Focusing on Impact Areas — Understanding the Global Internal Audit Standards Updates (Part 2 of 3)

How should you approach the revised Standards?

While the final Standards updates may not be as dramatic as those initially proposed, there are substantive changes CAEs must drive, both within the IA function and within stakeholder relationships, to remain in conformance with the Standards. Additionally, The Institute of Internal Auditors (IIA) Standards Board (“Board”) has advised functions to think of the update as intended to deliver “conformance plus performance”, with improvements in overall quality being the sum of these parts. The Board’s goal to elevate the profession by requiring board-approved performance objectives to propel continuous improvement for the function emphasises their desire to raise the bar for IA. In the aforementioned Part 1, we discussed the IA stakeholders’ collective conclusion on how far along this continuum they wish to push the function beyond simply a “Generally Conforms” conclusion, which most in the profession would acknowledge has been historically relatively easy to attain.

How will the new standards impact the IA function?

While this post is not intended to be a complete summary of the Standards updates or to take the place of a detailed implementation review, we have summarised key areas and themes of change below. Addressing these four areas of change will require additional analysis and documentation. The Governance/Mandate and Internal Audit Strategy areas will require increased stakeholder collaboration, including related to strategic priorities for IA, and formal strategic planning.

Image

The Standards require the board, CAE and senior management to collaborate in more areas, including collectively defining a mandate and performance objectives for the IA function. The Standards also require the board to approve the initial annual audit plan, budget and resource plan, as well as any significant changes to the aforementioned, and the approach to external quality assessment. The updated Standards also call for increased CAE focus on defining the function’s strategic goals and supporting initiatives. We will focus on reviewing this IA function strategy (a historical gap for many IA functions) in further detail in Part 3 of this blog series.

How can the CAE communicate additional actions required from the board and senior management?

Because multiple sections of the revised Standards call for increased collaboration among the CAE, the board and senior management, we have summarised the required and suggested responsibilities of these roles in the table below to clarify ownership, consultation and approval requirements for the governance of the IA function. The CAE can utilise this summary to begin planning for the required adjustments in communication protocols and documentation of formal approvals.

Image

What actions does the CAE need to take?

While the revised standards go into effect in 2025, the time to evaluate, plan for and start transitioning to the needed changes is now. IA needs to set or refine strategic direction, redefine the rules of collaboration and retain more formal documentation. Below are four action steps the CAE can take to advance the implementation now.

Understand

Once the organisation aligns on its approach, the individuals focused on the implementation process should read and digest the applicable Standards changes and create a plan, with defined milestones and ownership, to address adoption of the new Standards, leveraging the function’s quality assurance improvement program if possible. This group should also utilise the educational resources from The IIA and other providers and networking groups to address any questions. The IIA has provided supporting materials as follows:

• Report on Proposed to Final Standards
• Final Standards
• Condensed Mandatory Only Standards
• Getting to Know the Internal Audit Standards

These are great resources that we highly encourage you to take the time to review and digest.

Evaluate

Completing a gap assessment to identify the areas where the current IA function activities and methodologies differ from the Standards will help identify and plan for the layers of change required. Documentation updates will be required simply due to the changes in the structure and organisation of the Standards. Others will require updates to the methodology or the implementation of new procedures altogether. Capturing the level of impact and effort will help prioritise which gaps to address most urgently and inform the timeline for methodology updates in advance of the January 2025 effective date.

Strategise

Take this opportunity to formalise and enhance the IA function’s vision, strategic objectives and supporting initiatives through execution of the following steps:

• Define IA performance objectives with input from senior management and the board.
• Incorporate evaluation of enabling technology into the strategic assessment of the function’s capabilities.
• Refresh the Quality Assurance Improvement Program and refresh or document the external quality of the assessment plan.
• Develop or refine IA methodology to assess the root cause and rate or prioritise findings to address the driver of identified issues and provide actionable guidance to management on required remediation and follow-up.

Establishing or refreshing the IA strategic plan is a great opportunity to engage the full IA team – solicit input, generate excitement and gain alignment on the future of the IA function.

Communicate

Building on the stakeholder collaboration approach outlined in Part 1, begin with agreement on IA’s mandate (the authority, role(s) and responsibilities of IA) and leverage the content in these blog posts to continue discussion of the final revised standards with IA stakeholders. Continuing to educate and take action to address the required collaboration areas in conjunction with the stakeholders will help create and sustain the necessary alignment to achieve the desired results.

Learn more about the Global Internal Audit Standards update by registering for our webinar here.

This is part 2 of a 3 part blog series. Read blog 1 and blog 3 to further understand the Global Internal Audit Standards.