • Proactive activities
informal. associates. • A formalized training measurement methods are implemented so
• A resource • Role descriptions program for all levels are in place for actual gaps are not incurred
training process and expectations is established and its results. between actual and
does not exist or are documented and completion is tracked. • Continuous target.
is informal. communicated. • A formalized improvement projects
• Training programs are succession plan and are initiated for
implemented. recruiting plan are in gaps between actual
place. performance and
targeted metric.
• Compensation
correlates to
documented
performance
management
expectations and
contributions.

www.globaliia.org/standards-guidance / 16
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Process Capability Maturity Model

Level 1 Level 2 Level 3 Level 4 Level 5

Reactive Repeatable Defined & Managed Sustained Optimized

Process • Processes and • Policies, high-level • Documentation • Key controls and control • Process
Management procedures are procedure documents, is maintained, execution standards documentation
and Self- not documented and basic templates communicated, and are tracked for current and controls
assessment or known exist that drive accurate. and new processes/ are proactively
informally. repeatable processes. • Standard evidence is products. developed and
• Controls are identified available, including • Formal quality validated before new
and noted in the a process control assurance through systems, products, or
documentation. management system, self-assessment is initiatives.
process narratives, executed regularly for • Proactive initiatives
and process flows. key processes. are taken based
• Documentation is • Record retention upon gaps identified
readily available for policies are in place through self-
outside audit without and monitored. assessments.
advance notice.

17 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Example 2: Compliance and Ethics Program Maturity Model

This is adapted from a model published by The IIA’s Research Foundation (IIARF) that applies to an organization’s
compliance and ethics program.

Compliance and Ethics Program Maturity Attributes4

Attribute Initial Repeatable Defined Mature World Class

1. Code of Ethics • There is no formally • A code of ethics has • A comprehensive • The code of ethics • Specific compliance
documented code of been developed, code of ethics is reviewed as and ethics policies
How effectively ethics. but it may not be exists, was approved appropriate by are in place to
does the comprehensive or by the board, and outside legal support and provide
code outline • In general, there
are no other means current. is reviewed every counsel to ensure additional guidance
management’s two to three years it remains current on key components of
expectations of communicating • Experienced
management’s employees generally to determine what and appropriate. the code.
regarding ethical updates are needed. • The code of
conduct? expectations understand • Periodic focus groups
regarding ethical management’s • All employees must ethics is reviewed and/or surveys are
conduct. expectations sign off annually annually and conducted with
regarding ethical that they are in updated as a representative
conduct, but new compliance with the necessary. sample of employees
employees may not code of ethics. • All employees must to assess their
have any way of • New employees complete annual understanding
determining those must sign a questionnaires of the code of
expectations. document asserting that ask more ethics and their
that they have read probing questions perceptions on the
and understand the regarding level of compliance
code. compliance with throughout the
the code of ethics. organization.

4 Adapted from the IIA Research Foundation. Internal Auditing: Assurance & Consulting Services. Altamonte Springs, Fla.: IIARF, 2009.

www.globaliia.org/standards-guidance / 18
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Compliance and Ethics Program Maturity Model

Compliance and Ethics Program Maturity Attributes4

Attribute Initial Repeatable Defined Mature World Class

2. Culture and • The organization • There are perceptions • The perception • Compliance and • Periodic surveys or
Consistency seems indifferent that compliance and is that senior ethics are topics focus groups are
to compliance and ethics are important. management takes at organization conducted to assess
How does the ethics. compliance and and department- the perception of
organization • The program was
• The program was developed to address ethics seriously and level meetings, the compliance and
perceive “walks the talk.” ensuring a ethics culture and
management’s developed by very few legal ramifications of
individuals with no noncompliance. • The program was consistent cultural make adjustments
commitment to message. when needed.
compliance? outside input. • Discipline is generally developed with
• There are perceptions left to the discretion input from legal, • The program was • Periodic input
of disciplinary of business and human resources, developed with is solicited from
inconsistencies and department and internal audit. input from various employees to help
“playing favorites.” managers and, as • Human resources is employee groups. improve the program.
• People are promoted such, is not always consulted to make • Disciplinary • Disciplinary actions
without formal consistent. sure disciplinary decisions involve are reviewed by an
consideration of • Although ethical actions are an appropriate independent group
ethical conduct. conduct seems to appropriate and mix of human (e.g., internal audit)
be considered, it’s compliant with resources, legal, to support the
• Events of regulations. and compliance consistency of such
noncompliance are not a part of job
descriptions. • Job descriptions personnel actions.
typically learned from to ensure
complaints versus • Events of non- include expectations • People are recognized
for ethical conduct. appropriateness for demonstrating
monitoring or audit compliance are and consistency.
activities. generally reported • Many employees ethical conduct.
timely, but there raise compliance • Job descriptions • Some
are few efforts questions before and interviews employees make
to report events they become a formally cover recommendations
before they become problem. ethical conduct. for improving the
noncompliant. • Employees feel compliance program.
empowered to
raise questions
about compliance
matters.

4 Adapted from the IIA Research Foundation. Internal Auditing: Assurance & Consulting Services. Altamonte Springs, Fla.: IIARF, 2009.

19 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Compliance and Ethics Program Maturity Attributes4

Attribute Initial Repeatable Defined Mature World Class

3. Awareness • Employees are • Employees are • There is widespread • Annual training • Communications
generally aware that aware the program employee awareness reinforces the occur regularly
How aware the program exists exists, went through of the program. program, with to remind/
are employees but are not sure how training once, and individual modules update employees
and outside • All employees went
to get information. intuitively know some through training in delivered in more on program
stakeholders of of the requirements depth. expectations.
the compliance • Employees aren’t the last three years.
familiar with specific contained in the • Employees know • The program is
and ethics program. • Employees know
program and its requirements. who the chief which individuals part of external
requirements? • Employees don’t know • Employees know who compliance officer are responsible sustainability
who manages the the chief compliance and the compliance for key compliance reporting conducted
compliance and ethics officer is, but not managers are. areas. annually.
program. others involved • Compliance with
in managing the • Stakeholders are
• Stakeholders know aware a program the program
compliance and and ethical
nothing about the ethics program. exists and can find
program. references on the expectations are
• Stakeholders assume company’s website. covered in the
a program exists but contracts with
don’t know anything vendors.
about it.

www.globaliia.org/standards-guidance / 20
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Compliance and Ethics Program Maturity Model

Compliance and Ethics Program Maturity Attributes4

Attribute Initial Repeatable Defined Mature World Class

4. S tructure and • There is no formal • A compliance • A compliance and • Reporting by • An integrated

Accountability compliance and ethics officer has been ethics structure has compliance area monitoring plan has
program structure. designated, but the been established, officers to the been implemented
How effective responsibilities of the with accountability chief compliance that involves the
is the structure • Independent oversight
is nonexistent or position are not well- assigned to officers officer is timely chief compliance
for managing developed. responsible for and consistent. officer, compliance
the program ad hoc.
• Oversight and compliance areas. • The applicable area officers, and
and enforcing • Accountability is not internal audit.
accountability? defined. monitoring are • Oversight is defined board committee
inconsistent and from a senior receives quarterly • Sensitive or
• Investigations are reactionary. management and updates on significant
ad hoc. board perspective. compliance and investigations
• Accountability is
• Compliance risks are broadly understood, • Monitoring is ethics matters. are conducted in
not understood. but not formally established, • Internal audit has accordance with
documented. including internal a consistent plan the protocol by
audit and others. for auditing all individuals trained
• Investigations are in forensic and
typically conducted • There is a focal compliance risks.
investigation
by the appropriate point for determining • A formal techniques.
personnel. who should conduct investigation
investigations. protocol exists • Compliance risk
• Compliance risks are scenarios have been
generally understood • Compliance risks that outlines
appropriate identified, assessed,
but not formally and scenarios are and mapped to
documented. documented. resources to
use (internal compliance controls,
vs. external), and are updated at
documentation least annually.
requirements, and
how investigations
are closed.
• A formal
compliance risk
assessment has
been completed.

4 Adapted from the IIA Research Foundation. Internal Auditing: Assurance & Consulting Services. Altamonte Springs, Fla.: IIARF, 2009.

21 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Compliance and Ethics Program Maturity Attributes4

Attribute Initial Repeatable Defined Mature World Class

5. Process • There are no formal • There are some • Compliance and • Compliance and • The company has
Automation compliance and compliance and ethics controls and ethics controls established an
and ethics controls and ethics controls procedures are well and procedures integrated GRC
Integration procedures, although and procedures, documented and are an integral program that ensures
many employees know but they are not standardized across part of business compliance risks
How effectively intuitively how to act. consistent across the organization. processes. are managed to be
are compliance the organization nor consistent with the
and ethics controls • There is no formal • Compliance and • Many compliance
protocol for employees formally documented. ethics controls and and ethics organization’s risk
and processes appetite.
standardized, or outsiders to report • There is limited procedures are controls address
integrated, and suspected events of testing of the controls tested periodically key compliance • Event management
automated? non-compliance. and procedures in to identify gaps or risks as part of a software is used to
• Information/data place. weaknesses. governance, risk, ensure all key data
related to compliance • Employees generally • An external hotline and compliance is gathered and
and ethics is not understand that they is in place through (GRC) view of the the resolution of
available. can contact legal or which employees or program. events is completely
human resources if outsiders can report • There are multiple and consistently
they suspect an event suspected events of avenues through documented.
of noncompliance. non-compliance. which employees • GRC software is used
• Information/data • Some compliance or outsiders can to provide integrated
related to compliance and ethics controls report suspected information on the
and ethics events is are integrated with events of program.
difficult to compile. other business noncompliance, • Integrated technology
processes and and all follow a routines are run
automated to the consistent protocol regularly to prevent
extent supported by for gathering or detect timely
existing systems. information on potential compliance
the event and and ethics events.
• Some standard escalating it.
reports are
prepared related • A consistent test
to compliance and plan is used to
ethics events. ensure compliance
and ethics controls
and procedures
operate effectively.
• Technology is
used to aid in the
identification and
investigation of
compliance and
ethics events.

www.globaliia.org/standards-guidance / 22
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Compliance and Ethics Program Maturity Model

Compliance and Ethics Program Maturity Attributes4

Attribute Initial Repeatable Defined Mature World Class

6. Goals and • No formal goals or • Although goals and • Broad compliance • Specific • All employees have
Metrics metrics exist or are metrics are not and ethics goals compliance and individual compliance
contemplated. formalized, employees are established and ethics goals are and ethics goals.
How is success generally understand communicated. integrated into
of the compliance • Metrics are
that the absence • Broad metrics the annual goal integrated into the
and ethics of compliance setting process for
program exist to measure overall performance
and ethics events the nature and each compliance measurement
measured? is indicative of a area.
frequency of process.
successful program. compliance and • Metrics are
ethics events. established for
each compliance
area.

4 Adapted from the IIA Research Foundation. Internal Auditing: Assurance & Consulting Services. Altamonte Springs, Fla.: IIARF, 2009.

23 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Example 3: Public Sector Internal Audit Capability Maturity Model

In addition to applying the maturity model to different processes within the organization, internal audit also can perform
an assessment of its own processes by tailoring the maturity model framework. The example below is adapted from a
model published from The IIARF, which was built for assessing public sector internal audit departments but can easily be
adapted and applied to all sectors.

Internal Audit Capability Model Matrix5

Performance Organizational
Services & People Professional Governance
Management & Relationships &
Role of IA Management Practices Structures
Accountability Culture

Level 5 – • Internal audit • Leadership • Continuous • Public reporting • Effective • Independence,

Optimizing is recognized involvement with improvement of internal audit and ongoing power, and
as key agent of professional in professional effectiveness. relationships. authority of the
change. bodies. practices. internal audit
• Workforce • Strategic activity.
projection. internal audit
planning.
Level 4 – • Overall • Internal audit • Audit strategy • Integration of • CAE advises • Independent
Managed assurance on contributes to leverages qualitative and and influences oversight of the
governance, management organization’s quantitative top-level internal audit
risk development. management performance management. activity.
management, • Internal audit of risk. measures. • CAE reports
and control. actively supports to top-level
professional authority.
bodies.
• Workforce
planning.
Level 3 – • Advisory • Team building and • Quality • Performance • Coordination • Management
Integrated services. competency. management measures. with other review oversight of the
• Performance • Professionally framework. • Cost information. groups. internal audit
and value-for- qualified staff. • Risk-based • Integral activity.
• Internal audit
money audits. • Workforce audit plans. management component of • Funding
coordination. reports. management mechanisms.
team.

5 Adapted from the IIA Research Foundation. Internal Audit Capability Model (IA-CM) For the Public Sector. Altamonte Springs, Fla.: IIARF, 2009.

www.globaliia.org/standards-guidance / 24
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Public Sector Internal Audit Capability Maturity Model

Internal Audit Capability Model Matrix5

Performance Organizational
Services & People Professional Governance
Management & Relationships &
Role of IA Management Practices Structures
Accountability Culture

Level 2 – • Compliance • Individual • Professional • Internal audit • Managing within • Full access to the
Infrastructure auditing. professional practices operating budget. the internal audit organization’s
development. and process • Internal audit activity. information,
• Skilled people are framework. business plan. assets, and
identified and • Audit plan people.
recruited. is based on • Reporting
management relationships
and established.
stakeholder
priorities.
Level 1 – Initial • Ad hoc and unstructured; isolated single audits or reviews of documents and transactions for accuracy and compliance; outputs
dependent upon the skills of specific individuals holding the position; no specific professional practices established other than
those provided by professional associations; funding approved by management, as needed; absence of infrastructure; auditors
likely part of a larger organizational unit; no established capabilities; therefore, no specific key process areas.

5 Adapted from the IIA Research Foundation. Internal Audit Capability Model (IA-CM) For the Public Sector. Altamonte Springs, Fla.: IIARF, 2009.

25 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

Additional Resources For further in-depth analysis of maturity models, review

the paper titled: What Makes a Useful Maturity Model?
A Framework of General Design Principles for Maturity
Internal auditors may refer to other maturity models for Models and Its Demonstration in Business Process.
insights when developing their own models. The following
are a few examples. Jens Pöppelbuß, European Research Center for Infor-
mation Systems, University of Münster, Maximilian
IIA Path to Quality Model (PTQM) — The PTQM pro- Röglinger, FIM Research Center, University of Augsburg.
vides a framework for the CAE to assess the current state
of the internal audit activity’s quality capability, target an
appropriate level of quality capability for the activity, and
present the steps along a path for the audit activity to
reach its quality capability target. Categories consist of:
Beginning (1), Emerging (2), Conforming (3), Leveraging
(4), Leading (5).

RIMS Risk Maturity Model is a tool for executives in risk

management and others charged with risk management
responsibilities to develop sustainable enterprise risk man-
agement programs. Levels include: Ad Hoc (1), Initial (2),
Repeatable (3), Managed (4), and Leadership (5).

Software Engineering Institute (SEI) Capability Matu-

rity Models (CMM), an analytical adaptation of maturity
modeling for software engineering processes, people ca-
pability, process integration and other uses. Categories
consist of: Initial (1), Managed (2), Defined (3), Quanti-
tatively Managed (4), and Optimizing (5).

The International Standards Organization (ISO) and the

International Electrotechnical Commission (IEC) have
developed the ISO/IEC 15504, which is the reference
model for the maturity models (consisting of capability
levels that in turn consist of the process attributes and
further consist of generic practices) against which the
assessors can place the evidence they collect during their
assessment, so the assessors can give an overall deter-
mination of the organization’s capabilities for delivering
products (software, systems, IT services). The six levels
include: Incomplete (0), Performed (1), Managed (2),
Established (3), Predictable (4) and Optimizing (5).

www.globaliia.org/standards-guidance / 26
IPPF – Practice Guide
Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements

About the Authors

and Reviewers
Author:
James Rose, CIA, CRMA, CPA

Reviewers:
Maria E. Mendes, CIA, CCSA
Steven Jameson, CIA, CCSA, CFSA, CRMA

27 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2013 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

global headquarters T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

130513
Talent Management
Recruiting, Developing, Motivating, and
Retaining Great Team Members
 Practice Guide / Talent Management

Table of Contents

Executive Summary ........................................................................................................... 3

Introduction ........................................................................................................................ 5
Business Significance and Related Risks ................................................................... 5
Definition of Key Concepts .......................................................................................... 5
Related IIA Standards ................................................................................................. 6
Getting Started .................................................................................................................. 9
Understanding Stakeholder Needs and Expectations ................................................. 9
Assessing Compentencies .......................................................................................... 9
Recruiting Talent ............................................................................................................. 11
Internal Recruitment.................................................................................................. 11
External Recruitment ................................................................................................ 12
Candidate Selection .................................................................................................. 13
Outsourcing and Co-sourcing ................................................................................... 13
Developing Talent............................................................................................................ 14
Professional Development Plans .............................................................................. 14
Training and Continuing Education ........................................................................... 14
Mentoring .................................................................................................................. 15
Succession Plan ....................................................................................................... 16
Motivating and Retaining Talent ...................................................................................... 17
Rewards .................................................................................................................... 18
Flexible Work Practices ............................................................................................ 19
Talent Management and Quality Assurance and Improvement Program (QAIP) ...... 20

2
 Practice Guide / Talent Management

Executive Summary

Recruiting, motivating, and retaining great team members is recognized as one of 10

imperatives that will enable internal audit to drive success in a changing world. According to
The IIA’s 2015 Global Internal Audit Common Body of Knowledge (CBOK) study, internal audit
departments need to cast their nets wider to attract, motivate, and retain team members who
are able to understand and anticipate the rapidly changing business environment. Professional
development also plays an important role, and internal auditors should share responsibility for
their professional development with the internal audit activity. 1

The internal audit activity’s ability to address high-priority risks and drive business value is as
much affected by the right talent mix as the right staff size.

The first steps toward managing talent are to:

1. Assess stakeholder needs and expectations.
2. Develop an audit plan to meet stakeholder needs and expectations, with
consideration for organizational objectives, strategies, and risks.
3. Leverage the Global Internal Audit Competency Framework (Competency
Framework)2 to identify competencies required to execute the audit plan.
4. Perform a competency gap analysis.
5. Develop a talent management strategy.
6. Periodically reassess internal audit’s collective competencies and address key
gaps.

After assessing stakeholder needs and expectations, chief audit executives (CAEs) and
internal audit managers are involved in four key activities: recruiting, developing, motivating,
and retaining talent.

Collaborating with the organization’s human resources department, CAEs may recruit internal
and external candidates. Internal recruits bring organizational knowledge into the internal audit
activity but may lack internal audit core competencies. External recruits may enhance internal
audit’s collective competencies and bring a fresh perspective, but they may require more time
for onboarding, training on policies and procedures, and adapting to the organization’s culture.
Filling the gaps with outsourced or cosourced arrangements is an option when specific skills
are required. CAEs and internal audit managers should consider having outsourcing and
cosourcing plans and arrangements in place to facilitate execution.

1
Larry Harrington and Arthur Piper, Driving Success in a Changing World: 10 Imperatives for Internal Audit, The IIA
Research Foundation (IIARF), 2015.
2
The IIA’s Global Internal Audit Competency Framework, The Institute of Internal Auditors, Inc. (IIA), 2013.

3
 Practice Guide / Talent Management

CAEs and internal audit managers should motivate team members and develop talent on a
continuous basis to address gaps identified during the assessment process. E-learning may
provide more flexibility and lower costs than traditional classroom training. On-the-job training
is a traditional approach in internal auditing and provides practical experience to individuals
with diverse backgrounds. Mentoring programs, and financial and nonfinancial rewards and
incentives complement training and further motivate team members.

Investment in recruiting, developing, and motivating talent should lead to higher levels of
retention. To further strengthen these talent management activities, CAEs and internal audit
managers should consider implementing a talent management “plan, do, check, act”3
continuous improvement process, and ensure best practices are included in internal audit’s
quality assurance and improvement program (QAIP).

The purpose of this practice guide is to help CAEs and internal audit managers better
understand how to recruit, develop, motivate, and retain competent team members.

3
http://balancedscorecard.org/Resources/Articles-White-Papers/The-Deming-Cycle

4
 Practice Guide / Talent Management

Introduction
Business Significance and Related Risks

The collective competencies of the internal audit staff directly influence the efficiency and
effectiveness of the internal audit activity. Recognizing this, The IIA Research Foundation
(IIARF) released The IIA’s Global Internal Audit Competency Framework in 2013 to define the
core competencies needed to meet the requirements of the International Professional
Practices Framework (IPPF). In turn, competent internal auditors can better help the internal
audit activity and the organization at large achieve their objectives.

Talent management shortcomings may potentially expose the internal audit activity to the
following risks:

 Having insufficient resources to implement the audit plan, as agreed to by the board.
 Having insufficient skills to perform an engagement with the necessary level of
proficiency and due professional care.
 Not being able to conform with The IIA’s International Standards for the Professional
Practice of Internal Auditing (Standards), adversely affecting internal audit’s brand
and reputation.

Definition of Key Concepts

Board – The highest level of governing body responsible for directing and overseeing the
activities and management of the organization. Typically, this comprises an independent group
of directors, such as a board of directors, a supervisory board, or a board of governors or
trustees. If such a group does not exist, the “board” may refer to the head of the organization.
The “board” also may refer to an audit committee to which the governing body has delegated
certain functions.4

Competency – Refers to the knowledge, skills, and experience needed in the performance of
internal audit services.5

Talent management – Refers to recruiting, developing, motivating, and retaining competent

team members.

The IIA’s Global Internal Audit Competency Framework – A tool that defines core
competencies needed to meet the requirements of the IPPF for the success of the internal
audit profession. The framework outlines 10 core competencies to be demonstrated by each of

4
The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards).
5
Kurt F. Reding et al., Internal Auditing: Assurance & Advisory Services, Third Edition p. 2-8 (IIARF, 2013).

5
 Practice Guide / Talent Management

three broad job levels — internal audit staff, internal audit management, and the CAE. Core
competencies include6:

I. Professional ethics: Promotes and applies professional ethics.

II. Internal audit management: Develops and manages the internal audit function.
III. IPPF: Applies the International Professional Practices Framework (IPPF).
IV. Governance, risk, and control: Applies a thorough understanding of governance,
risk, and control appropriate to the organization.
V. Business acumen: Maintains expertise of the business environment, industry
practices, and specific organizational factors.
VI. Communication: Communicates with impact.
VII. Persuasion and collaboration: Persuades and motivates others through
collaboration and cooperation.
VIII. Critical thinking: Applies process analysis, business intelligence, and problem
solving techniques.
IX. Internal audit delivery: Delivers internal audit engagements.
X. Improvement and innovation: Embraces change and drives improvement and
innovation.

Related IIA Standards

1200 – Proficiency and Due Professional Care

Engagements must be performed with proficiency and due professional care.

1210 – Proficiency

Internal auditors must possess the knowledge, skills, and other competencies needed to
perform their individual responsibilities. The internal audit activity collectively must possess or
obtain the knowledge, skills, and other competencies needed to perform its responsibilities.

1210.A1 – The chief audit executive must obtain competent advice and
assistance if the internal auditors lack the knowledge, skills, or other
competencies needed to perform all or part of the engagement.

1210.A2 – Internal auditors must have sufficient knowledge to evaluate the risk of
fraud and the manner in which it is managed by the organization, but are not
expected to have the expertise of a person whose primary responsibility is
detecting and investigating fraud.

6
The IIA’s Global Internal Audit Competency Framework, 2013.

6
 Practice Guide / Talent Management

1210.A3 – Internal auditors must have sufficient knowledge of key information

technology risks and controls and available technology-based audit techniques to
perform their assigned work. However, not all internal auditors are expected to
have the expertise of an internal auditor whose primary responsibility is
information technology auditing.

1210.C1 – The chief audit executive must decline the consulting engagement or
obtain competent advice and assistance if the internal auditors lack the
knowledge, skills, or other competencies needed to perform all or part of the
engagement.

1220 – Due Professional Care

Internal auditors must apply the care and skill expected of a reasonably prudent and
competent internal auditor. Due professional care does not imply infallibility.

1220.A1 – Internal auditors must exercise due professional care by considering

the:

o Extent of work needed to achieve the engagement’s objectives;

o Relative complexity, materiality, or significance of matters to which assurance
procedures are applied;
o Adequacy and effectiveness of governance, risk management, and control
processes;
o Probability of significant errors, fraud, or noncompliance; and
o Cost of assurance in relation to potential benefits.

1220.A2 – In exercising due professional care, internal auditors must consider

the use of technology-based audit and other data analysis techniques.

1220.A3 – Internal auditors must be alert to the significant risks that might affect
objectives, operations, or resources. However, assurance procedures alone,
even when performed with due professional care, do not guarantee that all
significant risks will be identified.

1220.C1 – Internal auditors must exercise due professional care during a

consulting engagement by considering the:

o Needs and expectations of clients, including the nature, timing, and

communication of engagement results;
o Relative complexity and extent of work needed to achieve the engagement’s
objectives; and
o Cost of the consulting engagement in relation to potential benefits.

7
 Practice Guide / Talent Management

1230 – Continuing Professional Development

Internal auditors must enhance their knowledge, skills, and other competencies through
continuing professional development.

1300 – Quality Assurance and Improvement Program

The chief audit executive must develop and maintain a quality assurance and improvement
program that covers all aspects of the internal audit activity.

1310 – Requirements of the Quality Assurance and Improvement Program

The quality assurance and improvement program must include both internal and external
assessments.

1311 – Internal Assessments

Internal assessments must include:

o Ongoing monitoring of the performance of the internal audit activity; and

o Periodic self-assessments or assessments by other persons within the organization
with sufficient knowledge of internal audit practices.

2030 – Resource Management

The chief audit executive must ensure that internal audit resources are appropriate, sufficient,
and effectively deployed to achieve the approved plan.

8
 Practice Guide / Talent Management

Getting Started

Before recruiting talent, the CAE should understand stakeholder needs and expectations, and
perform a competency assessment.

Understanding Stakeholder Needs and Expectations

Stakeholder needs and expectations of internal audit are changing.

 External auditors are relying more on the work performed by internal audit.
 Investors are demanding more transparency from organizations.
 Regulators are increasing their scrutiny over governance and risk management
practices.

Meeting such needs and expectations requires that internal audit expand its traditional
compliance and control evaluation/testing focus to include becoming a strategic adviser to the
organization. To serve in this role, internal auditors must demonstrate competence in
analytical/critical thinking and communication skills — the top skills that CAEs are seeking for
staff.7

Assessing Competencies

To meet stakeholders’ expectations and requirements, the internal audit activity needs to
ensure it has access to the full range of competencies articulated in the Competency
Framework. The CAE should assess whether the internal audit activity collectively has the
competencies needed to fulfill its mission and meet stakeholder expectations. Focus should be
on the competencies needed to address emerging risks, high-priority risks, and primary
business value drivers, not solely on the number of auditors needed to staff the activity.

A competency assessment should be based on a systematic and structured process, including

the following steps:
1. Assess the needs and expectations of primary stakeholders such as the audit
committee, board, senior management, external auditors, investors, and
regulators. This step is critical in defining internal audit’s organizational structure,
deliverables, working practices, communication protocols, and resourcing model.
2. Develop an audit plan that meets stakeholder needs and expectations with
consideration of the organization’s objectives, strategies, and risks. The audit plan
should be aligned with the organization’s business objectives and value drivers.

7
Larry Harrington and Arthur Piper, Driving Success in a Changing World: 10 Imperatives for Internal Audit,
IIARF, 2015.

9
Practice Guide / Talent Management

CAEs should leverage information such as organizationwide or business-unit

strategic plans to assess internal audit’s future role in providing assurance and
consulting services, and its need for talent.
3. Leverage the Standards and the Competency Framework to identify competencies
needed to execute the audit plan, such as having basic fraud and IT knowledge
and being able to perform their engagements with due professional care.
4. Assess internal audit’s current collective competencies and identify gaps when
compared with competencies needed to execute the audit plan and core internal
audit competencies.
5. Develop a talent management strategy. The CAE should develop this strategy for
the internal audit activity based on the gap analysis. To best serve internal audit’s
long-term interests, core competencies should be acquired through hiring and
professional development. Ad hoc competencies required for specific assurance
and consulting engagements could be acquired through alternative strategies such
as rotational and guest auditor programs or cosourcing. In addition, the talent
management strategy should consider potential constraints such as budget,
internal audit brand/reputation, the labor market, and the desirability of the
organization’s location.
6. Periodically reassess internal audit’s collective competencies and address key
gaps.

10
 Practice Guide / Talent Management

Recruiting Talent

Internal Recruitment

Full-time Permanent Recruitment

Internal recruitment may result in acquiring talent with high-level organizational awareness and
strong business knowledge. However, internal recruits may need additional training to develop
core audit skills. In addition, impaired objectivity may be a potential concern. Effective training
programs, supervision, and thoughtful assignment planning can help to mitigate such
concerns.

Rotational Recruitment
Rotational programs provide a training ground for internal candidates from other departments
while filling talent gaps in internal audit. Rotational programs can be outbound or inbound:

 Outbound rotational programs rotate internal auditors out of internal audit and into
other business units. Rotating out gives internal auditors the opportunity to enhance
their business knowledge in other functional areas.
 Inbound rotational programs rotate employees from other business units into internal
audit for a limited time. Inbound programs provide an opportunity for high-performing
staff members outside of internal audit to learn about governance, risk management,
and internal control practices.

Rotational programs also facilitate the sharing of best practices and potentially increase
awareness of internal control and the role of internal audit among business-unit staff.

The primary challenges associated with inbound rotational programs are potential impairment
to individual objectivity, providing audit skills training to inbound employees, and scheduling.
Additional concerns include the possible disruption to career development paths and the lack
of organizational support.

Tips to successfully implement an inbound rotational program include:

 Obtain commitment and support from other business units.

 Promote the benefits of the program through the organization’s intranet, bulletin
boards, and other communication vehicles.
 Coordinate with human resources to identify viable candidates.
 Assess candidates’ qualifications against desired competencies. Select a pool of
candidates to participate in the program.

11
 Practice Guide / Talent Management

 Develop a process to onboard selected candidates. The process should include

providing an overview about the program; the internal audit activity’s vision, mission,
and charter; the Standards; and standard operating policies and procedures.

Guest Auditor Program

A guest auditor program can be used to fill competency gaps for specific audit engagements.
This provides an opportunity for personnel from other parts of the organization to make a
short-term commitment to internal audit. A guest auditor typically serves as a subject matter
expert on a unique internal audit engagement, enhancing knowledge sharing within the
organization.

Tips for implementing a guest auditor program include:

 Enable the guest auditor to interact with internal audit staff to collaboratively identify
mutually beneficial opportunities.
 Provide the guest auditor with preparatory materials before the start of the audit
engagement, such as information about the internal audit activity, broad business or
market information, inherent risks, and other information applicable to the guest
auditor’s assignment.
 Solicit feedback from the guest auditor and other internal auditors on the
engagement team, during and after the assignment. Evaluate performance and
satisfaction with the guest auditor program and share such information with human
resources, the guest auditor, the guest auditor’s manager, and internal audit
management.

External Recruitment

External recruitment finds talent from outside of the organization. External talent may be
sourced from public accounting firms, internal audit activities at other organizations, colleges
and universities, and areas outside of the traditional internal audit domain.

 Candidates from public accounting firms (external auditors) typically have high-level
audit expertise and may have broad industry experience. However, conflicts of
interest can arise if candidates are recruited from the organization’s public
accounting firm. The CAE should be aware of any restrictions on recruiting from the
organization’s public accounting firm.
 Candidates from internal audit activities at other organizations may have relevant
internal audit competencies, but still require onboarding and training to become
familiar with the new organization’s culture, processes, regulatory requirements, and
dynamics.

12
 Practice Guide / Talent Management

 Undergraduate or Master of Business Administration candidates may require more

focused training, supervision, and on-the-job experiences to reach satisfactory levels
of performance. However, college recruits also provide exisiting staff members the
opportunity to develop their internal audit management competencies as they train,
coach, and supervise entry-level internal auditors.

An organization’s internship and co-op programs also could be a beneficial source of talent.

Candidate Selection

Job descriptions should be clearly defined and a standard set of competency-based interview
questions should be used consistently with all candidates. This standardization and
consistency helps to establish baseline criteria from which to evaluate a pool of candidates.

Tips for candidate selection include:

 Ensure that human resources has a high-level understanding of internal audit’s role
and need for talent, and that desired competencies are reflected in the job
description.
 Coordinate with human resources to leverage the organization’s intranet and
websites, general job boards, professional association job boards, and recruiting
agencies to search for potential candidates.
 Screen candidates by assessing their relevant competencies and alignment with the
organization’s espoused values. Verify candidate experience and qualifications, and
completebackground checks, as applicable.
 Prepare competency-based interview questions, ensure that interviewers are
knowledgeable of legal constraints (i.e., types of questions or answers to avoid), and
trained in conducting behavioral or competency-based interviews, as appropriate.

Outsourcing and Co-sourcing

Internal audit activities may engage outside personnel to perform tasks that require specialized
expertise. Outsourcing and cosourcing require more planning and preparation to help external
personnel understand how the organization operates. For more information, see Imperatives
for Change: The IIA’s Global Internal Audit Survey in Action8 and the IIA Position Paper, The
Role of Internal Audit in Resourcing the Internal Audit Activity.

8
See Imperative 9 in Richard J. Anderson and J. Christopher Svare, Imperatives for Change: The IIA’s Global Internal
Audit Survey in Action, pp. 37-38, IIARF, 2011.

13
 Practice Guide / Talent Management

Developing Talent

The CAE should align internal audit’s talent development approach with the organization’s
professional development practices. Efforts to develop talent typically include professional
development plans, training and continuing education, and mentoring.

Professional Development Plans

Individual professional development plans require staff members to take ownership of their
professional development, and may include formal agreements that outline specific activities,
target accomplishments, and time lines. A professional development plan may support a
particular career path identified by the organization or by the individual internal auditor. For
example:

 Career internal auditor: Career internal auditors pursue internal audit as a long-term
profession, often with the goal of achieving a management position within an internal
audit activity or developing expertise in a specialized field such as fraud or IT. This
career path might include rotating in and out of internal audit as a way to enhance
the career internal auditor’s organizational knowledge.
 Business operations: Internal auditors may serve in audit to gain a broad and deep
understanding of the organization’s business operations, risk management, internal
controls, and governance. They then leverage this experience to seek operational
roles.
 Executive leadership: A rotation through internal audit may be part of an
organization’s executive leadership development program.

Individual development plans should include a path toward certification so that collectively,
internal audit staff certifications form a base level of qualifications for the internal audit
department.

One-size-fits-all professional development practices are not effective for all employees.
Practices should be customized based on generational differences, professional goals,
position, experience, and seniority. Professional development plans should be reviewed and
updated as necessary.

Training and Continuing Education

Internal audit can meet its professional development plan goals through various training and
continuing education activities, such as on-the-job training, classroom training, e-learning, and
other methods. Audit leaders should consider the needs of the individual as well as the internal
audit activity. The best result generally can be achieved through a combination of activities.

14
 Practice Guide / Talent Management

Internal audit should develop its training plan based on an assessment of staff competencies
against the Competency Framework. The plan should meet the collective needs of the internal
audit activity as well as the professional development needs of individual internal auditors.

On-the-job Training
On-the-job training can be highly effective, especially for new staff members. It provides them
with hands-on experience performing internal audit tasks. In addition, on-the-job training can
help new staff members learn about core business processes and tasks performed by second
line of defense functions such as risk management and compliance.

Internal audit should define, communicate, and periodically assess its desired on-the-job
training outcomes. On-the-job training should include ongoing feedback and coaching from
experienced team members.

Classroom Training
Classroom training is a common training method. Many organizations have in-house training
programs to provide specific training based on job roles and responsibilities. For example,
training may cover the organization and its processes, the regulatory framework governing the
organization’s business, and other governance structures. Training also could include specific
technical skills for internal auditors such as data analytics and fraud control. IIA chapters and
institutes often offer or provide technical training to their members.

Workshops are a special form of classroom training that require a higher level of individual and
group participation. Depending on participant interaction, this approach may work best when
participants already have a certain degree of experience and knowledge.

E-learning
E-learning may be delivered by internal as well as external providers. It provides greater
flexibility for scheduling and does not require travel or absence from the office. The main
disadvantage is minimal interaction with the facilitator and other participants.

Assessing Training Options

Reading and writing articles for professional publications, attending professional conferences,
and networking are other types of ways to gain internal audit knowledge and skills. Different
types of training and continuing education activities have varying costs. Mapping professional
development plans against the internal audit plan can help the CAE establish a training budget
that supports successful talent management.

Mentoring

A mentoring program can be key to developing talent, not only for new hires but also for more
experienced staff. Mentoring programs should be largely informal, with consideration given to
the following:
 A mentor must be more experienced than the mentee.

15
 Practice Guide / Talent Management

 Each auditor may be assigned a mentor.

 It is best if the mentor is not the individual’s supervisor.
 Meetings between the mentor and the mentee should be informal, without official
documentation.

Succession Plan

Succession planning should start well in advance of any potential employment event.
Succession plans should identify potential candidates for existing positions, taking into
consideration the needs of the organization and the candidates’ career goals, competencies,
and potential for development.

Potential candidates could be approached regarding their interest in possible succession

opportunities. Interested persons then could be developed for future roles and responsibilities
and, where appropriate, could be given the opportunity to fill more senior positions during
periods of temporary absence.

16
 Practice Guide / Talent Management

Motivating and Retaining Talent

Figure 1
Potential motivators can be mapped
 Challenging work
against Maslow’s hierarchy of needs9,
as illustrated in Figure 1.  Personal responsibility
Self-Actualization  Opportunity for creativity
Although it is important to find the best Needs  Achievement in work
combination of motivators for each  Recognition & Praise
individual, challenging work, career  Promotion & Bonuses
opportunities, quality of work
 Social recognition
environment, and recognition  rather
 Job title
than compensation  are leading Self Esteem Needs
drivers of staff retention. Rewards and  High status of job
recognition, flexible working practices,  Feedback from the job itself
and work–life balance all can be  Work groups / teams
potential motivators of retention. Social Needs  Supervision
Retention also can be affected by  Professional associations
other individual and team incentives.
 Health & Safety
Efforts to motivate individuals may Safety Needs  Job security
include:  Contract of employment
 Compensation
 Helping staff members find
Physiological Needs  Benefits
meaning in their work and
 Working conditions
establishing a connection
to their work. Ensuring that work itself aligns with employees’ expectations and
needs.
 Helping staff members set and achieve their goals.
 Mentoring and counseling.
 Developing career and performance management plans.
 Using appropriate techniques to improve or change behavior.
 Specifying standards and expectations and designing appropriate performance
evaluation tools.
 Explaining the consequences of any mistakes or inappropriate behavior.
 Undertaking regular formal and informal performance evaluations.
 Providing appropriate compensation and benefits.

9
A.H. Maslow, “A Theory of Human Motivation,” Psychological Review, 1943.

17
 Practice Guide / Talent Management

Factors that motivate teams may include:

 Shared vision and well-understood strategies.

 Clearly established team goals.
 Clearly defined team roles and responsibilities.
 Clearly understood rules and channels.
 Supportive team behaviors.
 Well-defined ground rules and decision-making processes (e.g., delegating
authority, encouraging team empowerment).
 Balanced participation (i.e., proportionate assignment of tasks within the team).
 Awareness of group processes.
 Solid brand/reputation of internal audit within the organization.

Rewards

People should feel recognized for their contributions and supported in their individual
aspirations. Transparent processes for rewarding staff members should be established, such
as:

 Establishing criteria that define which behaviors or actions will be

rewarded/recognized.
 Making recognition eligibility open to all employees.
 Consistent application of rewards to all who qualify.

Recognition should occur as close to the performance as possible, so that it reinforces

behavior. A reward should always be preceded by recognition, but recognition can be given
without the reward.

Rewards may be financial and be representative of the organization’s compensation, bonuses,

and incentives scheme. However, not all organizations will be able to grant financial rewards,
and some organizations may prefer nonfinancial rewards, such as:

 Increasing responsibilities for the employee who proves potential. However, take
care to ensure that additional responsibilities are seen as a reward rather than a
burden.
 Appointing the employee to be a team leader.
 Exposing the employee to engagements that require advanced competencies to
execute the audit.
 Enrolling the employee in certification programs.

18
 Practice Guide / Talent Management

 Inviting the employee to facilitate engagement opening/closing meetings, make a

presentation to the audit committee or board, or participate on a special team
project.
 Publicly recognizing employee performance in staff/office meetings.

Flexible Work Practices

Flexible work practices can help retain talent. Flexibility can be offered formally or informally, in
accordance with the organization’s local and national practices. In implementing flexible work
practices, CAEs should pay special attention to balancing employee workload with
engagement and business needs. They should still expect internal audit staff to comply with
internal policies and confidentiality standards, especially when working remotely.
 Occasional flexible work time should be assessed on a case-by-case basis,
depending on the internal auditor’s role (i.e., manager, team leader, staff) and
engagement requirements.
o Flexible hours – allow employees a temporary variance of starting/ending
times, based on a specific need that best fits their schedule.
o Remote work – different locations may be more suitable for completing tasks
and assignments, including working from home. Such requests should be
discussed and agreed upon in advance with the team leader or CAE.
Working remotely can help internal audit staff balance personal and
professional commitments. However, the team leader or CAE must ensure
that relevant tools and technology are provided and used appropriately,
timely and quality work is produced, and professional standards are
observed.
 Long-term flexible hours:
o Long-term change of starting/ending working times can be beneficial to staff
members and provide incentive for talent retention. However, nonstandard
working hours should be aligned to the internal audit activity’s needs.
o Long-term remote work, aligned with the internal audit activity’s needs, may
provide incentive for talent retention.
o Part-time work – reduction of working hours with corresponding adjustment of
compensation and benefits may appeal to some staff members.
o Reduced work hours for people with care-giving responsibilities – a special
type of part-time working arrangement to help staff members care for a
member of their immediate family — can be an attractive incentive to stay
with an organization.

19
 Practice Guide / Talent Management

 Unpaid leave – this incentive, which may be allowed as long as there are no
obstacles, could appeal to staff members who value free time or extended time off.
Examples include unpaid vacation and sabbatical leave.
 Social responsibility leave — some organizations may grant staff members
optional paid days off to perform social responsibility activities such as charitable
endeavors.

Talent Management and Quality Assurance and Improvement Program (QAIP)

Talent management is related to The IIA’s 1200-series standards on proficiency and due
professional care, and should be addressed in the internal audit activity’s quality assurance
and improvement program (QAIP). As an ongoing and periodic assessment of the entire
spectrum of audit and consulting work performed by internal audit,10 a QAIP promotes
continuous improvement.
Figure 2
A continuous improvement model popularized by W.
Edwards Deming,11 is the Deming Cycle, which consists
of four steps — plan, do, check, act — as illustrated in Act Plan
Figure 2.

The Deming Cycle can be applied to talent management

as part of the QAIP. Although each CAE should determine
how to best assess the quality of the internal audit
activity’s talent management processes, some examples
follow: Check Do
Plan: Documentation of talent management objectives.

 Internal audit activity attracts candidates with the necessary skills and talent to
complete the audit plan.
 Internal audit staff receives sufficient and appropriate training.
 Internal audit activity develops and retains its staff as needed and at all levels.
 Internal audit meets stakeholder needs and expectations.

10
Practice Advisory 1310-1: Requirements of the Quality Assurance and Improvement Program.
11
http://balancedscorecard.org/Resources/Articles-White-Papers/The-Deming-Cycle

20
 Practice Guide / Talent Management

Do: Activities to define quality and build staff awareness.

 All training activities are planned, authorized, and documented. Criteria should be
tailored to fit the specific internal audit activity. Factors to consider are size and
complexity of the organization, industry, maturity level of the internal audit activity,
and specific challenges (e.g., no changes in staff in the last two years, low
competency ratings by senior management).

Check: Assessment and reviews to measure quality, including:

 Ongoing monitoring.
 Periodic self-assessment.
 External assessment.

For example, ongoing monitoring might be addressed as follows:

On a quarterly basis, managers document training activities for all team

members by type, content, cost, and number of days. Performance metrics
such as the average number of training days per team, and the minimum and
maximum number of training days completed, are compared to defined
benchmarks.

Ongoing monitoring should be part of internal audit’s overall performance management

system — for example, in the form of a balanced scorecard. Performance management
systems provide a good basis for efficient performance of internal and external
assessments.

Act: Improvement initiatives and lessons learned.

The Act step is crucial, as it allows for the continuous improvement of the internal audit activity.
This step relies on appropriate implementation of each of the other steps, as illustrated in this
example:

Ongoing monitoring reveals that IT audit staff completed an average of eight

days of training in the previous year. Further analysis shows that cost was the
determining factor in the number of training days completed. An internal
assessment also indicates that IT management is not fully satisfied with IT audit
coverage of new technologies such as cloud computing and social media. As a
consequence, management of the internal audit activity decided to increase the
target IT auditor training requirement to 12 days annually for the next two years.
The training budget will remain the same. The IT audit manager will explore
possibilities to arrange cost-efficient, in-house training for central and important
topics such as Internet security. For cloud computing and social media, high-
quality training courses will be identified and IT auditors will be selected to

21
 Practice Guide / Talent Management

attend. At the same time, the IT audit manager will organize a workshop with his
team to explore possibilities for effective, low-cost professional development
(e.g., Web-based training, Internet research, stronger participation at IT-specific
IIA chapter activities/meetings).

This example shows not only the diverse improvement activities resulting from the Deming
Cycle, but also how they can lead to the next Deming Cycle with improved performance of the
internal audit activity. Here, the objectives formulated in the Plan step should be reevaluated
but probably do not need to be changed. Certainly there is a need to change the criteria in the
Do step. For IT audit, the criterion will be: “On the average, IT audit staff are getting 12 days of
training per year.” Also, for IT audit, an additional criterion could be added: “IT management is
fully satisfied with IT audit coverage of new technologies.”

22
 Practice Guide / Talent Management

Authors:

Ana Figueiredo, CIA, CRMA

Fabiano Castello, CIA, CCSA, CRMA

Hans-Peter Lerchner, CIA

John Mickevice, CIA, CRMA

Max Haege

Ruxandra Billius, CIA, CRMA

Reviewers:

Rune Johannessen, CIA, CCSA, CRMA

Sally-Anne Pitt, CIA, CGAP

Takuya Morita, CIA

Tuncay Efendioglu, CIA, CCSA, CFSA, CRMA

Bruce Turner, CGAP, CRMA

23
 Practice Guide / Talent Management

About the Institute

The Institute of Internal Auditors (The IIA) is the internal audit profession’s most widely recognized advocate, educator,
and provider of standards, guidance, and certifications. Established in 1941, The IIA today serves more than 180,000
members from more than 170 countries and territories. The association’s global headquarters are in Altamonte
Springs, Fla. For more information, visit www.globaliia.org / www.theiia.org.

About Supplemental Guidance

Supplemental Guidance is part of The IIA’s International Professional Practices Framework (IPPF) and provides
additional recommended (non-mandatory) guidance for conducting internal audit activities. While supporting the
Standards, Supplemental Guidance is not intended to directly link to achievement of conformance with the Standards.
It is intended instead to address topical areas, as well as sector-specific issues, and it includes detailed processes and
procedures. This guidance is endorsed by The IIA through formal review and approval processes.

Practice Guides
Practice Guides are a type of Supplemental Guidance that provide detailed guidance for conducting internal
audit activities. They include detailed processes and procedures, such as tools and techniques, programs,
and step-by-step approaches, as well as examples of deliverables. As part of the IPPF Guidance,
conformance with Practice Guides is recommended (non-mandatory). Practice Guides are endorsed by The
IIA through formal review and approval processes.

A Global Technologies Audit Guide (GTAG) is a type of Practice Guide that is written in straightforward
business language to address a timely issue related to information technology management, control, or
security.

For other authoritative guidance materials provided by The IIA, please visit our website at
www.globaliia.org/standards-guidance or www.theiia.org/guidance.

Disclaimer
The IIA publishes this document for informational and educational purposes and is not intended to provide definitive
answers to specific individual circumstances. As such, is only intended to be used as a guide. The IIA recommends
that you always seek independent expert advice relating directly to any specific situation. The IIA accepts no
responsibility for anyone placing sole reliance on this guidance.

Copyright
Copyright ® 2015 The Institute of Internal Auditors.
For permission to reproduce, please contact guidance@theiia.org.

December 2015

24
 – Practice Guide

››ASSESSING
ORGANIZATIONAL
GOVERNANCE
IN THE PUBLIC SECTOR
››

›› OCTOBER 2014
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Table of Contents

Executive Summary............................................................................................................. 1

Introduction......................................................................................................................... 1

Public Sector Characteristics............................................................................................ 4

Public Sector Structure................................................................................................... 5

Public Sector Accountability........................................................................................... 5

The Public Sector Governance Roles and Responsibilities............................................... 6

Considerations by Specific Governance Process or Structure........................................ 7

Assessing Organizational Governance..............................................................................12

Additional Resources........................................................................................................ 25

Appendix — Board Risks, Control Objectives, and Practices........................................ 27

Author, Contributors, and Reviewer................................................................................. 30

www.globaliia.org/standards-guidance / iii

Assessing Organizational Governance in the Public Sector
Executive Summary
Assessing organizational governance in the public sec-
tor requires a firm understanding of the characteristics,
structure, and accountability processes prevalent in in-
ternational, national, regional, and local governments. At
the same time, governance structures and processes must
be customized according to the organization’s complex-
ity and political, cultural, economic, and regulatory en-
vironments. Regardless of the nature of the organization,
a principles-based approach to assessing organizational
governance will help auditors provide assurance that the
public is being well-served.
Responsibilities for governance are shared among the
board, senior management, and the audit function. The
board bears primary responsibility for organizational gov-
ernance and often delegates implementation responsi-
bilities to senior management. The chief executive also
sets the tone at the top, establishing a foundation for
good governance. Audit functions provide public sector
organizations with assurance and advisory services by
monitoring and reporting on the effectiveness of gover-
nance processes.
Auditors should prepare for the assessment process by
developing a deep understanding of the organization’s
governance context, including identifying key stake-
holders and their governance requirements. After the
context has been defined, major steps in the assess-
ment process include gathering documents, reviewing
processes and structures, establishing an assessment
criteria and maturity model, developing an audit plan,
and finally, planning and completing engagements.
Performing the assessment will require auditors to gath-
er evidence from and consider processes and structures
related to:
• The board and audit committee.
• Strategy.
IPPF – Practice Guide
• Enterprise risk management.
• Ethics.
• Compliance.
• Organizational accountability.
• Monitoring.
• IT governance.
Public sector governance audits are often high-profile,
sensitive in nature, and a matter of public record. Ade-
quate staffing, appropriate supervision, and quality assur-
ance are critical throughout the process.
Introduction
In 2012, The IIA released Assessing Organizational Gov-
ernance in the Private Sector, a practice guide designed
to provide chief audit executives (CAEs) in the private
sector with direction on how to assess and make recom-
mendations for improving governance. This public sector-
focused practice guide:
• Adapts Assessing Organizational Governance in the
Private Sector to suit the unique needs of the public
sector.
• Is designed to help public sector boards, audit com-
mittees, CAEs, and audit staffs assess governance.
• Is intended to be fully applicable to government and
all publicly controlled or publicly funded agencies,
enterprises, and other entities that deliver public
programs, goods, or services.
The public sector organization’s board is responsible for
governance oversight. The CEO is responsible for non-
board governance processes. An effective audit function
that is independent, objective, and proficient; uses sound
assurance processes and practices; and conforms to the
International Standards for the Professional Practice of In-
ternal Auditing (Standards), is qualified to assess gover-
nance and provide assurance on governance effectiveness
to the board.
www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
A Principles-based Approach
Public sector governance should be customized to align
with the organization’s complexity and geographic, politi-
cal, cultural, economic, and regulatory environments. To
address a wide spectrum of needs, this practice guide pro-
vides guidance that focuses on universal good principles
of governance.
“Because governments throughout the world are struc-
tured differently — with different and possibly overlap-
ping mandates and jurisdictions — no single governance
model applies to public sector organizations. Nevertheless,
certain governance principles are common across the pub-
lic sector. Common principles of corporate governance en-
compass the policies, processes, and structures used by an
organization to direct and control its activities, to achieve
its objectives, and to protect the interests of its diverse
stakeholder groups in an ethical manner.”1
Taking a principles-based approach, audit functions can
assess governance across different systems of govern-
ment including international governments, national and
state governments, government agencies, state-owned
enterprises, and municipalities. Boards, audit commit-
tees, CAEs, and audit staffs may need to supplement this
guidance with additional, in-depth or rules-based guid-
ance in specific areas applicable to their organizations
and jurisdictions.
Business Significance and Related Risks
Governance is the processes and structures implemented
by the board to inform, direct, manage, and monitor the
organization’s activities toward achieving its objectives.
Strong governance systems increase the likelihood that
organizations will meet their objectives and stakeholder
expectations. The organization faces risks to achieving ef-
fective governance, and the board is responsible for im-
plementing governance processes and structures. While
the board remains accountable for governance, it may del-
egate certain governance responsibilities to management.
Board-level governance risks are outlined in the Appendix.
2 / www.globaliia.org/standards-guidance
Related IIA Standards and Guidance
The International Professional Practices Framework
(IPPF) outlines the following Standards pertaining to
governance.
Standard 2110: Governance
The internal audit activity must assess and make appro-
priate recommendations for improving the governance
process in its accomplishment of the following objectives:
• Promoting appropriate ethics and values within the
organization;
• Ensuring effective organizational performance
management and accountability;
• Communicating risk and control information to
appropriate areas of the organization; and
• Coordinating the activities of and communicating
information among the board, external and internal
auditors, and management.
2110-A1
The internal audit activity must evaluate the design, im-
plementation, and effectiveness of the organization’s eth-
ics-related objectives, programs, and activities.
2110-A2
The internal audit activity must assess whether the infor-
mation technology governance of the organization sup-
ports the organization’s strategies and objectives.
Related IPPF practice advisories and practice guides pro-
viding additional guidance on governance include:
Practice Advisories
• PA 2110-1: Governance: Definition
• PA 2110-2: Governance: Relationship With Risk and
Control
• PA 2110-3: Governance Assessments
1
Supplemental Guidance: The Role of Auditing in Public Sector Governance,
The IIA, 2012.

Assessing Organizational Governance in the Public Sector
Practice Guides
• Auditing Executive Compensation and Benefits
• Assessing Organizational Governance in the Private
Sector
• Evaluating Corporate Social Responsibility/Sustain-
able Development
• Evaluating Ethics-related Programs and Activities
• Global Technology Audit Guide (GTAG) 4:
Management of IT Auditing, 2nd Edition
• GTAG 15: Information Security Governance
• GTAG 17: Auditing IT Governance
Standard 2120: Risk Management
The internal audit activity must evaluate the effectiveness
and contribute to the improvement of risk management
processes.
Related IPPF practice advisories, practice guides, and
a position paper providing additional guidance on risk
management include:
Practice Advisories
• PA 2120-1: Assessing the Adequacy of Risk
Management Processes
• PA 2120-2: Managing the Risk of the Internal Audit
Activity
Practice Guides
• Internal Auditing and Fraud
• GTAG 10: Business Continuity Management
• GTAG 13: Fraud Prevention and Detection in an
Automated World
Position Paper
• The Role of Internal Auditing in Enterprise-wide
Risk Management
Standard 2130: Control
The internal audit activity must assist the organization
IPPF – Practice Guide
in maintaining effective controls by evaluating their ef-
fectiveness and efficiency and by promoting continuous
improvement.
Related IPPF practice advisories and practice guides pro-
viding additional guidance on control include:
Practice Advisories
• PA 2130-1: Assessing the Adequacy of Control
Processes
• PA 2130.A1-1: Information Reliability and Integrity
• PA 2130.A1-2: Evaluating an Organization’s Privacy
Framework
Practice Guides
• GTAG 1: Information Technology Risks and Controls,
2nd Edition
• GTAG 2: Change and Patch Management Controls:
Critical for Organizational Success, 2nd Edition
• GTAG 8: Auditing Application Controls
• GTAG 9: Identity and Access Management
• GTAG 12: Auditing IT Projects
• GTAG 14: Auditing User-developed Applications
• The Guide to the Assessment of IT Risk (GAIT)
Methodology
• GAIT for IT General Control Deficiency Assessment
• Auditing External Business Relationships
• Auditing Privacy Risks, 2nd Edition
Other IIA Guidance
• Supplemental Guidance: Public Sector Definition
• Standard 1300: Quality Assurance and Improvement
Program
• Standard 1312: External Assessments
• Standard 2400: Communicating Results
• Practice Advisory 2400-1: Legal Considerations in
Communicating Results
www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Definitions of Key Concepts Public governance refers to preconditions to run (govern)

This practice guide uses the following definitions for gov-
ernance and governance-related terms:
Control — Any action taken by management, the board,
and other parties to manage risk and increase the likeli-
hood that established objectives will be achieved. Man-
agement plans, organizes, and directs the performance
of sufficient actions to provide reasonable assurance that
objectives will be achieved (Standards).
Governance involves the set of relationships among the
organization’s stakeholders, interest groups, citizens,
board, and management. These relationships are framed
by laws, rules, and requirements, and provide the struc-
ture through which the objectives of the organization are
set, the strategies to achieve those objectives are defined,
operating plans are prepared, performance is monitored,
and information is communicated transparently among
the parties.2
a jurisdiction — processes and structures necessary to en-
sure that the government can stay in power until the end
of its mandate, implement public policies, have smooth
relationships with legislative and judiciary powers, and
pass on administration to the next government.
Organizational governance is derived from the corporate
governance experience and deals with the specific orga-
nizations that comprise the public sector. Organizational
governance addresses how organizations should be struc-
tured to mitigate or eliminate conflicts of interest between
their personnel and the citizens that the organizations rep-
resent.
Risk Management — A process to identify, assess, man-
age, and control potential events or situations to provide
reasonable assurance regarding the achievement of the
organization’s objectives (Standards).

Public Sector — In general terms, the public sector con-
sists of governments and all publicly controlled or pub-
licly funded agencies, enterprises, and other entities that
deliver public programs, goods, or services. Public sector
governance includes two domains: public governance and
organizational governance.
Public Sector Characteristics
Public and private sector organizations differ considerably
with regard to governance. Generally, public sector gover-
nance is more rigid and under greater regulatory burden.
Table 1 outlines the major differences.

Table 1: Public vs. Private Sector Organizational Characteristics

ORGANIZATIONAL CHARACTERISTIC PUBLIC SECTOR PRIVATE SECTOR

Main Organizational Purpose Protect/Serve Public Interest Maximize Shareholder Value
Creation Law Incorporation Acts
Governing Board/Audit Committee/Senior
Governance Structure Shareholders/Board of Directors/Audit Committee
Official
Finance Taxes/Revenues Ownership/Debt/Revenues
Operational Rules Formal/Rigid/Law Formal/Flexible/Informal
Accountability Citizenry/Legislature Shareholders/Stakeholders/Regulators
Present/Potential Shareholders, Stakeholders, and
Outside Communication Open/Public
Regulators
Control Systems Rigid Flexible

For a more detailed discussion of governance context in the public sector, see The IIA’s
2

The Role of Auditing in Public Sector Governance and the International Federation of
4 / www.globaliia.org/standards-guidance Accountants’ (IFAC’s) Governance in the Public Sector: A Governing Body Perspective.
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Public Sector Structure Public Sector Accountability

The public sector structure includes the general govern- Assessing governance structure and practices requires an
ment (core government and agencies), and public corpo- understanding of public sector accountability. Public sec-
rations (state businesses and enterprises). This practice tor accountability is summarized in Figure 2.
guide is intended to be fully applicable to general gov-
ernment public sector entities. Public corporations’ ob- Figure 2– Example of Overall Accountability Process in the
jectives and conformations lie somewhere between the Public Sector3
public and private sectors. Therefore, auditors in public
corporations should refer to this practice guide in con-
junction with the practice guide, Assessing Organizational
Independent LEGISLATURE Transparency
Objective
Governance in the Private Sector, to potentially develop Information

Co ons ility
Re unta ting
a hybrid approach for assessing governance. Figure 1 de-

nfe ib
Au sibi d

Ac Rep

sp
Re dit lity
on re

co or

rre ility
sp fer
picts a representative public sector structure.

d
Re Con

rt

b
po
Figure 1– Public Sector Structure Audit

LEGISLATIVE EXECUTIVE
AUDITOR Acknowledgment of
Responsibility
PUBLIC SECTOR
In democratic governments, the executive function is
responsible for planning, directing, and controlling daily
General Government Public Corporations operations, while the legislature is responsible for autho-
(Core Government (State Business and rizing the executive budget and government expenditures.
and Agencies) Public Enterprise)
The legislative auditor audits and reports on the perfor-
mance of the executive branch.

International Financial Public Nonfinancial Public In many national governments, legislative auditors are es-
Government Corporations Corporations
tablished as supreme audit institutions (i.e., independent
government external auditors). In regional and local govern-
ments, auditors may play a dual role — helping to improve
National Monetary Public Corporations, the government (i.e., an audit function role), and providing
Government Including Central Bank the legislature with timely and relevant reports for control
purposes (i.e., an external assurance provider role).

Regional Nonmonetary Financial Public

In this particular accountability environment, it is impor-
Government Corporations tant that public sector auditors recognize the importance of
effective communication channels with legislative external
assurance providers. Management-approved communica-
Local
tion between audit function and external assurance provid-
Government ers helps to ensure public accountability. The audit com-
mittee is one of the main mechanisms to help facilitate this
communication.

3
Office of the Auditor General of Canada training material. Reproduced
with the permission of the Minister of Public Works and Government www.globaliia.org/standards-guidance / 5
Services, 2014.
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
The Public Sector Governance
Roles and Responsibilities
The Board
The board is the focal point for effective organizational
governance. It is the link between the stakeholders and
the organization’s executive management, and it bears pri-
mary responsibility for governance. The board:
• Sets the organization’s strategic objectives and pro-
vides the leadership to put them into effect.
• Directs and provides oversight of the executive
leader and senior management.
• Establishes appropriate risk levels.
• Approves and monitors entitywide ethics, operation-
al, and compliance standards and policies.
• Institutes effective control systems.
• Provides transparent, complete, clear, and timely
communication to stakeholders.
The board’s actions are subject to laws, regulations, and
the needs of stakeholders. The board typically delegates
significant authority for the day-to-day operations to an
executive leader (CEO) and the executive leadership
team. To be effective, the board should be independent,
engaged, and committed.
Management
The organization’s executive leadership and senior man-
agement are accountable to the board. Top management
is ultimately responsible for implementing the organiza-
tion’s governance system, as directed by the board. The
CEO sets the tone at the top for the integrity, ethics, and
conduct that will contribute to an effective governance
environment. This tone is imparted to the executive lead-
ership team, which in turn cascades organizationwide.
The CEO and executive management should “walk the
walk” to ensure that a positive governance culture exists
throughout the enterprise. In addition, executive leader-
6 / www.globaliia.org/standards-guidance
ship and senior management should ensure that gover-
nance policies, procedures, and programs exist and are
followed, and that there is compliance with applicable
laws, regulations, and codes.
Audit Function
Public sector audit functions can provide their organiza-
tions with governance assurance and advisory services.
The audit function charter should state that the audit
function’s scope includes all governance activities and
processes. However, this does not mean that auditors are
required to perform audits of all governance activities
and processes. The audit function should be positioned
appropriately within the organization and staffed with
proficient professionals.
The audit function can play numerous roles in assessing
and contributing to the improvement of organizational
governance. For example, auditors can:
• Provide advice on ways to improve the organization’s
governance practices if they are not mature.
• Contribute to the organization’s governance structure
through internal audits, even if those audits are not
focused specifically on governance.
• Act as facilitators, assisting the board in governance
self-assessments.
• Observe and either informally or formally assess
governance, risk, and control structural design and
operational effectiveness, while not being directly
responsible for them.
The appropriate role for the audit function and the
resource commitment to each of these roles depends
largely on the maturity of the governance system and
the organization’s size and complexity. The CAE should
discuss and reach an agreement with the board on the au-
dit function’s role in assessing organizational governance.

Assessing Organizational Governance in the Public Sector
The focus of the remainder of this practice guide is on
providing formal assessments of organizational gover-
nance. Recognizing that there could be sensitivities to as-
sessing and reporting on some board- and executive-level
governance activities, board-level support and, if needed,
sponsorship for assessments should be obtained as part of
the periodic audit planning process.
Considerations by Specific
Governance Process or Structure
Board and Audit Committee
The board should be satisfied that there is an effective
governance system in place. To that end, it should en-
sure that it is fulfilling all of its governance responsibili-
ties, the right governance processes are in place within
the organization and operating effectively, and transparent
communication exists between the organization and its
stakeholders. The board should discuss the state of the
organization’s governance system and seek input from the
three levels of assurance providers: operating or line man-
agement, organizationwide functions, and independent
activities such as the audit function. The board should
sponsor periodic evaluations and continuous improve-
ment of governance practices. This can be done through
self-assessments and obtaining assistance from the audit
function or external assurance providers. A highly compe-
tent and well-positioned audit function can assist with a
board’s self-assessment and can provide reliable assurance
on the organization’s internal governance practices.
The exact role of the board is determined by the pow-
ers, duties, and responsibilities delegated to it or con-
ferred upon it by applicable law and is typically specified
in the organization’s articles, bylaws, charters, rules, or
other similar documents. Usually, the organization’s legal
documents specify the number of members of the board,
how they are to be chosen, the frequency and mode of
meeting, and how decisions are to be made. The bylaws
primarily contain what is prescribed in legislation. More-
IPPF – Practice Guide
over, the organization’s legal documents specify the roles
and responsibilities of the board, senior management, and
other organizational bodies and functions.
The audit committee is an important governance tool to
help the board discharge its responsibility for establish-
ing and monitoring an adequate governance system within
the organization. Audit committees can be seen as com-
plementary vehicles that can improve communication and
coordination between top management — including the
governing board — and the audit function, which is pri-
marily responsible for assessing the organization’s internal
control, risk management, and governance structures.
The main desirable characteristics of an effective audit
committee are the independence and competence of
its members. These features empower audit committee
members to seek explanations and information about cru-
cial issues related to accountability and operational and
financial performance. The audit committee can help en-
sure that accepted internal audit recommendations are
followed up and taken into serious consideration by senior
management.
Leading practice guides for audit committees usually ad-
dress these areas: mandate, composition, independence,
members’ capability requirements, and reporting. Some of
these best practices include:
• An oversight mandate should be set out in a writ-
ten charter. At a minimum, the audit committee
oversight mandate should encompass areas such as
values and ethics, governance arrangements, risk
management, management control framework,
audit activities and other external assurance provid-
ers, financial statements, and public accountability
reporting.
• The composition of public sector audit committees
varies, but a minimum requirement of three mem-
bers is considered a general rule.
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
• Independence requirements are usually considered
to be met when most of an audit committee’s mem-
bers come from outside the government.
• Capability requirements include, among other
things, inquisitiveness, outspokenness, courage,
sound judgment, objectivity and integrity, a healthy
constructive skepticism, a high level of ethics, and
strong communications skills. Financial, control
framework, governance, and management expertise
also are highly desirable, if not necessary.
In assessing audit committee performance, government
auditors should focus on a three-pillar framework:
• Assessing compliance with charter obligations. Does
the audit committee discharge its responsibilities as
stated in the charter?
• Assessing the participation of audit committee mem-
bers. Is there a formal and effective assessment of
each member’s performance and contribution to the
audit committee?
• Assessing value-added activities pursued and out-
comes achieved. Does the audit committee add value
to the organization by facilitating well-informed and
effective decision-making, promoting and monitoring
an ethical culture, implementing an effective system
of risk oversight and management, implementing
an effective and efficient internal control system,
promoting effective communication with internal
and external auditors and responding appropriately to
matters they raise, and promoting high-quality inter-
nal and external reporting of financial and nonfinan-
cial information?
Strategy
Strategic planning is an organization’s process for defining
strategies for achieving its objectives, as well as making
decisions on allocating resources to pursue its strategies.
Simply put, strategic planning outlines where an organiza-
tion is going over the next few years and how the entity
proposes to get there.
8 / www.globaliia.org/standards-guidance
Strategies can exist at different levels of an organization.
They start at the overall organizational level and cascade
down.
Organizational Strategy — The highest level strategy,
organizational strategy is concerned with the overall pur-
pose and scope of the organization to meet stakeholder
expectations. This is the most critical level because it is
heavily influenced by stakeholder budgetary allocation
and acts to guide strategic decision-making throughout
the organization.
Subsidiary Strategies — Strategies that are concerned
with how the organization will successfully operate in par-
ticular areas. Subsidiary strategies involve decisions about
choice of services to be delivered, meeting community
needs, influencing political agendas, and exploiting or cre-
ating new opportunities.
Operational Strategies — At the operating level, strate-
gies are focused on how each activity or function will de-
liver organizational and subsidiary strategies. Compared to
organizational and subsidiary strategies, operational strat-
egies are much more detailed and focused on resources,
processes, people, etc. All material discrete activities and
functions should have operational strategies.
What are some conditions of satisfaction that can be used
to evaluate strategies? Strategies should:
• Be developed through a disciplined process and sup-
ported by the best available information.
• Be commonly understood by organizational person-
nel.
• Serve as a platform for all major decisions.
• Enhance stakeholder value.
• Align with other strategies, both top-down and across
the organization.
• Be clearly reflected in objectives, structures, and
operations at all levels.

Assessing Organizational Governance in the Public Sector
• Enable alignment of measurement and rewards.
• Eliminate redundancies.
• Be documented.
• Manage/maintain risks within risk tolerance limits.
• Allow risk expectations to be well understood by
stakeholders such as regulators, interest groups, citi-
zens, rating agencies, and capital markets.
In performing an assurance engagement, the audit func-
tion should assess whether each of the above conditions
are present. The assessment is generally not intended to
directly question the strategies themselves, but rather, to
assess the strategic-planning process and how well the
strategies have been communicated and adopted through-
out the organization.
Enterprise Risk Management (ERM)
Generally, the board will delegate the operation of the
risk management process to the organization’s executive
leadership team. Structures may vary depending on the
size, complexity, and maturity of the organization, and its
commitment to risk management. For example, in a small
organization with risk-conscious managers and a high de-
gree of communication about risks, there may be no need
for a formal structure. In a large organization, the struc-
ture may consist of a single individual with a staff that
owns the identification, assessment, and monitoring pro-
cesses and coordinates, along with top and middle man-
agement, risk management activities. Some organizations
have assigned specific risk management activities to the
audit function. The IIA position paper, The Role of Inter-
nal Auditing in Enterprise-wide Risk Management, pro-
vides guidance on permitted roles, roles that may be ap-
propriate with safeguards, and prohibited roles. Of great
importance is ownership of risks. Regardless of the roles
an audit function may play, it should not own any risks
other than risk within the audit activity.
There are several risk management frameworks or stan-
dards to choose from in establishing the criteria upon
See “Additional Resources” for a link to this guidance.
4
IPPF – Practice Guide
which to base the assessment. Two of the most widely
used are ISO 31000, Risk Management–Principles and
Guidelines and COSO’s Enterprise Risk Management–
Integrated Framework.
For guidance on assessing risk management, see The IIA
practice guide, Assessing the Adequacy of Risk Manage-
ment Using ISO 31000.4 That practice guide presents
three potential approaches:
• Process elements — Are all the elements of a
sound risk management process in place?
• Key principles — Does the risk management pro-
cess satisfy a minimum set of principles?
• Maturity model — How mature are the elements
of the risk management process? The practice guide
includes a basic risk maturity model.
The auditor should look at the qualitative aspects of risk
management and formal processes. For example, the qual-
ity of the risk policy or risk universe is as important as
having one in place.
Ethics
Senior management members have primary responsibility
for promoting strong ethics. The tone at the top, as indi-
cated by their actions, as well as by their formal and in-
formal communications, is critical. These actions include
their own behavior and how they respond when key em-
ployees such as other executives or “the best salesman,”
behave unethically. Operating managers set the tone in
their own areas, which may or may not be consistent with
that of the organization as a whole.
Ethical standards in areas such as gift giving differ cultur-
ally. Global organizations should decide whether and how
much to adapt their global standards to the local culture,
while being fully cognizant of all applicable laws and regu-
lations, and make this clear to all concerned.
www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
The audit function should promote ethical behavior and
may function in roles such as chief ethics officer, com-
pliance officer, or member of an ethics council, as long
as such a role does not compromise the audit function’s
independence. For more guidance on this matter, refer to
the IIA position paper: The Three Lines of Defense in Ef-
fective Risk Management and Control.
Standard 2110.A1 states: “The internal audit activity must
evaluate the design, implementation, and effectiveness of
the organization’s ethics-related objectives, programs, and
activities.” Evaluating the design might require develop-
ing and agreeing with management on criteria, perhaps by
research and benchmarking similar programs. Evaluating
the implementation will be similar to doing so for other
activities. Evaluating whether the programs are having the
desired effect requires an evaluation of the ethical climate
itself.
Evaluating the ethical climate is sensitive and can be
highly subjective. To succeed, auditors should:
• Get sponsorship and agreement on the evaluation
methods from the board and senior management. To
the extent possible, get buy-in from those who might
be subject to criticism as a result of the review.
• Consider using a maturity model for the evaluation,
because no ethical climate is completely good or bad.
• Consider using self-assessment methods such as sur-
veys or workshops, in which employees evaluate the
climate they work within and the ethical behavior of
management and other employees. Whenever pos-
sible, validate the results of these methods with more
tangible evidence. If they cannot be validated, make
this clear in reporting, and work with management to
determine the reasons for employees’ perceptions of
the climate.
Like other governance activities, ethics can be assessed as
part of a comprehensive review of governance, as a stand-
alone project that contributes to the overall governance
10 / www.globaliia.org/standards-guidance
assessment, or integrated into audits that focus more
directly on business operations or support activities.
Compliance
Compliance and ethics are closely related and are some-
times evaluated together. The preceding section on ethics
applies to compliance as well. This section presents ad-
ditional considerations.
The term “compliance,” particularly when referring to a
compliance function, normally refers to compliance with
laws and regulations, rather than compliance with internal
policies and procedures. Audit functions should consider
the need for technical assistance — for example, from the
organization’s legal department or an outside third party
— when evaluating legal and regulatory compliance.
The compliance function, if one exists, might be the sub-
ject of an audit. However, the scope should go beyond the
activities of the function itself. The effectiveness of the
function is determined by the awareness of, and commit-
ment to, compliance by employees whose work could be
noncompliant. If the CAE is responsible for the compli-
ance function, this audit should be strongly considered
as a candidate for outsourcing to an external assurance
provider.
If there is no designated compliance function, auditors
should determine and assess the methods by which the
organization fosters compliance knowledge and commit-
ment in its employees.
Organizational Accountability
The organization’s board and management derive their
authority from its key stakeholders. Accountability is im-
perative to make executive management and staff answer-
able for their behavior and responsive to the organization’s
key stakeholders. This may be achieved differently in
different countries or political structures, depending on
the history, cultural milieu, and value systems involved.

Assessing Organizational Governance in the Public Sector
The mechanisms used may vary from audit covenants at
one level to broadly elected legislatures or more narrowly
conceived consultative committees at another.
Accountability also means establishing criteria to measure
the performance of the board and management, and over-
sight mechanisms to ensure that the standards are met.
The litmus test is the process by which the stakehold-
ers can act to address inappropriate actions and reward
exemplary performance. This can be a sensitive area for
internal audit to review and underscores the importance
of the appropriate level of support and sponsorship.
When assessing accountability, the audit function
should consider:
• The organization’s legal or legislative appointment,
legal structures, and applicable laws and regulations.
• Formal and comprehensive “delegated authorities”
and “powers reserved.”
• Documented acknowledgement of their account-
abilities by key personnel.
• Processes to monitor accountabilities and corrective
actions taken when accountabilities are not met.
Monitoring
There are several different monitoring and measurement
systems in use today. Regardless of the nature, size, type,
form, or specialization, organizations tend to be interested
in the same general aspects of performance: financial, cli-
ent, internal services operations, societal, special interest
groups, employee, leadership, and stakeholder satisfaction.
By definition, the purpose of monitoring is to provide the
board and management with early indications of progress
being made, or not made, in achieving the organization’s
objectives. Monitoring enables and assists the board and
management in making timely decisions. Also, monitoring
provides a means for holding people accountable and en-
ables the organization to continually improve performance.
IPPF – Practice Guide
Monitoring should be based on an analysis and prioriti-
zation of risks to achieving organizational objectives and
the means by which those risks are mitigated. Monitoring
efforts over process-level risks should include consider-
ations for:
• Relevance.
• Reliability.
• Adaptability to address new or changing risks.
• Accuracy.
• Objectivity.
• Completeness.
• Cost-effectiveness.
• Timeliness.
• Usefulness.
• Communication and reporting content.
IT Governance
According to the Standards, IT governance consists of
leadership, organizational structures, and processes that
ensure that the enterprise’s IT supports the organization’s
strategies and objectives.
IT governance is an extension of organizational gover-
nance. As with all governance, there is no one-size-fits-
all solution. Effective IT governance should be a cohesive
and integrated process aligned with the business, compat-
ible with the management decision-making style and cul-
ture, and perceived by business management to be pro-
viding value. The board has oversight responsibility for IT
governance. The CAE should ensure that IT governance
is included in the annual program of audits.
Several widely recognized IT governance frameworks may
be used in establishing the criteria for assessing IT gover-
nance. These include:
• ISO 38500, Corporate Governance of Information
www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
Technology. This international standard is applicable
to all types and sizes of organizations. It is built
around six principles: responsibility, strategy, acquisi-
tion, performance, conformance, and human behav-
ior.
• COBIT 5. The fifth edition focuses on governance
activities that operate at the board and executive
level. It is organized in three domains aligned with
ISO 38500: evaluate, direct, and monitor.
• GTAGs are IPPF practice guides that provide
detailed guidance for conducting audit activities.5
Written in clear and concise business language,
GTAGs provide guidance for the more detailed parts
of an IT governance review.
• IT Infrastructure Library (ITIL) is a worldwide de
facto standard for service management and contains
broad, publicly available professional documenta-
tion on how to plan, deliver, and support IT service
features. Some of the core publications are: Service
Strategy, Service Design, Service Transition, and
Service Operation.
Assessing Organizational
Governance
The starting point for audit function’s assessment is to
gain an understanding of the organizational context for
governance. Efforts to understand the context include
identifying the key stakeholders and their requirements,
and determining how the organization defines governance.
The CAE should work with the board, the audit commit-
tee, and the executive management team, as appropriate,
to determine how governance should be defined for audit
purposes. After the context has been defined, major steps
or phases of the Organizational Governance Assessment
Review
Governance
Gather Governance
Documents Processes and
Structures
12 / www.globaliia.org/standards-guidance
Process outlined in Figure 3 should be followed.
Gather Governance Documents
Governance should be tailored to comply with mandatory
requirements and best fit the organization’s risk profile.
Records that document governance requirements and the
organization’s processes and structures to meet those re-
quirements include:
• Laws and regulations — These tend to establish
minimum governance requirements.
• Organizational policies, procedures, bylaws, and
operating agreements.
• Governance codes or preferred practices promulgat-
ed by an influential body related to the governance
of the organization. These codes can be mandatory,
strongly recommended, or optional.
Other resources useful in identifying governance pro-
cesses and structures include any documented evidence
of customs, behaviors, and stakeholder expectations that
exist in the organization’s operating environment. If gov-
ernance documentation is inadequate, the board should
be notified and given an initial opportunity to strengthen
governance.
Review Governance Processes and Structures
Governance processes and structures should be reviewed
as part of the assessment process and on a regular basis.
Auditors should keep in mind that there is no one-size-
fits-all governance framework or model. By design, the or-
ganization’s governance processes and structures should
respond to the requirements identified in the preceding
section.
Figure 3 – Organizational Governance Assessment Process
Establish Plan and
Assessment Develop Periodic Complete
Governance
Criteria and a Governance
Maturity Model Audit Plan Engagements
5
See “Additional Resources” for a link to this guidance.
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Governance processes and structures may come under
the purview of the board or management, depending on
the nuances of the organization, the particular process or
structure, and the level of the process or structure. The
following generic, yet comprehensive, list of governance
processes and structures can help audit functions ensure
that they include all relevant activities in their governance
review. Governance processes and structures listed are
grouped at the board level and within the organizational
(non-board) level, and include both quantitative (e.g.,
compliance metrics), and qualitative (e.g., tone-at-top)
measures. Together, board and organizational process-
es and structures form a governance umbrella over the
organization’s operations.
Board-level Governance Processes and
Structures
• Board and committee structure, charters, roles and
responsibilities, processes, and reporting.
• Board and committee activities — calendars, meet-
ing agendas, meeting papers, minutes and reports of
meetings, follow-up actions, and self-assessments of
board and committees’ governance practices.
• Board and committee composition, including selec-
tion, induction, ongoing education and training,
remuneration, and protection of members.
• Board and committee oversight areas, including
objective-setting, strategies, structures, operating
plans, budgets and capital allocation, CEO, ERM,
ethics and integrity, delegated authorities, perfor-
mance measurement and results, compensation
and rewards, policies and procedures, compliance,
decision-making, stakeholder communication such
as financial reporting and disclosures, reputation,
unpredictable events, and other organizational
governance practices.
• Assurance practices, including external, financial,
regulatory, and the audit function.
6
In some jurisdictions, compensation and retention of public sector top management is
not at the discretion of the board.
7
This type of process approval is more familiar to state-owned enterprises.
8
This is one of the main audit committee attributes.
9
Only applicable to state-owned enterprises.
• Additional practices generally retained by the board,
which may include:
›› Selecting, monitoring, evaluating, compensating,
and retaining the CEO and other key members of
senior management.6
›› Providing strategic guidance to the CEO and
senior management.
›› Reviewing and approving objectives and impor-
tant organizational plans and actions.
›› Making decisions on major transactions (trans-
formational transactions) before submission to
stakeholders for approval.7
›› Reviewing and approving major changes in
accounting and audit principles and practices.8
›› Declaring dividends and approving share-repur-
chase programs.9
›› Resolving cross-organizational issues.
Organization-level Governance Processes and
Structures
• Setting objectives.
• Developing strategies, operating plans and
budgets, organizational structures, and management
committees.
• Assigning authority and responsibilities organization-
wide.
• Defining behaviors, codes of ethics, and conduct,
including conflict of interest, fair dealing, protection
and appropriate use of assets, insider dealings, viola-
tion reporting (hot lines), and disciplinary actions.
• ERM to include internal control, fraud risk manage-
ment, and IT governance.
• Compliance with laws, regulations, and mandatory
and optional codes, where adopted.
• Monitoring and performance measurement.
www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
• Ensuring effectiveness of assurance providers
within the organization, particularly operational
management that serves as the first line of defense
for a sound system of internal controls and enter-
prisewide activities, such as risk management and
compliance, which serve as a second line of defense.
• Communication up, down, and across the organization.
• Processes that ensure effective communication with
stakeholders, interest groups, and citizens.
• Capital acquisition and allocation.10
• Capabilities — people selection, development, and
retention.
• Transformational transactions.
• Cross-organization issues.
• Organizational responsibility and sustainability.
• Evaluation and rewards, and salary and incentive
compensation.
• Organizational processes for assessing the perfor-
mance and independence of external assurance
providers, including the nature and extent of non-
audit services obtained.11
The audit function itself is a key governance tool. Its ef-
fectiveness in providing assurance to stakeholders is
critical to effective governance. The board and the audit
committee should look to the CAE for periodic reports
on the internal audit activity’s quality assurance and im-
provement program and ensure that the program provides
for an independent assessment at least every five years, as
mandated by Standard 1312: External Assessments. The
CAE should ensure that the reports of independent as-
sessors are provided to the board. In addition, the board
should draw its own conclusions on the effectiveness of
the audit function.
14 / www.globaliia.org/standards-guidance
Establish Assessment Criteria and a
Governance Maturity Model
Governance maturity models may be used to identify, de-
fine, and evaluate assessment criteria gleaned from the
review of governance records, processes, and structures.
To develop an organization-specific maturity model, the
CAE should review available models for the organization’s
country, sector, and industry, and consider the governance
documents and issues specific to the organization. A draft
maturity model should be discussed and agreed on with
senior management and the board, including the audit
committee.
In addition to establishing relevant and reliable criteria to
measure governance effectiveness, maturity models can
be used to:
• Evaluate governance effectiveness.
• Develop plans for improving the organization’s
governance structures, processes, and arrangements,
either taken as a whole or by individual governance
process (e.g., ERM, compliance, and internal audit).
These plans are particularly useful when varying
levels of maturity exist or are desired among different
processes.
• Track improvement progress.
• Benchmark governance best practices.
• Map governance activities to those responsible for
their design and operating effectiveness.
Audit activities should conclude this phase of the assess-
ment process by validating its understanding of gover-
nance processes, structures, and assessment criteria with
the board and related committees.
10
More applicable to, but not limited to, state-owned enterprises.
11
More applicable to state-owned enterprises, which, in most jurisdictions, have
their financial statements audited by private sector independent auditors. In most
jurisdictions, government organizations other than state-owned enterprises have
their financial accounts and operations audited by supreme audit institutions, which
generally have functional and administrative independence protected by law.

Assessing Organizational Governance in the Public Sector
Develop a Periodic Governance Audit Plan
The CAE should use a risk-based approach in defining the
scope of the governance assessment or assessments. It is
important to consider the nature of the organization (i.e.,
system of government, international government organiza-
tions, national and state government organizations, agen-
cies, state-owned enterprises, and municipalities) and the
context within which it operates. The risks to achievement
of organizational objectives for which comprehensive gov-
ernance processes and structures should be in place will
be greatest in large, complex, highly regulated organiza-
tions and organizations in multiple jurisdictions.
Developing a periodic governance audit plan requires:
• Discussion of any special circumstances with the
board.
• Consideration for relationships among governance,
risk management, and control.
• Selection of an audit approach.
• Consideration for reliance on other assurance providers.
Discussion of any special circumstances with the board
will provide general board and audit committee insights
to help frame the overall audit plan. The sections below
detail additional information on governance/risk/control
relationships, audit plan approach, and reliance on other
assurance providers.
Governance, Risk Management, and Control
Relationships
A periodic plan for auditing governance should consider
the relationships among governance, risk management,
and internal controls. As outlined in PA 2110-2: Gover-
nance: Relationship With Risk and Control:
• Effective governance activities consider risk when
setting strategy. Conversely, risk management relies
on effective governance (e.g., tone at the top, risk ap-
petite and tolerance, risk culture, and the oversight
of risk management).
IPPF – Practice Guide
• Effective governance relies on internal controls and
communication to the board on the effectiveness of
those controls.
• Control and risk also are related. Control is defined
as “any action taken by management, the board, and
other parties to manage risk and increase the likeli-
hood that established goals will be achieved.”
Audit Plan Approach
Governance/risk/control relationships and the nature of
the organization’s governance process and structures will
help the CAE to determine the best approach to develop-
ing the audit plan. The best approach may be one or a
combination of the following approaches:
• Audits of specific governance processes and struc-
tures such as those listed in the Review Governance
Processes and Structures section on page12.
• A single audit including all processes and structures
that focus specifically on governance. This approach
might be most practical in small organizations or as
a high-level review to determine whether additional
processes and structures are needed and whether
the existing processes and structures, taken together,
give the board all the information it needs to fulfill
its governance responsibilities.
• Incorporating governance in audits that focus more
directly on operations or support activities. In this
approach, a component of each audit would include
the interface of the governance processes and struc-
tures with the audited operation or activity. Gover-
nance audit work at the operations and support activ-
ity levels will provide detailed information to internal
audit about how well governance is understood and
practiced throughout the organization. Over time,
and if desired by the board, the audit function may
be able to assess the state of governance within the
organization as a whole, using this work as a basis for
that opinion.
www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
The CAE should discuss and agree with the board on
which approach or combination of approaches will be most
effective for the organization. To implement the selected
approach, the CAE should review the audit universe and
modify it as necessary to ensure that governance processes
and structures are included, for example:
• If the decision is to audit specific governance
processes and structures, these processes and
structures should be identified and included as
auditable entities in the audit universe.
• If the decision is to perform a single audit including
all processes and structures that focus specifically
on governance, these processes and structures will
become an auditable entity.
• If the decision is to include governance in audits
that focus more directly on business operations or
support activities, modifying the audit universe will
be more difficult. Ideally, the CAE will identify the
governance processes and structures within each au-
ditable entity and include them when assessing risk
for each entity. This might not be feasible, though,
because identifying those processes and structures
might be a major project in itself. In this case, it
might be more practical to require the audit teams to
identify and evaluate those processes and structures
during the audits they perform. Auditors will have to
add time for this additional work to each audit. After
some time — perhaps a year — auditors will know
enough about the organization’s governance that
identifying governance processes and structures in
entities not yet audited will not be a major project.
With the universe defined, auditors should use a risk-
based approach to identify the audits to be carried out
over the planning horizon. Audit functions should ensure
that a balance of units are selected for review with regard
to governance, risk management, and control. Doing so
allows the auditors to consider the holistic, organic view
of governance, risk management, and control.
16 / www.globaliia.org/standards-guidance
The CAE should obtain board input to ensure that the
highest risk non-board governance processes and struc-
tures are included in the internal audit plans. Many boards
categorize organizational risks into strategic, operational,
reporting, and compliance categories. The CAE should
work with the organization’s risk management profession-
als to identify possible discussion points with the board.
The CAE also should determine the board’s expectations
for audit function governance assessment deliverables.
Examples of potential deliverables include:
• An overall opinion on the effectiveness of
governance processes and structures.
• Opinions on the effectiveness of specific governance
attributes.
• Reports with recommendations for improvement that
do not include an opinion.
The board might prefer assessments based on a maturity
model, with the maturity of each governance attribute
measured against specific criteria. The board can then
compare the actual and desired levels of maturity for each
attribute, identify strengths and gaps, and get a more com-
plete and balanced picture of the ethical climate than an
audit opinion provides.
Some of the planned audits may be sensitive. It is im-
portant that the audit plan is reviewed with the board in
detail and its sponsorship is clearly established.
Reliance on Other Assurance Providers
Special consideration should be given relative to governance
audits including coordination with the external assurance
providers.12
During the planning process, the CAE should determine
what reliance the audit function can place on other assur-
ance providers. Internal assurance providers include func-
tions such as risk management, compliance, quality assur-
ance, environmental auditors, health and safety auditors,
12
See Practice Advisory 2050-1: Coordination and The IIA Practice Guide, Reliance by
Internal Audit on Other Assurance Providers.

Assessing Organizational Governance in the Public Sector
and government auditors. The criteria for reliance include:
• Organizational independence.
• Individual objectivity.
• Competence (e.g., technical knowledge, experience,
professional or industry certification, and continuing
professional education).
• Documentation of work.
• Engagement supervision.
• Quality of written reports delivered to management.
• Issues and action plans identified.
• Communication of results to the appropriate level of
the organization.
• Issue closure process.
• Issue closure escalation process to the appropriate
level of the organization.
• Risk-based considerations in the annual planning
process.
To confirm reliance, the audit function might:
• Review some of the assurance provider’s engagement
work.
• Re-perform a sample of the work.
• Perform one or more combined assessments with the
assurance provider.
The annual plans prepared by other assurance providers
where reliance is anticipated should be provided to internal
audit early in the audit planning cycle. The plans should
include scope, objectives, timing, and locations/areas to be
assessed. Ideally, these plans should be risk-based using
a common language — the one the audit function uses.
Copies of relevant assurance-provider performance re-
views should be provided to the audit function.
Boards with mature governance practices are beginning
to ask for more and better coordination and integration of
internal assurance services. The audit function should be
IPPF – Practice Guide
instrumental in forming an integrated or combined inter-
nal assurance-provider process.
External assurance providers such as external auditors,
third-party assurance providers, and regulatory examiners
will give the board, executive management, and stakehold-
ers’ additional comfort on aspects of the organization’s
performance and compliance. The CAE should consider
the nature, scope, and timing of external assurance pro-
viders’ work.
Plan and Complete Governance
Engagements
Note: This section deals primarily with governance
activities within the organization. Some leading internal
audit activities also provide assurance on board gover-
nance activities. Guidance on assessing board governance
is included in the Appendix.
Due to the uniqueness of each organization’s governance
processes and structures, planning a governance engage-
ment may be difficult and require significant judgment by
the auditor. Each engagement should include an evalua-
tion of the design of the process or activity and sufficient
testing to draw a conclusion on operating effectiveness.
Some specific areas to consider at the engagement level
include:
• Process objectives — goals and purpose of the pro-
cess or activities within the scope of the engagement.
• Risks — risks to the achievement of those objectives
identified in setting strategy.
• Structures — organizational units, processes, poli-
cies, and procedures that support the achievement of
objectives and are documented, communicated, and
understood.
• Accountabilities — clearly defined roles,
responsibilities, and accountabilities.
www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
• Compliance with legal and regulatory requirements.
• People — adequate staffing, training, and
development.
• Communicating results.
• Monitoring improvement action progress.
Planning the Engagement
Planning the engagement encompasses setting engage-
ment objectives, identifying governance process objec-
tives and risks, legal involvement, and engagement staff-
ing. The audit plan should include the program of audits
to be completed, timelines, and the resources needed.
Setting Engagement Objectives
Engagement objectives should align with the audit plan,
reflect the purpose for performing the engagement, and
identify the engagement deliverables. Simply put, engage-
ment objectives state what the audit will provide. Engage-
ment objectives should be formally established and com-
municated in an engagement memo or terms of reference.
Objectives should clearly state the specific assurance to
be provided. Examples include:
• Assess compliance with required governance
activities.
• Evaluate risk management activities at the subsidiary
level.
• Provide assurance on how well the organization’s
strategies have been communicated and adopted
organizationwide.
• Evaluate the design, implementation, and effective-
ness of the organization’s ethics program and related
activities.
• Assess how well authorities have been delegated,
acknowledged, and followed throughout the
organization.
18 / www.globaliia.org/standards-guidance
Identify Governance Activity (Process) Objectives and
Analyze Associated Risks
Understanding governance activity or process objectives
enables the auditor to identify and analyze associated risks
and controls. The overall objective of organizational gov-
ernance in the public sector is to best serve and protect
the public interest and ensure appropriate management
accountability and communication to its key stakeholders.
There may be different types of objectives for each spe-
cific governance activity, process, or structure. Generally,
objectives can be categorized as strategic, operational, re-
porting, and compliance. The Committee of Sponsoring
Organizations of the Treadway Commission’s (COSO’s)
Enterprise Risk Management–Integrated Framework can
provide useful guidance in identifying and understanding
governance objectives. The COSO framework has been
adapted by audit organizations to provide more direct ap-
plicability to public sector entities.13
Legal Involvement
Often, auditing requires an interpretation of laws and
regulations. Except for those with law degrees, auditors
generally do not have the legal background to adequately
interpret the more complex legal implications affecting
organizational governance. The CAE or supervisor of the
engagement should involve the organization’s legal depart-
ment or General Counsel to provide the necessary advice.
When the area of audit focus is assessment of the orga-
nization’s legal activity, the CAE should consider use of
outside counsel and obtain agreement from the board.
Engagement Staffing
Staffing requirements are shaped by the engagement’s
scope and objectives. While high-profile governance au-
dits often require individuals with advanced knowledge,
skills, competencies, and experience, the CAE is often
challenged with resource constraints. The CAE should
identify the knowledge, skills, competencies, and experi-
ence needed for the engagement and assign staff mem-
13
The U.S. Government Accountability Office and the International Organization
of Supreme Audit Institutions are among the organizations that have issued
comprehensive COSO adaptations.
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

bers who best fit the requirements. Where important gaps
exist, the CAE should consider just-in-time training, guest
auditors, or third-party providers. When using a third-par-
ty source for staffing, the CAE should ensure that guest
auditors and third-party providers are independent and
objective.
Performing the Engagement
Sources of Evidence
In providing assurance, auditors normally use a two-step
approach: Review the design and test the operating effec-
tiveness of key processes and structures. Audit functions
should gather sufficient, relevant, and reliable informa-
tion in carrying out the work and formulating conclusions
and recommendations. Evidence should be gathered from
a variety of sources, as recommended in Table 2.

Note: Many types of evidence may be relevant to one or

more processes or structures.

Table 2: Governance Assurance Engagement

PROCESS OR STRUCTURE EVIDENCE TO CONSIDER

Board and Audit Committee
• Legal documents establishing the organization (e.g., articles of formation, bylaws).
• Legal and regulatory requirements with which the board should comply (e.g., acts, statutes, and rules).
• Briefing papers including pre-meeting materials and presentations.
• Meeting minutes and actions taken.
• Charters including those of any committees of the board.
• Board member profiles.
• Self-assessments.
• Regulatory actions/sanctions.
• Orientation and training materials.
• External reports to independent auditors, regulators, rating agencies, etc.
• External reporting process documentation that evidences legal involvement.
• News sources for any relevant press regarding the organization.

www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

PROCESS OR STRUCTURE EVIDENCE TO CONSIDER

Strategy • Current list of the organization’s objectives, standards, and strategies.

• Communication protocols.
• Details on alignment throughout the organization.
• Process to update and re-communicate.
• Evidence of board approval from meeting minutes or correspondence directly from the board.
• Details showing the allocation of resources to execute strategies approved by the board.
• Documented responsibility for strategy implementation.
• Risk policy and procedures approved by the board that include risk process, risk universe with common
risk descriptions, risk tolerance levels, risk assessment and reporting process, and risk ownership.
• Details of function/department/unit/individual objectives and their alignment to organizational goals.
• Performance or reward systems that encourage personnel to achieve organizational goals that are
aligned with stakeholder expectations.

ERM • Clearly defined objectives to enable the identification and assessment of risks related to objectives.
• Formal processes/procedures to identify risks to the achievement of objectives across the entity.
• Formal processes/procedures to analyze risks as a basis for determining how risks should be managed.
• Formal processes/procedures to identify and assess changes in external and internal environments that
could significantly impact the achievement of objectives.
• Formal processes/procedures to consider the potential for fraud in assessing risks to the achievement of
objectives.

Ethics • Ethics and integrity policy — adoption, communication, affirmation, and training.
• Mission, vision, and values established and communicated.
• Whistleblower hotline established and communicated, its level of awareness and use, and the
organization’s response.
• Organizational personnel surveys confirming individual awareness and understanding.
• Organizational personnel surveys confirming that executive leadership displays a values-based culture
and philosophy.
• New employee training and orientation that include values, culture, and philosophy.
• Communication/training exists on ethics and values in “gray areas.”

20 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

PROCESS OR STRUCTURE EVIDENCE TO CONSIDER

Compliance • Articles of formation (incorporation), bylaws, operating agreements, etc.

(organizationwide) • Policies that include purpose, roles and responsibilities, audience, scope, definitions, authorities,
effective dates, implementation dates and procedures, authorities and administration, measurement,
and validation.
• Information and communication security/privacy policies and procedures.
• Standards that articulate the level of performance expected (e.g., zero defects or tolerance, Six Sigma).
• Mandatory governance requirements adopted with appropriate structures and incumbents in place at
C-suite level.
• Detailed process and accountability in place to keep current on governance requirements.
• Governance committee charters that include purpose, scope authority, roles and responsibilities, and
membership. These should be published, widely known, readily accessible, and periodically reviewed and
updated as necessary.
• Governance committee meeting minutes, actions taken, and reporting.
• Examples of governance committees in large organizations include governance, strategy, risk, audit,
control, compliance, disclosure, finance, and IT governance/risk.
• For large and more complex organizations, governance structures and organization charts that cascade
throughout the organization, are fully staffed, and have clear reporting relationships.
• Details on governance processes where there is shared accountability, particularly in organizations that
use matrices management.
• Process details for addressing or approving deviations to policies, standards, and procedures.
• Financial reports.
• Regulatory actions.
• Internal measurement results such as balanced scorecards.
• Civil actions.
• Press releases about the organization — what others are saying about the organization.
• Analysis, particularly external, comparing actual results to objectives and expectations, both short and
long term.
• External reports along with documentation evidencing conformance with established procedures.

www.globaliia.org/standards-guidance / 21
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

PROCESS OR STRUCTURE EVIDENCE TO CONSIDER

Compliance (level • Documentation that identifies all organizational activities, operations, departments, functions, and
below organizationwide processes.
structures) • Documented maps for each process showing inputs, activities, tasks, steps in the process, and outputs.
Mapping also should include references such as objectives, citizen conditions of satisfaction, ownership,
procedures to update when necessary, and procedures to make available to those with the need.
• Documentation for all aspects of transformational transactions and existing process change
management.
• Details on mandatory/required reporting to external parties.

Organizational • Job descriptions for all organization personnel that contain responsibilities, authorities, reporting
Accountability relationships, and education.
• Professional development program/process that applies to all personnel.
• Leadership development program/process.
• Individual training records that include skills assessments, development plans, and training completed.
• Organizationwide training on ethics, integrity, and values.
• Personnel surveys that provide insights into how people view the organization’s commitment to people,
their capabilities, accountabilities, behavior, training, and education.
• Detailed, board-approved delegated authorities with processes for personnel acknowledgement, periodic
review, validation, and remediation when authorities are breached.
• Disclosure committee charter, roles, responsibilities, and meeting minutes.

22 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

PROCESS OR STRUCTURE EVIDENCE TO CONSIDER

Monitoring • Documented organizational performance measurement system that illustrates the system and describes
the required information, form of the reports, reporting periods and due dates, and safeguards that
ensure accuracy and completeness.
• Copies of actual reports.
• Personnel and customer surveys: processes, questions, frequency, audiences, results, responses, and
status of improvement actions.
• Monitoring systems over and above performance measurement systems that should specify what and
when to monitor, responsibility, results, and improvement action plans and status.
• Internal communication systems up, down, and across the organization.
• Details on assurance mechanisms that include charters, scope, plans, and reports.
• Benchmarking process and results.
• Information “asset” management process/program.
• Due diligence evidence/documentation on assessment of third-party governance practices.
• External reports with comparisons to relevant internal reports covering governance practices.
• Surveys and results regarding personnel perceptions of the quality of information and communication.

IT Governance • IT governance/risk/control program and processes.

(where applicable) • Defined information security policies, procedures, and practices.

www.globaliia.org/standards-guidance / 23
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
Workpaper Documentation
Due to the sensitivity of some governance audit work,
special handling may be needed for access and storage of
related audit workpapers. Audit workpapers are the prop-
erty of the organization. The files are under the control of
the audit function and are accessible only to authorized
personnel and citizens or others granted the right by le-
gal jurisdiction. Management review may be granted to
substantiate or explain audit findings or to use audit docu-
mentation for other purposes.
Communicating Outcomes and Results
Audit functions should communicate engagement out-
comes and results consistent with Standard 2400 and
Practice Advisory 2400-1.14 Due to potential sensitivity,
the audit function should consider obtaining the general
counsel’s advice on communicating results and retain-
ing related workpapers before starting the engagement.
Reporting may be formal or informal, with consideration
for which method will stimulate corrective action with-
out resulting in unintended negative repercussions. Even
if reporting is informal, audit functions must follow the
Standards in communicating the audit results and in mon-
itoring improvement action progress.
The CAE may be asked to facilitate self-assessments of
the board or its committees. The results, including any
action plans, should be documented so that the board
can monitor their progress. The method for documenting
and communicating results will be at the board’s discre-
tion. The CAE should agree with the board and executive
management on dissemination of all governance-related
reports.
24 / www.globaliia.org/standards-guidance
Monitoring Improvement Action Progress
The CAE should work with the audit committee to estab-
lish a system to monitor the progress of improvement ac-
tions communicated to management and the board. Due
to the importance of governance activities and board and
CEO responsibilities for effective governance, the system
should include:
• The time frame within which the improvement
action will be completed, including key milestone
dates.
• Ongoing evaluation of governance activity owners’
responses.
• Audit functions validation or follow-up audit of the
improvement action.
• An escalation process for unsatisfactory response
to include the assumption of risk for a delayed or
incomplete improvement action.
Engagement Administration
Governance audits can become high profile because they
are generally public record. If the audit function is to have
a key role in assessing governance, its overall effective-
ness in providing assurance to stakeholders is critical. The
CAE should ensure that governance engagements are
adequately staffed, appropriately supervised, and subject
to the audit function quality assurance and improvement
process, consistent with the Standards.
The board, through its audit committee, should look to
the CAE for periodic reports on the audit activity’s qual-
ity assurance and improvement program and ensure that
the program provides for an independent assessment at
least every five years. The CAE also should ensure that
these reports are provided. In addition, the board should
draw its own conclusions on the effectiveness of the audit
function.
14
See “Additional Resources” for a link to IIA guidance, Transparency of the
Internal Audit Report in the Public Sector.
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Additional Resources
IIA Guidance
GTAG 17: Auditing IT Governance
https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/GTAG17.aspx

Practice Advisory 2050-1: Coordination

https://global.theiia.org/standards-guidance/Member%20Documents/PA_2050-1.pdf

Practice Advisory 2110-2: Governance: Relationship With Risk and Control

https://global.theiia.org/standards-guidance/Member%20Documents/PA_2110-2.pdf

Practice Advisory 2120-3: Internal Audit Coverage of Risks to Achieving Strategic Objectives
https://global.theiia.org/standards-guidance/Member%20Documents/PA_2120-3.pdf

Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000
https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/Assessing-the-Adequacy-
of-Risk-Management-Practice-Guide.aspx

Practice Guide: Coordinating Risk Management and Assurance

https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/Coordinating-Risk-Man-
agement-and-Assurance-Practice-Guide.aspx

Practice Guide: Evaluating Ethics-related Programs and Activities

https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/Evaluating-Ethics-relat-
ed-Programs-and-Activities-Practice-Guide.aspx

Practice Guide: Reliance by Internal Audit on Other Assurance Providers

https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/Reliance-by-Internal-Au-
dit-on-Other-Assurance-Providers-Practice%20Guide.aspx

Public Sector Definition

https://global.theiia.org/standards-guidance/leading-practices/Pages/Public-Sector-Definition.aspx

The Role of Auditing in Public Sector Governance

https://global.theiia.org/standards-guidance/leading-practices/Pages/the-role-of-auditing-in-public-sector-governance.
aspx

Transparency of the Internal Audit Report in the Public Sector

https://global.theiia.org/standards-guidance/leading-practices/Pages/Transparency-of-the-Internal-Audit-Report-in-
the-Public-Sector.aspx

www.globaliia.org/standards-guidance / 25
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Non-IIA Guidance
Board Briefing on IT Governance, 2nd Edition. IT Governance Institute.

Enhancing Board Oversight by Avoiding and Challenging Traps and Biases in Professional Judgment (2012). COSO.

Enterprise Risk Management–Integrated Framework (2004). COSO.

Internal Control–Integrated Framework (2013). COSO.

Principles of Good Governance. Professional Risk Managers’ International Association, September 2009.

26 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Appendix — Board Risks, Control Objectives, and Practices

The overall objective of organizational governance is to inform, direct, manage, and monitor an organization’s activities
toward achieving its objectives. On behalf of the organization’s key stakeholders, the board is the focal point for ensuring
effective governance.

The following table describes examples of risks that boards may encounter as well as control objectives and practices that
can be used to manage them.

RISKS/EVENTS CONTROL OBJECTIVES PRACTICES

Board members do not have There is a sufficient number of outside, independent members of the
the required organization, board as required by organizational need and applicable laws.
industry, technical, IT,
or other knowledge and The sufficient number of members and expertise needed for the board
experience. is defined by formal, specific criteria.

Practices are in place to ensure the right mix of expertise, skills, and
diversity is represented on the board at all times.

Backgrounds of potential board members are thoroughly reviewed

and validated.

Term limits are strictly enforced to ensure a regular infusion of new

To fulfill board roles
individuals who bring needed competencies, provide fresh thinking,
and responsibilities
and keep governance connected to the stakeholders.
completely, accurately,
and timely.
Members do not understand Orientation, onboarding, and continuous training is conducted to
the role or responsibilities of ensure all members understand their role and responsibilities.
the board.

Failure of board members to The board charter, policies, roles and responsibilities, and procedures
adequately fulfill their roles are documented and made available.
and responsibilities.
Updates are made timely.

Changes are communicated adequately.

Board members periodically visit the organization and meet with key
leaders.

www.globaliia.org/standards-guidance / 27
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector
RISKS/EVENTS
Failure of the board to meet
legal requirements.
Failure of individual board
members to exercise
appropriate due diligence.
Insufficient challenge and
skeptical inquiry is provided
by board members.
28 / www.globaliia.org/standards-guidance
CONTROL OBJECTIVES PRACTICES
All legal requirements are identified, communicated, and made
To meet legal available to board members.
requirements of the
Requirements are continuously monitored.
board.
Updates are communicated timely and adequately.
A parliamentarian is assigned to monitor and advise on board
processes, procedures, and legal requirements.
An agenda is followed and minutes are kept for all meetings.
To ensure all board Action dockets or similar methods are used to track assignments and
policies, procedures, and deadlines.
legal requirements are
followed. Calendars are maintained to keep board members informed of
meetings and important deadlines.
Individual evaluations and board assessments are conducted at least
annually to identify improvements and if any board members’ terms
have ended and/or need to be rotated off the board.
Robert’s Rules of Order 15 procedures are followed in board meetings,
which are the standards for board rules of order.
Sufficient time is allocated in all agendas for open discussion and
debate.
The chairman of the board position is held by an outside, independent
member with extensive experience on other boards. This is considered
To ensure all board a best practice and is mandated by law in some jurisdictions because
members’ concerns are such a person is less likely to be influenced by relationships with, and
identified and addressed. the personal interests of, management, and may be more effective in
challenging executive actions.
The board interacts regularly with the internal and external auditors,
at times outside the presence of management, to ensure they are
allowed to carry out their mandate in an unrestricted manner.
A sufficient number of nonexecutive directors on the board are
attending board meetings.
14
Originally titled Pocket Manual of Rules of Order for Deliberative
Assemblies, written by Henry Martyn Robert in 1876. See http://www.
robertsrules.com/ for latest edition.

RISKS/EVENTS
Unknown or unanticipated
vulnerabilities.
Decisions are made or
actions are taken based on
unreliable, incomplete, or
untimely information.
Failure to meet stakeholder
expectations.
Failure to appropriately
inform key stakeholders.
Organizational governance
structures, processes, and
practices are ineffective or
lack sustainability.
Assessing Organizational Governance in the Public Sector
CONTROL OBJECTIVES
To ensure board members
understand the risks
to the organization’s
objectives and the related
vulnerabilities of the
organization.
To ensure the board has
reliable, complete, and
timely information.
To ensure primary
stakeholder needs are
known by all board
members.
To ensure that all
mandatory and
optional information is
communicated accurately
and timely to key
stakeholders (including
regulatory agencies).
Ensure an appropriate
organizational
governance framework
is in place and operating
effectively.
IPPF – Practice Guide
PRACTICES
Risk assessments conducted by the organization’s chief risk officer
— if one exists — management, internal audit, or external parties
(e.g., external auditors, regulators) are provided to board members as
they become available.
Board members conduct their own risk assessments at least annually
to include scanning the environment for unanticipated events that
may harm the organization’s reputation.
All necessary information (e.g., background, financial impact, risks,
and benefits) is provided to board members in a consistent format
with sufficient time for thorough review before decisions are made.
Sufficient time is allowed for debate before decisions are made.
Primary stakeholders are identified and allowed to vote on board
membership.
Surveys are conducted periodically to identify primary stakeholder
needs.
Primary stakeholders are allowed to attend meetings and ask
questions at appropriate times during the meeting.
The board reviews and approves all information, reports, and filings
before release of information to key stakeholders.
Board oversight and monitoring of key organizational activities such
as objective setting, strategies, structures, operating plans and
budgets, operating performance, and results.
A succession-planning process exists for the organization’s CEO and
other key leadership positions.
The board reviews and approves the organization’s code of conduct,
ethical culture, policies, and procedures.
www.globaliia.org/standards-guidance / 29
IPPF – Practice Guide
Assessing Organizational Governance in the Public Sector

Author, Contributors, and Reviewer

Author
Gualter Portella, CIA, CCSA, CGAP, CRMA

Contributors
Scott Cohen, CIA, CCSA, CGAP, CRMA
Oliver Dieterle, CIA, CGAP, CRMA
Dr. Tea Enting-Beijering
Greg Hollyman, CIA, CCSA, CFSA, CGAP, CRMA
Kenneth J. Mory, CIA, CRMA
Christie J. O’Loughlin, CGAP, CRMA
Gloria Spelman, CGAP
Mmathabo Sukati, CIA, CCSA

Reviewer
Bruce Turner CGAP, CRMA, CISA, CFE, CFIIA

30 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2014 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at guidance@theiia.org.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

GLOBAL HEADQUARTERS T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

140454
 – Practice Guide

›› CREATING AN INTERNAL AUDIT

COMPETENCY PROCESS
FOR THE PUBLIC SECTOR
FEBRUARY 2015
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Table of Contents

EXECUTIVE SUMMARY................................................................................... 1

INTRODUCTION.............................................................................................. 1

BUSINESS SIGNIFICANCE AND RELATED RISKS.......................................... 2

DEFINITIONS OF KEY CONCEPTS................................................................ 2

RELATED IIA STANDARDS........................................................................... 3

PLANNING...................................................................................................... 4

THE INTERNAL AUDIT COMPETENCY PROCESS (IA-CP)................................ 4

VISION PHASE............................................................................................ 5

OVERSIGHT PHASE..................................................................................... 6

DIRECTION PHASE...................................................................................... 6

COMPETENCY PHASE................................................................................. 7

MONITORING PHASE.................................................................................. 9

APPENDIX A — CITY OF AUSTIN, TX: STRATEGIC COMPETENCY

PLAN PROCESS............................................................................................ 12

APPENDIX B — AUSTRALIAN GOVERNMENT CENTRAL AGENCY

STRATEGIC COMPETENCY PLAN PROCESS................................................. 15

APPENDIX C — RESOURCES....................................................................... 18

AUTHORS, CONTRIBUTORS, AND REVIEWERS............................................ 19

www.globaliia.org/standards-guidance / iii

Creating an Internal Audit Competency Process for the Public Sector
Executive Summary
Across the globe, public sector entities are facing
increasing demands and heightened expectations from
the community, government, and other stakeholders. In
part, this reflects the complexity, depth, breadth, and
cross-jurisdictional nature of the public sector landscape.
Independent assessment of public sector accountabil-
ity, risk management, and internal control is increasingly
reliant on well-mandated and structured audit activi-
ties comprising competent internal auditors. An internal
audit competency process is designed to meet audit
activities’ competency requirements and support the
Internal Audit Capability Model (IA-CM) for the public
sector.1
The Internal Audit Competency Process (IA-CP) is a flex-
ible process that can be used to benefit the audit function’s
activities. Key players in the process include the Board or
Board Oversight Committee (BOC)2 and the chief audit
executive (CAE). Effective audit planning — including
the strategic alignment of the IA-CP with the entity’s stra-
tegic plan — will help to streamline efforts.
The IA-CP comprises five phases, broken down into
12 steps. The five phases include:
1. Vision – Assess the current position of the audit
function’s collective competencies and identify the
desired position.
2. Oversight – Determine the audit function’s
competency goals and identify competencies that
need to be developed or sourced.
3. Direction – Decide how to best develop the required
skills or source them from third parties.
4. Competency – Develop and implement a strategic
competency plan.
5. Monitoring – Evaluate effectiveness of the strategic
competency plan.
1
The IIA Research Foundation, Internal Audit Capability Model (IA-CM)
for the Public Sector, 2009.
2
See definition on page 2.
IPPF – Practice Guide
Each phase includes multiple steps to be executed by the
CAE, Board, or BOC. Each step is described in detail
within this guidance, and case studies from the United
States and Australia depict how this guidance has been
put into practice.
Introduction
National, regional, and local level public sector internal
audit activities work with government officials, boards,
CEOs, and management on behalf of taxpayers, consumers
of government services, and the general public. The audit
function’s effectiveness is impacted by unique public
sector characteristics, including:
• The demand for a high level of transparency and
performance.
• The usual absence of a profit motive.
• A wide variety of organizational forms (e.g., national,
regional, and local governments and quasi-
governmental and international government
organizations).
• Complex legal frameworks for governing bodies.
In 2009, The IIA Research Foundation published
the Internal Audit Capability Model (IA-CM) for the
Public Sector. The IA-CM is a framework that identifies the
fundamentals needed for effective internal auditing in
government and the broader public sector. The IA-CM
illustrates the stages through which an audit function
evolves as it defines, implements, measures, controls, and
improves its processes and practices.
www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector
• The IA-CM describes WHAT capabilities are
required of a public sector audit function.
• The IA-CP describes HOW to achieve those
capabilities through the competence of the
audit staff.
This practice guide complements the IA-CM by providing
specific guidance on developing, implementing, and
sustaining an IA-CP to ensure that the organization’s
audit function has the collective knowledge, skills, and
other competencies necessary to complete planned
audits and to support the audit function as it evolves. The
IA-CP attempts to match the capability level of the audit
function with the internal auditor competencies needed
to support it.
Business Significance and Related Risks
In times of change and uncertainty, political risk is
heightened, as reflected in the potential for financial
or market losses or the reduction in talent and human
resources because of political decisions or disruptions.
Public sector internal auditing is being reframed by 21st
century economic and technological events.
Not surprisingly, this reframing has created both risks and
opportunities. Rapid change, emerging technologies, and
increasingly complex economic, regulatory, and operating
environments may increase audit risk — the risk of
reaching invalid audit conclusions and/or providing faulty
advice based on the audit work conducted.3 At the same
time, these circumstances serve as a catalyst for the
audit function to develop an IA-CP to provide the
opportunity to enhance and develop the necessary compe-
tencies to meet these challenges head on. Without sufficient
investment in internal audit competencies, there may be
increased exposure to key risks associated with not improving
the audit function activities across government, such as:
2 / www.globaliia.org/standards-guidance
• Failing to meet government commitments due to
loss of control, particularly during critical policy,
service delivery, and business system change.
• Service delivery failure (e.g. cross-agency matters,
poor procurement and operations, and information
communication and technology systems).
• Inefficient use of existing resources and potential
maladministration.
• Unreliable information for government decision-
making.
• Increased opportunities for fraud and corruption,
particularly with increased electronic service delivery.4
Definitions of Key Concepts
Audit function – See definition of Internal Auditing on page 3.
Audit risk – The risk of reaching invalid conclusions
and/or providing faulty advice based on the audit work
conducted.5
Board – The highest level of governing body charged with
the responsibility to direct and/or oversee the activities
and management of the organization. Typically, this
includes an independent group of directors (e.g., a board
of directors, a supervisory board, or a board of governors or
trustees). If such a group does not exist, the “board” may
refer to the head of the organization. “Board” may refer
to an audit committee to which the governing body has
“delegated certain functions.”6 As used in this guidance,
“board” refers to the governing body of a public sector entity.
Board Oversight Committee (BOC) – As used in this
guidance, BOC refers to a board committee with
responsibility for oversight of the internal audit function.
In some jurisdictions, this will be an audit committee.
Competency – The ability of an individual to perform a
job or task properly, being a set of defined knowledge,
skills, and behavior.7
Kurt F. Reding et. al., Internal Auditing Assurance & Advisory Services, 3rd Ed, p. 10-3
3,5
(The Institute of Internal Auditors Research Foundation, 2013).
4
“Review of Internal Audit Capacity in NSW Public Sector,” New South Wales Department of
Premier and Cabinet, Performance Review Unit, 2008.
6
The IIA’s International Standards for the Professional Practice of Internal Auditing (Standards).
7
The IIA’s Global Internal Audit Competency Framework, The Institute of Internal
Auditors, Inc., 2013.

Creating an Internal Audit Competency Process for the Public Sector
Internal Auditing – An independent, objective assurance
and consulting activity designed to add value and improve
an organization’s operations. It helps an organization
accomplish its objectives by bringing a systematic,
disciplined approach to evaluate and improve the
effectiveness of risk management, control, and gover-
nance processes.
Internal Audit Capability Model (IA-CM) – A framework
that identifies the fundamentals needed for effective
internal auditing in the public sector.8
Internal Audit Competency Process (IA-CP) – A
series of activities designed to enhance the likelihood that
public sector internal auditors collectively achieve the
knowledge, skills, and other competencies necessary
to support their respective audit activities as their
capabilities progressively evolve.
The IIA’s Global Internal Audit Competency
Framework – A tool that defines the competencies needed
to meet the requirements of the International
Professional Practices Framework® (IPPF®) for the success
of the internal audit profession.9 The framework outlines
the 10 core competencies to be demonstrated by each of
three broad job levels — internal audit staff, internal audit
management, and the CAE. Core competencies include:
I. Professional ethics: Promotes and applies
professional ethics.
II. Internal audit management: Develops and
manages the internal audit function.
III. IPPF: Applies the International Professional
Practices Framework (IPPF).
IV. Governance, risk, and control: Applies a
thorough understanding of governance, risk,
and control appropriate to the organization.
V. Business acumen: Maintains expertise of the
business environment, industry practices, and
specific organizational factors.
8
Internal Audit Capability Model (IA-CM) for the Public Sector, 2009 The IIA Research
Foundation, 2009
9
The IIA’s Global Internal Audit Competency Framework, 2013.
IPPF – Practice Guide
VI. Communication: Communicates with impact.
VII. Persuasion and collaboration: Persuades and
motivates others through collaboration and
cooperation.
VIII. Critical thinking: Applies process analysis,
business intelligence, and problem solving
techniques.
IX. Internal audit delivery: Delivers internal audit
engagements.
X. Improvement and innovation: Embraces
change and drives improvement and innovation.
Related IIA Standards
The International Professional Practices Framework
(IPPF) outlines the following International Standards for
the Professional Practice of Internal Auditing (Standards)
related to competency. Additional competency-related IIA
guidance documents are identified in Appendix C.
Standard 1010: Recognition of the Definition of
Internal Auditing, the Code of Ethics, and the
Standards in the Internal Audit Charter
The mandatory nature of the Definition of Internal
Auditing, the Code of Ethics, and the Standards must be
recognized in the internal audit charter. The chief audit
executive should discuss the Definition of Internal
Auditing, the Code of Ethics, and the Standards with senior
management and the board.
Standard 1200: Proficiency and Due Professional Care
Engagements must be performed with proficiency and
due professional care.
• 1210 – Proficiency: Internal auditors must possess
the knowledge, skills, and other competencies
needed to perform their individual responsibilities.
The internal audit activity collectively must possess
or obtain the knowledge, skills, and other
competencies needed to perform its responsibilities.
www.globaliia.org/standards-guidance / 3
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector
• 1210.A1 – The chief audit executive must obtain
competent advice and assistance if the internal auditors
lack the knowledge, skills, or other competencies
needed to perform all or part of the engagement.
• 1210.A2 – Internal auditors must have sufficient
knowledge to evaluate the risk of fraud and the
manner in which it is managed by the organization,
but are not expected to have the expertise of a person
whose primary responsibility is detecting and
investigating fraud.
• 1210.A3 – Internal auditors must have sufficient
knowledge of key information technology risks and
controls and available technology-based audit
techniques to perform their assigned work. However,
not all internal auditors are expected to have the
expertise of an internal auditor whose primary
responsibility is information technology auditing.
• 1210.C1 – The chief audit executive must decline
the consulting engagement or obtain competent
advice and assistance if the internal auditors lack the
knowledge, skills, or other competencies needed to
perform all or part of the engagement.
• 1220 – Due Professional Care: Internal auditors
must apply the care and skill expected of a
reasonably prudent and competent internal auditor.
Due professional care does not imply infallibility.
Standard 1230: Continuing Professional
Development
Internal auditors must enhance their knowledge, skills,
and other competencies through continuing professional
development.
4 / www.globaliia.org/standards-guidance
Planning
Effective planning is key to the successful development
and implementation of an IA-CP. The following planning
activities will help to streamline efforts.
• Determine the strategic links between the audit
function and the organization’s statutory objectives,
values, and strategic plan.
• Research the legal basis of the audit function within
the entity’s geopolitical environment.
• Evaluate compliance of the audit function with
government policy on internal auditing.
• Establish alignment with The IIA’s Standards and
other applicable standards.
• Assess congruence between the audit function
mandate and the audit committee charter.
• Review existing documents:
›› The audit function charter.
›› The audit function organizational structure.
›› Audit plan.
›› Audit universe that addresses new threats and
opportunities that may quickly evolve or appear
on the horizon.
›› The audit function job descriptions (CAE,
manager, staff auditor, IT auditor, etc.).
The Internal Audit Competency
Process (IA-CP)
The IA-CP can be applied by public sector entities
striving to establish a new audit function as well as by
established audit activities striving to progress to a higher
IA-CM level. The IA-CP comprises five phases, which
are further broken down into 12 steps, as illustrated in
Table 1: Internal Audit Competency Process (IA-CP).
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Table 1: Internal Audit Competency Process (IA-CP)

NEW OR REPOSITIONED AUDIT FUNCTION ESTABLISHED AUDIT FUNCTION

Vision Phase Oversight Phase Direction Phase Competency Phase Monitoring Phase

Step 4 – Select Step 6 –

Step 1 – Assess Step 8 – CAE develops Step 11 – BOC
qualified board Identify and
the balance of skills a strategic competency reviews audit function
oversight com- recruit a The internal audit function
within the board. plan. competency profile.
mittee (BOC). qualified CAE. fulfills competency needs
and achieves conformance
Step 12 – BOC
Step 2 – Assess Step 7 – De- with IIA Standards. It has
Step 5 – Devel- Step 9 – CAE identifies endorses and monitors
the organization’s velop internal positioned itself to add
op BOC charter. existing competencies. strategic competency
needs. audit charter. value to the business and
plan.
help it achieve its
Step 3 – Identify objectives.
desired IA-CM
Step 10 – CAE identifies
level and scope of
competency gaps.
responsibility and
authority.

Note: The IA-CP is designed to be flexible. An entity or audit function may begin at any phase, and steps within a phase may be conducted simultaneously
or in different order, as needed.

Vision Phase mix of skills should include a working knowledge of

contemporary governance, risk, and compliance
The IA-CP vision relates to how the board wants to
frameworks, and leading internal control frameworks
position the audit function in the future. It should align
such as The Committee of Sponsoring Organizations of
with the organization’s statutory objectives, values, board
the Treadway Commission’s (COSO’s) Internal Control–
mandate, strategic plan, business plans, and assurance
Integrated Framework, the Canadian Criteria of Control
framework, with consideration for known and emerging
Board’s Internal Control Framework, the King Code of
risks and vulnerabilities. The cultural, social, economic,
Governance, or the U.K. Corporate Governance Code.
political, and legal characteristics of the entity’s jurisdic-
Experience should be commensurate with the audit
tion will impact the IA-CP vision. The vision phase should
function’s current position within the IA-CM, and the
be performed by, or on behalf of, the board and may be
entity’s complexity and level of government (e.g., national,
in response to a legislative mandate, a regulatory require-
regional, or local).
ment, an administrative policy, or a management dictate.10
The vision phase comprises three steps. Step 2 – Assess the Organization’s Needs
Step 1 – Assess the Balance of Skills within the Board The second step in the vision phase is to assess the audit
activities current IA-CM level (see Table 2), relative to
The first step is an assessment of the board’s ability
the needs of the organization. Consideration should be
to oversee the establishment or repositioning of the
given for required competencies of internal audit staff at
audit function. Qualifications should provide a
all levels. Public sector audit functions operate in a com-
multidisciplinary mix of professions including legal,
plex environment. The vision should be congruent with
accounting, technology, and public administration. The
the degree of complexity. For example, an audit function

For related information, see The IIA’s Global Public Sector Insight: Policy Setting for
10

Public Sector Internal Auditing in the Absence of Government Legislation, 2014. www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Table 2: Competencies Associated with IA-CM Levels

COMPETENCIES ASSOCIATED WITH IA-CM LEVELS

Level 5
Top-level professional and specialized skills
Optimizing
Level 4
Requisite skills/competencies in place; renewable and shareable
Managed
Level 3
Professionally qualified staff/internal audit function coordination
Integrated
Level 2
Continued reliance on individual auditor
Infrastructure
Level 1
Skills of individual auditor
Initial

operating in an industry with unique risks (such as nuclear exists, the governing board should confirm that it is well
energy) most likely would be required to have more tech- qualified. See Global Public Sector Insight: Independent
nical competencies compared to an audit function operat- Audit Committees in Public Sector Organizations for more
ing in a less complex environment (such as policy setting). information.

Step 3 – Identify the Desired IA-CM Level and Scope
of Responsibility and Authority
The board should clearly identify the desired position
of the audit function, in accordance with the IA-CM
illustrated in Table 2: Competencies Associated With
IA-CM Levels. Factors to consider include the scope
of audits, the structural arrangements within the audit
function, and the balance of skills needed. The board
and the CAE should collaborate to the greatest extent
possible — each will have varying degrees of input depend-
ing on their own respective competencies and the current
position of the audit function.
Oversight Phase
During the oversight phase, the audit activities’
competency goals are determined and competencies that
need to be developed or sourced are identified.
Step 4 – Select Qualified Board Oversight
Committee (BOC)
For new audit activities, the board should appoint a BOC
with the skills described in Step 1. If a BOC already
Step 5 – Develop BOC Charter
The BOC should develop a charter addressing
competencies expected of the committee members in
conjunction with the desired IA-CM maturity level and
the organization’s operations, reporting, and compliance
objectives. See model charter contained in the Global
Public Sector Insight: Independent Audit Committees in
Public Sector Organizations.
Direction Phase
The direction phase involves activities to define and
acquire a qualified CAE and, subsequently, for that CAE
to initiate steps to move the audit function forward.
Step 6 – Identify and Recruit a Qualified CAE
The BOC should identify the competencies required for
the CAE. The BOC, the CEO, and the existing CAE (if
applicable) should be involved in creating or updating the
CAE’s job description. Next, it should be determined if
the identified competencies are present within the audit
function and, if not, whether they can be developed

6 / www.globaliia.org/standards-guidance

Creating an Internal Audit Competency Process for the Public Sector
internally, recruited from within the organization, or
provided by a third party. The CAE must have relevant
public sector experience and have achieved competency
on the IA-CM at a level consistent with or better than
the desired IA-CM level established by the BOC in
Step 3. The CAE also should demonstrate CAE-level
competencies identified in The IIA Global Internal Audit
Competency Framework (Competency Framework).
See The IIA’s Practice Guide, Chief Audit Executives
Appointment, Performance Evaluation, and Termination
for more information.
Step 7 – Develop Internal Audit Charter
A CAE must develop an internal audit charter in
conformance with IIA Standard 1010: Recognition of the
Definition of Internal Auditing, the Code of Ethics, and
the Standards in the Internal Audit Charter. The charter
should be consistent with the related BOC charter
and address the relevant IA-CM maturity level and the
desired competency requirements in accordance with the
Competency Framework. Sample language:
Our vision is to continue to evolve the internal audit
function within the entity to embrace the relevant and
recognized elements of a “world-class” audit function.
These elements are founded on client experience,
audit planning, maximizing audit resources, audit
strategy, and audit breadth. By (year), the internal
audit function will be recognized through an
independent review as operating at an “optimizing”
level on the IA-CM.
Competency Phase
The strategic competency plan is developed and
implemented during the competency phase.
Step 8 – CAE Develops a Strategic Competency Plan
In conjunction with the development of the audit
plan, the CAE should develop a complementary
competency plan. The competency plan should identify
IPPF – Practice Guide
the competencies necessary to implement the audit
plan. Key points to consider when developing a
competency plan include:
• Develop an aspiration statement. For example: By
(year), anyone who is practicing internal auditing
at the entity will be appropriately certified or will be
reporting to someone who is appropriately certified.
• Leverage the Competency Framework.
›› An approach is to distinguish between basic
awareness and greater degrees of
competence including understanding, proficiency,
and expertise.
›› Consider the size of the audit function, the audit
environment, and complexity of the audit plan in
selecting an approach.
• If an entity has its own capability framework, map
the Competency Framework’s core competencies to
the entity’s framework.
• Apply the Competency Framework to the audit
function’s third-party providers. For more
information, see The IIA’s Position Paper, The Role
of Internal Auditing in Resourcing the Internal
Audit Activity.
• Identify sophisticated technical and business
acumen competencies necessary to anticipate how
risks impacting other industries or sectors might
eventually impact the entity.
• Revise applicable policies, procedures, and job
descriptions to reflect the strategic competency
plan requirements.
www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Table 3: Sample IA-CP Skills Matrix

SAMPLE IA-CP SKILLS MATRIX

IA-CP Stakeholder Competency Goal Gap Action

New government-directed business Appoint a member to the

Stable, well balanced, and multiskilled
initiatives are being explored with the governing body with extensive
Board with extensive public sector experience.
likelihood of a commercial business arm business and transformational
Well connected with government’s agenda.
being established to cover utility services. leadership experience.

Board Oversight The entity is set to embark on a complex

Strong governance, risk, control, financial, Recruit a BOC member with
Committee multimillion-dollar technology solution.
and auditing skills. extensive skills in IT governance.
(BOC) BOC has limited IT experience.

Engage an executive coach to

Well respected and highly experienced in
CAE
traditional auditing techniques.
BOC is looking for the audit function to add
assist the CAE in the
greater value, and sees a need for them to
transformation of the audit
step up to a higher maturity level.
function.

Deliver a tailored communications

Multidiscipline skill set with strong public
Auditor
sector auditing experience.
Objective feedback in stakeholder
training course for all internal
satisfaction surveys has indicated that
auditors, including writing,
auditors need to improve in their
presenting, controlling meetings,
communication skills.
listening, and body language.

Step 9 – CAE Identifies Existing Competencies
The CAE should inventory existing competencies among
the audit staff. Procedures for gathering information include:
• Benchmarking – Comparing the overall profile of
the audit staff against entities with leading audit
practices.
• Feedback – Analysis of responses to stakeholder
satisfaction surveys (e.g., audit committee, internal
clients, and audit staff).
• Inquiry – Interviewing clients or third parties, or ask
internal auditors to complete a competency self-
assessment.
• Observation – Watch internal auditors perform
various duties.
• Inspection – Review performance evaluations and
training records.
Step 10 – CAE Identifies Competency Gaps
The CAE should perform a competency gap analysis and
develop an action plan to fill the gaps. Various matrices
may be utilized to report the findings as illustrated in
Table 3: Sample IA-CP Skills Matrix. For example:
• A skills matrix would identify current competen-
cies within the audit function and provided through
existing contracts with third-party providers.
• A blended skill matrix would identify business-
specific competencies as well as internal auditing
competencies.

8 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

The CAE should develop an action plan to fill the gaps using a three-pillar solution.

Table 4: Three Pillar Solution

THREE PILLAR SOLUTION

Maintain a structured professional Selective recruitment to achieve a well-balanced
Nurture a professional learning environment.
development plan. audit team.

It can be difficult to reach the competency levels needed
if internal auditors are not enthused to embark on
further studies or training. So it is important to nurture a
professional learning environment, which becomes self-
motivating as colleagues achieve success.
In many jurisdictions across the globe, public sector
organizations need to trim their costs and manage
discretionary expenditure areas such as training and
development. The establishment of a professional
development plan for the audit function provides a well-
considered strategic driver for the board to support the
audit function’s investment in this area.
An investment in training and development alone will
not always deliver all the competencies needed, so the
targeted recruitment of audit team members with the
desired skill sets becomes an important strategy. This is
illustrated in Table 5: Sample High-level Competency
Profile.
Monitoring Phase
During the monitoring phase, the results of the strategic
competency plan are evaluated against defined targets and
key performance indicators.
Step 11 – BOC Reviews Audit Function
Competency Profile
BOCs play a key role in monitoring the competency,
performance, and contribution of the audit function.
Leading practice audit entities typically produce a
periodic (at least annual) profile of their staffing
competency at an overall and individual level.
The high-level profile typically includes benchmarking
of the audit activities competencies as a whole against
relevant resources, such as The IIA’s IA-CM, The IIA’s
Global Audit Information Network data, and against
leading public sector agencies in their region. It will be
informed by collating and analyzing a detail-level profile,
which provides insights on key indicators such as the
average years of audit experience, base qualifications,
post-graduate qualifications, and auditing and other
professional certifications. After the first year, the CAE
should be able to provide trends against the targets
and key performance indicators (KPIs) established in
agreement with the BOC.

www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Table 5: Sample High-level Competency Profile

SAMPLE HIGH-LEVEL COMPETENCY PROFILE

Result
Outcome Measure
Year 1 Year 2 Year 3
Specific Strategies
Boost proportion of Percentage of staff with tertiary qualifications 77% 97% 97%
qualified staff Percentage of staff with post-graduate qualifications 30% 67% 70%
Increase the percentage Percentage of staff with auditing certifications (CIA, CISA, CGAP) 10% 21% 23%
of certified staff Percentage of staff with accounting certifications (CPA, CA) 37% 39% 40%
Achieve greater links to
Percentage of staff with professional memberships 70% 91% 100%
professional bodies
Average years of auditing experience – overall 9 years 11.5 years 12 years
Grow years of auditing Average years of auditing experience – senior leaders 18 years 19 years 20 years
experience Average years of auditing experience – supervisors 13.5 years 14 years 14 years
Average years of auditing experience – other auditors 5 years 6.5 years 7 years
Grow high-potential talent Percentage of staff placed from a graduate recruitment program 7% 18% 18%
Ancillary Outcomes
Percentage of staff who are women 27% 42% 40%
Alter gender imbalance
Percentage of women in leadership roles 23% 50% 47%
How the Audit Function Team is Shaped – Three-Year Trend
Stalwarts 40%
Original team members 31%
Original team members who had spent time away on secondment 9%
Additions 60%
Recruited from outside the entity 30%
Recruited from other areas of the entity 9%
Sourced from Graduate Program 18%
Returned from overseas secondment 3%
Total 100%

A detail-level profile provides an opportunity to showcase expertise across the audit function by summarizing at a high level
the business background (capturing the skills, public sector knowledge, and experience throughout their career), time and
current position at the organization, years of specific auditing experience (both internal and external audit), the qualifica-
tions (both undergraduate and postgraduate), and professional certifications (auditing and others). A partially populated
detail-level profile is provided in Table 6: Sample Detail-level Competency Profile.

10 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Table 6: Sample Detail-level Competency Profile

SAMPLE DETAIL-LEVEL COMPETENCY PROFILE

Years at Auditing
Level/Name Prior Business Experience Qualifications Certifications
Your Entity experience
CAE
19 years, including
25 years in public sector, 12 years internal
BS Business CIA, CISA,
previously 10 years in finance auditing and 7 years in
George 7 years CGAP, CFSA,
sector working in London, external auditing, with M Accounting CFE
New York, and Sydney. 10 years in senior audit
management roles
Audit Leadership
Early 6-year career in Financial and
marketing drumming up new operational auditing
Ringo business; 1 year as acting CFO 17 years for 22 years, with BS Accounting CIA, CGAP
in energy sector; then transi- senior managerial
tioned to internal auditing. roles for 8 years
10 years in business support BS IT
IT auditing for
John areas for information systems 3 years CISA
16 years MS IT
before transitioning to IT audit.
Audit Supervisors
15 years internal
Spent 8 years with major
auditing, specializing BA
accounting firm before
Paul 5 years in business CIA, CGAP
transitioning to internal audit MBA
improvement and
in the public sector.
assurance frameworks
Auditors
Information for each staff auditor should be filled out in a similar manner.
Average of
Overall Summary Average of 18 years 100% 100%
8 years

Step 12 – BOC Endorses and Monitors the Strategic Competency Plan

For a BOC to fulfill its typical charter requirements with respect to the competency, performance, and contribution of the
audit function, its members need to review and challenge the analysis, narrative, and conclusions contained in the CAE’s
strategic competency plan. Once the BOC is satisfied that the strategic competency plan is congruent with their vision,
direction, and expectations, it should formally endorse the plan.

Steps should then be taken for the BOC to monitor the implementation of the strategic competency plan, with the CAE
required to produce periodic (i.e., semi-annual) updates against the agreed targets and KPIs.

See Appendices A and B for practical IA-CP applications.

www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector
Appendix A
City of Austin, Texas (United States):
Strategic Competency Plan Process
Background
The City of Austin, Texas, chartered in 1839, has a
council-manager form of government with a mayor and
six council members. The mayor and council members
are elected at-large for three-year staggered terms with a
maximum of two consecutive terms. The city manager, ap-
pointed by the city council, is responsible for managing
all city employees and the administration of city
affairs with the exception of the city auditor, city clerk,
municipal court, and municipal court judge.
The city provides a full range of services including
financial administration, public safety, transportation,
aviation, planning and development, sustainability, health
and human services, public recreation and culture,
library, urban growth management, electric, water, waste-
water, watershed protection, public works, convention,
and animal services.
Office of the City Auditor
The Office of the City Auditor (OCA) seeks to assist
the Austin City Council, citizens, and city manage-
ment in establishing accountability and transparency.
The dynamic city of Austin, Texas, is growing and has
navigated through recent economic challenges, emerging
relatively unscathed.
Nonetheless, the city faces many challenges and
opportunities in the years ahead. The global financial
crisis and lingering concerns about the stability of global
financial systems continue to have serious impacts in both
the private and public sectors. In today’s environment,
especially with rapid changes in the cyber world, the
challenge is that issues not currently present could
become threats in a short amount of time.
12 / www.globaliia.org/standards-guidance
The OCA has an audit staff made up of full- and part-time
auditors and administrative staff.
Competency Process
OCA recognizes that today’s auditor must possess
the needed knowledge, skills, and abilities (KSAs) or
competencies to obtain key insights related to their audit
environment, including threats and opportunities that are
present, evolving, or on the horizon.
To address this competency issue, Austin’s OCA
conducts a self-analysis to determine critical resource
availability. The city’s strategic planning efforts provide
the basis for OCA’s planning efforts — seeking to align
the plan with the ideals and direction captured in the
City’s Imagine Austin Comprehensive Plan.
Flowing from that plan, a strategic competency plan is
developed by identifying the competencies that are
required and available. Where gaps are identified,
strategies are employed to obtain that competency through
recruiting efforts, developing current staff, or hiring
subject matter experts (SMEs).
These identified competency “need” areas drive changes
to job descriptions and postings, determine individual and
office wide training plans, and dictate specifications in the
requests for qualifications for SMEs who can provide the
competencies needed to complete specialized, critical, or
time-sensitive projects (see Figure 1: Flowchart – OCA
Strategic Competency Plan). This plan is multifaceted in
that competency is viewed from three perspectives — the
auditing profession as a whole, the audit entity, and the
individual auditor.
The OCA Strategic Competency Plan identifies six areas of
key competency and details the objective, focus, and imple-
mentation strategy to achieve improvement in each area. This
competency plan will provide the opportunity to enhance the
capacity of each auditor and, therefore, OCA to provide in-
sightful audits and services to stakeholders as they are needed.
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

The training and developmental initiatives identified in the plan focus on strengthening existing competencies
through core training and developing skills specific to city systems and functions. Continuous improvement of core
audit skills will always be a key part of the action plan. The goal is for staff to achieve a thorough understanding
of COSO’s Internal Control–Integrated Framework. In addition, OCA seeks to develop SME skills through
specialized training, as well as through the recruiting and hiring process.

Figure 1: Flowchart – OCA Strategic Competency

IMAGINE AUSTIN COMPREHENSIVE PLAN

OCA AUDIT PLAN

OCA STRATEGIC
COMPETENCY PLAN

Competency
Required GAP Competency
Available

Job Descriptions
Strategies to Acquire
Needed Competency

Recruiting Development Subject Matter Experts

(SMEs)

Job Postings Training Plan Qualifications

www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

The city auditor ensures that the organizational structure, developmental initiatives, and programs are congruent with
what is required to effectively and efficiently achieve planned objectives. To effectively and efficiently achieve the goals of
the audit plan, highly qualified resources are required as illustrated in Table 7: OCA Strategic Competency Plan.

KEY COMPETENCY AREAS

Regulatory Matters
Cybersecurity

Sustainability
Construction

Financial
Core
Table 7: OCA Strategic Competency Plan
OBJECTIVES
To ensure that OCA staff possesses the knowledge, skills, and other competencies needed to perform
√ √ √ √ √ √
responsibilities as required by U.S. Generally Accepted Government Auditing Standards (GAGAS).
To increase audit capability to address specific risk areas. √ √ √ √ √

COMPETENCY FOCUS

Audit methodologies (including root cause analysis, internal controls, and data analysis). √ √ √ √ √ √

Evidence standards. √

Communications (including interviewing and report writing). √

Project management. √
Develop audit capabilities that comply with applicable GAGAS standards and address operational and strategic
√ √ √ √ √ √
risks. Also, as appropriate, IPPF and AICPA standards.
Strengthen staff insight of critical risk areas and understanding of key city systems. √ √ √ √ √

IMPLEMENTATION STRATEGY

Require supervisory staff and above to hold relevant audit certification. √

Provide cost-effective core audit competency training. √ √ √ √ √ √

Identify OCA staff to develop insights into critical risk areas and key city systems. √ √ √ √ √

Provide cost-effective baseline and advanced training in critical risk areas and city priorities. √ √ √ √ √

Encourage CISA certification. √

14 / www.globaliia.org/standards-guidance

Appendix B
Table 8: Australian Government Central Agency Strategic Competency Plan Process
STEPS
Step 1 – Assess the balance
of skills within the board.
Step 2 – Assess the
organization’s needs.
Step 3 – Identify desired
IA-CM level and scope of
responsibility and authority.
Step 4 – Select qualified
BOC.
Step 5 – Develop BOC
charter.
Step 6 – Identify and recruit
a qualified CAE.
Step 7 – Develop internal
audit charter.
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector
ACTIONS TAKEN
• Experienced and capable board leadership was in place.
• The board determined that an experienced professional CAE was needed if they were to deliver the audit
function vision.
• In particular, the board was seeking someone to provide strong professional leadership to a large audit function
that had teams spread across four states.
• The BOC (in this case the audit committee) was apprised of better practice guidance published by the auditor
general of Australia on Public Sector Audit Committees: Having the Right People is the Key.
• The contribution of the audit function was benchmarked against leading practices, and opportunities for
strengthening existing arrangements were determined.
• Based on an IA-CM assessment, the internal audit function was operating below expectations, close to Level 2
(Infrastructure).
• The requirements of the audit function to deliver at a basic level were established, and the audit committee
further agreed with the CEO on the aspiration to create an internal audit function that was of a “world-class”
level.
• By aligning the “world-class” vision to the IA-CM, the audit committee determined that it would need to establish
strategies to move the audit function through Level 3 (Integrated) to Level 4 (Managed), and ultimately toward
Level 5 (Optimized).
• Based on risk-based assurance mapping, the audit committee determined that the coverage of the audit function
needed to be broadened to cover emerging technology and business-specific risk areas, and recognized that this
would require different auditing skills.
• It is a legislative requirement at the federal (national) level in Australia to maintain an audit committee.
• The audit committee had been well established and was functioning at a high standard, with a highly competent
and experienced membership.
• The audit committee contained a multidisciplinary skill set with a mix of financial, technology, legal, business-
specific, and public sector skills.
• The audit committee charter was reviewed and amended to align to the Model Charter produced by the auditor
general of Australia in Public Sector Audit Committees: Having the Right People is the Key.
• An updated position description for the CAE was established in consultation with the audit committee and CEO. A
rigorous merit-based recruitment process was undertaken to secure an experienced career audit executive as CAE.
• The internal audit charter was reviewed and amended to align to the Model Charter produced by the auditor
general of Australia in the guidance, Public Sector Internal Audit: An investment in Assurance and Business
Improvement.
• The internal audit charter provided for various types of internal audits, including performance, assurance,
and consulting engagements.
www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector
STEPS
Step 8 – CAE develops a
strategic competency plan.
Step 9 – CAE identifies
existing competencies.
Based on the competency analysis, the CAE identified competency gaps at four distinct levels.
Step 10 – CAE identifies
competency gaps.
Step 11 – BOC reviews audit
function competency profile.
16 / www.globaliia.org/standards-guidance
ACTIONS TAKEN
• The CAE developed a contemporary, risk-based program called the Forward Work Program covering the ensuing
12 months, which was accompanied by a menu of audits for the following two years.
• In addition to the proposed coverage for three years (above), an allowance of 20 percent of time was provided to
accommodate emerging risk areas, new business, and management-initiated requests (at the discretion of the
CAE in consultation with the audit committee).
• A strategic competency plan was formulated based on the approved Forward Work Program. The plan articulated
the skills that would be required to tackle the proposed audits over the ensuing three years.
• The CAE developed a skills matrix that identified the current skills available throughout the audit function and
those available through existing contracts with third-party specialist suppliers.
• The skills matrix contained a blend of current competencies that were business specific, together with those
required for professional auditing.
• There were flaws in the current staffing competency to complete the existing Forward Work Program. The CAE
established a professional development plan to specify the holistic and individual training needs over the ensuing
three years, and the CAE arranged for tailored training courses to be conducted. As an example, the first phase
of the professional development plan recognized that auditing staff did not have strong all-around
communication skills (e.g., interviewing, presentation, listening and body language, and report writing skills.
They also did not have a consistent appreciation of soft skills, and their knowledge of professional auditing
standards was fragmented).
• The staffing composition was substantially of an accounting nature, whereas the Forward Work Program required
a multidisciplinary skill set. The job redesign undertaken by the CAE produced updated position descriptions to
use in a targeted recruitment program.
• A small percentage of staff held auditing-specific certifications (e.g. Certified Internal Auditor, Certified
Government Auditing Professional, Certified Information Systems Auditor, and Certified Fraud Examiner). The
CAE aspired to at least double the percentage of auditing certifications over the ensuing three years and then
appropriate mechanisms and incentives were put in place to achieve this goal.
• While 15 percent of the financial budget was available to secure specialist providers (when it was not financially
prudent to retain the competencies in-house), the contract panel was not broad enough to cover future needs.
A new contract panel was established.
• As the CAE rebuilt the audit function, it was appropriate to showcase the talent available through a profile of staff
competencies. This was an important step in lifting the confidence that the audit committee had in the audit
function’s overall competency. The profile was produced semi-annually initially (during the rebuilding phase) and
annually (once stability of staffing was achieved).
• The profile delivered to the audit committee contained three sections — the leadership team, the team leaders
and supervisors, and the auditing cohort. The profile provided a foundation for high-level
discussions on succession planning arrangements.
• Based on the profile, the CAE was able to demonstrate staffing trends, including years of auditing experience,
percentage of staff qualified, and percentage of staff with auditing certifications.
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

STEPS ACTIONS TAKEN

• The CAE discussed the SCP and related plans at the audit committee meeting and articulated how these would
collectively enable achievement of the vision, internal audit charter requirements, and the Forward Work Program.
Step 12 – BOC endorses The audit committee endorsed the planning suite.
and monitors strategic • The balanced scorecard reporting approach adopted by the CAE captured key targets and key performance
competency plan (SCP). indicator (KPI) measures associated with the planning suite, including the professional development plan,
multidisciplinary skill set, auditing certifications, and third-party services. The audit committee monitored the
trends in the balanced scorecard report on a quarterly basis.

An external quality assessment review — completed on this audit function within five years after the CAE was
recruited and implemented the planning suite — confirmed the successes achieved.
Notably:
• The audit activities were recognized as being consistent with world-class auditing in most areas, thus achieving
the vision that had been agreed with the CEO and audit committee.
Outcome
• Most elements of the IA-CM were rated at an optimized level, with two elements rated as managed and bordering
on optimized.
• Professional auditing standards were consistently applied across all sites.
• The key stakeholders, including the audit committee and CEO, recognized the transformation and rated the audit
function as providing “value for money.”

www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Appendix C
Resources

Related IIA Guidance

Code of Ethics Competency is a Principle and a Rule of Conduct

• Principle – Internal auditors apply the knowledge, skills, and experience needed in the performance of internal audit activities.

• Rule of Conduct – Internal auditors:

›› Shall engage only in those services for which they have the necessary knowledge, skills, and experience.

›› Shall perform internal audit services in accordance with the International Standards for the Professional Practice of
Internal Auditing.

›› Shall continually improve their proficiency and the effectiveness and quality of their services.

Global Public Sector Insight: Independent Audit Committees in Public Sector Organizations (The IIA, 2014).
https://global.theiia.org/standards-guidance/leading-practices/Pages/Independent-Audit-Committees-in-Public-Sector-
Organizations.aspx

Global Public Sector Insight: Policy Setting for Public Sector Internal Auditing in the Absence of Government Legislation (The IIA, 2014).
https://global.theiia.org/standards-guidance/leading-practices/Pages/Policy-Setting-for-Public-Sector-Auditing-in-the-Absence-
of-Government-Legislation.aspx

Global Strategic Planning Document 2012–2016, The IIA.

https://na.theiia.org/committees/Committee%20Documents/IIA_Strategic_Planning_Document.pdf

Internal Auditor Competency Framework, IIA–Australia, July 2010.

https://www.iia.org.au/sf_docs/default-source/learning-development/Internal_Audit_Competency_Framework.pdf?sfvrsn=0

Leading Practices: Transparency of the Internal Audit Report in the Public Sector (The IIA, 2012).
https://global.theiia.org/standards-guidance/leading-practices/Pages/Transparency-of-the-Internal-Audit-Report-in-the-Public-
Sector.aspx

Position Paper, The Role of Internal Auditing in Resourcing the Internal Audit Activity (The IIA, 2009).
https://global.theiia.org/standards-guidance/Public%20Documents/PP%20The%20Role%20of%20Internal%20Auditing%20
in%20Resourcing%20the%20Internal%20Audit%20Activity.pdf

Practice Advisory 1200-1: Proficiency and Due Professional Care.

https://global.theiia.org/standards-guidance/Member%20Documents/PA_1200-1.pdf

Practice Advisory 1210-1: Proficiency.

https://global.theiia.org/standards-guidance/Member%20Documents/PA_1210-1.pdf

Practice Advisory 1220-1: Due Professional Care.

https://global.theiia.org/standards-guidance/Member%20Documents/PA_1220-1.pdf

18 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Creating an Internal Audit Competency Process for the Public Sector

Practice Advisory 1230-1: Continuing Professional Development.

https://global.theiia.org/standards-guidance/Member%20Documents/PA_1230-1.pdf

Practice Guide: Chief Audit Executives Appointment, Performance, Evaluation, and Termination (The IIA,2010).
https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/CAESAppointment-Performance-
Evaluation-and-Termination-Practice-Guide.aspx

Practice Guide: Developing the Internal Audit Strategic Plan (The IIA, 2012).
https://global.theiia.org/standards-guidance/recommended-guidance/practice-guides/Pages/Developing-the-Internal-Audit-
Strategic-Plan-Practice-Guide.aspx

Supplemental Guidance: Implementing a New Internal Audit Function in the Public Sector (The IIA, 2012).
https://global.theiia.org/standards-guidance/leading-practices/Pages/Implementing-a-New-Internal-Audit-Function-in-the-
Public-Sector.aspx

Supplemental Guidance: Value Proposition of Internal Auditing and the Internal Audit Capability Model (The IIA, 2012).
https://global.theiia.org/standards-guidance/leading-practices/Pages/Value-Proposition-of-Internal-Auditingand-the-Internal-
Audit-Capability-Model.aspx

The IIA’s Global Internal Audit Competency Framework.

https://global.theiia.org/about/about-internal-auditing/Pages/Competency-Framework.aspx

Research: The Institute of Internal Auditors Research Foundation (IIARF)

Insight: Delivering Value to Stakeholders

Internal Audit Capability Model (IA-CM) for the Public Sector.

Nine Elements Required for Internal Audit Effectiveness in the Public Sector.

The IIA’s Global Internal Audit Survey: Core Competencies for Today’s Internal Auditor

Authors, Contributors, and Reviewers

Authors:
Bruce Turner, CGAP, CRMA, CISA, CFE, PFIIA (Aus)
Kenneth J. Mory, CIA, CPA, CISA, CRMA
Audrey Donavan, CIA, CRMA

Contributors and Reviewers:

Christie J. O’Loughlin, CGAP, CRMA
Paul J. Duggan, CA, CIA, CISA
Elizabeth (Libby) MacRae, CGAP

www.globaliia.org/standards-guidance / 19
About the Institute
Established in 1941, The Institute of Internal
Auditors (IIA) is an international professional
association with global headquarters in Altamonte
Springs, Fla., USA. The IIA is the internal audit
profession’s global voice, recognized authority,
acknowledged leader, chief advocate, and
principal educator.
About Practice Guides
Practice Guides provide detailed guidance for
conducting internal audit activities. They include
detailed processes and procedures, such as tools
and techniques, programs, and step-by-step
approaches, as well as examples of deliverables.
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category of
guidance, compliance is not mandatory, but it is
strongly recommended, and the guidance is
endorsed by The IIA through formal review and
approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at www.globaliia.org/
standards-guidance
Disclaimer
The IIA publishes this document for
informational and educational purposes.
This guidance material is not intended to
provide definitive answers to specific individual
circumstances and, as such, is only intended to
be used as a guide. The IIA recommends that you
always seek independent expert advice relating
directly to any specific situation. The IIA accepts
no responsibility for anyone placing sole reliance
on this guidance.
Copyright
Copyright ® 2015 The Institute of Internal
Auditors. For permission to reproduce, please
contact guidance@theiia.org.

GLOBAL HEADQUARTERS T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

140590