Section A: Internal Audit Operations

Domain IV

Managing the Internal Audit Function

According to this, the Chief Audit Executive is responsible for managing the internal audit function in accordance with the internal audit charter and Global Internal Audit Standards. This responsibility includes strategic planning, obtaining and deploying resources, building relationships, communicating with stakeholders, and ensuring and enhancing the performance of the function.

Domain IV: Managing the Internal Audit Function

Management Principle

POLC

1. Planning

2. Organizing

3. Leading

4. Controlling

It includes setting goals, defining policies, and forecasting along with choosing the best actions to achieve the goals.

Planning

It involves building relationships, creating an organizational structure, and assigning human resources to achieve objectives. It also includes designing individual roles within the organization.

Organizing

It involves guiding and motivating subordinates. It also involves the social and informal sources of influence that you use to inspire action taken by others.

Leading

It involves monitoring and evaluating performance against standards to ensure conformity.

Controlling

They are the highest-level body charged with governance, such as:

• A board of directors.

• An audit committee

• A board of governors or trustees.

• A group of elected officials or political appointees.

• Another body that has authority over the relevant governance functions.

The Board

They are the highest level of executive management of an organization that is ultimately accountable to the board for executing the organization’s strategic decisions, typically a group of persons that includes the chief executive officer or head of the organization.

Senior Management

They are the party with a direct or indirect interest in an organization’s activities and outcomes. They may include the board, management, employees, customers, vendors, shareholders, regulatory agencies, financial institutions, external auditors, the public, and others.

Stakeholders

They are the resource from outside the organization that provides relevant knowledge, skills, experience, and/or tools to support internal audit services.

External Service Provider

They are the starting position to internal audit, which performs most of the audit procedures guided by the Work Program or the Audit Program Guide (APG)

Entry-level Internal Auditor

They gained several years of experiences to more senior position, which handles complex audit engagements from the planning stages through to the final reporting stages. May supervise and lead audit teams to complete audit projects.

Lead / Senior Internal Auditor

They have the managerial roles directing the activities of the department, supervising department performance, and communicating audit results to the relevant authorities in the organization.

Internal Audit Supervisor / Manager

They have the leadership roles responsible for effectively managing all aspects of the internal audit function and ensuring the quality performance of internal audit services in accordance with Global Internal Audit Standards.

Chief Audit Executive (CAE) / Head of Internal Audit

Standard 7.2: Chief Audit Executive Qualifications

The CAE must maintain and enhance the qualifications and competencies necessary to fulfill the roles and responsibilities expected by the board, including:

• A comprehensive understanding of the Global Internal Audit Standard and leading internal audit practices.

• Experience building and managing an effective internal audit function by recruiting, hiring, and training internal auditors and helping them develop relevant competencies.

• Certified Internal Auditor designation or other relevant professional education, certifications, and credentials.

• Leadership experience.

• Industry or sector experience

Principle 9:

Plan Strategically

Standard under Principle 9: Plan Strategically

9.1: Understanding Governance, Risk Management, and Control Processes

9.2: Internal Audit Strategy

9.3: Methodologies

9.4: Internal Audit Plan

9.5: Coordination and Reliance

According to Principle 9, they plans strategically to position the internal audit function to fulfill its mandate and achieve long-term success. Planning strategically requires them to understand the internal audit mandate and the organization’s governance, risk management, and control processes.

The Chief Audit Executive

A properly resourced and positioned _________ develops and implements a strategy to support the organization’s success. In addition, the _________ creates and implements methodologies to guide the internal audit function and develop the internal audit plan.

internal audit function, CAE

To develop an effective internal audit strategy and plan, the CAE must understand the organization’s __________, ___________, and ____________.

Governance, Risk Management, and Control Processes

It is an organization’s goal and intended outcome

Objectives

It is the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives.

Governance

It is a process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization’s objectives.

Risk Management

These are the positive or negative effect of uncertainty on objectives.

Risks

These are any action taken by management, the board, and other parties to manage risk and increase the likelihood that established objectives and goals will be achieved.

Controls

These are the policies, procedures, and activities designed and operated to manage risks to be within the level of an organization’s risk tolerance.

Control Processes.

According to Standards 9.2: Internal Audit Strategy: The CAE must develop and implement a strategy for the internal audit function that supports the strategic _______ and _______ of the organization and aligns with expectation of the _______, _______, and other key stakeholders.

objectives, success, board, senior management

It is a plan of action designed to achieve a long-term or overall objective. It must include a vision, strategic objectives and supporting initiatives for the internal audit function. It also helps guide the internal audit function toward the fulfillment of the internal audit mandate.

Internal Audit Strategy

Frequency of the review of internal audit strategy of the CAE must with the board and senior management

Periodically

It describes the desired future state of the internal audit function and provides direction to help the function fulfill its mandate. It is also designed to inspire internal auditors to continuously improve.

Vision

They define achievable targets to attain the vision.

Strategic Objectives

They outline more specific tactics and steps for achieving each strategic objective.

Supporting initiatives

(Vision - strategic objectives - supporting initiatives)

It is a strategic tool used to identify a company’s internal strengths and weaknesses, as well as external opportunities and threats.

SWOT Analysis

It is a tool used to identify the difference between current and desired performance in order to improve business processes.

Gap Analysis

Factors that may prompt a more frequent review of the internal audit strategy include:

• Changes in the organization’s strategy or the maturity of its governance, risk management, and control processes.

• Changes in the organization’s policies and procedures or the laws and/or regulations to which the organization is subject.

• Changes in members of the board, senior management, or the chief audit executive

• Results of internal and external assessments of the internal audit function.

According to Standard 9.3: The CAE must establish __________ to guide the internal audit function in a systematic and disciplined manner to implement the internal audit strategy, develop the internal audit plan, and conform with the Standards.

methodologies

The form, content, level of detail, and degree of documentation of methodologies may differ based on the size, structure, complexity, industry / regulatory expectations, and maturity of the organization and the internal audit function (T/F)

True

Methodologies may exist as individual documents (such as standard operating procedures) or may be collected into an internal audit manual or integrated into internal audit management software (T/F)

True

The effectiveness of the internal audit methodologies should be reviewed during _____.

Assessments of the internal audit function’s quality.

Reasons for updating established methodologies:

Significant changes in:

• professional internal audit standards and guidance;

• legal and/or regulatory requirements;

• technology;

• department size or composition;

• board chairman

Manage Resources:

Domain:

Principles:

Standards:

Domain III: Governing the Internal Audit Function

Principle 8: Overseen by the Board

Standard 8.2: Resources

Principle 10: Manage Resources

Standard 10.1: Financial Resource Management

Standard 10.2: Human Resources Management

Standard 10.3: Technological Resources

According to Standard 8.2: Resources. The CAE must evaluate whether internal audit resources are sufficient to fulfill the internal audit mandate and achieve the internal audit plan. If not, the CAE must develop a strategy to obtain sufficient resources and inform the board about the impact of insufficient resources and how any resource shortfalls will be addressed (T/F)

True

Essential Conditions Board (Resources):

• Collaborate with senior management to provide the internal audit function with sufficient resources to fulfill the internal audit mandate and achieve the internal audit plan.

• Discuss with the CAE, at least annually, the sufficiency, both in numbers and capabilities, of internal audit resources to fulfill the internal audit mandate and achieve the internal audit plan.

• Consider the impact of insufficient resources on the internal audit mandate and plan.

• Engage with senior management and the chief audit executive on remedying the situation if the resources are determined to be insufficient.

Essential Conditions Senior Management (Resources):

• Engage with the Board to provide the internal audit function with sufficient resources to fulfill the internal audit mandate and achieve the internal audit plan.

• Engage with the Board and the CAE on any issues of insufficient resources and how to remedy the situation.

According to this principle, the CAE manages resources to implement the internal audit function’s strategy and achieve its plan and mandate. Managing resources requires obtaining and deploying financial, human, and technological resources effectively. The CAE needs to obtain the resources required to perform internal audit responsibilities and deploy the resources according to the methodologies established for the internal audit function.

Principle 10: Manage Resources

Standards under Principle 10: Manage Resources

10.1: Financial Resource Management

10.2: Human Resources Management

10.3: Technological Resource Management

According to this standard, the CAE must manage the internal audit function’s financial resources. They must develop a budget that enables the successful implementation of the internal audit strategy and achievement of the plan. The budget includes the resources necessary for the function’s operation, including training and acquisition of technology and tools. The CAE must manage the day-to-day activities of the internal audit function effectively and efficiently, in alignment with the budget.

Standard 10.1: Financial Resource Management

The CAE must seek budget approval from the _______. The CAE must communicate promptly the ________ of insufficient financial resources to the board and senior management.

board, impact

According to this standards, the CAE must establish an approach to recruit, develop, and retain internal auditors who are qualified to successfully implement the internal audit strategy and achieve the internal audit plan.

The CAE must strive to ensure that human resources are appropriate, sufficient, and effectively deployed to achieve the approved internal audit plan.

Standard 10.2: Human Resources Management

It refers to the mix of knowledge, skills, and abilities

Appropriateness

It refers to the quantity of resources

Sufficiency

It refers to assigning resources in a way that optimizes the achievement of the internal audit plan.

Effective deployment

The CAE must ensure that the internal audit function individually possesses the competencies to perform the internal audit services described in the internal audit charter or must obtain the necessary competencies (T/F)

False (individually)

These are measurable values that show how effectively a company or individual is achieving key business objectives. These help organizations assess progress toward goals, identify areas for improvement, and guide strategic decisions.

Key Performance Indicators (KPIs)

Effective KPIs are ___________

SMART (specific, measurable, attainable, relevant, and time-bound)

These measure subjective aspects of performance, such as customer satisfaction.

Qualitative Performance Indicators

These measures performance using numerical data, such as sales figures

Quantitative Performance Indicators

It is a strategic management tool used to align business activities with organizational vision and strategy by tracking performance across four perspectives.

Balance Scorecard

Four Perspectives of Balance Scorecard:

1. Financial

2. Customer

3. Internal Processes

4. Learning and Growth

It measures financial performance, such as revenue, profitability, and cost management

Financial

It tracks customer satisfaction, retention, and market share to assess value delivered to customers.

Customer

It monitors operational efficiency and effectiveness in delivering products or services.

Internal Processes

It evaluates employee training, skills development, and innovation to ensure long-term sustainability.

Learning and Growth

The following strategies improve employee motivation, productivity, and satisfaction, while aligning individual roles with organizational goals:

• Job Design

• Job Enrichment

• Job Enlargement

It is the process of structuring tasks, duties, and responsibilities to optimize employee satisfaction and organizational efficiency.

Job Design

It refers to enhancing a job by adding more meaningful tasks and autonomy to increase motivation and job satisfaction.

Job Enrichment

It is expanding a job’s scope by adding more varied tasks at the same level to reduce monotony and increase engagement.

Job Enlargement

Types of Leadership

• Authoritarian or Autocratic Leadership

• Democratic Leadership

• Laisse-faire Leadership

• Transformational Leadership

• Transactional Leadership

It is a style where the leader makes decisions unilaterally without seeking input from team members.

Authoritarian

It involves team members in decision-making processes, encouraging collaboration and input.

Democratic Leadership

It allows team members to work independently with minimal oversight or guidance

Laissez-faire leadership

It motivates and inspires team members by creating a shared vision and focusing on growth and development.

Transformational Leadership

It relies on a system of rewards and punishments to manage team performance

Transactional Leadership

Types of Followers

• Alienated Followers

• Conformists Followers

• Passive Followers

• Pragmatic Followers

• Exemplary Followers

These are independent thinkers who are critical of their leaders and the organization

Alienated followers

These are loyal and comply with orders, often without questioning or offering input

Conformist followers

They require constant direction and motivation from leaders and lack initiative

Passive followers

They adapt to situations, balancing between independent thinking and conforming based on circumstances.

Pragmatic followers

They are proactive, critical thinkers who engage actively and supportively with their leaders and team goals.

Exemplary followers

Types of Power

• Legitimate

• Reward

• Expert

• Referent

• Coercive

• Informational

It is the authority granted by a formal position or role in an organization (e.g., senior management)

Legitimate

It is the ability to provide incentives or benefits to influence other (e.g., performance incentives)

Reward

It is the influence stemming from specialized knowledge or skills (e.g., lawyer, doctor)

Expert

It is derived from personal traits that inspire loyalty or admiration (e.g., charisma, persuasion)

Referent

It is the capability to enforce compliance through threats or punishment (e.g., termination, sanctions)

Coercive

It is the control over access to valuable information that others need (e.g., news, media)

Informational

These are incentives given to individuals to recognize and motivate desired behaviors or achievements.

Rewards

These arise from personal satisfaction, enjoyment, or fulfillment gained from completing a tasks (e.g., sense of achievement)

Intrinsic rewards

These are external incentives like money, recognition, or tangible benefits provided by others. (e.g., bonuses)

Extrinsic rewards

According to this standard, the CAE must strive to ensure that the internal audit function has technology to support the internal audit process. The CAE must regularly evaluate the technology used by the internal audit function and pursue opportunities to improve effectiveness and efficiency.

When implementing new technology, the CAE must implement appropriate training for internal auditors in the effective use of technological resources properly.

The CAE must communicate the impact of technology limitations on the effectiveness or efficiency of the internal audit function to the board and senior management

Standard 10.3: Technological Resources

Building Relationships and Communicating with Stakeholders:

Domain:

Principle:

Standards:

Domain III: Governing the Internal Audit Function

Principle 6: Authorized by the Board

Standard 6.3: Board and Senior Management Support

Principle 8: Overseen by the Board

Standard 8.1: Board Interaction

Domain IV: Managing the Internal Audit Function

Principle 11: Communicate Effectively

Standard: 11.1: Building Relationships and Communicating with Stakeholders

According to this Principle, the CAE guides the internal audit function to communicate effectively with its stakeholders.

Principle 11: Communicate Effectively

According to Principle 11: Communicate Effectively, effective communication requires building _________, establishing ________, and enabling stakeholders to benefit from the __________ of internal audit services.

relationships, trust, results

According to this Standard, the CAE must provide the board and senior management with the information needed to support and promote the recognition of the internal audit function throughout the organization.

The CAE must coordinate the internal audit function’s board communication with senior management to support the board’s ability to fulfill its requirements.

The CAE should work with senior management to understand each other’s reporting requirements to the board to help enable timely, clear, and transparent reporting that is not redundant or conflicting.

This helps the board exercise its oversight responsibilities and enables a collaborative working relationship between the CAE and senior management

The board’s approval of the internal audit budget and resources plan is important as these demonstrate that the internal audit function has the resources necessary to complete its planned audit activities. The details provided to the board are subject o the judgment of the CAE.

Standard 6.3: Board and Senior Management Support

According to this Standard, the CAE must provide the board with the information needed to conduct its oversight responsibilities. This information may be specifically requested by the board or may be, in the judgment of the CAE, valuable for the board to exercise its oversight responsibilities,

Standard 8.1: Board Interaction

The Chief Audit Executive must report to the board and senior management:

• The internal audit plan and budget and subsequent significant revisions to them.

• Changes potentially affecting the mandate or charter.

• Potential impairments to independence.

• Results of internal audit services, including conclusions, themes, assurance, advice, insights, and monitoring results.

• Results from the quality assurance and improvement program.

According to this Standard, the CAE must develop an approach for the internal audit function to build relationships and trust with key stakeholders, including the board, senior management, operational management, regulators, and internal and external assurance providers and other consultants.

Standard 11.1: Building Relationships and Communicating with Stakeholders

The CAE must promote formal and informal communication between the internal audit function and stakeholders, contributing to the mutual understanding of:

• Organizational interests and concerns.

• Approaches for identifying and managing risks and providing assurance.

• Roles and responsibilities of relevant parties and opportunities for collaboration.

• Relevant regulatory requirements.

• Significant organizational processes, including financial reporting

Communication should include opportunities for ongoing, informal interaction between internal auditors and the organization’s employees. When informal interactions occur consistently, employees gain trust in internal auditors, increasing the likelihood of candid discussions that may not occur in formal meetings (T/F)

True