text:
Pagina principale Internal Auditing - Assurance and Advisory Services 4th Edition
Internal Auditing - Assurance and Advisory Services 4th EditionUrton L. Anderson, Michael J. Head
You may be interested in
You can write a book review and share your experiences. Other readers will always be interested in your opinion of the books you've read. Whether you've loved the book or not, if you give your honest and detailed thoughts then people will find new books that are right for them.
FOURTH EDITIO INTERNAL ASSURANCE & ADVISORY SERVICES AUDITING URTON L. ANDERSON. Pho. cu. crma. cgap. ccep MICHAEL J. HEAD. cia. cpa. cma, cba. cisa SRIDHAR RAMAMOORTI. pkd. cia. cpa cfe. maff CRIS RIDDLE, ma. cia MARK SALAMASICK, cia. cisa. CRma. CSP PAUL J. SOBEL. cia oial. crma INTERNAL AUDITING INTERNAL AUDITING ASSURANCE & ADVISORY SERVICES URTON L. ANDERSON, PhD, cia. crma. cgap, ccbP MICHAEL J. HEAD, cia, cpa, cma, cba, cisa SRIDHAR RAMAMOORTI, PhD, cia. cpa, cfe. maff CRIS RIDDLE, MA, CIA. CRMA MARK SALAMASICK, cia. cisa, crma, csp PAUL J. SOBEL, cia, qial, crma SPONSORED IN PART BY The Institute of Internal Auditors Chicago Chapter *" The Institute of Internal Auditors i Dallas Chapter INTERNAL AUDIT FOUNDATION Copyright © 2017 by the Internal Audit Foundation. All rights reserved. Published by the Internal Audit Foundation 1035 Greenwood Blvd., Suite 401 t -1" »* " "T ocinAd TTCA No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form by any meanselectronic, mechanical, photocopying, recording, or otherwisewithout prior witten permission of the publisher. Requests to the publisher for permission should be sent electronically to: firstname.lastname@example.com with the subject line "reprint permission request." Limit of Liability: The Foundation publishes this document for informational and educational purposes and is not a substitute for legal or accounting advice. The Foundation does not provide such advice and makes no warranty as to any legal or accounting results through its publication of this document. When legal or accounting issues arise, professional assistance should be sought and retained. The Institute of Internal Auditors' (ILA!s) International Professional Practices Framework (IPPF) compises the full range of existing and developing practice guidance for the profession. The IPPF provides guidance to internal auditors globally and paves the way to world-class internal auditing. The IIA and the Foundation work in patnership with researchers from around the globe who conduct valuable studies on critical issues affecting today's business world. Much of the content presented in their inal repots is a result of Foundation-funded research and prepared as a service to the Foundation and the internal audit profession. Expressed opinions, interpretations, or points of view represent a consensus of the researchers and do not necessarily relect or represent the oficial position or policies of The IIA or the Foundation. ISBN-13: 978-0-89413-987-1 21 20 19 18 17 1 2 3 4 5 6 7 8 9 Printed in Canada CONTENTS Preface xv Acknowledgments xix About the Authors xxi FUNDAMENTAL INTERNAL AUDIT CONCEPTS CHAPTER 1 Introduction to Internal Auditing 1-1 Learning Objectives 1-1 Deinition of Internal Auditing 1-3 The Relationship Between Auditing and Accounting 1-7 Financial Reporting Assurance Services: External Versus Internal The Internal Audit Profession 1-9 The Institute of Internal Auditors 1-13 Competencies Needed to Excel As an Internal Auditor Internal Audit Career Paths Summary 1-17 1-20 1-22 Review Questions 1-23 Multiple-Choice Questions Discussion Questions Cases 1- 1-24 1-26 1-27 CHAPTER 2 The International Professional Practices Framework: Authoritative Guidance for the Internal Audit Profession 2-1 Learning Objectives 2-1 The History of Guidance Setting for the Internal Audit Profession The International Professional Practices Framework Mandatory Guidance 2-6 Recommended Guidance 2-27 2-4 2-2 How the International Professional Practices Framework is Kept Current 2-32 Standards Promulgated by Other Organizations Summary 2-38 Review Questions 2-39 Multiple-Choice Questions Discussion Questions Cases 2-35 2-40 2-43 2-44 CHAPTER 3 Governance 3-1 Learning Objectives 3-1 Governance Concepts 3-3 The Evolution of Governance 3-15 Opportunities to Provide Insight 3-17 Summary 3-18 Appendix 3-A: Summary of Key U.S. Regulations Review Questions 3-21 iviuiLipie-v^noice ^uesuuns Discussion Questions Cases 3-19 o-zz 3-24 3-25 CHAPTER 4 Risk Management 4-i Learning Objectives 4-1 Overview of Risk Management 4-2 COSO ERM Framework 4-4 ISO 31000:2009 Risk Management - Principles and Guidelines The Role of the Internal Audit Function in ERM The Impact of ERM on Internal Audit Assurance Opportunities to Provide Insight Summary 4-23 Review Questions 4-25 Multiple-Choice Questions Discussion Questions Cases 4-29 4-28 4-26 4-23 4-19 4-22 4-16 CHAPTER 5 Business Processes and Risks 5-1 Learning Objectives Business Processes 5-1 5-2 Documenting Business Processes Business Risks 5-8 5-10 Business Process Outsourcing 5-24 Opportunities to Provide Insight 5-26 Summary 5-27 Appendix 5-A: Applying the Concepts: Risk Assessment for Student Organizations 5-28 Review Questions 5-32 Multiple-Choice Questions Discussion Questions Cases 5-33 5-35 5-36 CHAPTER 6 Internal Control 6-1 Learning Objectives Frameworks 6-1 6-2 Deinition of Internal Control 6-7 The Objectives, Components, and Principles of Internal Control Internal Control Roles and Responsibilities Limitations of Internal Control 6-17 6-20 Viewing Internal Control from Different Perspectives Types of Controls 6-23 6-24 Evaluating the System of Internal Controls: An Overview Opportunities to Provide Insight Summary 6-30 Review Questions 6-31 Multiple-Choice Questions Discussion Questions Cases 6-35 6-34 6-32 6-29 6-28 6-8 CHAPTER 7 Information Technology Risks and Controls 7-1 Learning Objectives 7-1 Key Components of Modern Information Systems IT Opportunities and Risks IT Governance 7-10 7-13 IT Risk Management IT Controls 7-13 7-14 Implications of IT for Internal Auditors Sources of IT Audit Guidance Summary 7-20 7-23 7-25 Review Questions 7-27 Multiple-Choice Questions Discussion Questions Cases 7-6 7-28 7-30 7-32 CHAPTER 8 Risk of Fraud and Illegal Acts s-i Learning Objectives 8-1 Overview of Fraud in Today's Business World Deinitions of Fraud 8-6 The Fraud Triangle 8-10 Key Principles for Managing Fraud Risk 8-2 8-12 Governance Over the Fraud Risk Management Program Fraud Risk Assessment 8-18 Illegal Acts and Response Fraud Prevention Fraud Detection 8-20 8-22 8-24 Fraud Investigation and Corrective Action Understanding Fraudsters 8-25 8-26 Implications for Internal Auditors and Others Opportunities to Provide Insight Summary 8-33 Review Questions 8-35 Multiple-Choice Questions Discussion Questions Cases 8-39 8-38 8-36 8-33 8-28 8-15 CHAPTER 9 Managing the Internal Audit Function 9-1 Learning Objectives 9-1 Positioning the Internal Audit Function in the Organization 9-3 Planning 9-7 Communication and Approval 9-8 Resource Management 9-9 Policies and Procedures 9-13 Coordinating Assurance Efforts 9-14 Reporting to the Board and Senior Management Governance 9-18 Risk Management Control 9-16 t 9-19 9-21 Quality Assurance and Improvement Program (Quality Program Assessments) 9-22 Performance Measurements for the Internal Audit Function Use of Technology to Support the Internal Audit Process 9-26 9-26 Opportunities to Provide Insight 9-29 Summary 9-29 1 1. IV - ^ i i . I i . .. ' ^J IS * Multiple-Choice Questions Discussion Questions Cases 9-32 9-35 9-36 CHAPTER 10 ^~^>~ .~^.^. Learning Objectives Audit Evidence 10-1 10-1 Audit Procedures Working Papers 10-4 10-14 Summary 10-16 Review Questions 10-18 Multiple-Choice Questions Discussion Questions Cases 10-24 10-19 10-22 .. 0 ~ x~ CHAPTER 11 Data Analytics and Audit Sampling n-i Learning Objectives Data Analytics 11-1 11-2 Steps to Internal Audit Data Analytics Use of Data Analytics 11-5 11- 6 Future of Internal Audit Data Analytics Audit Sampling 11-7 11-9 Statistical Audit Sampling in Tests of Controls 11-11 Nonstatistical Audit Sampling in Tests of Controls Statistical Sampling in Tests of Monetary Values 11-20 11-23 Summary 11-26 Review Questions 11-27 Multiple-Choice Questions Discussion Questions Cases 11-28 11-31 11-33 CONDUCTING INTERNAL AUDIT ENGAGEMENTS CHAPTER 12 Introduction to the Engagement Process 121 Learning Objectives 12-1 Types of Internal Audit Engagements 12-2 Overview of the Assurance Engagement Process The Consulting Engagement Process Summary 12-12 Review Questions 12-14 Multiple-Choice Questions Discussion Questions Cases 12-18 12-17 12-15 12-12 12-3 CHAPTER 13 Conducting the Assurance Engagement 13-1 Learning Objectives 13-1 Determine Engagement Objectives and Scope Understand the Auditee 13-8 Identify and Assess Risks Identify Key Controls 13-21 13-28 Evaluate the Adequacy of Control Design Create a Test Plan 13-4 13-30 13-31 Develop a Work Program 13-33 Allocate Resources to the Engagement Luiiuuu icsLO lu crauici i^viueiite 13-35 10-0/ Evaluate Evidence Gathered and Reach Conclusions 13-39 Develop Observations and Formulate Recommendations Opportunities to Provide Insight Summary 13-41 13-46 Review Questions 13-50 Multiple-Choice Questions Discussion Questions Cases 13-41 13-51 13-53 13-55 CHAPTER 14 Communicating Assurance Engagement Outcomes and Performing Follow-Up Procedures 14-1 Learning Objectives 14-1 Engagement Communication Obligations 14-2 Perform Observation Evaluation and Escalation Process 14-5 Conduct Interim and Preliminary Engagement Communications Develop Final Engagement Communications 14-19 Distribute Formal and Informal Final Communications Perform Monitoring and Follow-Up 14-28 14-22 14-17 Other Types of Engagements Summary 14-30 Review Questions 14-32 Multiple-Choice Questions Discussion Questions Cases 14-30 14-33 14-36 14-38 CHAPTER 15 The Consulting Engagement 15-1 Learning Objectives 15-1 Providing Insight Through Consulting 15-4 The Difference Between Assurance and Consulting Services Types of Consulting Services 15-7 Selecting Consulting Engagements to Perform The Consulting Engagement Process 15-11 15-13 Consulting Engagement Working Papers 15-18 The Changing Landscape of Consulting Services Capabilities Needed 15-5 15-21 15-21 The Impact of Culture and the Internal Auditor as a Trusted Advisor Orr"rti~ " -- - " e Tns o 15-23 -9.4 Summary 15-25 Review Questions 15-26 Multiple-Choice Questions Discussion Questions Cases 15-30 Notes BM-1 15-27 15-29 Glossary BM-7 Appendices BM-19 Appendix A: The IIA's Code of Ethics BM-19 Appendix B: The IIA's International Standardsfor the Professional Practice of InternalAuditing BM-21 Index BM-39 ADDITIONAL CONTENT ON THE COMPANION WEBSITE ACL Software CaseWare IDEA Software TeamMate+ The IIA's Code of Ethics The IIA's International Standardsfor the Professional Practice ofInternal Auditing Case Studies Case Study 1, "Auditing Entity-Level Controls" Case Study 2, "Auditing the Compliance and Ethics Program" Case Study 3, "Performing a Blended Consulting Engagement" Case Study 3, "Performing a Blended Consulting Engagement, abridged version" Students and instructors can access this material at the following address: www.theiia.org/IAtextbook PREFACE Welcome to the fourth edition of this textbook. There are many important changes, M'uii ui which die t».i,-irn un ujMaica likxi nave uccn mauc \.\j pivicooiunai guiuaiiLc such as The IIA's International Professional Practices Framework (IPPF) and the exposure draft of the Committee of Sponsoring Organizations of the Treadway Commission's (COSO's) Enterprise Risk Management - Aligning Risk with Strat¬ egy and Performance. The authors' continuing goal, carried forward from previous editions of the text¬ book, is to provide students with the fundamental knowledge and a sense of the skills they will need to succeed as entry-level internal audit professionals. Accord¬ ingly, our primary target audience is undergraduate and graduate university stu*"l*»T»+f nr» »»/-*! i,i/f in i »-t4-»**-\/"l,i'n'»t,*"\»«ir ln + arwi I ontit /i/mu'coc WTr* in U'-- i. iiiwiu 1. ill i i 1 i v ;mi iv I i II \ mil i ii<(i umiii i win.'i a. > * l"\nl i fw frt \ in iv . rtriWTCixmr* tnit iiwm . v i Liletl internal audit practitioners also will find the fourth edition of the textbook useful as a training and reference tool. SIGNIFICANT CHANGES IN THE FOURTH EDITION As indicated above, the fourth edition of the textbook includes several important changes: Chapter 1, "Introduction to Internal Auditing," introduces the concept of the internal audit function as a trusted advisor to the organization, which is carried throughout the other chapters as applicable. This chapter also introduces the changes to the IPPF that are discussed in detail in chapter 2. Chapter 2, "The International Professional Practices Framework: Authoritative Guidance for the Internal Audit Profession," provides details regarding the new mission for internal auditing and other updates to the IPPF, the new internal audit global competency model, and changes in committee structure as well as the updated process for setting guidance for the profession. Chapter 4, "Risk Management," has been updated to reflect the exposure draft of the new COSO framework, Enterprise Risk Management - Aligning Risk with Strategy and Performance, which is carried throughout the textbook. Chapter 6, "Internal Control," has been updated to reflect the Guidance on Risk Management, Interned Control and Related Financial and Business Reporting that supersedes Internal Control: Revised Guidefor Directors on the Combined Code (known as the Turnbull Report) in Wales and the UK. It also incorporates the relevant concepts from the exposure draft of COSO's Enterprise Risk Man¬ agement -Aligning Risk zeith Strategy and Performance. Chapter 7, "Information Technology Risks and Controls," includes increased coverage of emerging developments in technology, including a heightened focus on cybersecurity and the impact of associated risks to organizations. Chapter 8, "Risk of Fraud and Illegal Acts," pulls in the latest information and data from the 2016 COSO Fraud Risk Management Guide as well as the 2016 Report to the Nations global survey from the Association of Certified Fraud Examiners, and reflects the newest guidance in the exposure draft of COSO's Enterprise Risk Management - Aligning Risk with Strategy and Performance. Chapter 9, "Managing the Internal Audit Function," now includes a section on creating a centralized professional practices group within the internal audit function and the many benefits and efficiencies that can be realized. Chapter 11, previously titled "Sampling," has been renamed "Data Analytics and Audit Sampling" to relect the chapter's robust discussion of the beneficial use of data analytics by internal audit functions to provide assurance that is based on entire populations in a precise and efficient manner. The chapter introduces TeamMate Analytics while students and instructors retain access to the ACL and CaseWare IDEA tools that have always been available with the textbook. Chapter 15, "The Consulting Engagement," discusses how successful delivery of the wide variety of advisory services can position the internal audit activity as a trusted advisor within the organization and delineates the challenges that can make it dificult to achieve. The end-of-chapter material has been expanded to ensure coverage of each of the major concepts addressed in each chapter, including the new material in each. KnowledgeLeader, a resource provided by Protiviti, has been integrated throughout the textbook in the form of a relevant case at the end of each chapter that encourages students to do further research into the applicable topic and report on what they find, allowing them to lex their critical thinking muscles. The latest version of TeamMate+ audit management software is integrated throughout the applicable textbook chapters, and the process for accessing the software has been much improved. TeamMate-speciic case studies have been updated to relect the latest software enhancements and are embedded in the end-of-chapter material as applicable. Rather than including a CD historically packaged with the textbook, access to the ancillary materials will be facilitated via a companion website hosted by The IIA. This will allow students and instructors real-time access to the most current information and materials and provide a portal to partner sites for access to TeamMate software, KnowledgeLeader case material, and use of ACL and CaseWare IDEA software. CONTENT AND ORGANIZATION OF THE TEXTBOOK The textbook continues to include the following key components: Extensive coverage of governance, risk management, and internal control. A risk-based, process, and controls-focused internal audit approach. Integration of IT and fraud risks and controls. Alignment with the IPPF and Certified Internal Auditor (CIA) examination content specifications. Callouts of key terms in the margins of each chapter to reinorce key concepts. Chapters 1 through 11, which are collectively referred to as Fundamental Inter¬ nal Audit Concepts, cover topics that all internal auditors need to know and understand. Chapters 12 through 15, which are collectively referred to as Conduct¬ ing Internal Audit Engagements, focus on the planning, performing, and commu¬ nicating phases of internal audit assurance and consulting engagements. The end-of-chapter materials include review questions, multiple-choice questions, discussion questions, application-oriented cases, KnowledgeLeader research cases, and, in applicable chapters, exercises intended to familiarize students with Team¬ Mate, the most popular audit management software. Other than the TeamMate exercises, which are the creation of Wolters Kluwer, unless otherwise indicated, all end-of-chapter questions and cases are the original work of the authors or have been adapted from the CIA Model Exams published by The IIA in 1998, 2004, and 2015, or from CIA exams prior to The IIA's closure of the exams in 1997The Glossary contains the authors' deinitions of key terms used throughout the textbook. The IIA's Code of Ethics and the International Standardsfor the Profes¬ sional Practice of Internal Auditing are reproduced in appendix A and appendix B, respectively. TEXTBOOK SUPPLEMENTS The following supplemental materials can be accessed on the companion website of the textbook: ACL and CaseWare IDEA Sotware. Both ACL and CaseWare IDEA, the two predominant data analytics software programs used by internal auditors, can be accessed on the website. Instructors can decide individually the extent to which they want to give their students practical, hands-on experience with generalized audit software using ACL and/or CaseWare IDEA. TeamMate Sotware, Demonstration Videos, and Exercises. TeamMate, the most widely used audit management software, can be accessed on the website and integrated in the chapters to which the various software modules apply. Instructors can use the software, videos, and exercises to familiarize students with the various modules in the TeamMate suite. Protiviti KnowledgeLeader. Students and instructors have access to Protiviti's KnowledgeLeader. Case Studies at the end of each chapter direct students to the KnowledgeLeader site to research relevant guidance related to concepts in the chapters. Case Studies. The companion website contains four supplemental case studies that are intended to provide students with more in-depth, application-oriented coverage: Case Study 1, "Auditing Entity-Level Controls." Case Study 2, "Auditing the Compliance and Ethics Program." Case Study 3, "Performing a Blended Consulting Engagement." Case Study 3, "Performing a Blended Consulting Engagement, abridged version." The following supplemental materials are available separately for instructors on the companion website: Solutions Manual. The Solutions Manual contains answers prepared by the textbook authors for the end-of-chapter questions and cases. Textbook Exhibits. Each of the textbook exhibits has been reproduced indi¬ vidually for instructors who want to use them separately as visual aids and/or handouts. Slide Templates. Slide templates have been prepared for each chapter. Instruc¬ tors can use these templates as a starting point or preparing their personal sets of slides. Illustrative Exams. The illustrative exams prepared by the authors are intended to give instructors a head start on constructing exams best suited for their classes. Internal Audit Project. Two of the textbook authors, Urton Anderson and Mark Salamasick, describe how they have successfully integrated real-world internal audit projects into their Internal Auditing Education Partnership (IAEP) Program curricula. ACKNOWLEDGMENTS First and foremost, the authors thank Kurt Reding, who saw the need for a comDrehensive internal auditing textbook and recruited the rest of us to execute on his vision. Under his leadership, the irst three editions of this textbook beneitted from his passion for improving the profession through education. Kurt's very high stan¬ dards and appreciation or the diversity of thought around the execution of internal auditing resulted in a textbook that we've all been proud to have contributed to and that we believe has positively impacted the educational landscape around internal auditing. Due to competing priorities, Kurt was not available to lead us through this fourth edition and his talents and enthusiasm were sorely missed. While he was not with us physically, the spirit of his vision was ever present and we worked hard to build on the previous editions to create this new edition that relects the latest guidance on emerging topics while retaining Kurt's drive for excellence. The authors would like to thank the organizations and individuals, including col¬ lege instructors and students, who used the irst, second, and/or third editions of the textbook. We especially want to thank Deborah Kretchmar, CIA, Senior Vice President, Internal Audit, LPL Financial. In her role as a member of the Internal Audit Foundation's Board of Trustees and Trustee Champion of the textbook, Deb¬ orah thoroughly reviewed each updated chapter of the fourth edition and pro¬ vided insightful comments that helped us produce a high-quality textbook that we believe will serve students well. Additionally, we appreciate the efforts of Margaret Christ, PhD, CIA, Associate Professor of Accounting, University of Georgia, and Steve Goodson, CIA, CISA, CGAP, CCSA, CLEA, CRMA, Internal Audit Lecturer, McCombs School of Busi¬ ness, The University of Texas at Austin, for reviewing and providing valuable feed¬ back on select chapters of this fourth edition. Steve Mar, CISA, Lecturer in Information Technology at Seattle University and retired Information Technology Audit Director, generously contributed his time and technology expertise in reviewing chapter 7, "Information Technology Risks and Controls," resulting in a chapter that is comprehensive and relects the very latest information available. In addition, the authors would like to thank the following organizations and indi¬ viduals for their contributions to the fourth edition of the textbook: The Internal Audit Foundation for sponsoring the writing of the textbook. The IIA-Chicago and IIA-Dallas Chapters for their sponsorship of this fourth edition. The IIA for permission to incorporate the International Professional Practices Framework (IPPF) and other materials, including questions from the Certiied Internal Auditor Model Exams and from past CIA examinations. ACL Services Ltd. for contributing the education edition of ACL audit software that is provided on the companion textbook website. Audimation Services Inc. for contributing the CaseWare IDEA audit software that is provided on the companion textbook website. Michael Gowell, General Manager and Senior Vice President, TeamMate, and Michael Charney, Senior Director of Professional Services, TeamMate, of Wolters Kluwer for partnering with us to provide students who use this textbook with hands-on experience with TeamMate software. Chris Ryley, Regional Director of Professional Services, ofWolters Kluwer for working with the authors on the TeamMate pilot program and overall project management. Stephen Fuller, Senior Consultant, TeamMate, ofWolters Kluwer for creating the TeamMate case studies, exercises, and videos, and the TeamMate analytics exercise included in and accompanying the textbook. Stephen worked with the textbook team in two pilot projects with the universities to ensure easy adoption of TeamMate+ for Universities. _ f-". d«4i«_«« r>:_««4i nffliant t-i«.,«i«~.4i t;*;..*:.,,-. T"A,f* ~f"rH_., Kluwer for developing the TeamMate Analytics examples. David Carr, Senior Manager of Technical Services, TeamMate, of Wolters Klu¬ wer for setting up and making available the TeamMate Hosting Environment. Leila Daiuto, Director of New Product Initiatives, TeamMate, ofWolters Kluwer for developing and coordinating the TeamMate College and University Program. Joseph Mauriello, Director of Center for Internal Auditing, University of Texas at Dallas, Steve Goodson, Internal Audit Lecturer, University of Texas at Aus¬ tin, Urton Anderson, Director School of Accountancy, University of Kentucky, and Sandra Shelton, Professor of Accountancy, DePaul University for partic¬ ipating in the TeamMate+ pilot projects and providing feedback on improve¬ ments in the process. Protiviti, Lark Scheierman, Director, Marketing, and Katrina Opgenorth, KnowledgeLeader University Program Manager, for partnering with us to pro¬ vide instructors and students who use this textbook with hands-on experience with the KnowledgeLeader University Center educational tool repository. The IIA - United Kingdom and Ireland, the IT Governance Institute, the Committee of Sponsoring Organizations of the Treadway Commission (COSO), Grant Thornton, and the American Institute of Certiied Public Accountants (AICPA) for granting permission for use of materials throughout the textbook. Lillian McAnally, Editorial Content Manager, Internal Audit Foundation, for coordinating and directing the project and or managing the production pro¬ cess. Lee Ann Campbell, Senior Publications Editor, Internal Audit Foundation, for editing the entire textbook, including the supplemental material provided on the companion website to the textbook. Debi Roth, Managing Director - Global Standards & Guidance, The IIA, for providing timely information on updates to IPPF guidance throughout the writing of this textbook. Faceout Studio for designing the textbook's interior and cover. ABOUT THE AUTHORS URTON L. ANDERSON, PHD, CIA, CRMA, CFSA, CGAP, CCEP EY Professor and Director of Von Allmen School of Accountancy The University ofKentucky Urton is EY Professor and Director of Von Allmen School of Accountancy at the University of Kentucky. Prior to joining the Von Allmen School, he was a member of the accounting faculty at the McCombs School of Business at the University of Texas at Austin. His research has addressed various issues in internal and exter¬ nal auditing and organizational governanceparticularly compliance, enterprise risk management, and internal control. In addition to numerous articles, he has written four books, several of which have been translated into French, Spanish, Chinese, and Japanese. Professor Anderson has been involved in the AAA Audit Section throughout his career, and also served as President of the Section (2009-2010). Urton also is active in The IIA. He has been Chair of The IIA's Board of Regents (2003-2007) and Chair of the Internal Auditing Standards Board (2002-2003 and 2007-2010). In 1997, he received The IIA's Leon R. Radde Educator of the Year Award. In 2006, me jljla recogmzeu ms outsianaing conxriDUtions to tne neia ot internal auditing by giving him the Bradford Cadmus Memorial Award. He served as Chair of the Internal Audit Foundation's Committee of Research and Education Advisors from 2011-2015 and is currently a member of the Foundation's Board of Trustees. In March 2016, Urton was one of four internal audit leaders from business, government, and academia to make up the 2016 class of the American Hall of Distinguished Audit Practitioners. Established in 2011, the honor annually recognizes individuals who contributed signiicantly to the profession through¬ out their careers. Urton also serves on the Board of Directors for the Society Lii vuipuiate wuiiijjiiain-c aiiu jL.1.11 n a it < v^ctic v^uliiyiicuiue /\&&uciatiun ctiiu served as its President from 2016-2017. From 2011-2012, Urton was an Aca¬ demic Fellow in the Ofice of the Chief Accountant of the U.S. Securities and Exchange Commission. MICHAEL J. HEAD, CIA, CPA, CMA, CBA, CISA Lecturer, Accounting Department Mays Business School TexasA&M University Mike is currently a lecturer in the Accounting Department at Texas A&M Univer¬ sity in the Mays Business School. He also serves as a risk management, internal control, and operations consultant. Prior to joining Texas A&M University, Mike held the resident instructor position in the Accounting Department at Creighton University's Heider College of Business. He joined Creighton University in January 2013 and served as an adjunct instructor for the Accounting Department until August 2014 when he assumed the full-time position of resident instructor. Mike retired from TD Ameritrade in May 2013, where he served as the ChiefAudit Executive. As Managing Director of Corporate Audit at TD Ameritrade, Mike was responsible for the coordination and delivery of risk-based and process-driven review, assurance, and advisory services speciic to internal controls and risk management throughout TD Ameritrade. During his more than 36-year career, he served in various capacities, including Director of Internal Audit, Audit Man¬ ager, and Controller, for several companies and inancial institutions. His experi¬ ence includes developing and implementing comprehensive, risk-based internal audit functions, and serving as a strategic, inancial, operational, and compliance control consultant to the inancial services industry. In addition to earning numerous professional designationsCertiied Internal Auditor, Certiied Public Accountant, Certiied Management Accountant, Char¬ tered Bank Auditor and Certified Information Svsterns AuditorMike is a FINRA Registered General Securities Representative (Series 7), General Securities Prin¬ cipal (Series 24), and a Financial and Operations Principal (Series 27). He is an active member of The IIA. He also serves as an appointed member of the Public Company Accounting Oversight Board (PCAOB) Investor Advisory Group (IAG). In the past, Mike served as Vice Chair - Finance of the Executive Committee of The IIA's International Board and served on and chaired the Audit Committee of The IIA's International Board. Mike has also served as Chairman of the North Amer¬ ican Advocacy Committee, a Trustee on the Internal Audit Foundation Board, a North American Board member, and a Midwestern Region District Advisor. Mike co-authored Internal Auditing: Assurance £? Consulting Services, a textbook pub¬ lished by the Foundation in July 2007 with the second and third editions released in 2009 and 2013. He also co-wrote "Blended Engagements," published in Internal Auditor magazine, which earned the authors the 2010 Outstanding Contributor Award. In 2014, Mike was awarded the CAHILL Award for Excellence by Creigh¬ ton University's Heider College of Business. In the Fall of 2015, Mike helped form the Creighton Student Center for the Public Trust and served as the faculty mod¬ erator until June 2016. Mike, who earned a BSBA degree at the University of Mis¬ souri - Columbia, is also a member of the American Institute of Certiied Public Accountants, the Nebraska Society of CPAs, Missouri Society of CPAs, Information Systems Audit & Control Association, and Institute of Management Accountants. SRIDHAR RAMAMOORTI, PHD, ACA, CIA, CPA, CFE, CFF, CFSA, CGAP, CGFM, CGMA, CITP, CRMA, CRP, MAFF Department of Accounting, School of Business Administration University ofDayton, Ohio Sri has been an Associate Professor in the School of Accountancy and a Director nf thp Ptrnnrstp r^nvprnanpp Ppntpr in thp Ayfinhnpl T Pnlpc Pnllpo-p nf Rncinpcc at Kennesaw State University for almost seven years. He will be joining the Depart¬ ment of Accounting faculty at the University of Dayton, Ohio, in Fall 2017- His broad research and teaching interests include corporate governance, risk manage¬ ment, ethics, inancial and managerial accounting, external and internal auditing, international accounting, forensic accounting, and business valuation. Sri earned a Bachelor of Commerce (BCom) degree from Bombay University, India, became professionally qualiied as a Chartered Accountant in India, and worked for two years with EY in the Middle East before earning the MAcc and PhD degrees from The Ohio State University. After completing his PhD, Sri served on the accountancy faculty of the University of Illinois at Urbana-Champaign. A nroliic contributor to governance, risk, and compliance (GB_C) literature, he has published more than 35 research and professional articles. His co-authored book, A.B.C.'s ofBehavioral Forensics: Applying Psychology to Financial Fraud Prevention and Detection (Ramamoorti et al., 2013, Wiley), won the 2015 Coles College Publication prize and has been presented to the FBI Academy. Among his IIA-funded, co-authored research monographs are Research Opportunities in Internal Auditing, Using Neural Networksfor Risk Assessment in Internal Audit¬ ing, Behavioral Dimensions of Internal Auditing, Promoting and Supporting Effective Organizational Governance: Internal Audit's Role, and CAE Strategic Relationships: Building Rapport with the Executive Suite, which won the Internal Audit Foundation's Larry Sawyer Project of the Year Award in 2014. He has published several Internal Auditor articles. Prior to returning to academia, Sri was a principal with Arthur Andersen & Co. at the Chicago World Headquarters, National EY Sarbanes-Oxley Advisor, and a corporate governance partner with Grant Thornton LLP in the irm's National Ofice. Subsequently, he was a principal for Infogix Advisory Services, leading the GRC professional services division of Infogix, Inc., based in Naperville, IL. He was a core member of the Grant Thornton authoring/development team for the 2009 COSO Guidance on Monitoring Internal Control Systems, and later for ISACA's 2010 guidance, Monitoring Internal Control Systems and IT. In December 2016, Sri completed a three-year term on the prestigious Standing Advisory Group of the Public Company Accounting Oversight Board (PCAOB). He currently serves as a Trustee of the Financial Executives Research Foundation (FERF) and as a member of the Litigation Forensics Board of the National Associ¬ ation of Certiied Valuators and Analysts (NACVA). Sri has been an active volun¬ teer as the Chairman of the Academy for Government Accountability, a member of the Internal Audit Foundation's Board of Trustees, co-chair of the Foundation's Global Common Body of Knowledge (CBOK) 2010 study, and a member of The IIA's Global Ethics Committee. Over the last two decades, he has made profes¬ sional presentations in 15 countries. CRIS RIDDLE, MA, CIA, CRMA Solutions & Strategy Senior Audit Manager TD Ameritrade Cris is the Solutions & Strategy Senior Audit Manager for TD Ameritrade. She is responsible for managing the processes, systems, and databases for the adminis¬ tration of the internal audit department. Additionally, she develops and delivers internal training and reviews and edits audit materials, including audit reports, meeting presentations, audit committee and risk meeting materials, and the Audit Manual. Cris also teaches English Composition, Critical Reasoning and Rhetoric, Professional Communication, Engaging the Short Story, and World Literature at Creighton University and Nebraska Methodist College. In addition to co-authoring all four editions of Internal Auditing: Assurance £2 Advisory Services, Cris has served as the General Editor and project manager. She was also the General Editor of the sixth edition ofSawyer's InternalAuditing. Cris received the Outstanding Contributor Award for the article "Blended Engage¬ ments" that she co-authored with fellow authors Kurt Reding and Michael Head. She is a member of The IIA as well as a FINRA Registered General Securities Rep¬ resentative (Series 7). She received both her BA and MA degrees in English/Creative Writing from Creighton University in Omaha, NE, where she held a Presidential Fellowship as a graduate student. Cris writes and presents on numerous topics. MARK SALAMASICK, CIA, CISA, CRMA, CSP Executive Director of Audit University ofTexas System Mark is currently Executive Director of Audit at the University of Texas System. In this role, he assists in the oversight of the Academic Institution audit groups of the UT System. He also works in advancing progressive strategies and initiatives outlined for the internal audit enterprise across the UT System. Previous to this, he was the Director of the Center for Internal Auditing Excellence at the Univer¬ sity of Texas at Dallas (UTD). Mark created the internal audit program and many of the courses in the program over the 12 years he led that program. He started the program in the Fall of 2003 with an extensive curriculum in internal audit¬ ing, technology, audit software, information security, corporate governance, and forensic accounting. He taught Internal Audit, Information Technology Audit and Risk Management, and Advanced Auditing. He authoredAuditing Outsourced Functions: RiskManagement in an Outsourced World published by the Internal Audit Foundation in October 2012. He was the principal researcher on a project with the Foundation and Intel on PC Manage¬ ment Best Practices along with another publication, Auditing Vendor Relation¬ ships, both published in 2003. He was previously with Bank of America for more than 20 years. He worked within the Internal Audit Group for 18 years, serving as Senior Vice President and Director of Information Technology Audit with respon¬ sibility for various technology, inancial, and operational audits. He was responsi¬ ble for partnering on and auditing technology, information security, and business continuity. Before joining Bank of America, Mark was a senior consultant with Accenture (Andersen Consulting). Mark currently serves on the Academic Relations Committee of IIA International. He previously served multiple terms on the Foundation's Board of Trustees and Committee of Research and Education Advisors. He received the 1994 IIA Inter¬ national Audit and Technology Award. In 2005, he was named Leon R. Radde Educator of the Year by The IIA. The University of Texas at Dallas created the endowed IT Audit Fellowship in his name in 2016. He is a frequent conference speaker on emerging technology issues, internal audit practices, and the future direction of internal audit. He was on The IIA's Dallas Chapter's Board of Governors for 20 years. Mark holds a BS in Business Administration and an MBA from Central Michigan University, where he taught accounting and information systems as a graduate student and as a full-time fac¬ ulty member. PAUL J. SOBEL, CIA, QIAL, CRMA Vice President/Chief Audit Executive Georgia-Paciic LLC Paul is Vice President/Chief Audit Executive for Georgia-Paciic, LLC, a privately owned forest and consumer products company based in Atlanta, GA. He pre¬ viously served as the Chief Audit Executive for three public companies: Mirant Corporation, an energy company based in Atlanta, GA; Aquila, Inc., an energy company based in Kansas City, MO; and Harcourt General's publishing opera¬ tions based in Orlando, FL. His responsibilities included leading the global inter¬ nal audit efforts at these companies, as well as consulting on each company's enterprise risk management (ERM), compliance, and internal controls programs. He has also served as International Audit Manager for PepsiCo, Senior Manager in Arthur Andersen's Business Risk Consulting practice, and Experienced Man¬ ager in Arthur Andersen's Financial Statement Assurance practice. Paul is a frequent speaker on governance, risk management, and internal audit topics. In addition to co-authoring the previous editions of this textbook, he has published a book titled Auditor's Risk Management Guide: Integrating Auditing and ERM, currently in its eighth edition, and co-authored Enterprise Risk Management: Achieving and Sustaining Success, abook published by the Internal Audit Foundation. Paul is a past Chairman of the Board for The IIA and has served in other IIA oficer and board roles. In 2012, Paul was recognized in Treasury & Risk magazine's list of 100 Most Inluential People in Finance. He has also served on the COSO ERM Advisory Council for its recent update to the COSO ERM frame¬ work thp SltnnHintr AHvicnrv irnnn nf flip Pnhlin Ptmnsnv Amrmntinor Ovprcicrlit Board (PCAOB), and as The IIA's representative on the Pathways Commission, which developed recommendations to enhance the future of accounting education in the United States. -"Wi i I - L-i ^i ^ & ses -i » / CHAPTER 1 Introduction to Internal Auditing LEARNING OBJECTIVES Understand the value proposition that stakeholders expect from the internal audit function. Obtain a basic understanding of internal auditing and the internal audit process. Understand the relationship between auditing and accounting. Distinguish between financial reporting assurance services provided by internal auditors and those provided by indenendent outside auditors. Become familiar with the internal audit profession and The IIA. Understand the competencies needed to excel as an internal auditor. Be aware of the various internal audit career opportunities it is possible to pursue. Think about the term "internal auditing" for a moment. What pops intu juui mind? What does the term mean to you? For many people, the term has no par¬ ticular significance, and for some, it may invoke negative thoughts. For example, many people have long held the view that auditing in general is merely a boring branch of accounting. To others, internal auditing conveys an even more negative connotationafter all, the only thing auditors do is check other peoples' work and report the mistakes they make, sort of like a police function. As the authors of this textbook, we hope to dispel these misperceptions about internal auditing. The fact is that internal auditing is widely viewed as a prestigious, high-proile profession, the stature of which has never been higher than it is now. The demand for talented individuals at all levels of internal auditing far exceeds the supply. Chief audit executives (CAEs) of public companies commonly report directly to the audit committee of the board of directors and are viewed as peers among senior management executives. Worldwide membership in The IIA as of 2016 exceeded 185,000. 1-1 However, to survive and thrive, internal audit, like any other function within an organization, must justify its existence to its key stakeholders. In other words, the stakeholders must value the services the internal audit function has to offer. In recognition of this fact, The IIA formed a task force in 2008 "to explore and develop a clear and concise description of internal audit's value proposition..." In 2010, the IIA Global Board of Directors, The IIA's governing body, endorsed the outcomes of the task force's work. A visual depiction of internal audit's value prop¬ osition, as set forth by The IIA, is presented in exhibit 1-1. The three components of the value proposition are deined below: Assurance = Governance, Risk, and Control. Internal audit provides assur¬ ance on the organization's governance, risk management, and control processes to help the organization achieve its strategic, operational, inancial, and compli¬ ance objectives. Internal Auditing An independent objective sssurance and consulting activity designed to add value and improve an organiza¬ tion's operations. Insight = Catalyst, Analyses, and Assessments. Internal audit is a catalyst for improving an organization's effectiveness and eficiency by providing insight and recommendations based on analyses and assessments of data and business process. Objectivity = Integrity, Accountability, and Independence. With commit¬ ment to integrity and accountability, internal audit provides value to governing bodies and senior management as an objective source of independent advice.1 EXHIBIT 1-1 THE VALUE PROPOSITION cfyVRAt, Internal Auditing = Assurance, Insight, Add Value and Objectivity Value is provided by improving opportunities to achieve organiza¬ Governing bodies and senior tional objectives, identifying opera¬ management rely on inter¬ tional improvement, and/or reducing risk exposure through both assurance INTERNAL AUDITING and consulting services. nal auditing for objective assurance and insight on the effectiveness and eiciency of governance, risk management, and internal control processes. OB^G Source: Miller, Patty, and Tara Smith, Insight: Delivering Vatue to Stakeholders (Lake Mary, FL: The Institute of Internal Auditors, 20U), 14. This value proposition clearly articulates why internal auditing is important. In the next section of this introductory chapter, we walk through the deinition of internal auditing and introduce readers to the internal audit process. We next clar¬ ify the relationship between auditing and accounting and distinguish the inancial reporting assurance services provided by internal auditors from those provided by independent outside auditors. We then provide an overview of the internal audit profession and The IIA. We conclude the chapter by discussing the competencies 1-2 INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES needed to excel as an internal auditor and the various internal audit opportunities that interested, competent individuals can pursue. DEFINITION OF INTERNAL AUDITING The IIA's Board of Directors adopted the current deinition of internal auditing in 1999: Internal auditing is an independent, objective assurance and consulting activ¬ ity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disci¬ plined approach to evaluate and improve the effectiveness ofrisk management, control, and governance processes.2 The Deinition of Internal Auditing states the fundamental purposes, nature, and scope of internal auditing. The key components of this deinition are listed here and discussed in turn below: Helping the organization accomplish its objectives. Evaluating and improving the effectiveness of risk management, control, and governance processes. Assurance and consulting activity designed to add value and improve operations. Independence and objectivity. A systematic and disciplined approach (speciically, the engagement process). Helping the Organization Accomplish Its Objectives An organization's objectives deine what the organization wants to achieve, and its ongoing success depends on the accomplishment of its objectives. At the high¬ est level, these objectives are reflected in the organization's mission and vision statements. The mission statement expresses, in broad terms, what the organiza¬ tion wants to achieve today. The vision statement conveys what the organization aspires to achieve in the future. There is no single right way to categorize business objectives. This textbook uses the following categorization: Strategic objectives are those goals that management sets speciically related to stakeholder interests. Throughout this textbook, the term objectives will be used when discussing what an organization wants to achieve and the term strategy when discussing the way management intends to achieve those objec¬ tives. Operations objectives petain to the effectiveness and eficiency of the entity's operations, including operational and inancial performance goals, and safe¬ guarding resources against loss.3 Reporting objectives petain to internal and external inancial and noninancial reporting and may encompass reliability, timeliness, transparency, or other terms as set forth by regulators, standard setters, or the entity's policies.4 Compliance objectives pertain to adherence to laws and regulations to which the entity is subject.5 INTRODUCTION TO INTERNAL AUDITING 1-3 EXHIBIT 1-2 ILLUSTRATIVE BUSINESS AND AUDIT ENGAGEMENT OBJECTIVES RucinoCQ Ohiorfivoc LU > I- O LU cb Grow the organization's market <-" share by acquiring complemen- JZ tary businesses. VE Ship all orders no later than 48 hours after receivinq the orders. Q. Aiirlit Fnnanomant Ob'@C^'v Ensure that the informatio management uses to decide whether to acquire Company X is accurate, complete, and valid. Determine whether orders are, in fact, being shipped within 48 hours of receipt. O -i CD o Verify the design adequacy and operating effectiveness of </> E z o to LU t/> 0) control activities put in place to Record only valid sales ensure that recorded sales actu¬ transactions. ally occurred (in other words, recorded sales reflect the transfer of ownership on goods shipped to customers). u c .5 "5. E o U Determine that policies and Comply with Occupational procedures established to Safety and Health ensure compliance with Administration (OSHA) OSHA regulations are well regulations. understood, documented, and communicated. Understandable and measurable business objectives represent achievement tar¬ gets and, accordingly, establish parameters for evaluating actual achievements over time. From an internal auditor's perspective, business objectives provide a foundation for deining engagement objectives (in other words, what the internal auditor wants to achieve). The direct link between business objectives and internal audit engagement objectives sets the stage for internal auditors to help the organi¬ zation achieve its objectives. This is an important concept that will be emphasized throughout the text. Exhibit 1-2 illustrates a set of business objectives and corre¬ sponding internal audit engagement objectives. Objectives What an organization wants to achieve. 1-4 Evaluating and Improving the Effectiveness of Risk Management, Control, and Governance Processes An organization cannot achieve its objectives and sustain success without effec¬ tive risk management, control, and governance processes. These processes are complex and interrelated; an in-depth discussion of them at this point would be premature. They are covered extensively in later chapters. INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES Simple definitions are provided here to facilitate thinking about the various roles internal auditors might play in evaluating and improving these processes. Gover¬ nance provides a good starting point because it is generally viewed as the broad¬ est of the three. Governance is the process conducted by the board of directors to authorize, direct, and oversee management toioard the achievement of the organi¬ zation's objectives. Risk management, which is closely interlinked with governance, is the process conducted by management to understand and deal with uncertainties (risks and opportunities) that could affect the organization's ability to achieve its objectives. Hereafter, risk is used when referring to the possibility that an event will occur and negatively affect the achievement of objectives (for example, employee fraud) and opportunity is used when referring to the possibility that an event will occur and positively affect the achievement of objectives (for example, introducing a new product). v '' I i ' >i . i i i iii" i n iv.vi til i ion iiuniacvui^Hi, ii> niv. if i i "< "ii -i "i ii ") i i \ " i agement to mitigate risks to acceptable levels. All three processes focus on the achievement of the organization's objectives. Whereas the board of directors is responsible for conducting the governance pro¬ cess, management is responsible for conducting the risk management and con¬ trol processes. The term conducting here means guiding or leading the process as opposed to unilaterally perorming or completing the steps in the process. The board and management need each other to effectively implement governance, risk management, and control. They also need the internal audit function, which plays ^ ^.w ........... .«.^- ... >,.u..v.u.w..t>M...u F.~ 0 U1C3C ^.wv.SCO. HUWCYClj LUC w. nal audit function's responsibility stops well short of actually guiding or leading governance, risk management, and control. Chapter 3, "Governance," chapter 4, "Risk Management," and chapter 6, "Internal Control," discuss in detail the inter¬ nal audit function's responsibilities in these areas. Assurance and Consulting Activity Designed to Add Value and Improve Operations Assurance and consulting engagements differ in three respects: the primary pur¬ pose of the engagement, who determines the nature and scope of the engagement, and the parties involved. The terms used to refer to these parties vary widely. Hereafter, auditee is used to denote the people subject to assessment in an assur¬ ance engagement and customer is used to denote the people seeking services in a consulting engagement. The primary purpose of internal assurance services is to assess evidence rele¬ vant to subject matter of interest to someone and provide conclusions regarding the subject matter. The internal audit function determines the nature and scope of assurance engagements, which generally involve three parties: the auditee directly involved with the subject matter of interest, the internal auditor making the assessment and providing the conclusion, and the user relying on the internal auditor's assessment of evidence and conclusion. The primary purpose of internal consulting services is to provide advice and other assistance, generally at the speciic request of engagement customers. The cus- INTRODUCTION TO INTERNAL AUDITING 1-5 tomer and the internal audit function mutually agree on the nature and scope of consulting engagements, which generally involve only two parties: the customer seeking and receiving the advice, and the internal auditor offering and providing the advice. Independence and Objectivity Independence The freedom from conditions that threaten objectivity or the appear¬ ance of objectivity. Such threats to objectivity must be managed at the individual auditor, engagement, func¬ The IIA's Code of Ethics and International Standardsfor the Professional Practice ofInternal Auditing, both of which will be discussed in greater detail later in this chapter and in chapter 2, "The International Professional Practices Framework: Authoritative Guidance for the Internal Audit Profession," emphasize the critical¬ ly of independence and objectivity to the practice of internal auditing. Indepen¬ dence refers to the organizational status of the internal audit function. Objectivity refers to the mental attitude of individual internal auditors. Core principle num¬ ber 3 of the Core Principles for the Professional Practice of Internal Auditing underscores this, stating that the internal audit function "is objective and free from undue inluence (independent)."6 tional, and organizational levels. Objectivity An unbiased mental attitude that allows internal auditors to perform For the internal audit function to be independent, the CAE must report to a level within the organization that has suficient authority to ensure broad engagement coverage, due consideration of engagement outcomes, and appropriate responses to those outcomes. While the CAE often repots administratively to the organiza¬ tion's CEO, The IIA recommends that the CAE report functionally to the organi¬ zation's board of directors (Implementation Guide 1110). engagements in such a manner that they have an honest belief in their work product and that no signifi¬ cant quality compromises are made. Objectivity requires internal auditors not to subordinate their judgment on audit matters to that of others. Objectivity means that an auditor is able to make impartial, unbiased judgments. To ensure objectivity, internal auditors should not involve themselves in day-to¬ day operations, make management decisions, or otherwise put themselves in sit¬ uations that result in actual or potential conflicts of interest. For example, if an individual moves into the internal audit function from another area of the organi¬ zation, the internal auditor may not provide assurance services to that area for one year (Standard 1130.A1-1). The reasoning behind this policy is that the internal auditor would be put in a position of auditing his or her own work. Chapter 2 goes into greater depth on the subjects of independence and objectivity. A Systematic and Disciplined Approach: The Engagement Process To truly add value and improve operations, internal assurance and consulting engagements must be performed in a systematic and disciplined manner. The three fundamental phases in the internal audit engagement process are planning the engagement, performing the engagement, and communicating engagement outcomes. These three phases are introduced in chapter 12, "Introduction to the Engagement Process," and covered in depth in chapter 13, "Conducting the Assur¬ ance Engagement," chapter 14, "Communicating Assurance Engagement Out¬ comes and Performing Follow-Up Procedures," and chapter 15, "The Consulting Engagement." However, a brief overview is provided here. Planning the engagement involves, among other activities: Obtaining an understanding of the auditee or customer. An internal auditor cannot provide value-adding assurance or consulting services to an auditee or customer that is not well understood. The internal auditor needs to understand 1-6 INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES the auditee's or customer's business objectives and the risks that threaten the achievement of those objectives. Other aspects of the auditee or customer that the internal auditor must understand include, for example, the auditee's or cus¬ tomer's personnel, resources, and operations. Setting the engagement objectives. Because the overall purpose of internal Engagement acciiranr-p anrl onncnltino- CAr\rir»AC ic tn hgm the Organization achliVi its obieC- tives, the internal auditor will use the auditee's or customer's business objectives as a foundation for deining the desired outcomes of a speciic engagement. Determining the required evidence. The internal auditor must design the engagement to obtain suficient appropriate evidence to achieve the engage¬ ment objectives. A specific internal audit assignment or project that includes multiple tasks or activities designed to accomplish a specific set of objectives. See also Assurance Services and Consulting Services. Deciding the nature, timing, and extent of the audit tests. These decisions will inluence the internal auditors testing approach that is necessary to gather the required evidence. Performing the engagement involves the application of specific audit proce¬ dures. Procedures include, for example, making inquiries, observing operations, inspecting documents, and analyzing the reasonableness of information. A second important aspect of gathering evidence is documenting the procedures performed and the results of performing the procedures. Evaluating the evidence gathered during an assurance engagement involves reaching logical conclusions based on the evidence. For example, an internal audi¬ tor might reach the conclusion that controls over sales transactions are effective. Evaluating the evidence gathered during a consulting engagement involves for¬ mulating practical advice based on the evidence. For example, an internal auditor might advise the customer that speciic application controls need to be built into a new computerized information system. * %/W\ V Communicating outcomes is a critical component of all internal assurance and consulting engagements. Regardless of the content or form of the communica¬ tions, which may vary, communications of engagement outcomes "must be accu¬ rate, objective, clear, concise, constructive, complete, and timely" (Standard 2420: Quality of Communications). ^7A*k THE RELATIONSHIP BETWEEN AUDITING AND ACCOUNTING Students beginning their irst auditing course have a tendency to assume that auditing is a subset of accounting. Although such an assumption is understand¬ able, it is not correct. Exhibit 1-3 contains a quote from The Philosophy ofAuditing that explains the difference between auditing and accounting. Although the context of this quote is the audit of financial statements conducted by an independent outside auditor, the ideas expressed are just as relevant to inter¬ nal assurance and consulting services. Internal assurance and consulting services are analytical and investigative; they are based on logic, which involves reasoning and drawing inferences. Internal auditors use logic when they reach conclusions or formulate advice based on evidence they gather and evaluate. The quality of internal auditors' conclusions or advice depends on their ability to gather and eval¬ uate suficient appropriate evidence. INTRODUCTION TO INTERNAL AUDITING 1-7 EXHIBIT 1-3 RELATIONSHIP BETWEEN AUDITING AND ACCOUNTING "The relationship of auditing to accounting is close, yet their natures are very different; they are business associates, not parent and child. Accounting includes the collection, classification, summarization, and communication of financial data; it involves the mea¬ surement and communication of business events and conditions as they affect and repre¬ sent a given enterprise or other entity. The task of accounting is to reduce a tremendous mass of detailed information to manageable and understandable proportions. Auditing does none of these things. Auditing must consider business events and conditions too. but it does not have the task of measuring or communicating them. Its task is to review the measurements and communications of accounting for propriety. Auditing is analyti¬ cal, not constructive; it is critical, investigative, concerned with the basis for accounting measurements and assertions. Auditing emphasizes proof, the support for inancial state¬ ments and data. Thus, auditing has its principal roots, not in accounting, which it reviews, but in logic on which it leans heavilv for ideas and methods," Source: Mautz. R. K., and Hussein A. Sharaf, The Philosophy of Auditing (Sarasota, FL: American Accounting Association, 1961), 14- FINANCIAL REPORTING ASSURANCE SERVICES: EXTERNAL VERSUS INTERNAL COSO The Committee of Sponsoring Organizations of the Treadway Commission. Publicly traded companies in many countries are required by law or the require¬ ments of the stock exchange on which they trade to have their annual financial statements audited by an independent outside auditor, for example, a chartered accounting (CA) or certiied public accounting (CPA) irm. A inancial statement audit is a form of assurance service in which the irm issues a written attestation report that expresses an opinion about whether the financial statements are fairly stated in accordance with Generally Accepted Accounting Principles (GAAP). Many privately held companies, government organizations, and not-for-proit organizations also have annual inancial statement audits. The U.S. Sarbanes-Oxley Act of 2002 requires a U.S. public company's inde¬ pendent outside auditor (frequently referred to as the external auditor) to also attest to the effectiveness of the company's internal control over financial reporting as of the balance sheet date. The CPA firm's opinion on internal con¬ trol over financial reporting must be based on a recognized framework such as Internal Control - Integrated Framework issued by the Committee of Spon¬ soring Organizations of the Treadway Commission (COSO). The COSO frame¬ work, as it is often called, and other internal control frameworks are discussed in detail in chapter 6. Both the CPA firm's financial statement audit report and the firm's report on the effectiveness of internal control over financial report¬ ing are public documentsthey are included in the company's annual report and submitted to the U.S. Securities and Exchange Commission (SEC). This requirement is not restricted to the United States. Many other countries have similar financial reporting laws with similar requirements. 1-8 INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES Independent outside audit irms provide their inancial reporting assurance ser¬ vices primarily for the beneit of third parties. Third parties rely on a irm's inde¬ pendent attestations when making inancial decisions about the organization. The independent attestations provide credibility to the information being used by the third-party decision-makers and, accordingly, increase the users' con¬ idence regarding the accuracy, completeness, and validity of the information upon which they base their decisions. Internal auditors also provide inancial reporting assurance services. The pri¬ mary difference between internal and external inancial reporting assurance services is the audience. Internal auditors provide their inancial reporting assur¬ ance services primarily for the benefit of management and the board of directors. For example, Sarbanes-Oxley requires the CEO and chief inancial oficer (CFO) of U.S. public companies to certify the company's inancial statements as part of their quarterly and annual ilings. It also requires management to assess and repot on the effectiveness of internal control over inancial reporting. Manage¬ ment relies on the inancial reporting assurance services provided by the com¬ pany's internal audit function to provide them with conidence regarding the truthfulness of their financial reporting assertions. THE INTERNAL AUDIT PROFESSION Modern Internal Auditing: A Dynamic Profession in High Demand "The profession ofauditing in general, and internal auditing in particular, is ancient."1 Although historians have traced the history of internal auditing to centuries B.C., many people associate the genesis of modern internal auditing with the establishment of The IIA in 1941. At its inception, The IIA was a national orga¬ nization with 24 charter members.8 Both The IIA and the internal audit profession have evolved dramatically since then. A timeline of selected IIA milestones is presented in exhibit 1-4. Two items that stand out in the timeline are the phenomenal growth of The IIA, especially during the last 30 years, and its globalization. IIA members now reside in more than 170 countries and territories, with more than 50 percent of the membership residing outside North America.9 Internal auditing is now a truly global profes¬ sion and the demand for internal audit services continues to grow. A number of interrelated circumstances and events have fueled the dramatic increase in demand for internal audit services over the past 30 years. The business world during this time has changed dramatically. Examples of these changes include globalization, increasingly complex corporate structures, e-commerce and other technological advances, and a global economic down¬ turn. Simultaneously, the business world has experienced a rash of devastat¬ ing corporate scandals, which have precipitated a groundswell of new laws and regulations and professional guidance. These forces, in combination, con¬ tinue to generate an ever-widening array of risks that corporate executives INTRODUCTION TO INTERNAL AUDITING 1-9 must understand and address. As a result, internal auditors are increasingly being called upon to help organizations strengthen their corporate governance, risk management, and control processes. The Nature and Scope of Modern Internal Audit Services The overarching objective 01 tne internal auuit lunction is to ueip an organization achieve its business objectives. Consequently, the targets of internal audit atten¬ tion may include: Operational effectiveness and eficiency of business processes. Reliability of information systems and the quality of the decision-making infor¬ mation produced by those systems. Safeguarding assets against loss, including losses resulting from management and employee fraud. Compliance with organization policies, contracts, laws, and regulations. "Governing bodies and senior management rely on Internal Auditing for objective assurance and insight on the effectiveness and eficiency of governance, risk man¬ agement, and internal control processes."10 The internal audit function helps the organization achieve its business objectives by evaluating and improving the effec¬ tiveness of governance, risk management, and control processes and by providing EXHIBIT 1-4 TIMELINE OF SELECTED IIA MILESTONES 1941 The Institute of Internal Auditors is established. IIA membership totals 24. 1947 The Statement of Responsibilities of the Internal Auditor is issued. 1948 The first chapters outside North America are formed in London and Manila. 1953 "Progress Through Sharing" is adopted as The IIA's official motto. 1957 The Statement of Responsibilities of the Internal Auditor is revised to include more responsibility for operational areas. 1968 The IIA Code of Ethics is approved. 1973 The irst Board of Regents is appointed. The Certified Internal Auditor (CIA*) nrQnrlm 15 established. 1976 The Foundation of Auditability, Research, and Education (FARE) is founded; the name is later changed to The IIA Research Foundation. 1978 The Standards for the Professional Practice of Internal Auditing is approved. 1979 The National Institute Agreement is approved; five national institutes are established. 1980 IIA membership totals 21,549. The Quality Assurance Review Manual is published. A pilot school is estab¬ 1984 lished at Louisiana State University. The first Statement on Internal Auditing Standards (SIAS) is published. 1986 The target school program is started. 1988 An IIA National Institute is established in The People's Republic of China. 1989 The United Nations grants consultative status to The IIA. 1990 The IIA elects A.J. Hans Spoel as the first chairman from outside North America. (continued next page) 1-10 INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES EXHIBIT 1-4 TIMELINE OF SELECTED IIA MILESTONES (cont.) The IIA becomes an oficial member body of the American National Standards 1995 Institute (ANSI) and the sole United States representative to the International Standards Organization (ISO). Accounting Today names IIA President William G. Bishop III. CIA, as one of 1996 the "top lOO most influential people in accounting." The IIA begins to aggres¬ sively promote the CIA program in Europe, Asia, the Middle East, and South America. 1998 1999 200O The irst all-objective CIA exam is offered with a record-breaking 5.165 candi¬ dates sitting for one or more parts. The new deinition of internal auditing is introduced. The 25th anniversary of the CIA designation is celebrated. The new Standards is introduced. IIA membership totals 68,985. 2002 2003 The new IIA Professional Practices Framework is issued. 2006 IIA membership exceeds 120,000. To continue to use the statement "conducted in accordance with the 2007 International Standards for the Professional Practice of Internal Auditing," internal audit functions that existed as of January 1, 2002, must have an exter¬ nal quality assessment completed by January 1, 2007. 2008 Computer-based testing is introduced for all professional examinations admin¬ istered by The IIA. The International Professional Practices Framework is issued, which speciied mandatory guidance (Deinition of Internal Auditing, Code of Ethics, and the 2009 International Standards for the Professional Practice of Internal Auditing) and strongly recommended guidance (Practice Advisories, Position Papers, and Practice Guides). The IIA develops a social media presence on Twitter, Facebook, and 2010 Linkedln. Additionally, The IIA's Audit Executive Center, a conveniently accessible suite of information, resources, and services that empowers CAEs to be more successful, is launched. The IIA launches its own social media channel, a new video-sharing websitewww.auditchannel.tv. The Audit Channel enables internal audit professionals to view, post, and comment on short videos that address the topics of greatest interest to the profession. Currently, the site features videos in English, Spanish, French, Japanese, and Chinese. The IIA expands the number of languages in which internal auditors can take the CIA exam to 20. 2013 The Florida Magazine Association names Internal Auditor magazine "2013 Magazine of the Year." The IIA launches the Financial Services Audit Center. 2015 Internal Auditor magazine wins awards for general excellence and web publish¬ ing at the 35,h Annual EXCEL Awards Gala in Washington, DC. 2016 The MA iaunches the Environmental, Heaith & Safety Audit Center. The IIA celebrates 75 years of advancing the internal audit profession. Source: www.theiia.org. INTRODUCTION TO INTERNAL AUDITING Ml insight through consulting services. Evaluating and improving these processes propels the internal audit function into virtually all areas of the organization, including, for example, production of goods and services, inancial management, human resources, research and development, logistics, and IT. The stakeholders served by the internal audit function include the board of directors, management, employees, and interested parties outside the organization. Internal auditors provide insight by using a wide variety of procedures to test the design adequacy and operating effectiveness of the organization's governance, risk management, and control processes. These procedures include: Inquiring of managers and employees. Observing activities. Inspecting resources and documents. Reperforming control activities. Performing trend and ratio analysis. Performing data analysis using computer-assisted audit techniques. Gathering corroborating information from independent third parties. Performing direct tests of events and transactions. Internal auditors also provide insight through a variety of consulting activities, including: Advisory services designed to provide guidance on effective governance, risk management, and control processes. Facilitative services through which internal auditors facilitate exercises designed to encourage sound governance, risk management, and control pro¬ cesses. Training on current and emerging governance, risk management, and control process concepts. The Professionals Who Perform Internal Audit Services X 1-12 Providers of internal audit services are employed by all types of organizations: public and private companies; local, state, and federal government agencies; and nonproit entities. Until the 1990s, these services were provided exclusively "in-house," in other words, by employees of the organizations employing them. This is no longer the case. Some organizations are choosing to outsource their internal audit functions, either fully or partially, to external service providers. External providers of internal audit services include public accounting irms and other third-party vendors. The most common form of outsourcing is referred to as "co-sourcing." Co-sourcing means that an organization is supplementing its in-house internal audit function to some extent via the services of third-party vendors. Common situations in which an organization will co-source its inter¬ nal audit function with a third-party service provider include circumstances in which the third-party vendor has specialized internal audit knowledge and skills that the organization does not have in-house and circumstances in which the organization has insuficient in-house internal audit resources to fully com¬ plete its planned engagements. Chapter 9, "Managing the Internal Audit Func¬ tion," goes into more detail regarding co-sourcing. INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES THE INSTITUTE OF INTERNAL AUDITORS The IIA, headquartered in Lake Mary, Florida, is recognized around the world as "the internal audit profession's global voice, standard-setter, and resource for professional development and certiication."11 The IIA's mission is presented in exhibit 1-5. The IIA Leadership Structure The IIA headquarters' executive leadership team is headed by the president and CEO. Hundreds of volunteers, including The IIA's Global Board of Directors, also provide IIA leadership. The 38-member Global Board of Directors oversees the affairs of The IIA. The board's Executive Committee comprises the chairman of the board, the senior vice chairman, ive vice chairmen, a secretary, and the two most recent former chairmen of the board. The board also includes the North American Board, which holds speciic authority and oversight of North American activities, directors-at-large, ex-oficio directors, institute directors, and The IIA presi¬ dent as an ex-oficio member.12 The IIA's Motto progress I nrough ohanng EXHIBIT 1-5 THE IIA'S MISSION Mission The Mission of The institute of internal Auditors is to provide dynamic leadership for the global profession of internal auditing. Activities in support of this mission will include, but not be limited to: Advocating and promoting the value internal audit professionals add to their organizations. Providing comprehensive professional education and development opportunities, standards and other professional practice guidance, and certiication programs. Researching, disseminating, and promoting knowledge concerning internal auditing and its appropriate role in control, risk management, and governance to practitioners and stakeholders. B Educating practitioners and other relevant audiences on best practices in internal auditing. Bringing together internal auditors from all countries to share information and experiences. Source: www.theiia.org. Diversity and Inclusion The IIA is committed to creating an environment of inclusion that values diversity. Its diversity and inclusion mission is "to build a vibrant and diverse association for all members, volunteers, and employees by embracing their diverse talents, opin¬ ions, experiences, backgrounds; and foster inclusion that invites collaboration, fairness, respect, and innovation, enabling everyone to participate and contribute to their full potential."13 INTRODUCTION TO INTERNAL AUDITING 1-13 Professional Guidance Professional guidance provided by The IIA is embodied in the International Pro¬ fessional Practices Framework (IPPF). The following is a brief introduction to the IPPF. It is described in detail in chapter 2. The IPPF supports the mission of internal audit, which is "to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight."14 Internal auditors should leverage the IPPF in its entirety to deliver on this mission within their respective organizations. The IPPF comprises two cate¬ gories of guidance: IPPF International Professional Practices Framework, which consists of both mandatory and recommended guidance. Category 1: Mandatory Guidance. Conformance with the principles set forth in the mandatory guidance is required and essential for the professional practice of internal auditing. The mandatory guidance is developed following an established due diligence process, which includes a period of public exposure for stakeholder input. The mandatory elements of the.IPPF are: _ l«i ilt: v^uie rr:iiicipies iui uie r iuicaaiuuai r lattice ui nn.ciiiairvuuii.iiig The Code of Ethics The Standards The Deinition of Internal Auditing'5 Category 2: Recommended Guidance. The recommended guidance is endorsed by The IIA through a formal approval process. It describes practices for effective implementation of The IIA's Core Principles, Deinition of Internal Auditing, Code of Ethics, and Standards. The recommended elements of the IPPF are Implemen¬ tation Guidance and Supplemental Guidance.16 More detailed information about the IPPF and the other guidance resources provided by The IIA can be found on its website (www.theiia.org). Professional Certifications The IIA offers several professional certiications that allow internal auditors to demonstrate their knowledge, acumen, and leadership ability in three areas: industry, competency, and leadership. These certifications help internal auditors progress their career by: Enhancing skills and knowledge of internal auditors. Helping internal auditors gain credibility and respect in the ield. Increasing the earning potential of internal auditors. Allowing internal auditors to demonstrate an understanding of and commit¬ ment to the practice of internal auditing. Certified Internal Auditor (CIA) The premier certification sponsored by The IIA; the only globally accepted certification for internal auditors. 1-14 The premier certiication sponsored by The IIA is the Certiied Internal Audi¬ tor (CIA), the only globally accepted certiication for internal auditors. The CIA examination tests a canuiuates expertise in nircc paits: internal AlZCut uasics; Internal Audit Practice; and Internal Audit Knowledge Elements. In addition to passing the CIA examination, candidates must have a minimum of two years of internal audit experience or its equivalent to become a CIA. New and rotational internal auditors can obtain the Internal Audit Practitioner designation by pass- INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES ing the irst two parts of the CIA exam. The CIA transcends all three areas as depicted in exhibit 1-6.17 EXHIBIT 1-6 IIA GLOBAL CERTIFICATIONS AND QUALIFICATIONS QIAL / r\ V*> CRMA D V W"//> A o CFSA Certified Internal Auditor O ev % <i «\ s*.6A/, INTERNAL AUDIT PRACTITIONER ?V CCSA- CGAP & CPEA CPSA* Source: www.theiiaorg. In the area of competency, The IIA sponsors two specialty certiication programs: Certiication in Control Self-Assessment (CCSA) and Certiication in Risk Man¬ agement Assurance (CRMA). Industry certiications include Certiied Govern¬ ment Auditing Professional (CGAP), Certiied Financial Services Auditor (CFSA), Certiied Professional Environmental Auditor (CPEA), and Certiied Process Safety Auditor (CPSA). The Qualiication in Internal Audit Leadership (QIAL) is the certiication for leaders working to ascend to the level of CAE in their orga¬ nizations. Detailed information about each of the certification programs can be found on The IIA's website. INTRODUCTION TO INTERNAL AUDITING 1-15 Other professional organizations also sponsor certiication programs relevant to internal auditors. For example, ISACA (formerly known as the Information Sys¬ tems Audit and Control Association) sponsors the Certiied Information Systems Auditor (CISA) program, and the Association of Certiied Fraud Examiners spon¬ sors the Certiied Fraud Examiner (CFE) program. Research and Educational Products and Services Internal Audit Foundation Established in 1976. its mission is "to shape, expand, and advance knowledge of internal auditing by The IIA is widely known as the chief educator and global leader in professional development for the profession of internal auditing. The wide variety of research and educational products and services offered by The IIA are briefly described below. More detailed information can be found on The IIA's website. developing and disseminating timely, relevant information and insights that address the needs of our stakehold¬ ers globally." The Internal Audit Foundation, formerly The IIA Research Foundation, was established in 1976. It exists to help audit leaders, practitioners, students, and aca¬ demics experience continuous growth in their careers to propel them to become respected as trusted advisers as well as thought leaders within the industry. The following components facilitate this: Mission: To shape, expand, and advance knowledge of internal auditing by developing and disseminating timely, relevant information and insights that address the needs of our stakeholders globally. Vision: To be a vital resource for impactful internal audit and related stake¬ holder research, educational materials, and practice insights. Strategy: To consistently set the standard for helping practitioners and aca¬ demics achieve excellence in the internal audit profession.18 The Foundation sponsors research projects and publishes research reports. The Foundation's Bookstore offers hundreds of educational products, including books and videos, covering topics of interest to internal audit professionals. The IIA's Global Audit Information Network (GAIN) Benchmarking Services and Flash Surveys enable internal audit functions to share information and learn from each other. Internal Auditor, The IIA's bi-monthly magazine, publishes articles of widespread interest to internal auditors around the world. Numerous newsletters published by The IIA also cover topics of interest to internal auditors, including topics of speciic interest to CAEs and to various internal audit industry and spe¬ cialty groups such as inancial services, gaming, and IT auditing. Internal Auditing Education Partnership (IAEP) Sponsored by The IIA, the IAEP program provides an internal audit curriculum in approved colleges and universities. 1-16 Professional development opportunities offered by The IIA include meetings, seminars, and conferences as well as technology-based training, books, and web¬ casts. The premier IIA conference is the annual International Conference, which attracts thousands of internal auditors from around the world. Other IIA oppor¬ tunities include industry-speciic conferences such as the Financial Services Con¬ ference and the Government Auditing Conference, specialty opportunities such as the General Audit Management Conference, which is targeted toward CAEs, and district and regional conferences. The IIA, through its Academic Relations Committee, also promotes and supports internal audit education around the world. The Internal Auditing Education Part¬ nership (IAEP) program is designed to support universities and colleges that have made formal commitments to offer internal audit education. The level of support INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES provided by The IIA to a particular school is directly related to the level of devel¬ opment of the internal audit program at that school. COMPETENCIES NEEDED TO EXCEL AS AN INTERNAL AUDITOR If internal auditors are to be trusted advisers to the organizations they serve, they must embody the ive Cs, character traits that are required for success in the inter¬ nal audit profession: Competencethe skills and knowledge required to provide assurance and advi¬ sory services that add value. Credibilitythe ability to inspire trust based on consistent competence and integrity. Connectivitythe ability to understand the needs of each of the stakeholders individually within the greater whole of the organization. Communicationinstituting methods of relaying information (orally and in multiple written forms) and listening to the individuals served. Couragethe personal fortitude to remain independent and objective and to stand by the results of the engagements conducted.19 Reflecting back on the deinition and description of internal auditing presented earlier in this chapter, what else must individuals know to achieve success as inter¬ nal auditors? What must they be able to do? Are there certain personal character¬ istics that are indicative of success? The good news is that there is no single right answer to these questions; different people with different competency proiles can achieve success as internal auditors. Moreover, the competencies needed to suc¬ ceed are not unique to internal auditing. There are, however, certain competencies that tend to be common among success¬ ful internal auditors. Some of these competencies are inherent personal qualities. Others are knowledge and skills that can be learned and developed. An under¬ standing of these competencies provides information with which an informed decision can be made about internal auditing as a desirable vocation. Inherent Personal Qualities "The practitioners must be 'state ofthe art'in more thaninancial manage¬ ment. They will often be asked to act with courage and challenge the prevailing ethos of the organization in which they serve. Their chiefvalue to stakeholders in all sectors is their tireless searchfor truth, their ability to explain truth to people that matter, and their courage to tell the truth no matter the risk." Basil Pflumm, Former Vice President, Research and Professional Practices, The IIA20 Different people have different inherent personal qualities or characteristics. For example, some people are by nature more introverted (shy and reserved), while others are more extroverted (outgoing and sociable). Personal qualities that are common among successful internal auditors at all levels include: INTRODUCTION TO INTERNAL AUDITING 1-17 Integrity. Integrity is not an option for internal auditors; they must have it. People with integrity build trust, which in turn establishes the foundation for reliance on what they say and do. Users of internal audit work products rely on internal audi¬ tors' professional judgments to make important business decisions. These stake¬ holders must have confidence that internal auditors are trustworthy. Passion. It is virtually impossible to be very good at something you do not really like to do. Successful internal auditors have a deep interest in, and intense enthu¬ siasm for, their work. Some show this passion more than others, but long-term success cannot be achieved or sustained without this passion. Work ethic. Success in business requires the ability to consistently meet the qual¬ ity, cost, and timing expectations of "customers." But this success does not come without hard work. The same applies to successful internal auditors, who must not only work hard but also work smart. They get the right things done the right way at the right time. Curiosity. The information needed to make judgments during internal audit engagements may not always be obvious. Thus, successful internal auditors must be inquisitive and go beyond asking "checklist" type questions. They may need to ask more probing questions to gain the necessary understanding of how things work and why they work the way they do. Creativity. Most internal auditors like to solve problems. However, the solutions to many problems are not always obvious. Therefore, successful internal auditors must be creative and "think outside the box" to generate the types of ideas valued by management and other stakeholders. Initiative. Successful internal auditors are self-starters. They voluntarily seek out and pursue opportunities to add value and want to play the role of change agent within their organizations. Flexibility. Change is the only constant in today's business world. Successful orga¬ nizations continuously adapt to change, and change brings new risks that must be managed. Successful internal auditors embrace change; they adapt quickly to new situations and challenges. The characteristics described above are illustrative of the inherent personal quali¬ ties that are required to succeed as an internal auditor. Does this mean that some¬ one lacking one or more of these traits is destined to fail as an internal auditor? Not necessarily. Integrity is imperative and it would be foolish for anyone to pur¬ sue a vocation they really do not believe in or to which they are not fully commit¬ ted. The other qualities can be exercisedthey can be strengthened, if desired. However, it is important to recognize and understand how each of these qualities enables internal auditors to be successful. For those seeking long-term success, most of these qualities will be necessary. Knowledge, Skills, and Credentials The IIA's Standards requires internal auditors to perform their assurance and consulting engagements with proficiency, which means they must possess the knowledge and skills needed to fulill their responsibilities (Standard 1210). What knowledge and skills are needed to succeed as an internal auditor? The answer to 1-18 INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES this question depends, to a certain extent, on the current stage in a person's career and the responsibilities they are undertaking. Those planning to pursue a longterm career in internal auditing will need to continuously advance their knowl¬ edge and skills. For example, an internal auditor will be expected to know and do things as an in-charge auditor with four years of experience that would not be expected of someone directly out of school. Accordingly, one of the most important skills to begin developing while in school is learning how to learninternal audi¬ tors continue to learn throughout their careers. Nobody is an expert internal auditor when they graduate from college. Internal auditing, like any other profession, is learned primarily by doing; in other words, through on-the-job experience. It is like learning how to drive a car. It is impos¬ sible to learn how to drive merely by reading about it, listening to someone talk about it, or watching someone else drive. It must be experiencedit is necessary to get in a car and practice, preferably under the supervision of a well-qualiied instructor. Such is the case with internal auditingit is learned by doing it under the watchful eyes of experienced supervisors and mentors. Proficiency Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities. The internal audit activity coiiectiveiy must possess or obtain the knowledge, skills, and other competencies needed to perform its responsibilities. (Standard 1210) EXHIBIT 1-7 GLOBAL INTERNAL AUDIT COMPETENCY FRAMEWORK STRUCTURE mproveme on Personal Skills Communication Persuasion and Critical Thinking Collaboration Technical Expertise IPPF Governance, Risk, Business Acumen and Control Internal Audit Managem Professional Ethics Source, www.theiia.org. Recognizing that internal auditors need a wide variety of competencies, The IIA developed a Global Internal Audit Competency Framework. This framework can help individual internal auditors and internal audit functions assess their current competency levels and identify areas for improvement. The framework outlines the 10 core competencies recommended for each broad job level, namely internal audit staff, internal audit management, and the CAE. Each competency is supported by a list of more detailed competencies that further deine the core competency statement. While the core competencies have been deined individually, it should INTRODUCTION TO INTERNAL AUDITING 1-19 be understood that there are connections and interdependencies between all of the competencies. The Global Internal Audit Competency Framework will be discussed in greater detail in chapter 2. Exhibit 1-7 depicts the structure of the Global Internal Audit Competency Framework and how the core competencies relate to each other. The credentials students attain and report on their resumes will reflect the knowl¬ edge and skills they have obtained. The completion of a degree with a good grade point average displays mastery of a ield of study. Working while in school or actively participating in extracurricular activities shows the ability to multitask successfully. Scholarships and other awards signify respect for a student's achieve¬ ments. Completion of an internship demonstrates the ability to apply what has been learned. Serving as an oficer in a student organization signiies motiva¬ tion and the ability to lead. Completing the CIA examination before graduation demonstrates not only competency in internal auditing and related subjects but also motivation to succeed. Progression from a staff internal auditor to an experienced in-charge internal auditor indicates a readiness to coach and share expertise with subordinates, make presentations and facilitate meetings, communicate persuasively with all levels of people, build rapport and lasting relationships with auditees and custom¬ ers, and proactively stimulate change. Credentials to accrue during this stage of an internal audit career may include, for example, a track record of engagement successes, testimonials from auditees and customers (being recognized as a "go to" person), a master of business administration degree, multiple professional certii¬ cations, and a volunteer leadership position in a professional organization such as a local IIA chapter. Internal audit professionals who continue to develop their management and lead¬ ership skills can progress into internal audit management. These individuals must be able to coach and mentor subordinates, adeptly address strategic management issues, and command respect among senior executives and professional colleagues. As an individual gains a reputation as an internal audit thought leader, he or she will likely be called upon to share his or her expertise by doing such things as serv¬ ing as an IIA volunteer at the international level, delivering presentations at pro¬ fessional meetings or conferences, and writing articles for professional journals. iNTERNAL AUDiT CAREER PATHS Pathways Into Internal Auditing Until very recently, most internal auditors began their careers in public account¬ ing. Accounting graduates would start out as inancial statement auditors in pub¬ lic accounting and, after gaining experience, move into internal audit positions, oftentimes with former clients. While this is still a recognized pathway into inter¬ nal auditing, it is by no means the only one. Hiring internal auditors directly out of school has become much more common in recent years. Public and private companies, governmental entities, not-for-proit organizations, and irms providing internal audit services are increasingly recruit¬ ing internal auditors directly out of colleges and universities. Schools that have established internal audit programs endorsed by The IIA are growing in num¬ ber and popularity among recruiters. Top-tier students with degrees in account¬ ing, information systems, and other business and nonbusiness ields from these 1-20 INTERNAL AUDITING: ASSURANCE & ADVISORY SERVICES and other schools are in high demand. Students who have completed one or more internal audit-related internships are in especially high demand because of the real-world experience they have gained. Some organizations consider internal auditing to be an important component of their management trainee programs because it offers management candidates a unique opportunity to gain relevant governance, risk management, and control expertise across many areas of the organization. In these organizations, prospec¬ tive managers from different areas of the organization are required to spend a certain amount of time in the internal audit function as a prerequisite to moving upward into management. Pathways Out of Internal Auditing I The majority of people who work in internal auditing do not spend their entire careers there. As indicated above, experience in an internal audit function serves as an excellent training ground for aspiring business executives. Many internal auditors use the expertise they gain in internal auditing as a stepping stone into inancial or noninancial management positions, either in the organization they have been working for or another organization. Moving from internal auditing into a position with a professional services irm that provides internal assurance and consulting services was virtually unheard of a few years ago. This is now a viable opportunity, especially for individuals with specialized, highly valued expertise in a particular industry (for example, energy or banking) or subject matter (for example, information systems or fraud preven¬ tion, deterrence, and detection). Careers in Internal Auditing Some people, however, do choose to make internal auditing their career and even they have options. One option is to progress upward through the ranks of a single organization's internal audit function into internal audit management. Another option is to stay in internal auditing but advance up the ladder toward internal audit management, moving from one organization to another. A third option is to move upward through the various levels in a professional services irm that pro¬ vides internal assurance and consulting services. CAE The chief audit executive is a senior position within the organization responsible for internal audit activities. The ultimate destination of a career internal auditor in an organization is CAE. CAEs are highly respected within their organizations, often holding senior execu¬ tive positions. They interact with the highest levels of senior management and the board of directors. They commonly report functionally to the audit committee of the board of directors and administratively to a senior executive such as the CEO or CFO. Chapter 9 comprehensively addresses the roles and responsibilities of the CAE. In a irm that provides internal audit services to many organizations, an internal auditor can rise to the level of a partner or comparably prestigious position. Unlike CAEs in an organization, they interact with and report to senior executives and boards of directors of several organizations. Regardless of the career path chosen, present-day internal auditors have many more career opportunities than they did just a few years ago. Internal auditors who develop a wide range of skills and gain experience in different areas will be in a good position to pursue a wide variety of career options. INTRODUCTION TO INTERNA