The Institute of Internal Auditing is in the process of updating its International Professional Practices Framework (IPPF), which includes the International Standards for the Professional Practice of Internal Auditing.
It is necessary, as some in the profession need a kick.
A friend recently told me that they connected with audit leaders at peer organizations (other mid to large, complex organizations) to understand how long/large their audits typically are. They perform cyclical audits of auditable entities (an audit universe) that last up to 12 weeks.
So cyclical audits are alive and well, even though the practice should have died off decades ago.
Also alive and well are long audits of an entire process or business unit.
Too few are taking a risk-based approach to internal auditing.
Audit the controls over the risks, not entire business processes!
Don’t waste your or management’s time auditing more than you need to provide the assurance, advice, and insight management and the board need.
I have asked the IIA to use the opportunity of the IPPF update to jolt people out of these poor practices.
They replied, “That is our goal too, business objective-based and risk-based audit”.
Excellent!
Let’s have a quick look at what the IIA currently says about the role of internal audit.
The Definition of…
