Reactions to the Proposed IIA Standards Changes
May 24, 2023
For the past two years the Internal Audit Standards Board (IASB) has been creating the first major update to the Institute of Internal Audit Standards in over 20 years. A draft of the new Standards was released to the public on March 1, 2023. The 90-day public comment phase will commence May 30, 2023. Details about the new Standards changes and a link to the comment survey are on the IIA’s International Professional Practices Framework (IPPF) Evolution website at: https://www.theiia.org/en/Standards/ippf-evolution/
The Current Standards
The existing IPPF consists of multiple documents and resources, often repetitive and difficult to locate. There is a standalone mission of internal audit, “To enhance and protect organizational value by providing risk‐based and objective assurance, advice, and insight.” Mandatory guidance is divided between Core Principles, Definition of Internal Audit, Code of Ethics, and the Standards. The current Standards are further divided between attribute and performance standards. Additional recommended guidance is provided by Implementation Guidance and Supplemental Guidance.
The existing pieces of the International Professional Practices Framework.
Proposed Changes to the Standards
One of the biggest objectives of the IASB was to consolidate the former fragmented guidance into a single, user-friendly format. The proposed IPPF contains the new Global Internal Audit Standards (“new Standards”) that combines the guidance and is the section that has been released for public comment. The IASB plans to add two additional elements which have not been released yet: Topical Standards, which add more requirements on specific audit topics, and additional guidance on performing engagements.
The proposed IPPF, with Global Internal Audit Standards released for public comment.
The new Global Internal Audit Standards is a 108-page guide organized into five domains that more clearly indicate key roles and responsibilities. Each domain is broken down into different principles, each with its own requirements, considerations for implementation, and evidence of conformance. At first glance it appears the former guidance has merely been rearranged into a logical format, but the changes are in the details. There is a new purpose, new standards, additional mandatory requirements throughout, changes to quality assurance review (QAR) requirements, additional board oversite requirements, and an increased focus on stakeholders and the public interest. The new domains are as follows:
- Domain I: Purpose of Internal Auditing - Contains elements of the current Definition and Mission of Internal Audit.
- Domain II: Ethics and Professionalism - Incorporates and builds upon the current Code of Ethics.
- Domain III: Governing the Internal Audit Function - Focuses on the relationship between the board and the chief audit executive.
- Domain IV: Managing the Internal Audit Function - Focuses on the requirements for the chief audit executive to manage the internal audit function effectively
- Domain V: Performing Internal Audit Services - Focuses on performing assurance and advisory engagements.
ACUA Survey Results
The ACUA Auditing and Accounting Principles sub-committee recently asked members to complete a brief survey about the proposed changes to the IIA Standards. Surveys were completed by 58 members and gathered overall opinions along with open-ended questions about members’ top pros and cons of the changes.
Overall, 74% of respondents generally supported the proposed new Standards. Members appreciated the improved organization and structure of the domains and having one consolidated source of guidance. They cited the improved clarification of roles and responsibilities, especially regarding the chief audit executive (CAE) and audit committees. There was support over the additional standards and specific guidance within each standard. Some members favored additional emphasis on objectivity and professional skepticism, support for the public sector, and stronger requirements for continuing professional education and external assessors. Members also noted the de-emphasis on having separate Standards for assurance versus consulting engagements.
When asked about their top two concerns over the proposed new Standards, 40% of respondents cited the overly prescriptive requirements throughout the document. The number of “musts” and “shoulds” has members wondering if the internal auditing profession is becoming a big administrative checklist rather than one of critical thinking and professional judgment.
The top concerns over specific sections of the new Standards are as follows:
- 59% of respondents took issue of the excessive Board requirements throughout Domain III: Governing the Internal Audit Function. Most question whether the IIA has the authority to mandate specific Board requirements as board members are usually not IIA members and the CAE does not have authority over the board’s actions.
- 41% disagreed with Standard 8.4 External Quality Assurance, which modifies the requirements by mandating an external review be performed every 10 years, instead of a self-assessment with validation, and requires having a Certified Internal Auditor (CIA) on the review team. This is cost-prohibitive and excludes seasoned reviewers who are not CIAs.
- 21% were concerned with Standard 15.1 Final Engagement Communication because it requires findings to be ranked by significance, as rankings are subjective and cause conflict.
- 10% disagreed with elements of the new Domain I: Purpose of Internal Auditing. The purpose statement focuses on “enhancing the organization’s success” and “serving the public interest.” The prior mission statement focused on providing a risk-based independent and objective service. Members believe the emphasis on success and serving the public interest presents a conflict of interest and shift in priorities.
- 10% felt that acknowledgement of bias in Standard 2.1 Individual Objectivity and the statement “Internal auditors must be aware of and manage potential biases” negatively conveys auditors are inherently biased instead of being fair and impartial.
Additional concerns noted as particularly burdensome for the small shops were identified in the following areas:
- Standard 2.2 Safeguarding Objectivity – Small shops felt the requirement that internal auditors must not provide assurance over an activity where they provided advisory services within the last year is too restrictive and limiting.
- Standard 10.2 Human Resource Management – “The CAE must establish a program to recruit, develop, and retain qualified internal auditors” may be overly-burdensome.
- Standard 12.1 Internal Quality Assessment – The suggested alternative for small shops “to consider requesting assistance from others within the organization to conduct periodic assessments, such as former internal auditors or others with suitable knowledge of internal auditing” may not be practical.
- Standard 12.2 Performance Measurement- A new standard aiming to build upon accountability of internal audit to both the board and senior management requires the CAE to develop and report on a performance measurement methodology creates more administrative work.
Next Steps
While ACUA members are generally in favor of the modifications to the Standards, there are many details that members feel the IIA should reevaluate. The Auditing and Accounting Principles sub-committee have presented the survey results to the ACUA Board in preparation for the ACUA formal response to the IIA. The committee also encourages individual members to complete their own response to the IIA if desired at: https://www.theiia.org/en/Standards/Standards-Public-Comment/
After reviewing the public comments and making any modifications, the IIA anticipates releasing the new Standards in late 2023. The new Standards become effective 12 months from the release date in late 2024.
About the Author
Kara Hefner
Kara Hefner, CPA, CIA, CFE is the editor of the College and University Auditor Journal and an audit supervisor at the University of North Carolina, Chapel. Kara has 22 years of internal audit experience, is a frequent speaker...
Read Full Author Bio