34 Practice_Advisory_2060-1_Reporting_to_Board_and_Senior_Man匸1]

Practice Advisory 2060-1:
Reporting to Board and
Senior Management
Interpretation of Standard 2060 from the
International Standards for the
Professional Practice of Internal Auditing
Related Standard
2060 Reporting to Board and Senior Management
The chief audit executive should report periodically to the board and senior
management on the internal audit activity s purpose, authority, responsibility, and performance relative to its plan. Reporting should also include significant risk
exposures and control issues, corporate governance issues, and other matters
needed or requested by the board and senior management.
Nature of this Practice Advisory:Internal auditors should consider the following suggestions when reporting to the board and senior management. This guidance is not intended to represent all the considerations that may be necessary, but simply a recommended set of items that should be addressed. Compliance with Practice Advisories is optional.
1. The chief audit executive (CAE) should submit activity reports to senior management
and to the board periodically throughout the year. Activity reports should highlight significant engagement observations and recommendations and should inform senior management and the board of any significant deviations from approved engagement work schedules, staffing plans, and financial budgets, and the reasons for them.
2. Significant engagement observations are those conditions that, in the judgment of the
CAE, could adversely affect the organization. Significant engagement observations may include conditions dealing with irregularities, illegal acts, errors, inefficiency, waste, ineffectiveness, conflicts of interest, and control weaknesses. After reviewing such conditions with senior management, the CAE should communicate significant engagement observations and recommendations to the board, whether or not they have been satisfactorily resolved.
3. Management s responsibility is to make decisions on the appropriate action to be
taken regarding significant engagement observations and recommendations. Senior management may decide to assume the risk of not correcting the reported condition because of cost or other considerations. The board should be informed of senior
management s decisions on all significant observations and recommendations. 4. The CAE should consider whether it is appropriate to inform the board regarding
previously reported, significant observations and recommendations in those instances
when senior management and the board assumed the risk of not correcting the
reported condition. This may be particularly necessary when there have been
organization, board, senior management, or other changes.
5. In addition to subjects covered above, activity reports should also compare (a) actual
performance with the internal audit activity s goals and audit work schedules, and (b) expenditures with financial budgets. Reports should explain the reason for major variances and indicate any action taken or needed.
Origination Date: January 5, 2001
Revised Date: February 12, 2004
All contents of this Web site, except where expressly stated, are the copyrighted property of The Institute of Internal Auditors, Inc. (The IIA®). Privacy Policy。