CIA Part 1 - 2. Charter, Independence, and Objectivity

1STUDY UNIT TWOOBJECTIVITYCHARTER,INDEPENDENCE,ANDThe purpose,authority,and responsibility of internal auditing should be adequate to enable the internal audit activity to accomplish its objectives.For that reason,the purpose,authority,and responsibility should be stated in a written charter and periodically reassessed.Internal auditing is an independent,objective assurance and consulting activity designed to add value and improve an organization’s operations.Accordingly,the Standards require the internal audit activity to be independent and the internal auditors to be objective in performing their work.Thus, independence is an attribute of an organizational unit,and objectivity is an attribute of individuals.In this context,independence means that internal auditors can carry out their duties freely and objectively.Objectivity means independence in mental attitude.Core Conceptss The purpose,authority,and responsibility of the internal audit activity should be defined in a formal charter.s The nature of assurance and consulting services should be defined in the charter.s The internal audit activity should be independent,and the internal auditor should be objective.s The chief audit executive should report functionally to the audit committee.s Impairment of independence or objectivity should be disclosed.s Internal auditors should not assess operations for which they were previously responsible.2.1CHARTER1.This subunit concerns the content of the charter of the internal audit activity.One GeneralAttribute Standard,an Assurance Implementation Standard,a Consulting ImplementationStandard,and four Practice Advisories currently address this topic.2.1000Purpose,Authority,and Responsibility–The purpose,authority,andresponsibility of the internal audit activity should be formally defined in a charter,consistent with the Standards,and approved by the board.**The term“board”here and elsewhere in pronouncements of The IIA includes“anorganization’s governing body,such as a board of directors,supervisory board,head of an agency or legislative body,board of governors or trustees of a non-profit organization,or any other designated body of the organization,includingthe audit committee,to whom the chief audit executive may functionally report”(Glossary).2SU2:Charter,Independence,and Objectivitya.PRACTICE ADVISORY1000-1:INTERNAL AUDIT CHARTER1.The purpose,authority,and responsibility of the internal audit activity should bedefined in a charter.The chief audit executive should seek approval of thecharter by senior management as well as acceptance by the board,auditcommittee,or appropriate governing authority.The charter should(a)establishthe internal audit activity’s position within the organization;(b)authorizeaccess to records,personnel,and physical properties relevant to theperformance of engagements;and(c)define the scope of internal auditactivities.2.The internal audit activity’s charter should be in writing.A written statementprovides formal communication for review and approval by management and foracceptance by the board.It also facilitates a periodic assessment of theadequacy of the internal audit activity’s purpose,authority,and responsibility.Providing a formal,written document containing the charter of the internal auditactivity is critical in managing the auditing function within the organization.The purpose,authority,and responsibility should be defined and communicatedto establish the role of the internal audit activity and to provide a basis formanagement and the board to use in evaluating the operations of the function.If a question should arise,the charter also provides a formal,written agreementwith management and the board about the role and responsibilities of theinternal audit activity within the organization.3.The chief audit executive should periodically assess whether the purpose,authority,and responsibility,as defined in the charter,continue to be adequateto enable the internal audit activity to accomplish its objectives.The result ofthis periodic assessment should be communicated to senior management andboard.the3.1000.A1–The nature of assurance services provided to the organization should be definedin the audit charter.If assurances are to be provided to parties outside the organization,the nature of these assurances should also be defined in the charter.4.1000.C1–The nature of consulting services should be defined in the audit charter.a.PRACTICE ADVISORY1000.C1-1:PRINCIPLES GUIDING THE PERFORMANCEOF CONSULTING ACTIVITIES OF INTERNAL AUDITORS1.Value Proposition–The value proposition of the internal audit activity isrealized within every organization that employs internal auditors in a mannerthat suits the culture and resources of that organization.That value propositionis captured in the definition of internal auditing and includes assurance andconsulting activities designed to add value to the organization by bringing asystematic,disciplined approach to the areas of governance,risk,and control.SU2:Charter,Independence,and Objectivity32.Consistency with Internal Audit Definition–A disciplined,systematicevaluation methodology is incorporated in each internal audit activity.The list ofservices can generally be incorporated into the broad categories of assuranceand consulting.However,the services may also include evolving forms ofvalue-adding services that are consistent with the broad definition of internalauditing.3.Audit Activities Beyond Assurance and Consulting–There are multipleinternal auditing services.Assurance and consulting are not mutually exclusiveand do not preclude other auditing services,such as investigations andnonauditing roles.Many audit services will have both an assurance andconsultative(advising)role.4.Interrelationship between Assurance and Consulting–Internal auditconsulting enriches value-adding internal auditing.While consulting is often thedirect result of assurance services,it should also be recognized that assurancecould also be generated from consulting engagements.5.Empower Consulting Through the Internal Audit Charter–Internal auditorshave traditionally performed many types of consulting services,including theanalysis of controls built into developing systems,analysis of security products,serving on task forces to analyze operations and make recommendations,andso forth.The board(or audit committee)should empower the internal auditactivity to perform additional services if they do not represent a conflict ofinterest or detract from its obligations to the committee.That empowermentshould be reflected in the internal audit charter.6.Objectivity–Consulting services may enhance the auditor’s understanding ofbusiness processes or issues related to an assurance engagement and donot necessarily impair the auditor’s or the internal audit activity’s objectivity.Internal auditing is not a management decision-making function.Decisions toadopt or implement recommendations made as a result of an internal auditingadvisory service should be made by management.Therefore,internal auditingobjectivity should not be impaired by the decisions made by management.7.Internal Audit Foundation for Consulting Services–Much of consulting is anatural extension of assurance and investigative services and may representinformal or formal advice,analysis,or assessments.The internal audit activityis uniquely positioned to perform this type of consulting work based on(a)itsadherence to the highest standards of objectivity and(b)its breadth ofknowledge about organizational processes,risk,and strategies.munication of Fundamental Information–A primary internal auditingvalue is to provide assurance to senior management and audit committeedirectors.Consulting engagements cannot be performed in a manner thatmasks information that in the judgment of the chief audit executive(CAE)shouldbe presented to senior executives and board members.All consulting is to beunderstood in that context.9.Principles of Consulting Understood by the Organization–Organizationsmust have ground rules for the performance of consulting services that areunderstood by all members of an organization,and these rules should becodified in the audit charter approved by the audit committee and promulgatedin the organization.10.Formal Consulting Engagements –Management often engages outsideconsultants for formal consulting engagements that last a significant period oftime.However,an organization may find that the internal audit activity isuniquely qualified for some formal consulting tasks.If an internal audit activityundertakes to perform a formal consulting engagement,the internal audit groupshould bring a systematic,disciplined approach to the conduct of theengagement.11.CAE Responsibilities –Consulting services permit the CAE to enter intodialogue with management to address specific managerial issues.In thisdialogue,the breadth of the engagement and time frames are made responsiveto management needs.However,the CAE retains the prerogative of settingthe audit techniques and the right of reporting to senior executives and auditcommittee members when the nature and materiality of results pose significantrisks to the organization.12.Criteria for Resolving Conflicts or Evolving Issues –An internal auditor isfirst and foremost an internal auditor.Thus,in the performance of all services,the internal auditor is guided by The IIA Code of Ethics and the Attribute andPerformance Standards of the International Standards for the ProfessionalPractice of Internal Auditing.The resolution of any unforeseen conflicts oractivities should be consistent with the Code of Ethics andStandards.4SU 2:Charter,Independence,and ObjectivitySU2:Charter,Independence,and Objectivity5b.PRACTICE ADVISORY1000.C1-2:ADDITIONAL CONSIDERATIONS FORFORMAL CONSULTING ENGAGEMENTSThe following is the portion of this comprehensive Practice Advisory relevant toStandard1000.C1:Definition of Consulting Services1.The Glossary in the Standards defines“consulting services”as follows:“Advisory and related client service activities,the nature and scope of which areagreed with the client and which are intended to add value and improve anorganization’s governance,risk management,and control processes without theinternal auditor assuming management responsibility.Examples includecounsel,advice,facilitation,and training.”2.The chief audit executive should determine the methodology to use forclassifying engagements within the organization.In some circumstances,itmay be appropriate to conduct a“blended”engagement that incorporateselements of both consulting and assurance activities into one consolidatedapproach.In other cases,it may be appropriate to distinguish between theassurance and consulting components of the engagement.3.Internal auditors may conduct consulting services as part of their normal orroutine activities as well as in response to requests by management.Eachorganization should consider the type of consulting activities to be offered anddetermine if specific policies or procedures should be developed for each typeof activity.Possible categories could include:q Formal consulting engagements–planned and subject to writtenagreement.q Informal consulting engagements–routine activities,such asparticipation on standing committees,limited-life projects,ad-hocmeetings,and routine information exchange.q Special consulting engagements–participation on a merger andacquisition team or system conversion team.q Emergency consulting engagements–participation on a teamestablished for recovery or maintenance of operations after a disaster orother extraordinary business event or a team assembled to supplytemporary help to meet a special request or unusual deadline.4.Auditors generally should not agree to conduct a consulting engagement simplyto circumvent,or to allow others to circumvent,requirements that wouldnormally apply to an assurance engagement if the service in question is moreappropriately conducted as an assurance engagement.This does not precludeadjusting methodologies if services once conducted as assurance engagementsare deemed more suitable to being performed as a consulting engagement.6SU2:Charter,Independence,and Objectivityc.PRACTICE ADVISORY1000.C1-3:ADDITIONAL CONSIDERATIONS FORCONSULTING ENGAGEMENTS IN GOVERNMENT ORGANIZATIONALSETTINGS1.This Practice Advisory provides guidance for government audit organizationsconducting work in compliance with IIA Standards,but whose local governancerules,audit standards,policies,or legislation more strictly limit non-assurance(consulting)services.The parameters within which an organization plans toprovide non-assurance(consulting)services should be included in the internalaudit charter.They should be supported by the policies and procedures of theinternal audit activity.The guidance in this PA may assist organizations indeveloping relevant language and policies to manage the provision ofnon-assurance(consulting)services.2.Core Elements of the Role of Auditors.Through their assurance(audit)engagements,auditors help to ensure that management is accountable formeeting organizational objectives and complying with internal and externalrequirements for how operations and activities are carried out.Although theseengagements can include an“assistance”dimension through the inclusion ofrecommendations for improvement,the auditor does not bear ultimateresponsibility for making or authorizing the improvement.Should an auditortake responsibility for implementing or authorizing operationalimprovements,whether recommended in the course of an audit(assurance)engagement,or as a separate non-audit(consulting)engagement,the auditor isvery likely jeopardizing the independence and objectivity that are essential tothe role of audit.SU2:Charter,Independence,and Objectivity7 Even when assisting an organization through non-audit(consulting)activities,auditors should keep their activities within boundaries that define the coreelements of the audit function.These core elements include:q Auditors should be independent.They should avoid relationships andsituations that compromise their objectivity.q Auditors should not audit their own work.q Auditors should not perform management functions or makemanagement decisions.1The elements are“core”because they support the fundamental valueproposition of audit,namely,the principle that an objective third party isattesting to(or providing assurance to)the credibility of management’sassertions.Accordingly,to protect their ability to provide assurance,auditorsmust minimize potential threats to auditor independence that can arise when thesame audit function is also providing non-audit(consulting)services.In addition to the core elements above,other threats to auditor independencehave been identified,including the conduct of non-audit(consulting)work thatq Creates a mutuality of interest;or2q Places auditors in the role of advocate for the company.erning Rules.Specific jurisdictional rules that set restrictions on the workof auditors outside the audit(assurance)role may apply only to auditorsconducting the external(financial statement or statutory)audit,or they mayapply to auditors performing all types of audits.Moreover,the rules may havebeen established in the audit function’s enabling legislation,imposed byoversight or regulatory bodies,or included in codes of ethics or auditingstandards required for audits of specific organizations or jurisdictions.3It is theChief Audit Executive’s responsibility to ensure that the audit function’s charterand its policies and procedures comply with relevant governing rules.Moreover,even where the audit function is not subject to governing rules thatrestrict non-audit(consulting)services,CAEs will nevertheless need to ensurethat the quality assurance system is designed to manage or minimize threatsto auditor independence or objectivity.Otherwise,non-audit(consulting)assignments could have the long-term effect of compromising the auditfunction’s ability to carry out its audit(assurance)role.In addition,an auditfunction’s engagement in non-audit(consulting)work that compromises itsindependence could prevent other auditors from relying on the audit function’swork.1This principle has been articulated by numerous standard-setting bodies,including guidance publishedby IAASB/IFAC in its Code of Professional Ethics and the ernment Accountability Office in itsGenerally Accepted Government Auditing Standards.2This risk is raised in the January2003Smith Report on Audit Committees and Combined CodeGuidance,appointed by the Financial Reporting Council,and is addressed in guidance published byICAEW(Institute of Chartered Accountants in England and Wales),among others.3Examples of specific restrictions include U.K.’s Government Internal Audit Standard2.4.2,whichstates:“Objectivity is presumed to be impaired when individual auditors review any activity in which theyhave previously had executive responsibility,or in which they have provided consultancy advice.”Thisstandard is supplemented by Good Practice Guidance on Consultancy,which states:“In this role it isimportant that the internal auditor offers advice to management and does not undertake the task onbehalf of,or as a substitute for,management.Acceptance by management of the advice offered by theinternal auditor does not transfer or reduce management’s accountability for their own areas ofresponsibility.”(3.5.3)8SU2:Charter,Independence,and Objectivity4.Activities that Compromise Objectivity or Independence.Auditors’ability toengage in non-audit(consulting)work without compromising their independencedepends to some extent on where they“draw the line”between assisting orconsulting in the sense of advising,versus assisting by doing work that is theresponsibility of management.For example,providing advice on appropriatecontrols during system design with the clear understanding that managementhas responsibility for accepting or rejecting the advice would have a limitedimpact on the auditor’s objectivity toward that system in the future.By contrast,if the auditor led the system design team,decided which controls to select,oroversaw the implementation of the recommended controls,the auditor’s futureability to objectively evaluate that system would be significantly impaired.However,other non-audit assignments may not be as clear-cut.Accordingly,audit functions need to develop procedures for reviewing potential non-audit(consulting)assignments and determining whether they present a threat toindependence or objectivity.The review used to determine the effect onfuture independence and objectivity should be documented.Thisdocumentation should be provided to external quality control reviewers duringthe QAR engagement.5.Processes for Minimizing Threats to Objectivity or Independence.Theaudit function should implement controls that assist in reducing the potentialfor non-audit(consulting)projects to compromise objectivity of individualauditors,or the independence of the audit function as a whole.Techniques mayinclude:a.Charter language defining non-audit(consulting)service parameters.b.Policies and procedures limiting type,nature,or level of participation innon-audit(consulting)projects.e of a screening process for non-audit(consulting)projects,with limitson accepting engagements that might threaten objectivity.d.Segregation of non-audit(consulting)units from units conducting audits(assurance engagements)within the same audit function.e.Rotation of auditors on engagements.f.Employing outside providers for carrying out non-audit(consulting)engagements,or for conducting assurance engagements in activitieswhere the audit function’s prior involvement in non-audit(consulting)workhas been determined to impair objectivity/independence.g.Disclosure in audit reports where objectivity was impaired by participationin a prior non-audit(consulting)project.Attachment A provides examples of relevant language for some of these typesof control techniques.SU2:Charter,Independence,and Objectivity9Attachment AExample Language for Control Techniques Minimizing Threats to Auditor IndependenceCharter language defining non-audit(consulting)service parameters.Charter language will establish the boundaries within which the audit function will operate but is not expected to detail the specific services that would or would not be provided.Accordingly,if a baseline for independence has been described elsewhere in the Charter document,or is included in specifically applicable auditing standards that are referenced;the Charter may need only to include a reference to those other requirements to set parameters for services to be provided.Three examples below show language used in two cases where non-audit(consulting)services are limited to those where independence or objectivity should not be compromised,and for a case where the audit function may be called upon to do work that is normally management’s responsibility.s Where the audit function will be limiting non-audit(consulting)services to those that do not compromise objectivity or independence:“The auditor may also assist the mayor,the City Council,and management staff in carrying out their responsibilities by providing them with objective and timely information on the conduct of city operations or advising on appropriate management controls,in accordance with[title ofapplicable]Auditing Standards.”“The internal audit department may perform other non-audit functions,consistent with otherprovisions of this Charter,and prepare and submit such other reports as may be assigned by the Commission.”s Where the audit function will be providing a full range of non-audit services,even if certain such services may threaten objectivity or independence for audit work:“The auditor may from time to time be called upon to participate in non-audit activities of theAgency,to assist the Executive Director and managers in carrying out their responsibilities,as authorized by the Audit Committee.”Policies and procedures limiting type,nature,and/or level of participation in non-audit (consulting)projects;or establishing controls that minimize future threats to objectivity or independence from participation in non-audit engagements.If auditors do perform management functions for the organization,the audit unit should establish relevant policies and procedures. Specifically,policies should prohibit those individuals from planning,conducting,or reviewing future audits of the subject matter involving the non-audit(consulting)service.Moreover,if the audit function performs a non-audit(consulting)engagement that will impair the entire audit function’s independence or objectivity,the audit function’s oversight entity(e.g.,the audit committee)should be notified before the engagement begins that audit independence will be impaired on any future audit work performed within the area.Should the audit function proceed to conduct an audit in the activity where the impairment exists,this impairment should be identified in the audit report.These prohibitions can be relaxed if there are significant changes to the subject matter area after the assistance work was performed or if the assistance work involved some established de minimums standard,such as“under40hours.”The example policy and procedure below describes non-audit(consulting)services,and includes language(see underlined text)that limits the services to within parameters that minimize threats to objectivity and independence of the auditors.Policy:In addition to audit services,the Auditor’s Office provides three other types of services to managers in the jurisdiction,or at the request of the Commission—Quality Assurance for projects in process,Consulting and Training,and Control Self Assessment facilitated workshops.10SU2:Charter,Independence,and ObjectivityParameters for each type of service are detailed below.Quality Assurance Services:In providing quality assurance services,the Office of City Auditor will monitor and assist ongoing projects by assessing if:q project objectives will be achieved and are reasonable;q all options have been identified and thoroughly analyzed;q quantitative and qualitative analyses are complete and accurate;q a project plan has been established and project staff are adhering to the plan;andq best practices used by other jurisdictions to accomplish project objectives might be adopted in the City.Consulting Services and Training:Audit staff is available to provide assistance and training to City staff in designing management accountability systems and re-engineering operations.Audit staff is advisory only andmanagement must accept responsibility for implementing any suggestions.Control Self Assessment Facilitated Workshops:In this audit process,an employee team meets with auditors to hold structured discussions on how to achieve its objectives in the most efficient and effective way.Action plans,rather than a formal audit report,are developed to address any obstacles to the objective(s).Employee team members are responsible for implementing action plan steps.The example procedures on the next page contain language that clarifies actions to be taken by the audit function when non-audit(consulting)engagements are accepted that threaten independence and objectivity on future assurance(audit)engagements:When the audit function is requested by the Audit Committee to conduct non-audit engagements that are determined by the CAE to impair the audit function’s independence or an individualauditor’s objectivity for conducting subsequent audit work,the following procedures will be carried out:1.Prior to commencing the non-audit engagement,the CAE will communicate in writing withthe Audit Committee that the requested engagement will impair independence or objectivity;describe the nature of the impairment;and indicate the consequences of the impairment forfuture audit engagements(e.g.,that the audit function must decline future audits in the area,or the Audit Committee will need to contract with a third-party provider to conduct futureaudits).The CAE should request a response in writing from the Audit Committee,directingthe audit function either to proceed with the non-audit engagement,or to decline it.2.If the Audit Committee directs the audit function to proceed with the non-audit engagement,the CAE will document the impairment in:q The non-audit engagement’s documentation,with a copy to management responsible for the non-audit engagement;q The audit function’s annual project planning procedures;andq The audit function’s communications with external quality assurance providers at its next quality assurance review.If the Audit Committee directs the audit function to conduct an audit that includes in its scopeactivities or operations that were part of a prior non-audit engagement conducted by the audit function,about which the CAE previously determined that the non-audit engagement wouldcreate an impairment for future audit work,the following procedures should be carried out:1.Prior to commencing the audit engagement,the CAE will communicate in writing with theAudit Committee,provide notice and description of the impairment,and indicate options forcarrying out the work with a maximum of objectivity(e.g.,contracting with a third-partyprovider,or requesting the assistance of auditors from partner or regulatory entities).2.If the Audit Committee directs the audit function to proceed with the audit engagement,theCAE will document the impairment in:q The audit engagement’s planning documentation;andq The audit engagement’s final report.3.In addition,the CAE shall disclose the occurrence and provide full documentation to theaudit function’s external quality assurance providers at its next quality assurance review. Screening process for non-audit(consulting)projects.When accepting and performing consulting work,auditors should document their rationale for providing consulting services and demonstrate their judgment that the services do not violate the core elements of the audit role.This information should be disclosed to external quality assurance reviewers.One example policy for screening is below:1.Upon receipt of a request for non-audit(consulting)services,the Internal Audit Departmentwill consider whether providing such services would create a personal impairment either infact or appearance that would adversely affect either the assigned auditor’s objectivity or tothe department’s independence for conducting subsequent audits within the same area.Ifthe engagement is determined to constitute an impairment to independence or objectivity,the request should be declined.If declined,the factors and final conclusion will bedocumented in a memorandum addressed to the requestor of the services.2.Before performing non-audit(consulting)services,the auditor in charge will document anunderstanding with the requestor(s)that the requestor(s)are responsible for the outcome ofthe work;and,therefore,has a responsibility to be in a position in fact and appearance tomake an informed judgment on the results of the non-audit(consulting)work.The InternalAudit Department will establish an agreement with the requestor(s)concerning the objec-tive,scope,and limitations imposed on the non-audit(consulting)engagement services.。