Final exam prep (ch. 2-3, 7 & 9, simulated audit,
three lines of defense reading)
1st line of defense (operational mgt)
mgt controls and internal control measures (senior mgt served; operational managers
own and manage risk, responsible for implementing corrective actions to address
process and control deficiencies
2nd line of defense (risk mgt and compliance functions)
financial control, security, risk mgt, quality, inspections, compliance (senior mgt served)
3rd line of defense (internal audit)
internal audit; beneficial because provides a higher level of independence than the 2nd
lin eof defense (senior mgt and governing body/board/audit committee served)
chapter 2
international professional practices framework (IPPF)
IPPF elements
mission above all; mandatory guidance (core principles, definition, code of ethics, and
standards) and then recommended guidance (implementation guidance, supplemental
guidance)
mission of internal audit
"to enhance and protect organizational value by providing risk-based and objective
assurance, advice, and insight"-- do this through the audit report and must provide
value!!
3 types of activities of IA
1)risk based and objective assurance
2) risk based and objective advice
3) risk based and objective insight
, efficiency and effectiveness?
core prinicples
1- articulate the key elements that describe (in a doc) IA effectiveness and support the
principles based standards and code of ethics
2- are fundamental truths or propositions that serve as the foundation for a system of
belief or behavior or a chain of reasoning
3- taken as a whole, articulate IA effectiveness
4- to be considered effective, all principles should be present and operating effectively
5- how the IA function demonstrates achievement of the principles may be quite
different (wiggle room)
6-failure to achieve any of the principles implies that an IA function was not as effective
as it could be in achieving its mission
they are as follows:
-demonstrates integrity
-demonstrates competence and due professional care
-is objective and free form undue influence (independent)
-aligns w strategies, objectives, and risks of the org (IAs value, mission, and vision
statements should match those of the org)
-is appropriately positioned (important for independence) and adequately resourced
-demonstrates quality and continuous improvement
-communicates effectively
-provides risk based assurance
-insightful, proactive, and future focused (audit plan for next yr)
-promotes org improvement
definition of IA
IA is an independent, objective assurance and consulting activity designed to add
value and improve an org's operations. it helps an org accomplish its objectives by
bringing a systematic, disciplined approach to evaluate and improve the effectiveness
of risk mgt, control and governance processes
three lines of defense reading)
1st line of defense (operational mgt)
mgt controls and internal control measures (senior mgt served; operational managers
own and manage risk, responsible for implementing corrective actions to address
process and control deficiencies
2nd line of defense (risk mgt and compliance functions)
financial control, security, risk mgt, quality, inspections, compliance (senior mgt served)
3rd line of defense (internal audit)
internal audit; beneficial because provides a higher level of independence than the 2nd
lin eof defense (senior mgt and governing body/board/audit committee served)
chapter 2
international professional practices framework (IPPF)
IPPF elements
mission above all; mandatory guidance (core principles, definition, code of ethics, and
standards) and then recommended guidance (implementation guidance, supplemental
guidance)
mission of internal audit
"to enhance and protect organizational value by providing risk-based and objective
assurance, advice, and insight"-- do this through the audit report and must provide
value!!
3 types of activities of IA
1)risk based and objective assurance
2) risk based and objective advice
3) risk based and objective insight
, efficiency and effectiveness?
core prinicples
1- articulate the key elements that describe (in a doc) IA effectiveness and support the
principles based standards and code of ethics
2- are fundamental truths or propositions that serve as the foundation for a system of
belief or behavior or a chain of reasoning
3- taken as a whole, articulate IA effectiveness
4- to be considered effective, all principles should be present and operating effectively
5- how the IA function demonstrates achievement of the principles may be quite
different (wiggle room)
6-failure to achieve any of the principles implies that an IA function was not as effective
as it could be in achieving its mission
they are as follows:
-demonstrates integrity
-demonstrates competence and due professional care
-is objective and free form undue influence (independent)
-aligns w strategies, objectives, and risks of the org (IAs value, mission, and vision
statements should match those of the org)
-is appropriately positioned (important for independence) and adequately resourced
-demonstrates quality and continuous improvement
-communicates effectively
-provides risk based assurance
-insightful, proactive, and future focused (audit plan for next yr)
-promotes org improvement
definition of IA
IA is an independent, objective assurance and consulting activity designed to add
value and improve an org's operations. it helps an org accomplish its objectives by
bringing a systematic, disciplined approach to evaluate and improve the effectiveness
of risk mgt, control and governance processes
