PPA FEB UI

Part 1
Study Unit 1
Foundations of Internal
Auditing
 Topics

1.1. Applicable Guidance

1.2 Codes of Ethical Conduct for Professional

1.3 Internal Audit Ethics – Introduction and Principles

PPA FEB UI
1.4 Internal Audit Ethics – Integrity

1.5 Internal Audit Ethics – Objectivity

1.6 Internal Audit Ethics – Confidentiality

1.7 Internal Audit Ethics – Competency

1.8 Internal Audit Charter

2
 CIA Exam Syllabus

PPA FEB UI

3
International Professional Practices Framework (IPPF)

PPA FEB UI

4
 1.1 Applicable Guidance - Mission of Internal Audit

MISSION

To enhance and protect organizational value by providing risk-

based and objective assurance, advice, and insight.

PPA FEB UI

5
 1.1 Applicable Guidance - Mandatory Guidance

CORE PRINCIPLES

1. Demonstrates integrity.
2. Demonstrates competence and due professional care.
3. Is objective and free from undue influence (independent).
4. Aligns with the strategies, objectives, and risks of the

PPA FEB UI
organization.
5. Is appropriately positioned and adequately resourced.
6. Demonstrates quality and continuous improvement.
7. Communicates effectively.
8. Provides risk-based assurance.
9. Is insightful, proactive, and future-focused.
10. Promotes organizational improvement.

6
 1.1 Applicable Guidance - Mandatory Guidance

DEFINITION OF
INTERNAL AUDITING

Internal auditing is an independent, objective assurance and consulting

activity designed to add value and improve an organization's
operations. It helps an organization accomplish its objectives by

PPA FEB UI
bringing a systematic, disciplined approach to evaluate and improve the
effectiveness of risk management, control, and governance processes.

7
 1.1 Applicable Guidance - Mandatory Guidance

STANDARDS

The Standards are a set of principles-based, mandatory requirements consisting of:

• Statements of core requirements for the professional practice of internal auditing
and for evaluating the effectiveness of performance that are internationally
applicable at organizational and individual levels.
• Interpretations clarifying terms or concepts within the Standards.

PPA FEB UI Purpose of the

Standards
1. Guide adherence with the mandatory elements of the International
Professional Practices Framework.
2. Provide a framework for performing and promoting a broad range of value-
added internal auditing services.
3. Establish the basis for the evaluation of internal audit performance.
4. Foster improved organizational processes and operations.

8
 1.1 Applicable Guidance - Mandatory Guidance

Standards

Numbered in the 1000s, Numbered in the

address the attributes of Attribute Performance 2000s, describe the

PPA FEB UI
organizations and Standards Standards nature of internal
individuals performing auditing and provide
internal auditing. quality criteria
against which the
performance of these
Implementation Implementation services can be
Standards Standards measured.

expand upon the Attribute or Performance Standards by providing the

requirements applicable to assurance (.A) or consulting (.C) services.

9
 1.1 Applicable Guidance – Strongly Recommended Guidance

Implementation Guides assist internal auditors in

IMPLEMENTATION applying the Standards. They collectively address
GUIDANCE internal auditing's approach, methodologies, and
consideration, but do not detail processes or
procedures

PPA FEB UI Supplemental Guidance provides detailed guidance

for conducting internal audit activities. These include
SUPPLEMENTAL topical areas, sector-specific issues, as well as
GUIDANCE processes and procedures, tools and techniques,
programs, step-by-step approaches, and examples of
deliverables.

10
1.1 Applicable Guidance - Purpose, Authority, and Responsibility of the Internal Audit
Activity
PURPOSE

• to provide "independent, objective assurance and consulting services

designed to add value and improve an organization's operations.
• helps an organization accomplish its objectives by bringing a systematic,
disciplined approach to evaluate and improve the effectiveness of
governance, risk management and control processes.”

PPA FEB UI
Assurance services

• An objective examination of evidence for the purpose of providing

an independent assessment on governance, risk management, and
control processes for the organization.

Consulting services

• Activities intended to add value and improve an organization’s

governance, risk management, and control processes without the
internal auditor assuming management responsibility.

11
1.1 Applicable Guidance - Purpose, Authority, and Responsibility of the Internal Audit
Activity

ASSURANCE CONSULTING

determined by the internal subject to agreement with

Nature of Scope
auditor the engagement client

Three parties:

PPA FEB UI
Two parties:
Participants (1) Process owner (1) Internal auditor
(2) Internal auditor (2) Engagement client
(3) User (i.e. the person or
group using the
assessment)

Performing financial, Providing counsel, advice,

Examples of activities facilitation, and training
performance, compliance,
system security, and due
diligence engagements

12
1.1 Applicable Guidance - Purpose, Authority, and Responsibility of the Internal Audit
Activity

AUTHORITY
• the internal audit activity should be empowered to require auditees to
grant access to all records, personnel, and physical properties relevant
to the performance of every engagement.
• A formal charter for the internal audit activity that defines the internal
audit activity's purpose, authority, and responsibility must be adopted,

PPA FEB UI
and it should contain a grant of sufficient authority. Final approval of
the charter resides with the board.

RESPONSIBILITY

• to provide the organization with assurance and consulting services that

will add value and improve the organization's operations.
• Specifically, the internal audit activity must evaluate and improve the
effectiveness of the organization's governance, risk management, and
control processes.

13
 1.1 Applicable Guidance

1. Which Standards expand upon the other categories of Standards?

A. Performance Standards.
B. Attribute Standards.

PPA FEB UI
C. Implementation Standards.
D. All of the choices are correct.

14
 1.1 Applicable Guidance

Required: The Standards that expand upon other Standards.

Discussion: Implementation Standards expand upon the Attribute
and Performance Standards. They provide requirements applicable to
assurance or consulting engagements.

PPA FEB UI
Answer A : Incorrect. Performance Standards apply to all internal
audit services.
Answer B : Incorrect. Attribute Standards apply to all internal audit
services.
Answer D : Incorrect. Only Implementation Standards expand upon
the standards in other categories.
C
15
 1.1 Applicable Guidance

2. The purpose of the internal audit activity can be best described as

A. Adding value to the organization.
B. Providing additional assurance regarding fair presentation of
financial statements.
C. Expressing an opinion on the adequate design and functioning

PPA FEB UI
of the system of internal control.
D. Assuring the absence of any fraud that would materially affect
the financial statements.

16
 1.1 Applicable Guidance

Required: The best description of the internal audit activity.

Discussion: Internal auditing is an independent, objective assurance
and consulting activity designed to add value and improve an
organization's operations (Definition of Internal Auditing).

PPA FEB UI A

17
 1.1 Applicable Guidance

3. The Standards consist of three types of Standards. Which

Standards apply to the characteristics of providers of internal
auditing services?
A. Implementation Standards.
B. Performance Standards.

PPA FEB UI
C. Attribute Standards.
D. Independence Standards.

18
 1.1 Applicable Guidance

Required: The Standards describing the traits of entities and

individuals providing internal auditing services.
Discussion: Attribute Standards describe the characteristics of
organizations and parties providing internal auditing services.

PPA FEB UI
Answer A : Incorrect. Implementation Standards apply to specific
types of engagements.
Answer B : Incorrect. Performance Standards describe the nature of
internal auditing and provide quality criteria for evaluation of internal
audit performance.
Answer D : Incorrect. The IPPF does not contain Independence
Standards.
C
19
 1.2 Codes of Ethical Conduct For Professionals

Reasons for Codes of Ethical Conduct

• To promote an ethical culture among professionals who serve

others.

PPA FEB UI
• Additional purposes:
• Communicating acceptable values to all members
• Establishing objective standards against which individuals
can measure their own performance
• Communicating the organization’s values to outsiders

20
 1.2 Codes of Ethical Conduct For Professionals

Aspects of Codes of Ethical Conduct

• The mere existence of a code of ethical conduct does not ensure that its
principles are followed or that those outside the organization will believe that
it is trustworthy. A measure of the cohesion and professionalism of an

PPA FEB UI
organization is the degree of voluntary compliance with its adopted code.
• A code of ethical conduct worded so as to reduce the likelihood of members
being sued for substandard work would not earn the confidence of the
public.
• A code of ethical conduct can help establish minimum standards of
competence, but it is impossible to require equality of competence by all
members of a profession.
• To enhance its effectiveness, the code should provide for disciplinary action
for violators.

21
 1.2 Codes of Ethical Conduct For Professionals

Typical Components of a Code of Ethical Conduct

• A refusal to compromise professional values for personal gain.

Integrity Another facet of integrity is performance of professional
duties in accordance with relevant laws.

• A commitment to providing stakeholders with unbiased

PPA FEB UI
information. Another face of objectivity is a commitment to
Objectivity independence from conflicts of economic or professional
interest.

Confidentiality • A refusal to use organizational information for private gain.

• A commitment to acquiring and maintaining an appropriate

Competency level of knowledge and skill.

22
 1.2 Codes of Ethical Conduct for Professionals

4. A formal code of ethics should do all of the following except

A. Effectively communicate acceptable values to all members.
B. Communicate the organization's value system to outsiders.
C. Reflect only legal standards of conduct for individuals and the
organization.

PPA FEB UI
D. Provide a method of policing and disciplining members of the
organization for violations.

23
 1.2 Codes of Ethical Conduct for Professionals

Required: The item not a function of a code of ethics.

Discussion: An ethical organization aspires to a higher standard of
behavior than mere legality.

Answer A : Incorrect. A code of ethics should effectively

PPA FEB UI
communicate acceptable values to all organization members.
Answer B : Incorrect. A code of ethics should communicate the
organization's value system to those outside the organization.
Answer D : Incorrect. A code of ethics should indeed provide a
method of policing and disciplining members for violations.

C
24
 1.2 Codes of Ethical Conduct for Professionals

5. A typical code of ethical conduct for financial managers or

management accountants in an organization requires all of the
following except
A. Integrity and a refusal to compromise professional values for
the sake of personal goals.

PPA FEB UI
B. Independence from conflicts of economic interest.
C. Independence from conflicts of professional interest.
D. Subjectivity in presenting information, preparing reports, and
making analyses.

25
 1.2 Codes of Ethical Conduct for Professionals

Required: The item not a requirement of a code of ethical conduct for financial
managers.
Discussion: The code of ethical conduct for financial managers or management
accountants in an organization should require objectivity in presenting
information, preparing reports, and making analyses.
D
PPA FEB UI
Answer A : Incorrect. A typical code of ethical conduct for financial managers or
management accountants in an organization requires integrity and a refusal to
compromise professional values for the sake of personal goals.
Answer B : Incorrect. A typical code of ethical conduct for financial managers or
management accountants requires independence from conflicts of economic
interest.
Answer C : Incorrect. A typical code of ethical conduct for financial managers
or management accountants requires independence from conflicts of
professional interest.
26
 1.2 Codes of Ethical Conduct for Professionals

6. Objectivity is an ethical requirement for all persons engaged in

the professional practice of internal auditing. One aspect of
objectivity requires
A. Performance of professional duties in accordance with
relevant laws.

PPA FEB UI
B. Avoidance of conflict of interest.
C. Refraining from using confidential information for unethical or
illegal advantage.
D. Maintenance of an appropriate level of professional expertise.

27
 1.2 Codes of Ethical Conduct for Professionals

Required: The aspect of the objectivity requirement.

Discussion: Commitment to independence from conflicts of
economic or professional interest is an aspect of objectivity.

Answer A : Incorrect. Observing the law is a component of integrity.

PPA FEB UI
Answer C : Incorrect. Not using confidential information for unethical
or illegal advantage is an aspect of confidentiality.
Answer D : Incorrect. Maintenance of an appropriate level of
professional expertise is an aspect of competency.

B
28
 1.3 Internal Audit Ethics – Introduction

The IIA’s Code of Ethics

• is necessary and appropriate for the profession of internal auditing,
founded as it is on the trust placed in its objective assurance about
governance, risk management, and control.
• extends beyond the Definition of Internal Auditing to include two
essential components:

PPA FEB UI
• Principles that are relevant to the profession and practice of internal
auditing.
• Rules of Conduct that describe behavior norms expected of internal
auditors. These rules are an aid to interpreting the Principles into
practical applications and are intended to guide the ethical conduct
of internal auditors.

"Internal auditors" refers to Institute members, recipients of or candidates for IIA

professional certifications, and those who perform internal audit services within
the Definition of Internal Auditing.

29
 1.3 Internal Audit Ethics - Applicability

• The provisions of the Code of Ethics are applied broadly to all

organizations and persons who perform internal audit services, not
just CIAs and members of The IIA.

Applicability and Enforcement of The Code of Ethics

• The Code of Ethics applies to both entities and individuals that perform internal

PPA FEB UI
audit services.
• For IIA members and recipients of or candidates for IIA professional
certifications, breaches of the Code of Ethics will be evaluated and administered
according to The Institute's Bylaws and administrative Directives.
• The fact that a particular conduct is not mentioned the Rules of Conduct does
not prevent it from being unacceptable or discreditable, and therefore, the
member, certification holder, or candidate can be liable for disciplinary action.

• Violations of rules of ethics should be reported to The IIA's board of

directors.

30
 1.3 Internal Audit Ethics - Principles
Rules of Conduct in the Code are organized based on the principles:
Integrity
• establishes trust and thus provides the basis for reliance on their judgment.

Objectivity
• exhibit the highest kevel of professional objectivity in gathering, evaluating, and

PPA FEB UI
communicating information about the activity or process being examined.
• make a balance assessment of all the relevant circumstances and are not unduly
influenced by their own interests or by others in forming judgments.

Confidentiality
• respect the value and ownerships of information they receive and do not disclose
information without appropriate authority unless there is a legal or professional
obligation to do so.

Competency
• apply the knowledge, skills, and experience needed in the performance of internal
audit services.

31
 1.3 Internal Audit Ethics - Introduction and Principles

7. In complying with The IIA's Code of Ethics, an internal auditor

should
A. Use individual judgment in the application of the principles set
forth in the Code.
B. Respect and contribute to the objectives of the organization

PPA FEB UI
even if it is engaged in illegal activities.
C. Go beyond the limitation of personal technical skills to
advance the interest of the organization.
D. Primarily apply the competency principle in establishing trust.

32
 1.3 Internal Audit Ethics - Introduction and Principles

Required: The action complying with The IIA's Code of Ethics.

Discussion: The IIA's Code of Ethics includes principles that internal
auditors are expected to apply and uphold. They are interpreted by
the Rules of Conduct, behavior norms expected of internal auditors.
That a particular conduct is not mentioned in the Rules of Conduct

PPA FEB UI
does not prevent it from being unacceptable or discreditable.
Consequently, a reasonable inference is that individual judgment is
necessary in the application of the principles and the Rules of
Conduct.
A

33
 1.3 Internal Audit Ethics - Introduction and Principles

Answer B : Incorrect. An internal auditor "shall not knowingly be a

party to any illegal activity." Furthermore, an internal auditor is
bound to respect and contribute only to the legitimate and ethical
objectives of the organization.
Answer C : Incorrect. Internal auditors "shall engage only in those

PPA FEB UI
services for which they have the necessary knowledge, skills, and
experience."
Answer D : Incorrect. Applying and upholding the integrity principle
is the means by which an internal auditor establishes trust as a basis
for reliance on his or her judgment.

A
34
 1.3 Internal Audit Ethics - Introduction and Principles

8. An internal auditor who encounters an ethical dilemma not

explicitly addressed by The IIA's Code of Ethics should always
A. Seek counsel from an independent attorney to determine the
personal consequences of potential actions.
B. Take action consistent with the principles embodied in The

PPA FEB UI
IIA's Code of Ethics.
C. Seek the counsel of the audit committee before deciding on
an action.
D. Act consistently with the employing organization's code of
ethics even if such action would not be consistent with The
IIA's Code of Ethics.

35
 1.3 Internal Audit Ethics - Introduction and Principles

Required: The action that must be taken by an internal auditor

regarding an ethical dilemma not explicitly addressed by The IIA's
Code of Ethics.
Discussion: The IIA's Code of Ethics is based on principles relevant to
the profession and practice of internal auditing that internal auditors

PPA FEB UI
are expected to apply and uphold: integrity, objectivity,
confidentiality, and competency. Furthermore, the Code states that
particular conduct may be unacceptable or discreditable even if it is
not mentioned in the Rules of Conduct.

36
 1.3 Internal Audit Ethics - Introduction and Principles

Answer A : Incorrect. The auditor must act consistently with the spirit
of The IIA's Code of Ethics. It is not practical to seek the advice of
legal counsel for all ethical decisions. Moreover, unethical behavior
may not be illegal.
Answer C : Incorrect. It is not feasible to seek the audit committee's

PPA FEB UI
advice for all potential dilemmas. Furthermore, the advice might not
be consistent with the profession's standards.
Answer D : Incorrect. If the organization's standards are not
consistent with, or as high as, the profession's standards, the internal
auditor should abide by the latter.

B
37
 1.4 Internal Audit Ethics - Integrity
Rules of Conduct - Integrity
Internal auditors:
1.1 Shall perform their work with honesty, diligence, and responsibility.
1.2 Shall observe the law and make disclosures expected by the law and the
profession.
1.3 Shall not knowingly be a party to any illegal activity, or engage in acts that are
discreditable to the profession of internal auditing or to the organization.
1.4 Shall respect and contribute to the legitimate and ethical objectives of the

PPA FEB UI
organization

EXAMPLE
An internal auditor is working for a cosmetics manufacturer that may be
inappropriately testing cosmetics on animals. If, out of loyalty to the employer, no
information about the testing is gathered, the auditor violated the Rules of
Conduct by:
1. Knowingly becoming a party, to an illegal act,
2. Engaging in an act discreditable to the profession,
3. Failing to make disclosures expected by the law, and
4. Not performing the work diligently.

38
 1.4 Internal Audit Ethics - Integrity

9. Which situation is most likely a violation of The IIA's Code of

Ethics?
A. Reporting apparent violations of antitrust statutes by officers
to government regulators.
B. Cooperating with the government's criminal investigation of

PPA FEB UI
the organization.
C. Reporting apparent violations of antitrust statutes by officers
to the board of directors.
D. Immediately reporting a violent crime observed at work to
local law enforcement agencies.

39
 1.4 Internal Audit Ethics - Integrity

Required: The violation of the The IIA's Code of Ethics.

Discussion: An internal auditor must (1) not knowingly be a party to
any illegal activity (Rule of Conduct 1.3); (2) disclose all material facts
known to him or her that, if not disclosed, might distort the reporting
of activities under review (Rule of Conduct 2.3); and (3) respect and

PPA FEB UI
contribute to the legitimate and ethical objectives of the organization
(Rule of Conduct 1.4). Thus, when apparent violations of antitrust
statutes by officers come to the internal auditor's attention, (s)he
should report to the board of directors rather than directly to the
government regulators. An internal auditor also must observe the law
and make any disclosures required by the law or by the profession
(Rule of Conduct 1.2).
A
40
 1.4 Internal Audit Ethics - Integrity

Answer B : Incorrect. Everyone has a legal obligation to cooperate

with a criminal investigation. An internal auditor must observe the
law and make any disclosures required by the law or by the
profession (Rule of Conduct 1.2).
Answer C : Incorrect. An internal auditor should report apparent

PPA FEB UI
improprieties to the board.
Answer D : Incorrect. Everyone has a legal and moral obligation to
report violent crimes immediately.
A

41
 1.4 Internal Audit Ethics - Integrity

10. The IIA's Code of Ethics requires internal auditors to perform their
work with
A. Honesty, diligence, and responsibility.
B. Timeliness, sobriety, and clarity.
C. Knowledge, skills, and competencies.

PPA FEB UI
D. Punctuality, objectivity, and responsibility.

42
 1.4 Internal Audit Ethics - Integrity

Required: The qualities internal auditors should exhibit in the

performance of their work.
Discussion: Rule of Conduct 1.1 under the integrity principle states,
"Internal auditors shall perform their work with honesty, diligence,
and responsibility."

PPA FEB UI
Answer B : Incorrect. Timeliness, sobriety, and clarity are not
mentioned in the Code.
Answer C : Incorrect. Knowledge, skills, and competencies are
mentioned in the Standards.
Answer D : Incorrect. Punctuality is not mentioned in the Code.

A
43
 1.5 Internal Audit Ethics - Objectivity

Rules of Conduct - Objectivity

Internal auditors:
2.1 Shall not participate in any activity or relationship that may impair or be
presumed to impair their unbiased assessment. This participation includes those
activities or relationships that may be in conflict with the interests of the
organization.
2.2 Shall not accept anything that may impair or be presumed to impair their

PPA FEB UI
professional judgment.
2.3 Shall disclose all material facts known to them that, if not disclosed, may distort
the reporting of activities under review.

EXAMPLE
a. If management override of an important control creates exposure to a material risk,
the internal auditor is ethically obligated to report the matter to senior officials
charged with performing the governance function.
b. An internal auditor cannot assure anonymity. Information communicated to an
internal auditor is not deemed to be privileged.

44
 1.5 Internal Audit Ethics - Objectivity

Conflict of Interest Policy

A conflict of interest policy should
1. Prohibit the transfer of benefits between an employee and those with whom the
organization deals.
2. Prohibit the use of organizational information for private gain.

PPA FEB UI
EXAMPLE
At the end of the year, an internal auditing team made observations and recommendations that
an organization can use to improve operating efficiency. To express gratitude, the division
manager presented the internal audit team with a gift of moderate value. The internal audit
team meets to discuss whether to accept the gift. The following reasons for accepting or not
accepting the gift were discussed:
• One auditor said, "we should accept the gift because its value is insignificant.“
• Another auditor said; "we should not accept the gift until after we submit our final
engagement communication."
• The lead auditor considered the opinions of the other auditors and the intent of the Rules of
Conduct. The lead auditor then decided that acceptance of the gift would be inappropriate
because of the presumed impairment of the internal auditor’s professional judgment.

45
 1.5 Internal Audit Ethics - Objectivity

11. Which of the following concurrent occupations could appear to

subvert the ethical behavior of an internal auditor?
A. Internal auditor and a well-known charitable organization's
local in-house chairperson.
B. Internal auditor and part-time business insurance broker.

PPA FEB UI
C. Internal auditor and adjunct faculty member of a local
business college that educates potential employees.
D. Internal auditor and landlord of multiple housing that publicly
advertises for tenants in a local community newspaper listing
monthly rental fees.

46
 1.5 Internal Audit Ethics - Objectivity

B
Required: The concurrent occupations that could create an ethical issue.
Discussion: Rule of Conduct 2.1 under the objectivity principle states,
"Internal auditors shall not participate in any activity or relationship that
may impair or be presumed to impair their unbiased assessment. This
participation includes those activities or relationships that may be in

PPA FEB UI
conflict with the interests of the organization." As a business insurance
broker, the internal auditor may lose his or her objectivity because (s)he
might benefit from a change in the employer's insurance coverage.

Answer A : Incorrect. The activities of a charity are unlikely to be

contrary to the interests of the organization.
Answer C : Incorrect. Teaching is compatible with internal auditing.
Answer D : Incorrect. Whereas dealing in commercial properties might
involve a conflict, renting residential units most likely does not.
47
 1.5 Internal Audit Ethics - Objectivity

12. Which of the following activities of an internal auditor is most

likely to be acceptable under The IIA's Code of Ethics?
A. Late arrivals and early departures from work because this
practice is common in the organization.
B. Frequent luncheons and other socializing with major suppliers

PPA FEB UI
of the organization without the consent of senior
management.
C. Conducting an unrelated business outside of office hours.
D. Acceptance of a material gift from a supplier.

48
 1.5 Internal Audit Ethics - Objectivity

Required: The acceptable activity under The IIA's Code of Ethics.

C
Discussion: Nothing in The IIA's Code of Ethics prohibits operating an unrelated
business outside of regular office hours. The activity is not, in itself, (1) a
conflict of interest, (2) a use of information for personal gain, or (3) an
impairment of the internal auditor's unbiased assessment.

PPA FEB UI
Answer A : Incorrect. Internal auditors should exercise diligence in performing
their duties.
Answer B : Incorrect. Rule of Conduct 2.1 under the objectivity principle states,
"Internal auditors shall not participate in any activity or relationship that may
impair or be presumed to impair their unbiased assessment. This participation
includes those activities or relationships that may be in conflict with the
interests of the organization."
Answer D : Incorrect. Rule of Conduct 2.2 under the objectivity principle
states, "Internal auditors shall not accept anything that may impair or be
presumed to impair their professional judgment."
49
 1.5 Internal Audit Ethics - Objectivity

13. In their reporting, internal auditors are required by The IIA's Code
of Ethics to
A. Present sufficient factual information without revealing
confidential matters that could be detrimental to the
organization.

PPA FEB UI
B. Disclose all material information obtained by the auditor as of
the date of the final engagement communication.
C. Obtain factual information within the established time and
budget parameters.
D. Disclose material facts known to the internal auditor that
could distort the final engagement communication if not
revealed.

50
 1.5 Internal Audit Ethics - Objectivity

D
Required: The reporting responsibility under The IIA’s Code of Ethics.
Discussion: Rule of Conduct 2.3 under the objectivity principle states,
"Internal auditors shall disclose all material facts known to them that,
if not disclosed, may distort the reporting of activities under review.“

PPA FEB UI
Answer A : Incorrect. The Code requires only that internal auditors be
prudent in the use and protection of information.
Answer B : Incorrect. The Code does not address disclosure this
specifically.
Answer C : Incorrect. Time and budget parameters are not addressed
in the Code.

51
 1.5 Internal Audit Ethics - Objectivity

14. In their communication of results, internal auditors are required

by The IIA's Code of Ethics to
A. Obtain factual information within the established time and
budget parameters.
B. Reveal material facts that could distort communications if not

PPA FEB UI
revealed.
C. Present sufficient factual information without revealing
confidential information that could be detrimental to the
organization.
D. Disclose all material information obtained as of the date of the
final engagement communication.

52
 1.5 Internal Audit Ethics - Objectivity
Required: The requirement for internal auditors in their
communication of results.
Discussion: Internal auditors should disclose all material facts known
to them that, if not disclosed, may distort the reporting of activities
under review (Rule of Conduct 2.3).
B
PPA FEB UI
Answer A : Incorrect. Obtaining information pertains to performing
the engagement, not communicating results.
Answer C : Incorrect. The Code of Ethics does not prohibit
communicating confidential information to appropriate parties within
the organization, e.g. senior management and the board.
Answer D : Incorrect. Disclosures by the internal auditors are not
limited to information obtained as of the date of the final
engagement communication.
53
 1.5 Internal Audit Ethics - Objectivity
15. Which of the following situations is a violation of The IIA's Code of
Ethics?
A. An internal auditor, with the knowledge and consent of
management, accepted a token gift from a customer of the
organization that was not presumed to impair and did not
impair judgment.

PPA FEB UI
B. Knowing that management was aware of the situation, an
internal auditor purposely left a description of an unlawful
practice out of the final engagement communication.
C. An internal auditor shared techniques with internal auditors
from another organization.
D. Based upon knowledge of the probable success of the
employer's business, an internal auditor invested in a mutual
fund that specialized in the same industry.
54
 1.5 Internal Audit Ethics - Objectivity

Required: The violation of the Code of Ethics.

B
Discussion: Rule of Conduct 2.3 under the objectivity principle states, "Internal
auditors shall disclose all material facts known to them that, if not disclosed, may
distort the reporting of activities under review." Moreover, Rule of Conduct 1.3
under the integrity principle states, "Internal auditors shall not knowingly be a
party to any illegal activity, or engage in acts that are discreditable to the profession

PPA FEB UI
of internal auditing or to the organization.“

Answer A : Incorrect. Acceptance of anything from a customer is prohibited but

only if it would impair or be presumed to impair professional judgment.
Answer C : Incorrect. Rule of Conduct 4.3 under the competency principle states,
"Internal auditors shall continually improve their proficiency and the effectiveness
and quality of their services."
Answer D : Incorrect. Although an internal auditor is prohibited from using
confidential information for personal gain, and an investment in the organization's
stock would be questionable, an investment in a mutual fund is acceptable.
55
 1.6 Internal Audit Ethics - Confidentiality
Rules of Conduct - Confidentiality

Internal auditors:
1. Shall be prudent in the use and protection of information acquired in the
course of their duties.
2. Shall not use information for any personal gain or in any manner that
would be contrary to the law or detrimental to the legitimate and ethical
objectives of the organization.

PPA FEB UI EXAMPLE

Which of the following violate(s) The IIA's Code of Ethics?
• Investigating a lead sales person's expense reports based on rumors of overstatement.
Investigating potential instances of fraud is within the internal auditor's normal responsibilities.
It is not a violation.
• Purchasing stock in a target organization after reading reports that it may be acquired.
Rule of Conduct 3.2 states, "Internal auditors shall not use information for any personal gain."
The stock purchase is a violation. ·
• Disclosing confidential information In response to a court order.
The principle of confidentiality permits the disclosure of confidential information given a legal
or professional obligation to do so. This disclosure is not a violation.

56
 1.6 Internal Audit Ethics - Confidentiality

16. Which of the following actions taken by a chief audit executive

(CAE) could be considered professionally ethical under The IIA's
Code of Ethics?
A. The CAE decides to delay an engagement at a branch so that
his nephew, the branch manager, will have time to "clean
things up."

PPA FEB UI
B. To save organizational resources, the CAE cancels all staff
training for the next 2 years on the basis that all staff are too
new to benefit from training.
C. To save organizational resources, the CAE limits procedures at
foreign branches to confirmations from branch managers that
no major personnel changes have occurred.
D. The CAE refuses to provide information about organizational
operations to his father, who is a part owner.
57
 1.6 Internal Audit Ethics - Confidentiality

Required: The action considered ethical under The IIA's Code of

Ethics.
Discussion: Rule of Conduct 3.1 under the confidentiality principle
states, "Internal auditors shall be prudent in the use and protection of
information acquired in the course of their duties." Additionally, Rule

PPA FEB UI
of Conduct 3.2 states, "Internal auditors shall not use information for
any personal gain or in any manner that would be contrary to the law
or detrimental to the legitimate and ethical objectives of the
organization." Thus, such use of information by the CAE might be
illegal under insider trading rules.

D
58
 1.6 Internal Audit Ethics - Confidentiality

Answer A : Incorrect. According to Rule of Conduct 1.1, "Internal

auditors shall perform their work with honesty, diligence, and
responsibility."
Answer B : Incorrect. According to Rule of Conduct 4.3, "Internal
auditors shall continually improve their proficiency and the

PPA FEB UI
effectiveness and quality of their services."
Answer C : Incorrect. According to Rule of Conduct 4.2, "Internal
auditors shall perform internal audit services in accordance with the
International Standards for the Professional Practice of Internal
Auditing (Standards)." The Standards require supporting information
to be sufficient, reliable, relevant, and useful.
D
59
 1.6 Internal Audit Ethics - Confidentiality

17. An internal auditor is performing services in a division in which

the chief financial officer is a close personal friend, and the
internal auditor learns that the friend is to be replaced after a
series of critical labor negotiations. The internal auditor relays this
information to the friend. Has a violation of The IIA's Code of
Ethics occurred?

PPA FEB UI
A. No. The use of the confidential information resulted in no
personal gain to the internal auditor.
B. No. The internal auditor was just being honest with his or her
friend.
C. Yes. The internal auditor had a conflict of interest with the
organization.
D. Yes. The internal auditor was not prudent in the use of
information acquired in the course of his or her duties.
60
 1.6 Internal Audit Ethics - Confidentiality

Required: The basis for the violation, if any, of The IIA's Code of
Ethics.
Discussion: Rule of Conduct 3.1 under the confidentiality principle
states, "Internal auditors shall be prudent in the use and protection of
information acquired in the course of their duties." Rule of Conduct

PPA FEB UI
3.2 states, "Internal auditors shall not use information for any
personal gain or in any manner that would be contrary to the law or
detrimental to the legitimate and ethical objectives of the
organization." In this case, the decision whether to notify the
financial officer of his or her replacement was properly the
organization's. Accordingly, the internal auditor was bound not to tell
his or her friend.
D
61
 1.6 Internal Audit Ethics - Confidentiality

Answer A : Incorrect. The Rules of Conduct specifically prohibit using

information in a manner that would be detrimental to the legitimate
and ethical objectives of the organization.
Answer B : Incorrect. The Rules of Conduct specifically prohibit using
information in a manner that would be detrimental to the legitimate

PPA FEB UI
and ethical objectives of the organization.
Answer C : Incorrect. The facts do not suggest that a conflict of
interest existed. However, such a conflict would be present, for
example, if the internal auditor used confidential information to seize
a business opportunity that rightfully belonged to the organization.

D
62
 1.7 Internal Audit Ethics - Competency
Rules of Conduct - Competency
Internal auditors:
3.1 Shall engage only in those services for which they have the necessary knowledge,
skills, and experience.
3.2 Shall perform internal audit services in accordance with the International Standards
for the Professional Practice of Internal Auditing (Standards).
3.3 Shall continually improve their proficiency and the effectiveness and quality of

PPA FEB UI
their services.

EXAMPLE
Which of the following violate(s) The IIA's Code of Ethics?
• After obtaining evidence that an employee is embezzling funds, the internal auditor interrogates
the suspect. The organization has a security department.
Internal auditors generally lack the knowledge, skills, or experience regarding interrogation of
suspects possessed by security specialists. The lack of proficiency most likely is a violation.
• An internal auditor has been assigned to perform an engagement the warehousing department
next year. The auditor currently has no expertise in this area but accepted the assignment and
plans to take continuing professional education courses in warehousing.
The internal auditor plans to acquire the required knowledge and' skills prior to the start of this
engagement. The internal auditor most likely did not violate the Code of Ethics.

63
 1.7 Internal Audit Ethics - Competency
18. Which of the following most likely constitutes a violation of The IIA's Code of Ethics?
A. Auditor A has accepted an assignment to perform an engagement at the
electronics manufacturing division. Auditor A has recently joined the internal
audit activity. But Auditor A was senior auditor for the external audit of that
division and has audited many electronics organizations during the past 2 years.
B. Auditor B has been assigned to perform an engagement at the warehousing
function 6 months from now. Auditor B has no expertise in that area but

PPA FEB UI
accepted the assignment anyway. Auditor B has signed up for continuing
professional education courses in warehousing that will be completed before
the assignment begins.
C. Auditor C is content as an internal auditor and has come to look at it as a
regular 9-to-5 job. Auditor C has not engaged in continuing professional
education or other activities to improve effectiveness during the last 3 years.
However, Auditor C feels performance of quality work is the same as before.
D. Auditor D discovered an internal financial fraud during the year. The books
were adjusted to properly reflect the loss associated with the fraud. Auditor D
discussed the fraud with the external auditor when the external auditor
reviewed working papers detailing the incident.2
64
 1.7 Internal Audit Ethics - Competency

Required: The violation of The IIA's Code of Ethics. C

Discussion: Rule of Conduct 4.3 under the competency principle states,
"Internal auditors shall continually improve their proficiency and the
effectiveness and quality of their services.“

PPA FEB UI
Answer A : Incorrect. No professional conflict of interest exists per se,
especially given that the internal auditor was previously in public accounting.
However, the internal auditor should be aware of potential conflicts.
Answer B : Incorrect. An internal auditor must possess the necessary
knowledge, skills, and competencies at the time an engagement is conducted,
not the time it is accepted.
Answer D : Incorrect. The information was disclosed as part of the normal
process of cooperation between the internal and external auditor. Because the
books were adjusted, the external auditor was expected to inquire as to the
nature of the adjustment.
65
 1.7 Internal Audit Ethics - Competency

19. Under The IIA’s Code of Ethics, an entity that provides internal
auditing services is specifically required to
A. Maintain certain predetermining staffing requirements for
engagements.
B. Comply with the International Standards for the Professional

PPA FEB UI
Practice of Internal Auditing.
C. Comply with organizational policy.
D. Participate in a formal continuing education program.

66
 1.7 Internal Audit Ethics - Competency

Required: The requirement of The IIA’s Code of Ethics.

B
Discussion: The IIA’s Code of Ethics applies not only to individual but
also to entities that provide internal auditing services. Rule of
Conduct 4.2 under the competency principle states, “Internal auditors
shall perform internal audit services in accordance with the

PPA FEB UI
International Standards for the Professional Practice of Internal
Auditing.”

67
 1.7 Internal Audit Ethics - Competency

Answer A : Incorrect. Staffing requirements must be determined

based on the circumstances of each engagement.
Answer C : Incorrect. The Code requires internal auditors to respect
and contribute to the legitimate and ethical objectives of the
organization. However, the Code does not specifically mention

PPA FEB UI
compliance with organizational policy.
Answer D : Incorrect. The Code requires compliance with the
Standards, and the Standards require internal auditors to enhance
their knowledge, skills, and other competencies through continuing
professional development, but neither the Code nor the Standards
require formal continuing education.
B
68
 1.7 Internal Audit Ethics - Competency

20. A new staff internal auditor was told to perform an engagement in an

area with which the internal auditor was not familiar. Because of time
constraints, no supervision was provided. The assignment represented a
good learning experience, but the area was clearly beyond the internal
auditor’s competence. Nonetheless, the internal auditor prepared
comprehensive working papers and communicated the results to

PPA FEB UI
management. In this situation
A. The internal audit activity violated the Standards by hiring an
internal auditor without proficiency in the area .
B. The internal audit activity violated the Standards by not providing
adequate supervision.
C. The chief audit executive has not violated The IIA’s Code of Ethics
because it does not address supervision.
D. The Standards and The IIA’s Code of Ethics were followed by the
internal audit activity.
69
 1.7 Internal Audit Ethics - Competency
Required: The effect of failing to supervise an internal auditor who lacks
proficiency in the area of the engagement.
Discussion: Rule of Conduct 4.2 under the competency principle requires
internal auditing services to be performed in accordance with the
Standards. Attribute Standard 1200 requires engagements to be performed
with proficiency and due professional care. They also should be properly

PPA FEB UI
supervised to ensure that objectives are achieved, quality is assured, and
staff is developed (Performance Standard 2340).
B
Answer A : Incorrect. All internal auditors need not be proficient in all areas.
The internal audit activity as a whole should have an appropriate mix of
skills.
Answer C : Incorrect. The Code requires compliance with the Standards,
and the Standards require proper supervision.
Answer D : Incorrect. The Standards and the Code were not followed.
70
 1.8 Internal Audit Charter

Attribute Standard 1000

Purpose, Authority, and Responsibility

• The purpose, authority, and responsibility of the internal audit

activity must be formally defined in an internal audit charter,

PPA FEB UI
consistent with the Mission of Internal Audit and the
mandatory elements of the International Professional Practices
Framework (the Core Principles for the Professional Practice
of Internal Auditing , the Code of Ethics, the Standards, and
the Definition of Internal Auditing).
• The chief audit executive must periodically review the internal
audit charter and present it to senior management and the
board for approval.

71
 1.8 Internal Audit Charter

Interpretation of Standard 1000

• The internal audit charter is a formal document that defines the internal
audit activity's purpose, authority, and responsibility.
• The internal audit charter:
1. establishes the internal audit activity's position within the
organization, including the nature of the chief audit executive's
functional reporting relationship with the board;

PPA FEB UI
2. authorizes access to records, personnel, and physical properties
relevant to the performance of engagements; and
3. defines the scope of internal audit activities.
• Final approval of the internal audit charter resides with the board.

• An auditee must not be able to place a scope limitation on the internal audit activity
by refusing to make relevant records, personnel, and physical properties available to
the internal auditors.
• Engagement clients must be informed of the internal audit activity's purpose,
authority, and responsibility to prevent misunderstandings about access to records
and personnel.

72
 1.8 Internal Audit Charter
IG 1000, Purpose, Authority, and Responsibility, further address the charter:
1) "To create [the internal audit charter], the chief audit executive (CAE) must
understand the Mission of Internal Audit and the mandatory elements of
The IIA's International Professional Practices Framework (IPPF) - including
the Core Principles for the Professional Practice of Internal Auditing, the Code
of Ethics, the International Standards for the Professional Practice of Internal
Auditing, and the Definition of Internal Auditing.
2) This understanding provides the foundation for a discussion among the CAE,

PPA FEB UI
senior management, and the board to mutually agree upon:
a) Internal audit objectives and responsibilities.
b) The expectations for the internal audit activity.
c) The CAE's functional and administrative reporting lines.
d) The level of authority (including access to records, physical property, and
personnel) required for the internal audit activity to perform
engagements and fulfill its agreed-upon objectives and responsibilities.
3) The CAE may need to confer with the organization's legal counsel or the
board secretary regarding the preferred format for charters and how to
effectively and efficiently submit the proposed internal audit charter for
board approval.

73
 1.8 Internal Audit Charter

4) Once drafted, the proposed internal audit charter should be discussed with
senior management and the board to confirm that it accurately describes
the agreed-upon role and expectations or to identify desired changes. Once
the draft has been accepted, the CAE formally presents it during a board
meeting to be discussed and approve.
5) The minutes of the board meetings during which the CAE initially discusses

PPA FEB UI
and then formally presents the internal audit charter provide documentation
of conformance. In addition, the CAE retains the approved charter."

74
74
 1.8 Internal Audit Charter

• The charter must define the nature of assurance and consulting services
provided by the internal audit activity.

Implementation Standard 1000.A1

• The nature of assurance services provided to the organization must

PPA FEB UI
be defined in the internal audit charter. If assurances are to be
provided to parties outside the organization, the nature of these
assurances must also be defined in the internal audit charter.
Implementation Standard 1000.C1
• The nature of consulting services must be defined in the internal
audit charter.

75
 1.8 Internal Audit Charter

• The charter must also refer to the mandatory guidance portion of the
IPPF.

Attribute Standard 1010

Recognizing Mandatory Guidance in the Internal Audit Charter

PPA FEB UI
• The mandatory nature of the Core Principles for the Professional
Practice of Internal Auditing, the Code of Ethics, the Standards,
and the Definition of Internal Auditing must be recognized in the
internal audit charter.
• The chief audit executive should discuss the Mission of Internal
Audit and the mandatory elements of the International Professional
Practices Framework with senior management and the board.

76
 1.8 Internal Audit Charter
Key Definitions from the Glossary
Chief audit executive (CAE)
• describes the role of a person in a senior position responsible for effectively
managing the internal audit activity in accordance with the internal audit
charter and the mandatory elements of the International Professional
Practices Framework.
• The CAE, or others reporting to the CAE, will have appropriate professional
certifications and qualifications.

PPA FEB UI
• The specific job title of the CAE may vary across organizations.
Board
• is the highest level governing body, (e.g., a board of directors; a supervisory
board; or a board of governors or trustees) charged with the responsibility to
direct and/or oversee the organization's activities and hold senior
management accountable.
• Although governance arrangements vary among jurisdictions and sectors,
typically the board includes members who are not part of management. If a
board does not exist, the word "board" in the Standards refers to a group or
person charged with governance of the organization. Furthermore, "board"
in the Standards may refer to a committee or another body to which the
governing body has delegated certain functions (e.g., an audit committee).

77
 1.8 Internal Audit Charter

21. The authority of the internal audit activity is limited to that

granted by
A. The board and the controller.
B. Senior management and the Standards.
C. Management and the board.

PPA FEB UI
D. The board and the chief financial officer.

78
 1.8 Internal Audit Charter

Required: The source of authority of the internal audit activity.

C
Discussion: The purpose, authority, and responsibility of the internal
audit activity must be formally defined in a charter. The CAE must
periodically review and present the charter to senior management
and the board for approval (Attr. Std. 1000).

PPA FEB UI
Answer A : Incorrect. The controller is not the only member of
management.
Answer B : Incorrect. The Standards cannot provide actual authority
to an internal audit activity.
Answer D : Incorrect. Management and the board, not a particular
manager, give the internal audit activity its authority.

79
 1.8 Internal Audit Charter

22. The chief audit executive (CAE) is best defined as the

A. Inspector general.
B. Person responsible for the internal audit function.
C. Outside provider of internal audit services.

PPA FEB UI
D. Person responsible for overseeing the contract with the
outside provider of internal audit services.

80
 1.8 Internal Audit Charter

Required: The best definition of the CAE.

B
Discussion: The CAE is a person in a senior position responsible for
effectively managing the internal audit activity in accordance with the
internal audit charter and the mandatory elements of the IPPF (The
IIA Glossary).

PPA FEB UI
Answer A : Incorrect. The specific job title of the chief audit executive
may vary across organizations (The IIA Glossary).
Answer C : Incorrect. The internal audit activity may be insourced.
Answer D : Incorrect. The term "chief audit executive" is defined
broadly because (1) the internal audit activity may be insourced or
outsourced and (2) many different titles are used in practice.

81
 1.8 Internal Audit Charter

23. Which one of the following must be included in the internal audit
charter?
A. Internal audit objectivity.
B. Internal audit responsibility.
C. Chief audit executive's compensation plan.

PPA FEB UI
D. Number of full-time internal audit employees deemed to be
the necessary minimum.

82
 1.8 Internal Audit Charter

Required: The item required to be included in the internal audit

charter.
Discussion: The purpose, authority, and responsibility of the internal
audit activity must be formally defined in an internal audit charter.

PPA FEB UI
Answer A : Incorrect. Objectivity is an attribute of individual auditors
and is not included in the internal audit charter.
Answer C : Incorrect. The CAE's compensation plan is not an
appropriate matter to include in the internal audit charter.
Answer D : Incorrect. The staffing of the internal audit activity is
determined by the CAE and the board; it is not an appropriate matter
to include in the internal audit charter.
B
83
 1.8 Internal Audit Charter

24. The chief audit executive meets with the members of the internal
audit activity at scheduled staff meetings. Which of the following
is the most appropriate function of such a staff meeting?
A. Developing the engagement work schedule.
B. Revising travel, promotion, and compensation policies.

PPA FEB UI
C. Explaining administrative policies and obtaining suggestions
from the staff.
D. Developing long-range training programs that will meet the
staff's needs.

84
 1.8 Internal Audit Charter

C
Required: The most appropriate activity at an audit staff meeting.
Discussion: One reason for staff meetings is to explain routine
administrative matters, to teach new techniques, and even to let off
steam. For example, staff members should be able to raise questions
about ineffective procedures, promotions, salaries, or other

PPA FEB UI
problems.

Answer A : Incorrect. Management of the internal audit activity

should develop engagement work schedules.
Answer B : Incorrect. Management of the internal audit activity
should revise travel, promotion, and compensation policies.
Answer D : Incorrect. Developing long-range training programs that
will meet the staff's needs should be done by management of the
internal audit activity.
85
 Hak Cipta © 2020 PPA FEB UI

PPA SALEMBA
Gedung PPA UI
Universitas Indonesia
Jl. Salemba Raya No. 4
Jakarta Pusat 10430
Telp : 021-391-7279

Terimakasih Fax : 021-390-8967

PPA FEB UI
PPA DEPOK
Gedung Departemen Akuntansi Lt. 1
Fakultas Ekonomi dan Bisnis
Universitas Indonesia
Depok 16424
Telp : 021-78886407
Fax : 021-78849169

Web : www.ppa-feui.com
Email : [email protected]
Instagram : ppafebui
Facebook : ppafebui
Twitter : @ppafebui
PUSAT PENGEMBANGAN AKUNTANSI
FAKULTAS EKONOMI DAN BISNIS
UNIVERSITAS INDONESIA