The new IIA standards have landed. This is a significant change for the profession and obliges organisations, Heads of Internal Audit (HIA) and Audit Committees to take stock of their Internal Audit function and the role of the Audit Committee in overseeing the assurance provision.
More formal definitions of the Internal Audit Mandate and Charter provide an opportunity to reflect on the consider whether there needs to be a shift change. This could be in the organisational position, reporting relationships, scope of work or types of services provide by the function.
Alongside an updated purpose of Internal Audit which focuses more on organisational value - specifically, that internal audit strengthens a company’s ability to ‘create, protect and sustain value’ through ‘risk-based, and objective, assurance advice, insight and foresight’, there are significant changes for the Board and Senior Management in Domain III: Governing the Internal Audit Function.
This Domain emphasises the importance of appropriate governance arrangements for the internal audit function to be effective. The HIA is responsible for working closely with the Board to establish the internal audit function, position it independently, and oversee its performance. Senior management also has responsibilities that support the board's responsibilities and promote strong governance of the internal audit function. The Board (through the Audit Committee), Senior Management, and the HIA must establish an effective dialogue to enable an impactful internal audit function. To comply with the standards, the HIA is responsible for the requirements in the Domain, but they are reliant on activities of the Board and Senior management, and these activities are identified as "essential conditions" in each standard.
The HIA must discuss the requirements of this Domain with the Audit Committee and Senior Management, focusing on:
Where any essential conditions are not agreed by the Audit Committee or Senior Management following discussions, the HIA will need to document the reason a condition is unnecessary and alternative compensating conditions that are in place.
Essential conditions include discussions and/or approvals covering (but not limited to) the following:
Whilst none of these areas are particularly new, there is subjectivity running through some of the detail and careful consideration will need to be given as to how conformance will be demonstrated.
Plan your response, the Standards become effective 9 January 2025 so use this time to plan how you are going to comply accordingly.
Your strategic review should involve engagement with Senior Management, the Board/Audit Committee, the HIA and team and the wider business.
Once released, incorporate the IIA’s new Topical Guidance into your internal audit methodologies, policies, and procedures. Training and development plans for the internal audit team may need updating and implementing.
When you are done, brief the wider organisation on the changes they can expect from the internal audit function, and how they can better engage with internal audit to create value for the organisation.
It’s an exciting time to be part of the internal audit profession and the updated standards showcase internal audit’s evolving, value-added role in today’s organisations and dynamic environment. Our expert team would be delighted to support you in aligning with the latest International Internal Audit Standard. It is not just a compliance checkpoint exercise – it's about setting a benchmark in quality and innovation to increase the strategic value and impact of internal audit work.
Regardless of the size and maturity of your internal audit function, we can help you to reach compliance with the new standards. These changes reflect require agility, technical expertise, and a broader focus on risks, particularly those associated with governance, so it is the perfect time to consider the following focus areas:
Governance and refreshing the Internal Audit strategy: Whilst the IIA cannot require governance practices of the Board; the new standards do provide HIAs with a sound foundation to engage the Board and Audit Committee in a discussion around internal audit transformation. We can support HIAs and help enable drive better engagement between the Audit Committee and Senior Management. We facilitate workshops to work through what the changes to the standards mean to parties affected. This will in turn reinforce the standards, building on having a mandate, and HIAs needing to develop a strategy to fulfil this mandate. We can ensure your Internal Audit Strategy is linked to the mandate as required by the standards and that this is developed with realistic timeframes to implementation. Please refer to our Corporate Governance Hub for more information across this space.
EQA: If your Internal Audit function is planning an External Quality Assessment in 2024, we can incorporate a strategic review and/or a gap analysis into this exercise. For organisations due to have an EQA in 2025, a quality assessment can be accelerated to help get ahead in your implementation journey.
Whether it’s starting from scratch to create a transition plan, or revisiting an existing roadmap, we can help. Our team will be on standby to support you with updating your charter, methodology, policies and templates. If you need to formalise a performance measuring methodology, we have specific resource available to work with you to develop this and ensure that conformance is sustainable without jeopardising day to day delivery.
To find out more about what Heads of Internal Audit should be thinking about, read our latest Internal Audit & Risk Agenda.
Every quarter, experts from our Risk and Advisory Services team write on issues affecting internal audit professionals. The articles provide Heads of Internal Audit as well as Internal Auditors with relevant insight covering topics such as risk management, internal controls and governance.
Cherry Cromarty