Raising the BAR - newly revised Standards for the Professional Practice of Internal Auditing

Internal Auditor, April, 2001 by Christy Chapman

In closing the gap between existing guidance and current practice, the newly revised Standards for the Professional Practice of Internal Auditing lift performance expectations to new heights.

IN DECEMBER 2000, THE INSTITUTE OF INTERNAL Auditors approved the first set of new Standards for the Professional Practice of Internal Auditing (Standards). This initial installment of updated guidelines revamps the old Standards, also known as The IIA's Red Book, to better reflect current practice and the new definition of internal auditing. Additional, groundbreaking standards addressing consulting services will be released later this year, and work continues on specific criteria regarding assurance, risk, control, and governance.

Although the standards that have been revised to date primarily serve as the foundation for those to come, they nonetheless push the character of internal auditing to a higher level. The purpose of professional standards is to lay out the minimum requirements that must be met to remain in line with the acceptable practice of internal auditing. The updated Standards, with the new language they incorporate, the shifts in focus they depict, and the additional guidance they foreshadow, raise that bar in several ways.

EXPANDING AUDIT'S FOCUS

"The old Standards were narrowly constructed around internal control assurance and compliance," says Tony Ridley, former IIA chairman of the board and chair of the Guidance Task Force responsible for recommending changes to the Standards. "The revision depicts a much broader focus incorporating consulting, risk, and governance, three areas that have not been addressed before at the standards level." For example, the new Standards prescribe a more proactive role for internal auditors in risk management and governance processes.

Risk management and governance are also mentioned in sections regarding various elements of practice, such as planning, reporting, and engagement objectives. The nature of internal audit work itself is described in terms of evaluating and contributing to the improvement of risk management, control, and governance systems. The revised Standards even address what chief audit executives (CAEs) should do when they believe senior management has accepted an inappropriate level of risk--take their concerns to the board.

"This movement away from compliance toward proactive involvement in risk management and governance will necessarily change the emphasis of audit shops and increase awareness of the types of activities they should engage in," says Larry Rittenberg, IIA vice chairman of professional practices and professor of accounting at the University of Wisconsin-Madison. "The change in focus may represent a challenge for some, but for many the new Standards will simply reflect the leading edge activities they already practice."

PRESCRIBING A MORE STRATEGIC ROLE

By mandating involvement in risk management and governance processes, the rewritten Standards elevate the internal audit activity to a more strategic level within the organization. Risk is closely tied to business strategy because it addresses the company's organizational goals and objectives and whether or not they were achieved, observes Urton Anderson, a member of The IIA's Internal Auditing Standards Board and accounting professor at the University of Texas at Austin.

"Internal auditors now must know the objectives of the organization and the business as well as the processes in place to accomplish those objectives. In other words, they must understand strategy," Anderson says.

"Evaluating future risks to the business is a much more strategic process than measuring the effectiveness of internal controls," adds Ridley. "When we're providing controls assurance, we're usually addressing the history of a situation. But when we're addressing risk, we're talking about the fixture, which is where strategy is based."

"In addition, governance is the domain of directors and executives," says Ridley. "By getting involved in governance processes, the audit staff's interactions with senior management and the board are elevated to a higher level."

EMPHASIZING VALUE CREATION

Adding value is no longer an option for internal audit shops. It is now a mandated expectation of the function. The introduction of the new Standards states that internal auditing is designed to "add value and improve an organization's operations." It goes on to describe the purpose of the Standards as being, at least in part, "to provide a framework for performing and promoting a broad range of value-added internal audit activities."

The Standards also call for the CAE to develop and maintain a quality assurance and improvement program that will "help the internal auditing activity add value and improve the organization's operations." The goal of the CAE in managing the audit function should be to "ensure that it adds value to the organization."

In addition, to comply with the Standards, internal audit shops must periodically demonstrate that they add continuous value to the entities they serve. External quality reviews are to be performed at least every five years to evaluate whether or not the function is making a valuable contribution to the business.