The Internal Auditing Handbook

K. H. Spencer Pickett

• Publisher: Wiley
• Year: 2010
• ISBN:
  9780470662137
• Edition: 3
• Topic: Business
• Subtopic: Revisione contabile
• Index: Business

The first edition of The Internal Auditing Handbook received wide acclaim from readers and became established as one of the definitive publications on internal auditing. The second edition was released soon after to reflect the rapid progress of the internal audit profession. There have been a number of significant changes in the practice of internal auditing since publication of the second edition and this revised third edition reflects those changes. The third edition of The Internal Auditing Handbook retains all the detailed material that formed the basis of the second edition and has been updated to reflect the Institute of Internal Auditor's (IIA) International Standards for the Professional Practice of Internal Auditing. Each chapter has a section on new developments to reflect changes that have occurred over the last few years. The key role of auditors in reviewing corporate governance and risk management is discussed in conjunction with the elevation of the status of the chief audit executive and heightened expectations from boards and audit committees. Another new feature is a series of multi-choice questions that have been developed and included at the end of each chapter.

This edition of The Internal Auditing Handbook will prove to be an indispensable reference for both new and experienced auditors, as well as business managers, members of audit committees, control and compliance teams, and all those who may have an interest in promoting corporate governance.

Chapter 1

INTRODUCTION

Introduction

The third edition of the Internal Auditing Handbook reflects the significant changes in the field of internal auditing over the last few years. Since the last edition, there have been many developments that impact the very heart of the audit role. There really are ‘new look’ internal auditors who carry the weight of a heightened expectation from society on their shoulders. Auditors no longer spend their time looking down at detailed working schedules in cramped offices before preparing a comprehensive report on low-level problems that they have found for junior operational managers. They now spend much more time presenting ‘big picture’ assurances to top executives after having considered high-level risks that need to be managed properly. Moreover, the internal auditor also works with and alongside busy managers to help them understand the task of identifying and managing risks to their operations. At the same time, the internal auditor has to retain a degree of independence so as to ensure the all-important professional scepticism that is essential to the audit role. The auditor’s report to the board via the Audit Committee must have a resilience and dependability that is unquestionable. These new themes have put the internal auditor at the forefront of business and public services as one cornerstone of corporate governance - and the new Internal Auditing Handbook has been updated to take this on board. The third edition of the Internal Auditing Handbook contains all the detailed material that formed the basis of the second edition and has been expanded in the following manner:

1. The new edition has been updated to reflect the Institute of Internal Auditor’s (IIA) International Standards for the Professional Practice of Internal Auditing that were released during 2009.

2. Each chapter has a new section on new developments to reflect changes that have occurred since the second edition was published.

3. A series of multi-choice questions has been developed and included at the end of each chapter.

4. A number of important contributions from Dan Swanson on Information Systems auditing and other topics have been included throughout the book.

Change is now a constant and we have tried not to focus too much on specific events such as the 2007/2008 Credit Crunch, the resulting recession and the Madoff fraud, since it is the principles of internal auditing that remain constant, regardless of the latest scandal to impact the economy. Please have a look at the IIA’s web site at www.theiia.org to keep up to date with latest developments.

Back in 1997, the first edition of the Handbook described internal auditing as a growing quasi-profession. The quantumleap that occurred between the old and the new millennium is that internal auditing has now achieved the important status of being a full-blown profession. Note that the term chief audit executive (CAE) is used throughout the handbook and this person is described by the IIA:

The chief audit executive is a senior position within the organization responsible for internal audit activities. Normally, this would be the internal audit director. In the case where internal audit activities are obtained from external service providers, the chief audit executive is the person responsible for overseeing the service contract and the overall quality assurance of these activities, reporting to senior management and the board regarding internal audit activities, and follow-up of engagement results. The term also includes titles such as general auditor, head of internal audit, chief internal auditor, and inspector general.

The areas that are included in this chapter are:

1.1 Reasoning behind this Book

1.2 The IIA Standards and Links to the Book

1.3 How to Navigate around the Book

1.4 The Handbook as a Development Tool

1.5 The Development of Internal Auditing Summary and Conclusions Assignments and Multi-choice Questions

1.1 Reasoning behind the Book

The original Internal Auditing Handbook focused on the practical aspects of performing the audit task. It contained basic material on managing, planning, performing and reporting the audit, recognizing the underlying need to get the job done well. The new edition has a different focus. Now, we first and foremost need to understand the audit context and how we fit into the wider corporate agenda. It is only after having done this that we can go on to address the response to changing expectations. In fact, we could argue that we need to provide an appropriate response rather than think of the audit position as being fixed and straightforward. It is no longer possible to simply write about an audit programme and how this is the best way to perform the audit task. To do justice to the wealth of material on internal auditing, we must acknowledge the work of writers, thought leaders, academics, journalists and noted speakers at internal audit (IA) conferences. The first and second editions of the Internal Auditing Handbook set out the author’s views and understanding of the audit role. The new Handbook contains a whole range of different views and extracts of writings from a variety of representatives from the audit community. There are also special contributions from Richard Todd and Andy Wynne who have provided several examples, written specially for the Handbook, taken from their many years of professional internal auditing work. Gerald Vinten, Paul Moxey, Mohammed Khan, John Watts and Neil Cowan have likewise shared their experiences with the reader. Dan Swanson has provided many important contributions to the new handbook. Dan is an IA veteran who is also a former director of professional practices at the IIA. He has completed audit projects for more than 30 different organizations and has almost 25 years of auditing experience in government at federal, provincial and municipal levels, as well as in the private sector. Dan Swanson has also been a long-time columnist for Compliance Week, a leading US governance, risk and compliance publication.

The new context for internal auditing is set firmly within the corporate governance arena. The IIA definition of internal auditing was not changed when the standards were revised in January 2009 and remains as follows:

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It helps an organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes.

The Internal Auditing Handbook has early chapters on Corporate Governance Perspectives, Managing Risk and Internal Controls. It is only after having addressed these three inter-related topics that we can really appreciate the IA role. There are chapters on quality, professional standards, audit approaches, managing IA, planning, performance and reporting audit work and specialist areas such as fraud and IS auditing. The final chapter attempts to look at our future and changes that may well be on the way. The new Handbook includes several new references and quotes from a wide variety of sources; since all views are important, even where they conflict. This variety can only help move the profession onwards and upwards. The Handbook rests firmly on the platform provided by the International Standards for the Professional Practice of Internal Auditing as part of the International Professional Practices Framework (IPPF). Internal auditing is a specialist career and it is important that we note the efforts of a professional body that is dedicated to our chosen field. Note that despite the recent changes in the field of internal auditing, there is much of the first book that is retained in the new edition. Change means we build on what we, as internal auditors, have developed over the years rather than throw away anything that is more than a few years old. That is why the original material from the second edition has not been discarded, as the saying goes - it is important not to throw away the baby with the bath water. Note that all references to IIA definitions, code of ethics, IIA attribute and performance standards, practice advisories and practice guides relate to the IPPF prepared by the IIA in 2009.

1.2 The IIA Standards and Links to the Book

The Handbook addresses most aspects of internal auditing that are documented in the IIA International Standards for the Professional Practice of Internal Auditing. In late 2005, the IIA’s Executive Committee commissioned an international Steering Committee and Task Force to review the Professional Practices Framework (PPF), the IIA’s guidance structure and related processes. The Task Force’s efforts were focused on reviewing the scope of the framework and increasing the transparency and flexibility of the guidance’s development, review and issuance processes. The results culminated in a new IPPF and a reengineered Professional Practices Council, the body that supports the IPPF. The Attribute Standards outline what a good IA setup should look like, while the Performance Standards set a benchmark for the audit task. Together with the Practice Advisories, Position Statements and Practice Guides and other reference material (as at October 2009), they constitute a professional framework for internal auditing. The IIA’s main Attribute and Performance Standards are listed below:

ATTRIBUTE STANDARDS

1000 - Purpose, Authority, and Responsibility

The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval.

1100 - Independence and Objectivity

The internal audit activity must be independent, and internal auditors must be objective in performing their work.

1200 - Proficiency and Due Professional Care

Engagements must be performed with proficiency and due professional care.

1300 - Quality Assurance and Improvement Program

The chief audit executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity.

PERFORMANCE STANDARDS

2000 - Managing the Internal Audit Activity

The chief audit executive must effectively manage the internal audit activity to ensure it adds value to the organization.

2100 - Nature of Work

The internal audit activity must evaluate and contribute to the improvement of governance, risk management and control processes using a systematic and disciplined approach.

2200 - Engagement Planning

Internal auditors must develop and document a plan for each engagement, including the engagement’s objectives, scope, timing and resource allocations.

2300 - Performing the Engagement

Internal auditors must identify, analyze, evaluate, and document sufficient information to achieve the engagement’s objectives.

2400 - Communicating Results

Internal auditors must communicate the engagement results.

2500 - Monitoring Progress

The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management.

2600 - Resolution of Senior Management’s Acceptance of Risks

When the chief audit executive believes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the decision regarding residual risk is not resolved, the chief audit executive must report the matter to the board for resolution.

1.3 How to Navigate around the Book

A brief synopsis of the Handbook should help the reader work through the material. It is clear that the Handbook is not really designed to be read from front to back but used more as a reference resource. Having said that, there should be some logic in the ordering of the material so that it fits together if the reader wishes to work through each chapter in order. One important point to make is that although most chapters contain 10 main sections, they are each of variable length. Some readers find different chapter lengths inconvenient, but there is little point trying to fit set material into standard boxes when some chapters naturally consume more material than others. In fact, some sections are quite long because they need to cover so much ground. Apologies in advance if this policy proves bothersome at all.

Chapter 1 - Introduction

This first chapter deals with the content of the handbook and lists the International Standards for the Professional Practice of Internal Auditing. It also covers the way the handbook can be used as a development tool for the IA staff, linked to website material that can be used to form the basis of learning workshops and resources. The way internal auditing has developed over the years is an important aspect of the chapter, whereby the progress of the profession is tracked in summary form from its roots to date. It is important to establish the role of IA at the start of the book to retain this focus throughout the next few chapters that cover corporate perspectives. Note that the IA process appears in some detail from Chapter 5 onwards. Likewise our first encounter with the IPPF appears in this chapter based on the ‘Platform’ theory to underpin the entire Handbook.

Chapter 2 - Corporate Governance Perspectives

Chapter 2 covers corporate governance in general, in that it summarizes the topic from a business standpoint rather than focusing just on the IA provisions. A main driver for ‘getting things right’ is the constant series of scandals that have appeared in every developed (as well as developing) economy. The governance equation is quickly established, and then profiles of some of the well-known scandals are used to demonstrate how fragile the accountability frameworks are. New look models of corporate governance are detailed using extracts from various codes and guidance to form a challenge to business, government and not-for-profit sectors. Note that the chapter may be used by anyone interested in corporate governance as an introduction to the subject. The section on internal auditing is very brief and simply sets out the formal role and responsi...

Table of contents

• Title Page
• Copyright Page
• Dedication
• LIST OF ABBREVIATIONS
• Foreword
• Acknowledgements
• Chapter 1 - INTRODUCTION
• Chapter 2 - CORPORATE GOVERNANCE PERSPECTIVES
• Chapter 3 - MANAGING RISK
• Chapter 4 - INTERNAL CONTROLS
• Chapter 5 - THE INTERNAL AUDIT ROLE
• Chapter 6 - PROFESSIONALISM
• Chapter 7 - THE AUDIT APPROACH
• Chapter 8 - SETTING AN AUDIT STRATEGY
• Chapter 9 - AUDIT FIELD WORK
• Chapter 10 - MEETING THE CHALLENGE
• Appendix A - INDUCTION/ORIENTATION PROGRAMME
• Appendix B - CRSA BEST PRACTICE GUIDE
• Appendix C - A POEM BY PROFESSOR GERALD VINTEN
• Appendix D - ANALYTICAL TECHNIQUES BY SUE SEAMOUR
• Appendix E - MULTI-CHOICE QUESTIONS: ANSWER GUIDE
• INDEX