The International Professional Practices Framework (IPPF), the blueprint of knowledge and guidance for the practice of internal auditing, undergoes a required review every three years by the Institute of Internal Auditors (IIA). This review keeps the Standards relevant and focused to address the needs of stakeholders.
The IIA’s most recent review resulted in two revisions to the Standards.
Earlier this year, the IIA issued its second set of proposed changes to the Standards, in the form of an exposure draft. The exposure draft was open for comments from February to May 2010. After reviewing comments received from 1,390 individuals and 29 organizations, on October 20, 2010, the IIA’s Internal Auditing Standards Board (IASB) released updates to the Standards, which become effective January 1, 2011.
The latest updates added three new Standards, deleted two and revised fifteen. Two of the new Standards address report opinions. The third new Standard addresses circumstances when an organization uses outside service providers for or as the internal audit activity.
Internal Audit Report Opinions
Standard 2010.A2 (new) – Planning: The chief audit executive must identify and consider the expectations of senior management, the board, and other stakeholders for internal audit opinions and other conclusions.
Standard 2450 (new) – Overall Opinions: When an overall opinion is issued, it must take into account the expectations of senior management, the board, and other stakeholders and must be supported by sufficient, reliable, relevant, and useful information.
The new Standards include an interpretation, providing further guidance as to the content of the opinion report.
External Service Providers
Standard 2070 (new) – External Service Provider and Organizational Responsibility for Internal Auditing: When an external service provider serves as the internal audit activity, the provider must make the organization aware that the organization has the responsibility for maintaining an effective internal audit activity.
The interpretation included in the new Standard provides that this outsourcing activity can be assessed through the quality assurance and improvement program.
The revision eliminated the following two Standards:
Standard 2130.A2 (deleted) – Control: Internal auditors should ascertain the extent to which operating and program goals and objectives have been established and conform to those of the organization.
Standard 2130.A3 (deleted) – Control: Internal auditors should review operations and programs to ascertain the extent to which results are consistent with established goals and objectives to determine whether operations and programs are being implemented or performed as intended.
The substance of these two deleted Standards was incorporated into an amended Standard 2130.A1.
The IASB revised fifteen existing Standards. The majority of these revisions covered changes and/or additions to Interpretations to related Standards. In our point of view, the following are the most significant changes:
Standard 1110 - Organizational Independence: The IASB provided guidance on how to meet independence requirements and what it means to report functionally to the board.
Standards 1312 and 1321 - Quality Assurance and Improvement Program: Guidance was provided on how to assess a “qualified reviewer or review team” for the external assessment and the use of “conforms with the International Standards for the Professional Practice of Internal Auditing”.
Please contact us at RubinBrown if we can assist you in better understanding the Standards and the ways they can affect your business.