Managing an Internal Audit Function

Develop a risk-based internal audit plan from a strategic risk assessment to an annual plan, prioritizing by year and securing management and audit committee feedback.

The chief audit executive sets a risk-based internal audit plan rooted in a documented annual risk assessment and an audit universe, with mandatory consultation with senior management and the board.

Explore how auditing shifts from control- and process-based methods to risk-based approaches aligned with organizational and audit maturity, including reliance on internal assurance and enterprise risk management.

Apply assurance mapping to visualize assurance activities across risks and departments, color-code inherent and residual risk, and gauge internal and external audit coverage for comprehensive mitigation.

Communicate significant risk exposures and governance weaknesses to senior management and the board. Present internal audit plans, KPIs, and residual risk against the risk appetite to show value and assurance.

Explore how the balanced scorecard for internal audit KPIs organizes metrics across financial, customer, processes, and learning and growth, including budget, satisfaction, process effectiveness, and impact of recommendations.

Define what would make internal audit effective, align KPIs with value and business goals, and monitor and report results to senior management and the board.

Assess governance, support risk management, and maintain effective controls across processes. Promote continuous improvement of the control environment and reinforce ethical standards and risk management.

Internal auditors identify and evaluate significant risks, events that could hinder goals, and help improve risk management and internal controls for management, the audit committee, and the board.

Internal auditors assess and improve governance, risk management, and controls, delivering risk-based assurance, advice, and insight to the board, while coordinating with external assurance to avoid duplication and uphold independence.

Learn the core principles of internal auditing, including integrity, independence, and objectivity, and how to align with strategy, be adequately resourced, communicate effectively, and provide risk-based assurance, driving organizational improvement.

Explore the international professional practices framework for internal auditing, including mandatory and recommended guidance, core principles, definitions, standards, code of ethics, and guidance shaping CIA exam prep.

Outlines the institute of internal auditors' attribute and performance standards and explains how they apply to internal auditors, audit functions, and outsourced providers in governance, risk management, and controls.

Explore organizational independence as the freedom of the internal audit activity to operate without threats, and how it drives auditor objectivity across reporting lines and audit processes.

Define the ideal internal audit reporting structure, including shareholders or stakeholders, reports functionally to the board and audit committee, and administratively to the ceo, highlighting independent board members.

Maintain internal audit independence by granting the chief audit executive unrestricted access to the board and independent directors' contacts, and report annually on organizational independence to the board.

Maintain control over the scope and performance of internal audits without management interference. Demonstrate independence in reporting, resisting management influence, and negotiating audit timing with the audit committee.

Ensure functional reporting with a board-approved charter, plans, and budget, upholding independence; the board approves the chief audit executive's appointment, removal, remuneration, and direct board–CAE communication, using IIA templates.

Explain administrative reporting and dotted line relationships with senior management, contrast with functional reporting, and show how audits interact with budgeting, HR administration, invoices, and internal communication.

Strengthen organizational independence by aligning reporting lines with the board or audit committee, clarifying the internal audit charter, and maintaining objective adherence to the code of ethics.

Establish an internal audit charter to ensure independence, unfettered access, and clear reporting lines to the audit committee and board, with defined scope and periodic board-approved reviews per IIA standards.

Explore the four fundamental principles of the code of ethics—integrity, objectivity, confidentiality, and competency—and how honesty, diligence, responsibility, and disclosures, including conflicts of interest, shape internal audit ethics.

Define objectivity as an unbiased mental attitude essential to internal audits, linking independence to objective judgments, and require auditors to avoid conflicts, disclose material facts, and seek independent reviews.

Safeguard confidentiality and use information prudently in internal audits, avoiding personal gain and insider trading; learn to handle confidential disclosures, whistleblowing, and legal counsel without promising anonymity.

Internal auditors build competency by applying only services within their knowledge, skill, and experience, pursuing training plans with senior guidance, and performing work in accordance with internal audit standards.

Apply due professional care and proficiency as a competent internal auditor. Conform to standards that address significant risks, objectives, governance, staffing, and the use of computer assisted audit techniques.

Identify, assess, and document significant risks through a formal risk inventory and discussions with leadership, ensuring due professional care and comprehensive coverage in internal audits.

Proficiency arises from knowledge, skills, and competencies guiding internal audits; standards require auditors to possess and develop these abilities, seek training, and decide on external resources when budgets constrain.

The chief audit executive ensures sufficient, appropriate, and effectively used resources after planning the audit plan. Explore staffing options such as in-house, outsourcing, and secondment while maintaining independence and ethics.

Develop and maintain a mandatory quality assurance and improvement program for internal audit, including internal and external assessments by qualified external assessors, ongoing monitoring, and reporting to board and management.