Stakeholder pressure on internal auditors has never been greater. In today’s dynamic business world, internal audit is called on to ensure businesses around the globe conform to a wide range of legislation and regulation; to provide tactical and strategic insight and foresight into their organization’s performance; and to get ahead of the curve on emerging technologies and social trends. And, in fact, the list could go on. Professional internal auditing is based on The IIA’s
International Standards for the Professional Practice of Internal Auditing, which is part of the International Professional Practices Framework. Taken together, these guiding and mandatory principles provide internal auditors the tools to effectively serve their organizations and provide stakeholders confidence that their internal audit team is functioning at the highest possible standards of professionalism and skill. The
Standards underpin the work that we do every day. Whether auditors are performing a basic audit, providing assurance, giving advice and insight, or doing a consulting assignment, they need to adhere to certain professional behaviors — just like those followed by doctors, lawyers, accountants, and others.
International Standards for the Professional Practice of Internal Auditing are principle-focused and provide a framework for performing and promoting internal auditing. The Standards are mandatory requirements consisting of:
Statements of basic requirements for the professional practice of internal auditing and for evaluating the effectiveness of its performance. The requirements are internationally applicable at organizational and individual levels.
Interpretations, which clarify terms or concepts within the statements.
Auditors must consider both the statements and their interpretations to understand and correctly apply the Standards. The Standards use terms that have been given specific meanings as noted in its Glossary.
The International Internal Audit Standards Board released a revision to the Standards, which came into effect Jan. 1, 2017. For the full text of the IIA Standards, visit
Professional internal auditors must live and breathe the fundamental values enshrined in the
Standards. Those values should be crystal clear to everyone in an internal audit function. The theme I’ve chosen for my term as 2018–2019 chairman of the IIA Global Board of Directors, “Emphasize the Basics — Elevate the
Standards,” offers a fundamental way of both connecting with our stakeholders and providing the most solid, relevant internal auditing possible.
Setting and Meeting Expectations
Standards provide consistency in audit practice, guarantee the quality of whatever audit assignment is undertaken, and help the chief audit executive (CAE) align stakeholder expectations with the actual services the audit function provides. Auditors may need to educate stakeholders about what to consistently expect from internal audit and then deliver it — a process the Standards greatly enable.
Standards help ground the independent nature of internal audit as it operates as the third line of defense in conjunction with management and the various second line risk and compliance functions. Independence guarantees internal audit’s effectiveness. If there is uncertainty about the facts surrounding a particular initiative, for example, or different parts of the business are in dispute, internal audit can be relied on to provide an independent and objective view on the matter at hand. For example, I was recently involved in reviewing an integration project to bring two large organizations into one legal entity. Not only did the board’s audit committee ask internal audit to stay very close to the merger, but the regulator asked internal audit to keep it abreast of what was happening by bringing our independent view to the regulator on how the project was progressing. Both sides were concerned that certain controls may be overlooked, or not be established. Internal audit’s position of independence enabled us to provide assurance to both stakeholders and ensure that everyone had the same understanding of what was happening on the ground.
Being in Conformance
Getting the basics right enables internal auditors to tackle emerging issues such as robotics and artificial intelligence from a position of strength. Audit functions that follow the
Standards will be mature and have excellent connections throughout the business. Without this maturity, the audit function will be unable to respond timely to the rapid technological developments facing organizations.
According to The IIA’s rolling research project, the Common Body of Knowledge (CBOK), the percentage of CAEs who say that they are in full conformance with the
Standards fluctuates. In 2005, 56 percent of CAEs said they were in conformance; this figure dipped to 42 percent in 2010 and then rose to 54 percent in the latest, 2015 survey. However one reads those numbers, they are disappointing, because in any one year only about half of CAEs are achieving what should be the basic professional requirement to operate as an internal auditor.
I am a qualified accountant in the U.S., and I cannot be a member of the American Institute of CPAs without complying with its rules and regulations. The same holds true of other professionals , such as lawyers and doctors. That is why, if we are calling ourselves a profession, my expectation — and that of many stakeholders — is that all internal auditors should be in conformance with the
The CIA Certification: The Mark of the Profession
The Certified Internal Auditor (CIA) certification is the global designation all internal audit professionals should achieve. It represents our understanding and application of the Standards throughout our work, which helps our stakeholders better recognize the value the profession delivers to organizations. The CIA is the premier, globally recognized certification that enables professional internal auditors to rise above the rest and deliver on stakeholder expectations.
Recently, the CIA exam syllabi and topic areas were revised to bring the exams up to date with the current global practice of internal auditing, to clarify the knowledge and skills CIA candidates must possess, to create greater alignment between the CIA syllabi and The IIA’s Standards, and to refocus Part Three content on core skills.
The purpose of the exam is to assess individuals who meet the requisite global competencies in current internal audit practice. There are three parts:
- Part One — Essentials of Internal Auditing
- Part Two — Practice of Internal Auditing
- Part Three — Business Knowledge for Internal Auditing
CIA candidates are expected to:
- Possess current knowledge of The IIA’s Professional Practices Framework and demonstrate appropriate use.
- Be able to perform an audit engagement with minimal supervision in conformance with the Standards.
- Be able to apply tools and techniques to evaluate risks and controls.
- Demonstrate knowledge of organizational governance.
- Apply knowledge in business acumen, IT, and management needed for internal auditing.
Having the CIA certification conveys to our stakeholders that we mean business — and, importantly, that we have the competencies and skills to deliver on the purpose of internal auditing, to protect and enhance organizational value.
Obtaining External Quality Assurance
The CBOK findings seem to indicate that internal audit leaders do not see the value of external quality assurance. In many organizations with small audit functions, stakeholders often are not as demanding, or not knowledgeable, about what internal audit does compared to an audit committee for a listed company where quality assurance reviews of internal audit are expected. However, to be a professional internal auditor, one must be in conformance with all of the
Standards, including those on quality assurance, and that is much easier to achieve than people think. In the many quality assurance projects I have experienced, I have never seen a spectacular failure.
The bottleneck can be the quality assurance process, itself, but it need not be too onerous or expensive. CAEs can attend their local IIA chapters and find a suitable peer with whom to partner so they can reciprocally provide that service. There are plenty of resources that explain how to do this on The IIA’s
website. My challenge to CAEs is to get an external quality assurance review. I can guarantee they will learn a lot about their function and come away with many tangible benefits. For example, if an audit function finds it has not done enough training, it can use the evidence from the quality assurance review to request funds from the board. The CAE can require everyone who is pursuing a career in internal auditing to sit for the Certified Internal Auditor (CIA) exam.
Also, a quality assurance review will flush out potential conflicts of interest in terms of independence. And it will help align the organization’s expectations of internal auditing with internationally recognized best practices, so that stakeholders can feel confident calling on internal audit for the right issues at the right time.
A Unique Profession
There is another reason my theme is “Emphasize the Basics — Elevate the
Standards.” Internal auditing as a profession is truly global, and by following the Standards we set the benchmark for how the job should be done. Internal audit is practiced in similar ways regardless of industry, geography, size of organization, and whether it is for-profit or nonprofit. This is not the case in the legal or accounting professions, for example, where local laws and practices vary widely.
This is one of the reasons why internal auditing is important to me, personally. I am Japanese, but I’ve worked in the U.S., the Middle East, Asia, and Europe. Wherever I go, I can still practice my profession, speak to internal audit colleagues, and learn from what people are doing in various industries and regions. Those conversations have a direct relevance to me because the Standards enable us to speak a common language.
My first role was as an accountant, which I did not enjoy because I felt it encouraged me to share too narrow a view of the world. When I retrained as an internal auditor, I was amazed. Internal auditing entailed looking at an organization from end to end. CAEs have to see things through the chief executive officer’s or board member’s lens — without having to actually be in that role. That was — and remains — fascinating to me, and there is no other function in the organization that fulfills that role.
Advancing the Profession
My goal for every reader of this article, and the profession as a whole, is to put the
Standards center stage of our efforts. My tenure as chair is a relatively short 14 months. I would love to see conformance with the Standards rise from 54 percent where it is today, to 75 percent during my tenure. That may be too ambitious, but I believe it is possible if we all work together.
You do not have to be a CAE to help in that process. If you are a junior auditor planning a career in the profession, take the CIA exam and do at least the recommended amount of training. Attend local IIA chapter events, get to know colleagues in different industries, and develop skills. If you are a CAE and have not yet had an external quality assessment — take the plunge. You will not only be doing yourself and your organization a great service, you will be helping to advance the credibility and effectiveness of the global profession. And that is something worth aiming for.
The Chairman of the Global Board of Directors
Naohiro Mouri is executive vice president and chief auditor of American International Group (AIG), a global property-casualty, life
and retirement, and general insurance company based in New York.
In a career spanning more than 20 years, Mouri has held several chief auditor positions. Before joining AIG, he was a statutory executive officer, senior vice president, and chief auditor for MetLife Alico Insurance K.K. Japan. He also led the audit departments at J.P. Morgan Asia Pacific, Shinsei Bank, Morgan Stanley Japan, and Deutsche Bank Japan. He began his career at Arthur Andersen in Atlanta and Tokyo.
Committed to supporting internal audit professionals, Mouri also has held numerous board and volunteer leadership positions at The IIA, including international secretary (2007–2008), vice chairman–professional development (2008–2009), vice chairman–professional guidance (2015–2016), vice chairman–professional practices (2016–2017), and senior vice chairman of the Global Board (2017–2018). He has been IIA–Japan director since 2003.
Mouri served from 2001–2006 as the first elected president of the Asian Confederation of Institutes of Internal Auditors (ACIIA). ACIIA recognized him with its “Outstanding Contribution in the Field of Internal Auditing” honor in 2016.
Mouri advocates for the profession through IIA and other industry forums, and he has lectured at several universities in Japan, including the Meiji University Graduate Program for Professional Accountancy and Senshu University. Mouri co-authored Korega Kinyukikan no Naibukansa da (Internal Audit for Financial Institutions), which is available in Japanese and Mandarin.
Mouri, a Certified Internal Auditor and Certified Public Accountant, has a bachelor’s degree in accounting from Georgia State University.