“To enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.”
This is it. This is where it all starts. “This” is the Mission Statement for the internal audit profession recently approved by The IIA’s Global Board of Directors as a critical component of The Institute’s newly enhanced International Professional Practices Framework (IPPF).
“I love the IIA definition of internal auditing; it’s very inspirational, well worded, and an integral part of the IPPF — but we wanted to add something a bit more succinct,” says Bob Hirth, current chair of The Committee of Sponsoring Organizations of the Treadway Commission and senior managing director at Protiviti in San Francisco, who served as chair of the IPPF Relook Task Force. “It doesn’t take away from the definition, but it gives us something memorable we can rely on every day as it guides us in our efforts.”
The definition of the profession, long a part of the IPPF, focuses on what internal audit is; the Mission Statement reflects what the profession strives to accomplish. And that distinction, expressed in 16 words, drives the activities and objectives for the IPPF revision and enhancement project.
Why a Relook?
The impetus for the project arose when several IIA leaders were discussing the many changes that financial regulators were attaching to the work of internal auditors. These changes, plus others forthcoming, were considered likely to increase the pressure on boards to more specifically understand the important role internal auditing plays in overall good governance.
While acknowledgement of these changes started the conversation, other factors also indicated that the time had come for a new look at the guidance. Anton van Wyk, partner with PricewaterhouseCoopers LLP in Sunninghill, South Africa, and immediate past chairman of The IIA’s Global Board of Directors, explains: “The role of internal audit and the risk landscape in which we work have evolved significantly since 1999, the last time we revised the IPPF. Our guidance must meet new expectations for our profession and enable practitioners to be courageous and forward-looking in their work.”
Angela Witzany, head of Internal Audit for Sparkassen Versicherung AG, VIG, in Vienna, and senior vice chair of The IIA’s Global Board of Directors, agrees. “We knew that, if we were to remain relevant as a profession, now was the time for the project. Increased and enhanced stakeholder expectations, together with the evolving role of the internal audit function, were the driving forces to make the change.”
Members of the profession at large also were in favor of revisiting the guidance framework. A survey of internal auditors from 90 countries shows that, when presented with the proposed changes, 85 percent of respondents “support” or “completely support” them. With that vote of confidence and a host of useful suggestions, the task force and staff revised the draft recommendations document and presented the results to the Global Board of Directors, which approved them in March 2015. The road map for the enhancement of the IPPF was set.
Mandatory Guidance, Core Principles
In its new form, the IPPF still consists of two layers of guidance, albeit slightly renamed. The Mandatory Guidance retains that title; the Strongly Recommended Guidance is now referred to as Recommended.
|Core Principles for the Professional Practice of Internal Auditing |
- Demonstrates integrity.
- Demonstrates competence and due professional care.
- Is objective and free from undue influence (independent).
- Aligns with the strategies, objectives, and risks of the organization.
- Is appropriately positioned and adequately resourced.
- Demonstrates quality and continuous improvement.
- Communicates effectively.
- Provides risk-based assurance.
- Is insightful, proactive, and future-focused.
- Promotes organizational improvement.
Mandatory Guidance continues to include the International Standards for the Professional Practice of Internal Auditing (Standards), the Definition of Internal Auditing, and the Code of Ethics. However, it also contains a new component: the Core Principles for the Professional Practice of Internal Auditing (at right). Because the addition of the Core Principles may ultimately affect the Standards, The IIA’s Standards Board is conducting a gap analysis to determine whether new or revised standards are needed to better support the individual principles.
Overall, the Principles are perhaps the most obvious change to the IPPF. The task force agreed that an effort to articulate them plainly and succinctly was paramount to the project.
Hirth points to the first three principles and emphasizes the task force’s belief that, in the end, everyone benefits when individuals perform at their peak. “Of course, we want everyone to understand our firm and unwavering commitment to integrity, competence, and independence — all crucial to our effectiveness,” he says. But in terms of integrity and independence, Hirth adds, there may be instances where internal auditors are asked to avoid auditing a high-risk area or to inappropriately omit or modify a specific finding. “We have to stand our ground and stay the course,” he says. “The Principles give us great guidance on how to be effective and, if we follow them, tailored to each organization, we will be.”
Task force member Jenitha John, CAE at FirstRand Bank in Johannesburg, says the Principles serve a valuable purpose in orienting internal audit within the enterprise. “Positioning of internal audit in an organization is key if we are to demand the respect and relevance that the function deserves,” she says. “If the ‘tone at the top’ understands our value, then this will filter to the ‘tune in the middle’ and the ‘song at the bottom.’” She further emphasizes that, as reflected in the Principles, internal auditing must demonstrate that its approach aligns with the organization’s objectives, and it must direct audit efforts at the risks that matter most to the organization. “Our relevance is determined by how well we manage and respond to stakeholder expectations,” she adds.
The Principles also enhance the business-focused value of internal audit. Beatrice Ki-Zerbo, director of research for IFACI (IIA–France) and member of the IPPF Relook Task Force, adds, “These principles were implicit in the existing framework. They stress the distinctive role of internal audit as a dynamic tool anticipating governing bodies’ legitimate expectations, and an integral part of the organization and its ecosystem.”
While the Principles provide a strong basis for the Standards and the other portions of the IPPF in guiding and shaping the profession, they also serve a valuable externally facing function. “Audit committees will not read the IPPF,” notes Debi Roth, IIA director, Standards and Guidance. “The Principles and the Mission are an easy way to communicate with stakeholders, in language they will understand, exactly what internal audit seeks to accomplish.”
The framework’s Recommended Guidance has undergone additional changes. In its revised form, this guidance segment now consists of three separate components.
Implementation Guidance The Practice Advisories are being transitioned over the next 18 months and will be called Implementation Guidance to underscore their purpose of helping internal auditors implement the Standards. Eventually, every individual standard may, over time, be supported with an implementation guide. John points out that the shift in naming and content reflects “a view to enhancing future materials to ensure consistency in the internal audit practices around the world. Implementation Guidance is a stronger term; it reinforces standardization and alignment in our thinking as a global profession.”
Each implementation guide will discuss the work required to fulfill the specific standard, address the implementation itself (approaches and issues to take into consideration), and conclude with suggestions on how to demonstrate conformance after implementation. For example, in the new guide on governance — Implementation Guide 2110: Governance — the “Getting Started” section suggests referring to the Standards glossary and governance frameworks and models to gain an understanding of governance and typical governance processes; the implementation section outlines the number of different capacities in which internal auditors can assess and recommend ways to improve governance practices; and the final section, on demonstrating conformance with the Standards, describes different ways to evidence that conformance.
Supplemental Guidance The existing Practice Guides and Global Technology Audit Guides are now part of the Supplemental Guidance layer. Supplemental Guidance is intended to be more specific in nature than other guidance documents, addressing topical areas and sector-specific issues, as well as detailed processes and procedures. “These guidance volumes will contribute to increased reliance on internal audit,” Ki-Zerbo says. Explaining the significance of these volumes, she compares a business to a ship on turbulent seas. “Decision makers are like skippers in the midst of a storm,” she says. “They need robust and precise information. Generic approaches are useful to develop good reflexes but concrete insight depends on in-depth analysis — the Supplemental Guidance will provide that.”
Position Papers The IIA will continue to issue Position Papers — which help readers understand the significance of governance, risk, or control issues as they pertain to internal audit — but they will no longer be part of the IPPF. The reason for this change is that Position Papers have been focused primarily as internal audit stakeholder communications not necessarily aimed at the internal audit practitioner — hence their removal from the IPPF. The existing Position Papers will be reviewed to differentiate between guidance-related and advocacy content. Both will be retained, in their own respective settings.
A Better Tool
How do these enhancements benefit internal audit professionals? Hirth points to several ways. “The succinct Mission Statement will guide us every day, the foundational Principles will allow for appropriate flexibility given the wide range of internal audit activities we have around the world, and the updated content structure will offer guidance at various levels of necessity,” he says.
There is broad agreement among members of the task force that the new IPPF will be especially helpful in explaining what internal audit is and what it does for the organization. “I was an internal auditor for 20 years and invariably, when I would tell someone what I did for a living, they assumed I was going to talk to them about their taxes,” Roth laughs. Hal Garyn, The IIA’s vice president of Professional Practices, agrees that practitioners have traditionally struggled with articulating the definition and contribution of internal audit succinctly. “The new IPPF elements of the Mission and the Principles will help clarify to boards, executives, professionals, and practitioners the role of internal audit,” he says.
IIA President and CEO Richard Chambers sums up the benefits in terms of how the job is done and how it is perceived. “To carry out their responsibilities well, internal auditors must rely on the standards guiding the profession and have confidence that those standards reflect how the profession is being practiced,” he says. “The enhancements to the IPPF are designed to strengthen internal audit’s position as an invaluable partner in business success.”
The Mission Statement and Principles went into effect in July, and two new implementation guides — Implementation Guide 1000: Purpose, Authority, and Responsibility; and Implementation Guide 2110: Governance — were released at the same time. These volumes are free to IIA members via The Institute’s website.
As time goes on, new and revised publications will be issued on an ongoing basis. Garyn says practitioners should watch for “continued exposures of new and revised standards to support the Principles and quarterly issuance of the new Implementation Guidance replacing existing Practice Advisories.” The existing Practice Advisories remain valid and in effect until they are sunset with the publication of a replacement implementation guide. Also upcoming: a renewed focus on both IT and financial services guidance.
Hirth applauds the work done to date, but also notes the spirit that drove the project. “What’s really foundationally important about this IPPF enhancement is that the leadership of The IIA asked the task force to challenge the status quo of our organization, with no restrictions,” he explains. Any profession that wishes to remain viable must be willing to scrutinize itself and evolve. It cannot isolate its most fundamental precepts from regular review; nor can it be reluctant to change when needed. The new IPPF aims to provide internal audit practitioners the tools they need to “enhance and protect organizational value” in an ever-changing business environment.