Page 27 - IIA MAGAZINE_March 2017_English

TO COMMENT on the article,
EMAIL the author at rajiv.thakur@massarsolutions.ae
“The demands on internal audit are
evolving rapidly, and The IIA is working
diligently to make sure the Standards
and IPPF reflect that evolution”
IIA President and CEO Richard Chambers1
It mentions that where engagement
activities require coordination from
other assurance and consulting service
providers, the CAE can do so, provided
a consistent approach for reliance
is followed and the competencies,
objectivity and due professional care of
these service providers are considered.
The CAE is expected to have clear
understanding of the scope, objectives
and results of work performed by
such providers. The CAE still remains
accountable and responsible even if
the reliance is placed on work of others
for ensuring adequate support for
conclusions and opinions reached by the
internal audit activity.
2060 – Reporting to Senior Management
and the Board: The CAE is assigned with
additional responsibilities on periodically gives better insight and forecasts future
reporting to the Senior Management
and Board on the Internal Audit
Department’s conformance with the Code
of Ethics and the Standards in addition
to the department’s purpose, authority,
responsibility and performance relative
to its plan.
The Interpretation is amended and states
that the frequency of the reporting to
the Senior Management and the Board
is determined in collaboration and
not just mere discussion by the Senior
Management, Board and the CAE. Thus,
the CAE is empowered to collaborate
with Senior Management and Board
for deciding the frequency and content
of the reporting. The CAE is entrusted
with the responsibility of reporting and
communication to Senior Management
and the Board which must include
information about:
• The audit charter,
• Independence of the internal audit
activity,
• The audit plan and progress against
the plan,
• Resource requirements,
• Results of audit activities,
27 INTERNAL AUDITOR - MIDDLE EAST
• Conformance with the Code of Ethics
and the Standards and action plans to
address any significant conformance
issues,
• Management’s response to risk that,
in the CAE’s judgment, may be
unacceptable to the organization.
2100 – Nature of Work: The Internal
Audit Department is entrusted with
the responsibility of evaluating and
contributing to the improvement of
the organization’s governance, risk
management and control processes using
a systematic, disciplined and risk based
approach. The value and creditability of
the department enhances when the team
is proactive and the evaluation offers
impact. Thus, Internal Audit Department
is made more responsible in providing
value adding insights to the entity and
improving organization’s governance, risk
management and control processes.
2110 – Governance: The Internal
Audit Department is entrusted with
additional responsibilities on improving
the organizations’ governance process
by assessing and making appropriate
recommendations on the strategic and
operational decisions and overseeing the
risk management and controls.
2200 – Engagement Planning: The standard
is revised to include that the internal
auditors have to be well aware of the
organizations’ strategies, objectives and
relevant risks and must consider the same
while planning any engagement.
2201 – Planning Considerations: In
planning an engagement, internal auditors
must consider organization’s strategies and
significant risk to activity’s objectives under the earlier requirements.
review.
2210.A3 – This is a sub-standard under
Standard 2210 (Engagement Objectives)
and the amendment is that where criteria
to evaluate governance, risk management
and controls is inadequate, internal
auditors must identify appropriate
evaluation criteria through discussion
Internal Audit Quality
with management and the board instead
of working with the management and / or
board in developing appropriate evaluation
criteria as per previous standards. Thus,
internal auditors are supposed to use their
consulting skills and identify appropriate
evaluation criteria by due discussion with
management and / or the board rather
than working with management / board to
develop suitable criteria rather.
A new Interpretation is added stating there
are three types of criteria being 1) Internal,
2) External and 3) Leading Practices.
2410 – Criteria for Communicating:
The amended standard states that
communication must include engagement’s
objectives, scope and results.
2410.A1: The amendment done is the final
communication of engagement results
should mandatorily include applicable
conclusions, applicable recommendations
and / or action plans. Internal auditor’s
opinion should be provided only where
appropriate. Previously, internal auditor’s
opinion and / or conclusions must be
provided only where appropriate. Further,
only opinion (and not conclusion as in
previous standards) must take account of
expectations of senior management, board
and other stakeholders.
2430 – Use of “Conducted in Conformance
with the International Standards for
the Professional Practice of Internal
Auditing”: The internal auditors can
indicate that engagements are conducted
in conformance with the International
Standards for the Professional Practice
of Internal Auditing if the results of the
quality assurance and improvement
program support this. Thus, the emphasis
is on indication rather than on reporting
on the conformance.
2450 – Overall Opinions: The internal
auditors have an added responsibility of
taking into consideration the organization’s
strategies, objectives and also risks when
framing an overall opinion. Further, the
Interpretation states that a summary of
relevant information supporting such
opinion must be included in addition to
1 https://na.theiia.org/news/press-
releases/Pages/Proposed-Internal-Audit-
Standards-Changes-Unveiled.aspx
RAJIV THAKUR
CA, CIA, is an internal audit team leader at a
leading automotive company in Abu Dhabi.
MARCH 2017