IIA's proposed standards changes urge internal audit leaders and boards to further safeguard objectivity
When The Institute of Internal Auditors proposed changes to its professional practice standards last month, it included new guidance for chief audit executives on measures they should take to safeguard their independence and objectivity when the job takes them outside the realm of traditional audit duties.
The proposal is both an acknowledgement of the evolving role of internal audit and the department's leaders inside companies, as well as the realization of the need for some better protections against the possibility that internal audit leaders drink the Kool-Aid of "results at all costs," or become compromised by other conflicts.
The IIA is advising internal auditors to conduct period evaluations of their own potential to lose objectivity or to at least consider that safeguards are in place in their organizations. It includes looking at reporting lines and job responsibilities and possibly putting alternative plans to place to provide assurance on the areas they are or have advised on, such as using an outside firm.
The proposed edition to the IIA professional standards reads:
“The chief audit executive may be asked to take on additional roles and responsibilities outside of internal auditing, such as responsibility for compliance or risk management activities. These roles and responsibilities may impair, or appear to impair, the organizational independence of the internal audit activity, or the individual objectivity of the internal auditor. Safeguards are those oversight activities, often undertaken by the board, to address these potential impairments, and may include such activities as periodically evaluating reporting lines and responsibilities, and developing alternative processes to obtain assurance related to the areas of additional responsibility.”
Just how realistic the proposed safeguards are is debatable. Clearly, it can be difficult for practitioners to judge their own objectivity. It’s hard to imagine most professionals coming to a realization that he or she has become too cozy with individuals responsible for processes or projects on which the internal auditor needs to provide objective assessments. It’s human nature to consider ourselves objective, even when our judgement us clouded. Perhaps this is why the IIA has added the phrase “often undertaken by the board.”
No Independence Requirement
The IIA isn’t suggesting that internal auditors avoid all conflicts that could arise from internal auditors advising on processes only to provide assurance on them later—as have been established for external auditors. For small internal audit departments this would be extremely difficult. Most internal audit experts insist that leveraging internal audit’s skills outside the traditional finance and regulatory assurance is a positive development, even while they worry about the potential for lost objectivity.
“Internal audit may provide assurance services where they had previously performed consulting services provided the nature of the consulting did not impair objectivity, and provided individual objectivity is managed when assigning resources to the engagement,” the proposed language reads.
It will be interesting to see the comments on the proposed changes to the professional standards (Due to IIA by April 30). I suspect the question of how best to safeguard against the loss of objectivity and independent will be hotly debated topic in those responses.