Internal Auditing Standards under Revision

The Institute of Internal Auditors’ Internal Audit Standards Board has proposed several changes to the standards for internal auditors, including what should happen when giving an opinion on an audit, and the role of outsourced service providers.

The IIA noted that around the world, internal auditors are increasingly providing opinions, both at the engagement level and at an overall level. Existing standards permit, but do not require, internal auditors to give opinions. Given the variety of governance structures and other aspects that influence the context of internal auditors’ work, the board does not believe it is appropriate to require all internal auditors to provide opinions in every audit. However, the board wants to ensure that stakeholders can rely on an internal auditor’s opinion, if it is given.

Thus, the board is proposing two additional standards to address this issue: Performance Standards 2010.A2 and 2450. Standard 2010.A2 addresses the need for internal auditors to establish the expectations of the board and senior management in the planning process. Standard 2450 sets out the requirements for the work internal auditors must do if they wish to provide either an engagement-level or an overall opinion.

There have also been many discussions between service providers and the IIA about the role of external service providers and the challenges they face in conforming to the auditing standards. One issue has been the extent to which an external service provider can be responsible for an organization’s internal auditing.

The generally accepted position related to outsourcing any activity is that an organization can outsource the performance of an activity but cannot outsource responsibility for that activity, and the organization must retain the responsibility for internal auditing, even if it outsources the entire function.

The board provides standards for internal auditors, not for the organization’s management or boards. Therefore, the board is proposing a new Performance Standard 2070, which requires the external provider of internal audit services to make the organization aware that it has the responsibility for maintaining an effective internal audit activity. Other changes involve clarifications of definitions in the glossary.

The board is asking for comment on the proposed revisions and additions. For further information, visit http://www.theiia.org/guidance/standards-and-guidance/2010-Standards-Exposure/.

For reprint and licensing requests for this article, click here.
Audit
MORE FROM ACCOUNTING TODAY