A Guide for the Future - meeting standards for internal auditing

Internal Auditor, June, 2001 by Larry E. Rittenberg

The IIA's new Professional Practices Framework will help internal auditors expand their value and increase their level of knowledge.

TWENTY-FIVE YEARS AGO, The IIA developed the Standards for the Professional Practice of Internal Auditing (Standards). Since that time, there has been a dramatic change in the internal audit environment. Today's business and governmental entities rely on sophisticated electronic technology in every aspect of their operations and require timely information to make decisions regarding global operations. More business acumen is demanded of organizations -- better governance, improved risk management, stronger internal controls, more transparent financial reporting, and operational efficiency -- pressures also faced by today's internal auditor.

The demands for professionalism, knowledge, integrity, and leadership have never been more stringent. To be effective, auditors must serve as objective assurance providers and advisors to management, the board of directors, and the audit committee; provide guidance on improving operational efficiency and control; and educate personnel regarding control concepts. In addition, they evaluate risk and facilitate the improvement of risk and control processes within an organization. The boundaries of internal audit responsibility are as broad as today's business and the demand to add value requires a responsive and clearly articulated approach to the practice of internal auditing.

It is the internal auditor's task to operate within the framework of professionalism to assist the company in achieving the highest-quality results and long-term objectives. Because the scope of work performed by today's practitioners is so broad, there is an expanded need for clear and concise guidance that can be readily adopted and followed regardless of the industry, audit specialty, or sector. To fill that need, The IIA recently developed the Professional Practices Framework (PPF), which consists of three important, but distinct parts: mandatory guidance, recommended practice, and development and practice aids. It is a practices framework that is meant to apply to all of internal auditing -- wherever and by whomever the work is performed. It is intended to encourage the highest quality of services on a consistent basis worldwide, to guide not only internal auditors, but also management and audit committees that want to evaluate the performance of their internal audit activity.

ETHICS AND STANDARDS

The base of the PPF hierarchy is its mandatory guidance, embodied in the Code of Ethics and the Standards. This foundation maintains the principles of auditing practice. One distinguishing feature of a respected profession is its commitment to ethical conduct that embraces integrity, honesty, and diligence. An ethics code serves as guidance on how professionals interact with other members of the organization, each other, and major stakeholders. It also provides direction on how to solve ethical dilemmas, such as the need to keep information confidential and the need for important stakeholders to have knowledge important to their tasks. Therefore, the principles underlying the PPF's Code of Ethics are fundamental to the practice of internal auditing around the world -- regardless of what the cultural or economic differences may be.

Another distinguishing feature of a profession is the commitment to providing the highest quality of service to the organization and its stakeholders. To ensure stakeholders of a uniform quality of audit activities, as well as to guide the practicing professionals, the Standards are the second facet of PPF's mandatory guidance. Whether used when performing governmental audits, information technology audits, or consulting activities, they are uniform around the world.

Standards and mandatory guidance are interesting concepts. By making them mandatory, the Standards must embrace fundamental concepts of internal auditing that are unambiguous and can be easily interpreted and applied anywhere. Developed to stand the test of time, the Standards set a baseline for measuring performance even though there may be a number of ways in which internal audit activities can be organized or carried out to be in compliance with the Standards. For example, one of the standards mandates that an internal audit function be objective in all activities it performs. The standard is mandatory, but the processes used by an internal audit activity to ensure objectivity may vary with organizations and the nature of audit activities performed.

As mandatory sections of the PPF, the Code of Ethics and Standards should be incorporated into all aspects of an internal audit activity from staffing to assurance and consulting services. Because the fundamental principles are incorporated into every facet of the internal audit function, the Standards are invisible on a daily basis. However, they should guide every aspect of internal audit activities. At least every five years, auditors should demonstrate adherence to the Standards through a quality assessment.