Practice Advisory 1130.A1-1

330 Pages·2005·1.49 MB·English

by  Lee Ann Campbell

THE
PROFESSIONAL
PRACTICES
FRAMEWORK
Disclosure
Copyright © 2005 by The Institute of Internal Auditors (IIA), 247 Maitland Avenue,
Altamonte Springs, Florida 32701-4201. All rights reserved. Printed in the United
States of America. No part of this publication may be reproduced, stored in a retrieval
system, or transmitted in any form by any means — electronic, mechanical, photo-
copying, recording, or otherwise — without prior written permission of the publisher.
The IIA publishes this document for informational and educational purposes. This
document is intended to provide information, but is not a substitute for legal or ac-
counting advice. The IIA does not provide such advice and makes no warranty as to any
legal or accounting results through its publication of this document. When legal or
accounting issues arise, professional assistance should be sought and retained.
The Professional Practices Framework for Internal Auditing (PPF) was designed by
The IIA Board of Directors' Guidance Task Force to appropriately organize the full
range of existing and developing practice guidance for the profession. Based on the
definition of internal auditing, the PPF comprises Ethics and Standards, Practice
Advisories, and Development and Practice Aids, and paves the way to world-class
internal auditing. This guidance fits into the Framework under the heading Develop-
ment and Practice Aids.
The mission of The IIA Research Foundation (IIARF) is to be the global leader in
sponsoring, disseminating, and promoting research and knowledge resources to enhance
the development and effectiveness of the internal auditing profession.
The Institute of Internal Auditors
Global Practices Center
247 Maitland Avenue
Altamonte Springs, FL 32701-4201 USA
Phone: [phone]
FAX: [phone]
E-mail: [email protected]

ISBN 0-89413-569-4
05083 01/05
Second Printing
______________________________________________ Contents iii
CONTENTS
Preface ..................................................................................... xxi
Acknowledgments ................................................................... xxv
Definition of Internal Auditing ................................................xxvii
Code of Ethics ........................................................................ xxix
International Standards for the Professional Practice
of Internal Auditing (Standards)
Introduction ........................................................................ 3
Attribute Standards............................................................ 7
1000 – Purpose, Authority, and Responsibility .................... 7
1100 – Independence and Objectivity................................. 7
1110 – Organizational Independence.................... 7
1120 – Individual Objectivity ................................ 7
1130 – Impairments to Independence
or Objectivity ............................................ 8
1200 – Proficiency and Due Professional Care ................. 8
1210 – Proficiency ................................................ 8
1220 – Due Professional Care ............................. 9
1230 – Continuing Professional
Development ........................................... 10
1300 – Quality Assurance and Improvement
Program ................................................................ 11
1310 – Quality Program Assessments................ 11
1311 – Internal Assessments .............................. 11
1312 – External Assessments ............................. 11
1320 – Reporting on the Quality Program .......... 11
1330 – Use of “Conducted in Accordance
with the Standards” ............................... 12
1340 – Disclosure of Noncompliance ................. 12
iv The Professional Practices Framework ______________________
Performance Standards ................................................... 13
2000 – Managing the Internal Audit Activity .................... 13
2010 – Planning................................................... 13
2020 – Communication and Approval ................. 13
2030 – Resource Management........................... 14
2040 – Policies and Procedures ......................... 14
2050 – Coordination ............................................ 14
2060 – Reporting to the Board and
Senior Management................................ 14
2100 – Nature of Work ..................................................... 14
2110 – Risk Management ................................... 14
2120 – Control .................................................... 15
2130 – Governance ............................................. 17
2200 – Engagement Planning ........................................... 17
2201 – Planning Considerations .......................... 17
2210 – Engagement Objectives .......................... 18
2220 – Engagement Scope ................................. 19
2230 – Engagement Resource Allocation ........... 19
2240 – Engagement Work Program ................... 19
2300 – Performing the Engagement ................................. 20
2310 – Identifying Information ........................... 20
2320 – Analysis and Evaluation .......................... 20
2330 – Recording Information ............................ 20
2340 – Engagement Supervision......................... 21
2400 – Communicating Results ........................................ 21
2410 – Criteria for Communicating .................... 21
2420 – Quality of Communications..................... 22
2421 – Errors and Omissions.............................. 22
2430 – Engagement Disclosure of
Noncompliance with the Standards ....... 22
2440 – Disseminating Results ............................. 22
2500 – Monitoring Progress.............................................. 23
2600 – Resolution of Management’s Acceptance
of Risks ................................................................ 23
Glossary ............................................................................. 25
______________________________________________ Contents v
Practice Advisories
Attribute Standards
PA 1000-1 Internal Audit Charter ................................ 33
PA 1000.C1-1 Principles Guiding the Performance
of Consulting Activities of
Internal Auditors ........................................ 35
PA 1000.C1-2 Additional Considerations for Formal
Consulting Engagements ............................ 41
PA 1100-1 Independence and Objectivity.................... 51
PA 1110-1 Organizational Independence ..................... 53
PA 1110-2 Chief Audit Executive (CAE)
Reporting Lines .......................................... 55
PA 1110.A1-1 Disclosing Reasons for Information
Requests ..................................................... 61
PA 1120-1 Individual Objectivity.................................. 63
PA 1130-1 Impairments to Independence or
Objectivity .................................................. 65
PA 1130.A1-1 Assessing Operations for Which
Internal Auditors Were Previously
Responsible ................................................ 67
PA 1130.A1-2 Internal Auditing’s Responsibility
for Other (Non-audit) Functions ................ 71
PA 1200-1 Proficiency and Due Professional
Care............................................................ 75
PA 1210-1 Proficiency ................................................. 77
PA 1210.A1-1 Obtaining Services to Support or
Complement the Internal Audit
Activity ....................................................... 81
PA 1210.A2-1 Identification of Fraud ................................ 87
PA 1210.A2-2 Responsibility for Fraud Detection............. 95
PA 1220-1 Due Professional Care............................... 97
PA 1230-1 Continuing Professional Development ....... 99
PA 1300-1 Quality Assurance and Improvement
Program.................................................... 101
PA 1310-1 Quality Program Assessments ................. 105
vi The Professional Practices Framework ______________________
PA 1311-1 Internal Assessments ............................... 109
PA 1312-1 External Assessments .............................. 113
PA 1312-2 External Assessments Self-assessment
with Independent Validation ..................... 119
PA 1320-1 Reporting on the Quality Program ........... 123
PA 1330-1 Use of “Conducted in Accordance
with the Standards” ................................. 125
Performance Standards
PA 2000-1 Managing the Internal Audit Activity ....... 127
PA 2010-1 Planning .................................................... 129
PA 2010-2 Linking the Audit Plan to Risk
and Exposures.......................................... 131
PA 2020-1 Communication and Approval .................. 135
PA 2030-1 Resource Management ............................ 137
PA 2040-1 Policies and Procedures ........................... 139
PA 2050-1 Coordination ............................................. 141
PA 2050-2 Acquisition of External Audit Services .... 147
PA 2060-1 Reporting to Board and Senior
Management ............................................ 153
PA 2060-2 Relationship with the Audit
Committee ................................................ 155
PA 2100-1 Nature of Work ........................................ 161
PA 2100-2 Information Security ................................ 165
PA 2100-3 Internal Auditing’s Role in the
Risk Management Process ...................... 167
PA 2100-4 Internal Auditing’s Role in
Organizations Without a Risk
Management Process .............................. 171
PA 2100-5 Legal Considerations in Evaluating
Regulatory Compliance Programs ........... 175
PA 2100-6 Control and Audit Implications of
E-commerce Activities............................. 185
PA 2100-7 Internal Auditing’s Role in
Identifying and Reporting
Environmental Risks ................................ 195
______________________________________________ Contents vii
PA 2100-8 Internal Auditing’s Role in
Evaluating an Organization’s Privacy
Framework ............................................... 201
PA 2110-1 Assessing the Adequacy of Risk
Management Processes ........................... 205
PA 2110-2 Internal Auditing’s Role in the
Business Continuity Process .................... 211
PA 2120.A1-1 Assessing and Reporting on Control
Processes ................................................. 217
PA 2120.A1-2 Using Control Self-assessment for
Assessing the Adequacy of Control
Processes ................................................. 223
PA 2120.A1-3 Internal Auditing’s Role in Quarterly
Financial Reporting, Disclosures, and
Management Certifications ...................... 231
PA 2120.A1-4 Auditing the Financial Reporting
Process..................................................... 239
PA 2120.A4-1 Control Criteria ........................................ 249
PA 2130-1 Role of the Internal Audit Activity
and Internal Auditor in the Ethical
Culture of an Organization ....................... 251
PA 2200-1 Engagement Planning............................... 257
PA 2210-1 Engagement Objectives ........................... 261
PA 2210.A1-1 Risk Assessment in Engagement
Planning .................................................... 263
PA 2230-1 Engagement Resource Allocation ............ 267
PA 2240-1 Engagement Work Program .................... 269
PA 2240.A1-1 Approval of Work Programs.................... 271
PA 2300-1 Internal Auditing’s Use of Personal
Information in Conducting Audits............. 273
PA 2310-1 Identifying Information............................. 275
PA 2320-1 Analysis and Evaluation ........................... 277
PA 2330-1 Recording Information ............................. 281
PA 2330.A1-1 Control of Engagement Records.............. 285
PA 2330.A1-2 Legal Considerations in Granting
Access to Engagement Records.............. 287
viii The Professional Practices Framework ______________________
PA 2330.A2-1 Retention of Records ............................... 293
PA 2340-1 Engagement Supervision .......................... 295
PA 2400-1 Legal Considerations in
Communicating Results............................ 299
PA 2410-1 Communication Criteria ........................... 303
PA 2420-1 Quality of Communications ...................... 309
PA 2440-1 Recipients of Engagement Results .......... 311
PA 2440-2 Communications Outside the
Organization ............................................. 313
PA 2440-3 Communicating Sensitive Information
Within and Outside the Chain
of Command ............................................. 317
PA 2500-1 Monitoring Progress ................................. 325
PA 2500.A1-1 Follow-up Process ................................... 327
PA 2600-1 Management’s Acceptance of Risks ....... 329
Topical Index to Practice Advisories
Audit Charter
PA 1000-1 Internal Audit Charter ................................ 33
PA 1000.C1-1 Principles Guiding the Performance
of Consulting Activities of
Internal Auditors ........................................ 35
PA 1000.C1-2 Additional Considerations for Formal
Consulting Engagements ............................ 41
PA 1110-2 Chief Audit Executive (CAE)
Reporting Lines .......................................... 55
PA 1130.A1-2 Internal Auditing’s Responsibility
for Other (Non-audit) Functions ................ 71
PA 1310-1 Quality Program Assessments ................. 105
PA 2010-1 Planning .................................................... 129
PA 2060-2 Relationship with the Audit
Committee ................................................ 155
PA 2100-3 Internal Auditing’s Role in the
Risk Management Process ...................... 167
______________________________________________ Contents ix
PA 2100-4 Internal Auditing’s Role in
Organizations Without a Risk
Management Process .............................. 171
PA 2330.A1-2 Legal Considerations in Granting
Access to Engagement Records.............. 287
PA 2440-2 Communications Outside the
Organization ............................................. 313
PA 2500.A1-1 Follow-up Process ................................... 327
Assumption of Non-audit Duties
PA 1000.C1-2 Additional Considerations for Formal
Consulting Engagements ............................ 41
PA 1130.A1-1 Assessing Operations for Which
Internal Auditors Were Previously
Responsible ................................................ 67
PA 1130.A1-2 Internal Auditing’s Responsibility
for Other (Non-audit) Functions ................ 71
PA 2100-3 Internal Auditing’s Role in the
Risk Management Process ...................... 167
PA 2100-4 Internal Auditing’s Role in
Organizations Without a Risk
Management Process .............................. 171
Assurance
PA 1000.C1-1 Principles Guiding the Performance
of Consulting Activities of
Internal Auditors ........................................ 35
PA 1000.C1-2 Additional Considerations for Formal
Consulting Engagements ............................ 41
PA 1210.A2-1 Identification of Fraud ................................ 87
PA 1210.A2-2 Responsibility for Fraud Detection............. 95
PA 1220-1 Due Professional Care............................... 97
PA 2010-2 Linking the Audit Plan to Risk
and Exposures.......................................... 131
x The Professional Practices Framework ______________________
PA 2100-1 Nature of Work ........................................ 161
PA 2100-2 Information Security ................................ 165
PA 2100-3 Internal Auditing’s Role in the
Risk Management Process ...................... 167
PA 2100-5 Legal Considerations in Evaluating
Regulatory Compliance Programs ........... 175
PA 2100-6 Control and Audit Implications of
E-commerce Activities............................. 185
PA 2100-7 Internal Auditing’s Role in
Identifying and Reporting
Environmental Risks ................................ 195
PA 2100-8 Internal Auditing’s Role in
Evaluating an Organization’s Privacy
Framework ............................................... 201
PA 2110-1 Assessing the Adequacy of Risk
Management Processes ........................... 205
PA 2110-2 Internal Auditing’s Role in the
Business Continuity Process .................... 211
PA 2120.A1-1 Assessing and Reporting on Control
Processes ................................................. 217
PA 2120.A1-2 Using Control Self-assessment for
Assessing the Adequacy of Control
Processes ................................................. 223
PA 2120.A1-3 Internal Auditing’s Role in Quarterly
Financial Reporting, Disclosures, and
Management Certifications ...................... 231
PA 2120.A1-4 Auditing the Financial Reporting
Process..................................................... 239
PA 2120.A4-1 Control Criteria ........................................ 249
Board and Senior Management Reporting
PA 1000-1 Internal Audit Charter ................................ 33
PA 1000.C1-1 Principles Guiding the Performance
of Consulting Activities of
Internal Auditors ........................................ 35