IIA IIA-CIA-Part1 - Internal Audit Fundamentals

The board has approved the risk tolerance of the organization. Risk tolerance is the level of risk that an organization is willing to accept while pursuing its objectives before action is deemed necessary to reduce the risk. In this scenario, the board's acceptance of potential large monetary losses indicates their willingness to tolerate these losses in pursuit of expanding into a new market.

The IIA's guidance on risk management, specifically relating to defining and understanding risk appetite and risk tolerance.

In this situation, the internal auditor violated the IIA's Code of Ethics by using confidential information obtained during an audit (salary data) for personal gain (negotiating work conditions). This action breaches the confidentiality and objectivity principles outlined in the IIA Code of Ethics, which require auditors to refrain from using information for any personal advantage or in a manner that would be detrimental to the legitimacy or trust of the audit function.

Institute of Internal Auditors (IIA) - Code of Ethics

The ultimate goal of establishing a robust risk management framework in an organization is to facilitate the achievement of the organization's business goals and objectives. A comprehensive risk management framework helps identify, assess, and mitigate risks that could impede the organization's ability to achieve its strategic objectives, ensuring that risks are managed in a way that supports the organization's overall mission and goals.

The IIA Standards: Standard 2120 – Risk Management: "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes."

COSO Framework: Emphasizes that the purpose of risk management is to help organizations achieve their objectives and enhance performance through effective risk management practices.

The engagement supervisor should encourage the auditor to improve communication skills. Effective communication is essential for internal auditors, especially in ensuring that process owners have the opportunity to respond to and clarify any issues raised in the draft audit report. This collaboration helps ensure that the audit findings are accurate and that any misunderstandings or errors are resolved before the report is finalized. Encouraging better communication also helps build a positive relationship between the audit function and the audit clients.

The IIA Standards: Standard 2420 – Quality of Communications: "Communications must be accurate, objective, clear, concise, constructive, complete, and timely."

IIA Practice Guide: "Effective Communication for Internal Auditors": Emphasizes the importance of clear and effective communication in the audit process, including involving audit clients in the review of draft reports.

The Mission of Internal Audit emphasizes the provision of professional advisory and assurance services. This mission statement highlights that internal auditing is designed to add value and improve an organization's operations through a systematic and disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

The IIA's Mission of Internal Audit, which clearly outlines the core purpose and focus of internal auditing activities.

Protecting the objectivity of internal auditors is a crucial aspect of maintaining the integrity and reliability of the internal audit function. According to the International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 1120: Individual Objectivity, internal auditors must have an impartial, unbiased attitude and avoid any conflict of interest. Prohibiting auditors from accepting gifts from audit clients or potential clients (Option C) is a clear measure to prevent conflicts of interest and ensure that auditors remain objective and free from undue influence. This practice is in line with maintaining the highest level of ethical standards as per the IIA's Code of Ethics.

IIA Standards, Standard 1120: Individual Objectivity

IIA Code of Ethics

By notifying the chief audit executive of her candidacy for a position within the accounts payable department, the auditor upheld the principle of Objectivity. This principle requires auditors to disclose any potential conflicts of interest that could influence their independence and objectivity during the audit process.

The Institute of Internal Auditors (IIA) - Code of Ethics.

Demonstrating due professional care involves thorough testing and evaluation of evidence. The internal auditor exhibited due professional care by selecting a sample of purchase orders above a specific threshold and obtaining documentation for each to verify compliance with the required bidding process. This methodical approach ensures that audit findings are based on sufficient, appropriate evidence and that conclusions about the effectiveness of controls are well-supported.

International Standards for the Professional Practice of Internal Auditing, particularly those related to due professional care and evidence evaluation.

According to the Standards, the risk register should include information about identified risks and how these are being managed. Management’s acceptance of inadequate controls for a significant risk such as cybersecurity should be documented as it represents a known risk exposure that the organization has chosen to accept. This helps ensure transparency and informs subsequent audit activities and decisions.

International Standards for the Professional Practice of Internal Auditing, specifically on risk assessment and management.

According to the guidance from The IIA (International Professional Practices Framework - IPPF), the most robust support for concluding that an organization’s risk management processes are effective is the alignment of selected risk responses with the organization’s risk appetite. This indicates that the organization not only understands its risks but also manages them in a manner consistent with its capacity and willingness to accept risk. It reflects a mature risk management process where risks are identified, assessed, and managed in alignment with strategic objectives and risk appetite, ensuring that the organization is not taking on more risk than it can handle or than is acceptable to its stakeholders.

IIA Practice Guide on Assessing the Adequacy of Risk Management Processes.

COSO Enterprise Risk Management Framework.

Evaluating organizational culture requires insights into ethics, values, and behavior. The combination of the ethics policy, structured employee interviews, and communicated organizational values provides a comprehensive view, as recommended by IIA standards for governance audits​​.

The IIA recognizes that internal auditors can provide valuable consulting services that support the organization’s risk management without compromising their independence. Facilitating risk assessment workshops (option B) is a consulting service that internal auditors can perform, which helps the organization identify and evaluate risks in a structured way. This activity does not involve making management decisions or assuming management responsibilities, preserving the internal audit's advisory role.

IIA Standard 1000: "Consulting Services"

Reviewing training records for all internal auditors is a way to demonstrate an individual internal auditor's competency through continuing professional development. This method ensures that each auditor's training aligns with required competencies and standards, providing a clear record of professional development activities.

IIA standards on assessing professional competencies and continuing education.

In this scenario, the auditors have tested preventive controls. Preventive controls are designed to deter unwanted events before they occur. The mandatory training on taxation guidelines for finance department employees is a preventive measure, as it aims to prevent errors or violations in taxation processes by ensuring all employees are well informed and compliant from the start. The automation of training assignment further supports the preventive nature of this control.

IIA guidance on types of controls

Segregation of duties is a preventive control designed to mitigate fraud by ensuring that no single individual has control over all phases of a financial transaction. This control reduces the risk of errors and fraud by requiring the involvement of multiple people in tasks such as authorization, custody of assets, and record-keeping.

Institute of Internal Auditors (IIA) - Practice Advisories on Fraud Prevention and Control