Scarleticedragon

The definition above (first sentence of this page) is in essence the IIA's definition.^[3] A similar definition has been developed by the accounting profession and adopted by the government auditors: the ISA 610 and the INTOSAI’s standard ("ISSAI") 1003 define the Internal audit function as "An appraisal activity established or provided as a service to the entity. Its functions include, amongst other things, examining, evaluating and monitoring the adequacy and effectiveness of internal control."

The Internal Auditing profession evolved steadily with the progress of management science after World War II. It is conceptually similar in many ways to financial auditing by public accounting firms, quality assurance and banking compliance activities. Much of the theory underlying internal auditing is derived from management consulting and public accounting professions. With the implementation in the United States of the Sarbanes-Oxley Act of 2002, the profession's growth accelerated, as many internal auditors possess the skills required to help companies meet the requirements of the law.

In 2010, the Institute of Internal Auditors - UK and Ireland, was granted a Royal Charter and became the Chartered Institute of Internal Auditors. The Chartered Institute of Internal Auditors (also known as Chartered IIA) is affiliated with the Institute of Internal Auditors (IIA), although separate qualifications are awarded by the different organisations.

ISACA is the best known of the other audit organisations and is an IT specific Audit Institute. ISACA awards the CISA qualification. This is widely held, and has exceptionally high pass rates each year. It is internationally recognised. IRCA has also recently arrived on the scene but is almost exclusively dedicated to Quality Auditing.

The IIA awards the Certified Internal Auditor qualification (CIA) on completion of 4 multiple choice exam papers. It also has qualifications for ♦ Certified Government Auditing Professional (CGAP) and ♦ Certified Control Self Assessment Auditor (CCSA).

The Institute of Internal Auditors UK and Ireland (now replaced by the Chartered Institute of Internal Auditors) offered the following qualifications listed basic to advanced: ♦ IIA Certificate in Internal Audit and Business Risk (IACert) it required completion of both theory and practical skills in a workshop format with no examinations involved; ♦ IIA Diploma in Internal Audit Practice (PIIA) which required completion of 4 written exams; ♦ IIA Advanced Diploma in (MIIA) required completion of PIIA as a pre-requisite to registration (an accelerated route was available if specific alternative qualifications were held) and required completion of 4 written exams plus an experience module. ♦ Qualification in Computer Auditing (QiCA) it required completion of 4 exams plus an extensive logbook covering 1600 hours of specific IT audit work over a minimum of 2 years. This is a highly valuable qualification as the pass rate for exams was low, but the actual attainment of designation even lower due to the challenges faced by those attempting to gain the experience required to complete. It is undoubtedly the highest certification an IT auditor can hold. ♦ Fellow of the Institute of Internal Auditors (FIIA)- was awarded to individuals as an honour. It does not require an IIA certification to be held, which is why qualified members tend to quote both FIIA and MIIA or PIIA where these are held.

The Chartered Institute of Internal Auditors, has upgraded it's portfolio of qualifications and now offers:

♦ IIA Certificate in Internal Audit and Business Risk (IACert) it required completion of both theory and practical skills in a workshop format with no examinations involved; ♦ IIA Diploma in Internal Audit Practice (PIIA) which requires completion of 5 theory modules (written exams) plus a professional experience journal (fast track route available for experienced professionals with specified qualifications); ♦ Chartered Internal Auditor (CMIIA) requires completion of PIIA as a pre-requisite to registration (exemptions from some modules may be available based on educational background) and requires completion of 4 written exams including a case study plus a professional experience journal; ♦ IIA IT Auditing Certificate - aimed at qualified auditors (PIIA, CMIIA, or CIA) who wish to develop expertise in threats and vulnerabilities associated with IT and information systems (distance learning tuition with assessment by work-related assignment and multiple choice examination). ♦ Fellow of the Institute of Internal Auditors (FIIA)- awarded to individuals as an honour. It does not require an IIA certification to be held. Members who already hold Chartered Internal Auditor status use the designation CFIIA whilst PIIA holders use both FIIA, PIIA in there titles.

NOTE: Whilst the QiCA qualification has discontinued, the designation is still used. Those holders of MIIA who had lapsed membership or opted not to join the Chartered Institute of Internal Auditors are not entitled to use the CMIIA designation. CMIIA is only available to current members of the Chartered IIA who have maintained their Continued Professional Development to an accepted level.

Certified Internal Auditors (CIA) can opt to register for the PIIA (with exemptions from 3 of the 5 exams) but must complete PIIA before registering to become a Chartered Internal Auditor (CMIIA).

To perform their role effectively, internal auditors require organizational independence from management, to enable unrestricted evaluation of management activities and personnel. internal auditors are part of company management and paid by the company, the primary customer of internal audit activity is the entity charged with oversight of management's activities. This is typically the Audit Committee, a sub-committee of the Board of Directors. To provide independence, most Chief Audit Executives report to the Chairperson of the Audit Committee and can only be replaced with the concurrence of that individual.

♦ According to the Institute of Internal Auditors, the Internal Auditor's obligation of Independence refers to:

• 1) The reporting line or status of the CAE The Chief Audit Executive must report to a level within the organization that allows the internal audit activity to fulfill its responsibilities. The chief audit executive must confirm to the board, at least annually, the organizational independence of the internal audit activity (IIA standard 1110).

Organizational independence is effectively achieved when the chief audit executive reports functionally to the board (IIA practice advisory 1110A1). The board is a governing body, such as the board of directors, supervisory board, head of an agency or legislative body, board of governors or trustees of a nonprofit organization, or any other designated body of the organization, including the audit committee to whom the chief audit executive may functionally report (IIA Glossary).

• 2) Attitude of auditors, procedures of the internal audit department. The internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results (IIA practice advisory 1110A1).
• 3) Communication right. The chief audit executive must communicate and interact directly with the Board of Directors (IIA standard 1111).

♦ According to Mautz R.K. & Sharaf H.A, American Accounting Association,^[4] there are three main ways in which the auditor’s independence can manifest itself: Programming independence, Investigative independence, Reporting independence. For more detail, see the wikipage Auditor independence which deals with the independance of the external auditors.

♦ The European Union is strongly in favour of "Audit committees and an effective internal control system" (8th EU Company Law Directive on Statutory Audit^[5]). This 8th Directive states that "Each public-interest entity shall have an audit committee" which inter alia shall "monitor the effectiveness of the company's internal control, internal audit where applicable, and risk management systems". The European Confederation of Institutes of Internal Auditing (ECIIA)^[6] and Federation of European Risk Management Associations (FERMA) also support the independance of Internal Auditing. Their guidance^[7] on the 8th EU Company Law Directive states “The head of internal audit reports periodically to the board or the audit committee and to senior management on the internal audit activity’s purpose, authority, responsibility and performance relative to its plan. The main reporting line is to the audit committee.”

♦ Regarding public institutions, the same principle of independance of internal audit applies; cf. INTOSAI’s standard GOV9140 "Internal auditor independence in the public sector” endorsed in 2010, article 9.32.^[8] “The CAE should report ... to those charged with governance for strategic direction, reinforcement, and accountability. Those charged with governance (e.g. the audit committee) should safeguard the independence by approving the internal audit charter and (where applicable) the mandate."

The independence of the Internal Audit is applied by most international institutions: for instance, the European Commission audit is accountable to the Audit Progress Committee; the IBRD Auditor General reports to the president and to the audit committee comprising eight of the 24 executive directors; The IMF’s internal audit is overseen by the External Audit Committee (three members, all external and with the “accounting and financial expertise required”); The OSCE’s Office of Internal Oversight reports to the Secretariat General and the Permanent Council...

Internal auditing activity is primarily directed at improving internal control. Under the COSO Framework, internal control is broadly defined as a process, effected by an entity's board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following internal control categories:

• Effectiveness and efficiency of operations.
• Reliability of financial reporting.
• Compliance with laws and regulations.

Management is responsible for internal control. Managers establish policies and processes to help the organization achieve specific objectives in each of these categories. Internal auditors perform audits to evaluate whether the policies and processes are designed and operating effectively and provide recommendations for improvement.

In the United States, internal auditors may assist management with compliance with the Sarbanes-Oxley Act (SOX).

Internal auditing professional standards require the function to monitor and evaluate the effectiveness of the organization's Risk management processes. Risk management relates to how an organization sets objectives, then identifies, analyzes, and responds to those risks that could potentially impact its ability to realize its objectives.

Under the COSO enterprise risk management (ERM) Framework, risks fall under strategic, operational, financial reporting, and legal/regulatory categories. Management performs risk assessment activities as part of the ordinary course of business in each of these categories. Examples include: strategic planning, marketing planning, capital planning, budgeting, hedging, incentive payout structure, and credit/lending practices. Sarbanes-Oxley regulations also require extensive risk assessment of financial reporting processes. Corporate legal counsel often prepares comprehensive assessments of the current and potential litigation a company faces. Internal auditors may evaluate each of these activities, or focus on the processes used by management to report and monitor the risks identified. For example, internal auditors can advise management regarding the reporting of forward-looking operating measures to the Board, to help identify emerging risks.

In larger organizations, major strategic initiatives are implemented to achieve objectives and drive changes. As a member of senior management, the Chief Audit Executive (CAE) may participate in status updates on these major initiatives. This places the CAE in the position to report on many of the major risks the organization faces to the Audit Committee, or ensure management's reporting is effective for that purpose.

Internal auditors may help companies establish and maintain Enterprise Risk Management processes.^[9][10] Internal auditors also play an important role in helping companies execute a SOX 404 top-down risk assessment. In these latter two areas, internal auditors typically are part of the project team in an advisory role.

Internal auditing activity as it relates to corporate governance is generally informal, accomplished primarily through participation in meetings and discussions with members of the Board of Directors. Corporate governance is a combination of processes and organizational structures implemented by the Board of Directors to inform, direct, manage, and monitor the organization's resources, strategies and policies towards the achievement of the organizations objectives.^[11] The internal auditor is often considered one of the "four pillars" of corporate governance, the other pillars being the Board of Directors, management, and the external auditor.^[12]

A primary focus area of internal auditing as it relates to corporate governance is helping the Audit Committee of the Board of Directors (or equivalent) perform its responsibilities effectively. This may include reporting critical internal control problems, informing the Committee privately on the capabilities of key managers, suggesting questions or topics for the Audit Committee's meeting agendas, and coordinating carefully with the external auditor and management to ensure the Committee receives effective information.

Based on a risk assessment of the organization, internal auditors, management and oversight Boards determine where to focus internal auditing efforts. Internal auditing activity is generally conducted as one or more discrete projects. A typical internal audit project ^[13] involves the following steps:

1. Establish and communicate the scope and objectives for the audit to appropriate management.
2. Develop an understanding of the business area under review. This includes objectives, measurements, and key transaction types. This involves review of documents and interviews. Flowcharts and narratives may be created if necessary.
3. Describe the key risks facing the business activities within the scope of the audit.
4. Identify control procedures used to ensure each key risk and transaction type is properly controlled and monitored.
5. Develop and execute a risk-based sampling and testing approach to determine whether the most important controls are operating as intended.
6. Report problems identified and negotiate action plans with management to address the problems.
7. Follow-up on reported findings at appropriate intervals. Internal audit departments maintain a follow-up database for this purpose.

Project length varies based on the complexity of the activity being audited and Internal Audit resources available. Many of the above steps are iterative and may not all occur in the sequence indicated.

By analyzing and recommending business improvements in critical areas, auditors help the organization meet its objectives. In addition to assessing business processes, specialists called Information Technology (IT) Auditors review information technology controls.

Internal auditors typically issue reports at the end of each audit that summarize their findings, recommendations, and any responses or action plans from management. An audit report may have an executive summary; a body that includes the specific issues or findings identified and related recommendations or action plans; and appendix information such as detailed graphs and charts or process information. Each audit finding within the body of the report may contain five elements, sometimes called the "5 C's":

1. Criteria: What is the standard? The standard may be a company policy or other benchmark.
2. Condition: What is the particular problem identified (difference between criteria and actual status)?
3. Cause: Why did the problem occur (which control over risk was missing - design effectiveness failure; or which control did not execute as planned -operating effectiveness failure)?
4. Consequence: What is the risk/consequence (or opportunity foregone) because of the finding?
5. Corrective action: What should management do about the finding? What have they agreed to do and by when?

The recommendations in an internal audit report are designed to help the organization achieve its goals, which may relate to operations, financial reporting or legal/regulatory compliance. They may relate to effectiveness (i.e., whether goals were met or compliance with standards was achieved) or efficiency (i.e., whether the outputs were generated with minimum inputs).

Audit findings and recommendations also relate to particular assertions about transactions, such as whether the transactions audited were valid or authorized, completely processed, accurately valued, processed in the correct time period, and properly disclosed in financial or operational reporting, among other elements.

Internal auditing standards require the development of a plan of audit engagements (projects) based on a risk assessment, updated at least annually. The input of senior management and the Board is typically included in this process. Many departments update their plan of engagements throughout the year as risks or organizational priorities change.^[14]

This effort helps ensure the audit activity is aligned with the organization’s objectives, by answering two key questions: First, what goals are the organization trying to accomplish in the upcoming period? Second, how can the Internal Audit Department assist the organization in achieving these goals?

Internal auditors often conduct a series of interviews of senior management to identify potential engagements. Changes in people, processes, or systems often generate audit project ideas. Various documents are reviewed, such as strategic plans, financial reports, consulting studies, etc. Further, the results of prior audits and resolution of open issues are considered. For example, automated programs such as NEMEA Compliance Center can collect responses, produce and write standardized compliance reports for an organization seeking or issuing compliance rules. Even if a business area is important, prior audit work and the nature and status of open issues may render further audit effort unnecessary. If the organization has a formal enterprise risk management (ERM) program, the risks identified therein help limit the amount of separate risk assessment performed by Internal Audit.

The preliminary plan of engagements is documented and prioritized. Audit resources and expertise are then considered and a final plan is presented to senior management and the Audit Committee. The presentations vary based on the needs of the stakeholders and may include the following:

• Summary of key goals, risks and corresponding major audits, to illustrate alignment;
• Analyses of audit effort along a variety of dimensions (e.g., by business segment, COSO objective category, IT, Sarbanes-Oxley, vs. prior year, etc.) along with commentary regarding changes;
• Brief description of critical projects identified;
• Projects requested but not planned for execution due to prioritization and resources;
• Required co-sourcing effort, typically where outside expertise is required or during peak periods;
• Coordination with other risk functions, such as legal, compliance or insurance, to ensure coverage of key organizational risks;
• Update on audit staffing levels, experience and certification; and
• Appendix materials, such as planning approach, assumptions (e.g., days per auditor and staffing level) and brief descriptions of all planned audits and related prioritization.

The measurement of the internal audit function can involve a balanced scorecard approach.^[15] Internal audit functions are primarily evaluated based on the quality of counsel and information provided to the Audit Committee and top management. However, this is primarily qualitative and therefore difficult to measure. “Customer surveys” sent to key managers after each audit project or report can be used to measure performance, with an annual survey to the Audit Committee. Scoring on dimensions such as professionalism, quality of counsel, timeliness of work product, utility of meetings, and quality of status updates are typical with such surveys. Understanding the expectations of senior management and the audit committee represent important steps in developing a performance measurement process, as well as how such measures help align the audit function with organizational priorities.^[16]

Quantitative measures can also be used to measure the function’s level of execution and qualifications of its personnel. Key measures include:

Plan completion: This is a measure of the degree to which the annual plan of engagements is completed, measured at a point in time. This may be measured using the number of projects completed, weighted by the planned size of each project, with estimates for projects in-progress. Measured throughout the year, it is compared against the percentage of the year elapsed.

Report issuance: This is a measure of the time elapsed from completion of testing to issuance of the final audit report, including management’s action plans. This can be measured in average days or percentage of reports issued within a certain standard, such as 30 days. Establishing expectations for the timing of management’s response to report recommendations is critical. In addition, the scope and degree of change involved in the report’s action plans are key variables. For example, a report for a single retail store requiring only the store manager’s action might take 3–5 days to issue. However, a report consolidating findings from 20 retail stores, with action plans with national implications determined by top management, may take 30–60 days in complex organizations.

Issue closure: Reported audit findings are often called “issues” or “deficiencies.” Professional standards require audit functions to track reported findings to resolution, which effectively requires the maintenance of an issues follow-up database. The number of days that reported issues remain open, or open after their agreed-upon closure date, are key measures. In addition, reporting database statistics such as the number of issues open (unresolved), closed (resolved), and issues opened/closed during a given period are useful statistics.

Staff qualifications: This can be measured through the percentage of staff with professional certifications, graduate degrees, and overall years of experience.

Staff utilization rate: This is measured as the percentage of time spent on projects, as opposed to administrative time such as training or vacation. Many internal audit departments track time by audit project. This is typically captured in a database or spreadsheet.

Staffing level: The number of positions filled relative to the authorized staffing level. Due to the challenge of finding qualified staff, departments may have rotational programs to bring in management to complete tours in the function or be "guest" auditors. Audit departments also "co-source," meaning they obtain contract auditors from service providers.

Developing and retaining quality professionals is a key concern in the profession.^[17] Key methods for developing and retaining internal audit staff personnel include:

• Providing challenging, varied assignments
• Ensuring quality supervision
• Ensuring staff participates in projects from start to finish, to learn all phases of the audit process
• Providing opportunities to lead (in-charge) projects, starting with more structured projects such as Sarbanes-Oxley work
• Participating on departmental improvement task forces, such as preparation for quality assurance review
• Participating in the recruiting and interviewing process for new hires
• Rotating through various audit teams (in larger departments) or audits of various businesses
• Providing both outside training (e.g., seminars) and in-house training (e.g., company systems) for two weeks/year
• Participation in annual risk assessment activities, whether asking key questions or just taking notes

The Chief Audit Executive (CAE) typically reports the most critical issues to the Audit Committee quarterly, along with management's progress towards resolving them. Critical issues typically have a reasonable likelihood of causing substantial financial or reputational damage to the company. For particularly complex issues, the responsible manager may participate in the discussion. Such reporting is critical to ensure the function is respected, that the proper "tone at the top" exists in the organization, and to expedite resolution of such issues. It is a matter of considerable judgment to select appropriate issues for the Audit Committee's attention and to describe them in the proper context.

Institute of Internal Auditors - UK and Ireland

Scarleticedragon (talk) 02:18, 3 June 2011 (UTC)Reply

  Welcome to Wikipedia. Please do not replace pages with blank content, as you did with this edit to Template:Accounting, as this is confusing to readers. The page's content has been restored for now. If there is a problem with the page, it should be edited or reverted to a previous version if possible; if you think the page should be removed entirely, see further information. Thank you. Marek.69 ^talk 02:06, 3 June 2011 (UTC)Reply

First of all, I am assuming good faith for all the edits done by you in Template:Accounting, since you are new to Wikipedia. You are always welcome to edit any page in wikipedia, after all it is very purpose of wikipedia. But you need the understand the content of wikipedia and its layout. A template is not specific to a particular page but is used commonly among thousands of other pages. So if you edit a template, thousands of other pages are also automatically edited.

Your contention is that the accounting template has no relevance to Internal audit. Audit and accounting are related fields. Internal audit may be wider in scope than financial audit. But it will always be relevant to accounting. Any person interested in internal audit will also be interested in the other fields related to accounting. So the template should find a place there.

Secondly you had altered the list of qualifications. It is a accepted decision to add only qualifications to the list and not the institutes that offer such qualifications. For instance CIMA and various other other institutes offers CMA qualification so CMA finds a place. Further only widely recognised qualifications should be added.

So please understand the above discussed matter and further edit accordingly. Happy editing!!...-- R.Sivanesh ^{✆ ©} 07:47, 5 June 2011 (UTC)Reply

Thanks Sivanesh, I think I'm going to give up completely on Wiki! I had not understood that I was damaging other templates, but having attempted more than once to correct erroneous and misleading information about Internal Audit (which is not linked to Accountancy but is linked to Enterprise Risk Management), and had my edits deleted by those who apparently know better that me (a chartered accountant and chartered internal auditor) and who seek to persist with misleading the public, the only way I could see to correct the error was to edit the template that should not appear on the IA page. You may as well have an HSE, an ERM, and an IT template also on the page, all of which are equally if not more relevant to Internal Audit.

As regards the qualifications, CMA, and CCA are not recognised designations across Europe whereas CIMA and FCCA/ACCA are globally recognised designations. It appears that only those designations relevant to the North America are included on the template at present. To be so region specific does a disservice to the users of Wiki.

You're right that my edits were good faith, but I'll be honest, I have better things to do with my time than find that the work I put in is undone routinely and frequently on erroneous assumptions. I therefore quit Wiki. I hope you enjoy your continued editing.