The International Internal Audit Standards Board (IIASB) of the Institute of Internal Auditors (IIA) is proposing changes to the International Standards for the Professional Practice of Internal Auditing, also known as the Standards. For the most part, I believe that the Standards are headed in the right direction for the profession. There are two items that caught my attention (click here for sample):
- Standard #1312 – External Assessments and
- The proposed addition of Engagement Opinion and Overall Opinion to the Glossary
The rewording of some language in the external assessment standard has captured my attention with greater focus than in the past. Specifically it states that “The chief audit executive (CAE) must discuss with the board”…”The need for more frequent external assessments.”
This statement is extremely vague and presumptuous. It is not clear if the intention is to encourage the CAE to discuss the need for an assessment after a major departmental shift (i.e. hiring a new CAE, losing significant staff, etc) or if the IIA is concluding that the 5 year frequency is insufficient to provide the Board with reasonable assurance that the audit function is effectively discharging its duties. If it is the latter, I believe that this should be a decision made by the Board based on its (1) its comfort level with the audit function (2) the stability of the audit function and (3) the result of the internal Quality Assessment & Improvement Program. Overall, I believe the statement needs to be written in a manner that better discloses the IIA’s intention.
Now, the proposed updates to the glossary look promising. For example:
Engagement Opinion
The ratings, conclusions, or other descriptions of results of an individual internal audit engagement based upon the procedures performed, relating only to those aspects within the objectives and scope of the engagement.
I love this definition. As auditors, we evaluate processes, functions, products and services. We should provide an overall opinion as to whether those functions are operating in an effective and efficient manner. I have provided engagement opinions for years. I know many in the profession who do and quite a few who do not. We provide our opinions through “Likes” on Facebook, Recommendations on Linkedin.com, Reviews on Foursquare…well, you get my point. So why are so many afraid to stamp an opinion on an audit engagement?
Another proposed addition is:
Overall Opinion
The overall ratings, conclusions, or other descriptions of results provided by the chief audit executive addressing, at a broad level, governance, risk management and control processes of the organization. An overall opinion is based on the results of a number of individual engagements and other activities for a specific time interval.
Now this is another interesting concept. The CAE can provide an overall opinion as to the health of the organization, its subsidiaries or a set of related or unrelated processes based on audit work completed. Here is another opportunity to add real value. Suppose the audit function performed several audits in one subsidiary in which the results were not favorable. Now let’s assume it was so much of a mess, that there were concerns about the subsidiaries ability to achieve its goals and objective in the short and long term. The CAE should be able to report this to the Audit Committee as long as the conclusion is based on the performance of sufficient audit work.
This summarized my opinion of the proposed changes to IIA standards. I would to hear your thoughts and opinions.
You can find the relevant pages here (http://www.thatauditguy.com/wp-content/uploads/2012/04/Pages-from-IIA-2012_standards_exposure_draft-_2012.pdf)
That Audit Guy
