1/116 Practice Advisory 1000-1: Internal Audit Charter Interpretation of Standard 1000 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1000 Purpose, Nature of this Practice Advisory Authority, and Responsibility Internal auditors should consider the following sug- The purpose, authority, and responsi- gestions when adopting an internal audit charter. This bility of the internal audit activity guidance is not intended to represent all the consid- should be formally defined in a charter, erations that may be necessary when adopting a char- consistent with the Standards and ter, but simply a recommended set of items that approved by the board. (Source: Red should be addressed. Compliance with Practice Advi- Book 510) sories is optional. 1. The purpose, authority, and responsibility of the internal audit activity should be defined in a charter. The chief audit executive should seek approval of the charter by senior management as well as acceptance by the board, audit committee, or appropriate governing authority. The charter should (a) establish the internal au- dit activity's position within the organization; (b) authorize access to records, per- sonnel, and physical properties relevant to the performance of engagements; and (c) define the scope of internal audit activities. (Source: Red Book 110.01.4, 510.01) 2. The internal audit activity's charter should be in writing. A written statement provides formal communication for review and approval by management and for acceptance by the board. It also facilitates a periodic assessment of the ade- quacy of the internal audit acti-vity's purpose, authority, and responsibility. Provid- ing a formal, written document containing the charter of the internal audit activity is critical in managing the auditing function within the organization. The purpose, authority, and responsibility should be defined and communicated to establish the role of the internal audit activity and to provide a basis for management and the board to use in evaluating the operations of the function. If a question should arise, the charter also provides a formal, written agreement with management and the board about the role and responsibilities of the internal audit activity within the organization. (Source: PSPR 96-14) 3. The chief audit executive should periodically assess whether the purpose, authority, and responsibility, as defined in the charter, continue to be adequate to enable the internal audit activity to accomplish its objectives. The result of this periodic assessment should be communicated to senior management and the board. (Source: Red Book 110.01.4.a) 2/116 Practice Advisory 1100-1: Independence and Objec- tivity Interpretation of Standard 1100 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1100 – Independ- Nature of this Practice Advisory ence and Objectivity Internal auditors should consider the following sug- The internal audit activity should be gestions when evaluating independence and objectiv- independent, and internal auditors ity. This guidance is not intended to represent all the should be objective in performing their considerations that may be necessary when conduct- work. (Source: Red Book 100) ing such an evaluation, but simply a recommended set of items that should be addressed. Compliance with Practice Advisories is optional. 1. Internal auditors are independent when they can carry out their work freely and objectively. Independence permits internal auditors to render the impartial and unbiased judgments essential to the proper conduct of engagements. It is achieved through organizational status and objectivity. (Source: Red Book 100.01) 3/116 Practice Advisory 1110-1: Organizational Indepen- dence Interpretation of Standard 1110 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1110 – Organiza- Nature of this Advisory tional Independence Internal auditors should consider the following suggestions The chief audit executive should report when evaluating organizational independence. This guid- to a level within the organization that ance is not intended to represent all the considerations that allows the internal audit activity to may be necessary during such an evaluation, but simply a accomplish its responsibilities. recommended set of items that should be addressed. (Source: Red Book 110) Compliance with Practice Advisories is optional. 1. Internal auditors should have the support of senior management and of the board so that they can gain the cooperation of engagement clients and perform their work free from interference. (Source: Red Book 110.01) 2. The chief audit executive should be responsible to an individual in the organiza- tion with sufficient authority to promote independence and to ensure broad audit coverage, adequate consideration of engagement communications, and appro- priate action on engagement recommendations. (Source: Red Book 110.01.1) 3. Ideally, the chief audit executive should report functionally to the audit committee, board of directors, or other appropriate governing authority, and administratively to the chief executive officer of the organization. (Source: New) 4. The chief audit executive should have direct communication with the board, audit committee, or other appropriate governing authority. Regular communication with the board helps assure independence and provides a means for the board and the chief audit executive to keep each other informed on matters of mutual inter- est. (Source: Red Book 110.01.2 5. Direct communication occurs when the chief audit executive regularly attends and participates in meetings of the board, audit committee, or other appropriate governing authority which relate to its oversight responsibilities for auditing, fi- nancial reporting, organizational governance, and control. The chief audit execu- tive’s attendance and participation at these meetings provide an opportunity to exchange information concerning the plans and activities of the internal auditing activity. The chief audit executive should meet privately with the board, audit committee, or other appropriate governing authority at least annually. (Source: Red Book 110.01.2.a) 6. Independence is enhanced when the board concurs in the appointment or removal of the chief audit executive. (Source: Red Book 110.01.3) 4/116 Practice Advisory 1110.A1-1: Disclosing Reasons for Information Requests Interpretation of Standard 1110.A1 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1110.A1 Nature of this Practice Advisory The internal audit activity should Internal auditors should consider the follow- be free from interference in ing suggestions when requested to disclose determining the scope of reasons for information requests. This guid- internal auditing, performing ance is not intended to represent all the con- work, and communicating siderations that may be necessary, but sim- results. (Source: Red Book 110) ply a recommended set of items that should be addressed. Compliance with Practice Ad- visories is optional. 1. At times, an internal auditor may be asked by the engagement client or other parties to explain why a document that has been requested is relevant to an en- gagement. Disclosure or nondisclosure during the engagement of the reasons why documents are needed should be determined based on the circumstances. Significant irregularities may dictate a less open environment than would normally be conducive to a cooperative engagement. However, that is a judgment that should be made by the chief audit executive in light of the specific circumstances. (Source: PSPR 96-11) 5/116 Practice Advisory 1120-1: Individual Objectivity Interpretation of Standard 1120 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1120 Individual Nature of this Practice Advisory Objectivity Internal auditors should consider the following sug- Internal auditors should have an im- gestions when evaluating individual objectivity. This partial, unbiased attitude and avoid guidance is not intended to represent all the consid- conflicts of interest. (Source: Red Book erations that may be necessary during such an 120) evaluation, but simply a recommended set of items that should be addressed. Compliance with Practice Advisories is optional. 1. Objectivity is an independent mental attitude that internal auditors should main- tain in performing engagements. Internal auditors are not to subordinate their judgment on audit matters to that of others. (Source: Red Book 120.01) 2. Objectivity requires internal auditors to perform engagements in such a manner that they have an honest belief in their work product and that no significant quality compromises are made. Internal auditors are not to be placed in situations in which they feel unable to make objective professional judgments. (Source: Red Book 120.02) 3. Staff assignments should be made so that potential and actual conflicts of interest and bias are avoided. The chief audit executive should periodically obtain from the internal auditing staff information concerning potential conflicts of inter- est and bias. Staff assignments of internal auditors should be rotated periodically whenever it is practicable to do so. (Source: Red Book 120.02) 4. The results of internal auditing work should be reviewed before the related engagement communications are released to provide reasonable assurance that the work was performed objectively. (Source: Red Book 120.02.6) <BR.< LI> 5. It is unethical for an internal auditor to accept a fee or gift from an employee, client, customer, supplier, or business associate. Accepting a fee or gift may cre- ate an appearance that the auditor's objectivity has been impaired. The appear- ance that objectivity has been impaired may apply to current and future engage- ments conducted by the auditor. The status of engagements should not be con- sidered as justification for receiving fees or gifts. The receipt of promotional items (such as pens, calendars, or samples) that are available to the general public and have minimal value should not hinder internal auditors' professional judgments. 6/116 Internal auditors should report the offer of all material fees or gifts immediately to their supervisors. (Source: PSPR 96-21) Practice Advisory 1130-1: Impairments to Indepen- dence or Objectivity Interpretation of Standard 1130 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1130 Impairments to Nature of this Practice Advisory Independence or Objectivity Internal auditors should consider the following suggestions If independence or objectivity is impaired when evaluating impairments to independence or objectiv- in fact or appearance, the details of the ity. This guidance is not intended to represent all the con- impairment should be disclosed to appro-siderations that may be necessary during such an evalua- priate parties. The nature of the disclosure tion, but simply a recommended set of items that should be will depend upon the impairment. (Source: addressed. Compliance with Practice Advisories is op- Red Book 120.02) tional. 1. Internal auditors should report to the chief audit executive any situations in which a conflict of interest or bias is present or may reasonably be inferred. The chief audit executive should then reassign such auditors. (Source: Red Book 120.02.2) 2. A scope limitation is a restriction placed upon the internal audit activity that precludes the audit activity from accomplishing its objectives and plans. Among other things, a scope limitation may restrict the: o Scope defined in the charter. o Internal audit activity’s access to records, personnel, and physical properties relevant to the performance of engagements. o Approved engagement work schedule. o Performance of necessary engagement procedures. o Approved staffing plan and financial budget. (Source: Red Book 110.01.5.b) 3. A scope limitation along with its potential effect should be communicated, pref- erably in writing, to the board, audit committee, or other appropriate governing authority.(Source: Red Book 110.01.5.c) 4. The chief audit executive should consider whether it is appropriate to inform the board, audit committee, or other appropriate governing authority regarding scope limitations that were previously communicated to and accepted by the board, au- dit committee, or other appropriate governing authority. This may be necessary particularly when there have been organization, board, senior management, or other changes. (Source: Red Book 110.01.5.d) 7/116 Practice Advisory 1130.A1-1: Assessing Operations for Which Internal Auditors Were Previously Res- ponsible Interpretation of Standard 1130.A1 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1130.A1 Nature of this Practice Advisory Internal auditors should refrain from Internal auditors should consider the following sug- assessing specific operations for which gestions when faced with a situation where the auditor they were previously responsible. Ob- has been assigned to assess an operation for which jectivity is presumed to be impaired if he or she was previously responsible. This guidance an auditor provides assurance ser- is not intended to represent all the considerations that vices for an activity for which the audi- may be necessary during such an evaluation, but tor had responsibility within the previ- simply a recommended set of items that should be ous year. (Source: Red Book 120.02) addressed. Compliance with Practice Advisories is optional. 1. Internal auditors should not assume operating responsibilities. If senior manage- ment directs internal auditors to perform nonaudit work, it should be understood that they are not functioning as internal auditors. Moreover, objectivity is pre- sumed to be impaired when internal auditors perform an assurance review of any activity for which they had authority or responsibility within the past year. This impairment should be considered when communicating audit engagement re- sults. (Source: Red Book 120.02.4) o If internal auditors are directed to perform nonaudit duties that may impair ob- jectivity, such as preparation of bank reconciliations, the chief audit executive should inform senior management and the board that this activity is not an as- surance audit activity; and, therefore, audit-related conclusions should not be drawn. (Source: PSPR 97-12) o In addition, when operating responsibilities are assigned to the internal audit activity, special attention must be given to ensure objectivity when a subse- quent assurance engagement in the related operating area is undertaken. Ob- jectivity is presumed to be impaired when internal auditors audit any activity for which they had authority or responsibility within the past year. These facts should be clearly stated when communicating the results of an audit engage- ment relating to an area where an auditor had operating responsibilities. (Source: PSPR 97-12) 8/116 2. At any point that assigned activities involve the assumption of operating authority, audit objectivity would be presumed to be impaired with respect to that activity. (Source: PSPR 96-18 3. Persons transferred to or temporarily engaged by the internal audit activity should not be assigned to audit those activities they previously performed until a reason- able period of time (at least one year) has elapsed. Such assignments are pre- sumed to impair objectivity, and additional consideration should be exercised when supervising the engagement work and communicating engagement results. (Source: Red Book 120.02.5) 4. The internal auditor's objectivity is not adversely affected when the auditor recommends standards of control for systems or reviews procedures before they are implemented. The auditor's objectivity is considered to be impaired if the auditor designs, installs, drafts procedures for, or operates such systems. (Source: Red Book 120.03) 5. The occasional performance of nonaudit work by the internal auditor, with full disclosure in the reporting process, would not necessarily impair independence. However, it would require careful consideration by management and the internal auditor to avoid adversely affecting the internal auditor's objectivity. (Source: PSPR 96-13) 9/116 Practice Advisory 1130.A1-2: Internal Audit Respon- sibility for Other (Non-Audit) Functions Interpretation of Standard 1130.A1 from the Standards for the Professional Practice of Internal Auditing Related Standard: 1130.A1 Nature of this Practice Advisory Internal auditors should refrain from The following guidance is offered to internal auditors assessing specific operations for which faced with accepting responsibility for non-audit, op- they were previously responsible. Ob- erational functions or duties. Acceptance of such re- jectivity is presumed to be impaired if sponsibilities can impair independence and objectivity an auditor provides assurance ser- and, if possible, should be avoided. This guidance is vices for an activity for which the audi- not intended to represent all the considerations that tor had responsibility within the previ- may be necessary in evaluating such responsibilities ous year. (Source: Red Book or assignments. Compliance with Practice Advisories 120.02.4) is optional. 1. Some internal auditors have been assigned or accepted non-audit duties be- cause of a variety of business reasons that make sense to management of the organization. Internal auditors are more frequently being asked to perform roles and responsibilities that may impair independence or objectivity. Given the in- creasing demand on organizations, both public and private, to develop more effi- cient and effective operations and to do so with fewer resources, some internal audit activities are being directed by their organization’s management to assume responsibility for operations that are subject to periodic internal auditing assess- ments. 2. When the internal audit activity or individual internal auditor is responsible for, or management is considering assigning, an operation that it might audit, the inter- nal auditor’s independence and objectivity may be impaired. The internal auditor should consider the following factors in assessing the impact on independence and objectivity: o The requirements of The IIA Code of Ethics and Standards for the Professional Practice of Internal Auditing (Standards). o Expectations of stakeholders that may include the shareholders, board of di- rectors, audit committee, management, legislative bodies, public entities, regu- latory bodies, and public interest groups. o Allowances and/or restrictions contained in the internal audit activity charter. o Disclosures required by the Standards; and 10/116 o Subsequent audit coverage of the activities or responsibilities accepted by the internal auditor. 3. Internal auditors should consider the following factors to determine an appropri- ate course of action when presented with the opportunity of accepting responsi- bility for a nonaudit function: o The IIA Code of Ethics and Standards require the internal audit activity to be independent, and internal auditors to be objective in performing their work. § If possible, internal auditors should avoid accepting responsibility for non- audit functions or duties that are subject to periodic internal auditing as- sessments. § If this is not possible, then impairment to independence and objectivity are required to be disclosed to appropriate parties, and the nature of the disclo- sure depends upon the impairment. § Objectivity is presumed to be impaired if an auditor provides assurance ser- vices for an activity for which the auditor had responsibility within the previ- ous year. § If on occasion management directs internal auditors to perform non-audit work, it should be understood that they are not functioning as internal audi- tors. o Expectations of stakeholders, including regulatory or legal requirements, should be evaluated and assessed in relation to the potential impairment. o If the internal audit activity charter contains specific restrictions or limiting lan- guage regarding the assignment of non-audit functions to the internal auditor, then these restrictions should be disclosed and discussed with management. If management insists on such an assignment, the auditor should disclose and discuss this matter with the audit committee or appropriate governing body. If the charter is silent on this matter, the guidance noted in the points below should be considered. All the points noted below are subordinated to the lan- guage of the charter. o Assessment – The results of the assessment should be discussed with man- agement, the audit committee, and/or other appropriate stakeholders. A de- termination should be made regarding a number of issues, some of which ef- fect one another. § The significance of the operational function to the organization (in terms of revenue, expenses, reputation, and influence) should be evaluated. § The length or duration of the assignment and scope of responsibility should be evaluated. § Adequacy of separation of duties should be evaluated.