2 Professionalism in Internal Auditing Professionalism in any endeavor connotes status, commitment, and credibility.

The business community has come to expect a high degree of professionalism from internal auditors. This expectation arises from what is becoming a tradition of excellence in the profession. Many internal auditors and their managers have made significant efforts to set and maintain high standards for the profession and to establish internal auditing as a key function in the successful operation of their organizations. Professionalism in internal auditing may be considered at three levels: 1. The profession in general. 2. Internal auditing departments. 3. Individual practitioners. At its broadest level, The Institute of Internal Auditors (IIA) has led the way in promoting professionalism for the practice of internal auditing, and continues to do so. At the same time, organizations require a high degree of professionalism from their internal auditing departments and individual auditors. Consequently, people who go into internal auditing must maintain high personal standards of conduct and performance in order to meet the expectations of the profession in general and the demands of specific organizations. This chapter will help you understand the importance of each of these three levels in the continuing development and maintenance of professionalism in internal auditing. Actions by The Institute of Internal Auditors The IIA has taken four important steps in promoting a hig degree of professionalism among internal auditors and thei departments in organizations around the world. The Institut has adopted: 1. A Statement of Responsibilities or Internal Auditing. 2. Standards for the Professional Practice of Internal Audi: ing. 3. A Code of Ethics for internal auditors. 4. A program of auditor certification. Each of these actions was taken in an effort to encourage th best possible performance of the internal auditing function b competent individuals of high integrity, using sound principles Unlike similar actions taken by the American Institute c Certified Public Accountants (AICPA'\. these steps are not le gaily binding upon professional internal auditors. Federal an. state laws uphold the licensing and :he practice of public ac counting. Some states and state audi: eroups have enacted law adopting The IIA's Standards for the:: state auditors, but th provisions arc restricted to governmental auditors tor thos states.

The guidance offered by The IIA represents strong profes sional encouragement. Consequently, The IIA uses variou: methods of persuasion and education to establish and main tain a state of the art for internal auditing that will adequateh serve the demands being made on the profession. As a result 0 these efforts, many organizations have formally adopted Thi IIA's Standards and the Code of Ethics as policy. The following discussion outlines each of the four steps taker by The IIA to promote professionalism among internal audi tors, their departments, and individual practitioners. Statement of Responsibilities The Statement of Responsibilities of Internal Auditing ha? been changed several times since it was first drafted in 1947 Its overall purpose remains unchanged, however, and that is tc establish a set of guidelines defining the proper role and re sponsibilities of the internal auditing function within organi zations. This document, shown in Exhibit 2-1, presents a more concise, practical statement than the conceptual discussion given in the previous chapter. The Statement serves as a general foundation upon which to establish charters for internal auditing departments, and formally outlines their role and authority in their respective organizations. This Statement covers three topics: 1. The objective and scope of internal auditing. 2. The responsibility and authority given the internal auditing function. 3. The independence of the function. Exhibit 2-1 Statement of Responsibilities of Internal Auditing The purpose of this statement is to provide in summary form a general understanding of the responsibilities of internal auditing. For more specific guidance, readers should refer to the Standards for the Professional Practice of Internal Auditing. OBJECTIVE AND SCOPE Internal auditing is an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization. The objective of internal auditing is to assist members of the organization in the effective discharge of their responsibilities. To this end, internal auditing furnishes them with analyses, appraisals, recommendations, counsel, and information concerning the activities reviewed. The audit objective includes promoting effective control at reasonable cost. The members of the organization assisted by internal auditing include those in management and the board of directors.,

The scope of internal auditing should encompass the examination and evaluation of the adequacy and effectiveness of the organization's system of internal control and the quality of performance in .carrying out assigned responsibilities. Internal auditors should: Review the reliability and integrity of financial and operating information and the means used to identify, measure, classify, and report such information. Review the systems established to ensure compliance with those policies, plans, procedures, laws, and regulations which could have a significant impact on operations and reports, and should determine whether the organization is in compliance. Review the means of safeguarding assets and, as appropriate, verify the existence of such assets. Appraise the economy and efficiency with which resources are employed. Review operations or programs to ascertain whether results are consistent with established objectives and goals and whether the operations or programs are being carried out as planned. RESPONSIBILITY AND AUTHORITY The internal auditing department is an integral part of the organization and functions under the policies established by senior management and the board. The purpose, authority, and responsibility of the internal auditing department should be defined in a forma" written document (charter). The director of internal auditing shoulc seek approval of the charter by senior management as well as ac ceptance by the board. The charter should make clear the purpose: of the internal auditing department, specify the unrestricted scope of its work, and declare that auditors are to have no authority o responsibility for the activities they audit. Throughout the world internal auditing is performed in divers environments and within organizations which vary in purpose, siz; and structure. In addition, the laws and customs within variot countries differ from one another. These differences may affect th practice of internal auditing in each environment. The implement; tion of the Standards for the Professional Practice of Internal At ditirig, therefore, will be governed by the environment in which tl internal auditing department carries put its assigned responsibi; ties.. Compliance with the concepts enunciated by the Standan for the Professional Practice of Internal Auditing is essential b fore the responsibilities of internal auditors can be met. As stated the Code of Ethics, members of The Institute of Internal Auditors, Inc. and Certified Internal Auditors shall adopt suitable means to comply with the Standards for the Professional Practice of Internal Auditing. INDEPENDENCE Internal auditors should be independent of the activities they audit. Internal auditors are independent when they can carry out their work freely and objectively. Independence permits internal auditors to render the impartial and unbiased judgments essential to the proper conduct of audits. It is achieved through organizational status and objectivity. The organizational status of the internal auditing department should be sufficient to permit the accomplishment of its audit responsibilities. The director of the internal auditing department should be

responsible to an individual in the organization with sufficient authority to promote independence and to ensure a broad audit coverage, adequate consideration of audit reports, and appropriate action on audit recommendations. Objectivity is an independent mental attitude which internal auditors should maintain in performing audits. Internal auditors are not to subordinate their judgment on audit matters to that of others. Designing, installing, and operating systems are not audit functions. Also, the drafting of procedures for systems is not an audit function. Performing such activities is presumed to impair audit objectivity. The Statement of Responsibilities of Internal Auditing was originally issued by The Institute of Internal Auditors in 1947. The current Statement, revised in 1990, embodies the concepts previously established and includes such changes as are deemed advisable in light of the present status of the profession. Let's examine the provisions related to each of the three topics. Objective and Scope. The Statement of Responsibilities of Internal Auditing states the nature of internal auditing as follows: Internal auditing is an independent appraisal function established within an organization to examine and evaluate its activities as a service to the organization. The activity of internal auditing is described as an "independent appraisal." The nature of that appraisal is as an examination and evaluation of (1) the adequacy (i.e., the design), and (2) the operational efficiency and effectiveness of the control system. The parameters of the internal auditing function would include tests of the control system to determine if it is operating as designed. Although an evaluation of controls is appropriate, the parameters of internal auditing responsibilities do not include either the design or the implementation of controls. As an illustration of this Statement, it would be appropriate for the internal auditors of an organization to test whether the personnel department is complying with a prescribed procedure to contact previous employers of job applicants, to evaluate whether the procedure is designed to acquire the desired information, and even whether the procedure is necessary as an effective control device. The Statement does not suggest that the internal auditors should design the procedure and be responsible for implementing or for managing the department. Notice that independence is specified as a necessary condition for the establishment of the internal auditing function within an organization. This aspect of the function is so important that the third section of the Statement of Responsibilities of Internal Auditing addresses that issue solely. The Statement of the objective and scope of the internal auditing function continues to read as follows: The objective of internal auditing is to assist members of the organization in the effective discharge of their responsibilities. To this end, internal auditing furnishes them with analysis, appraisals, recommendations, counsel, and information concerning the activities reviewed. The audit objective

includes pro-vmoting effective control at reasonable cost. The members of the organization assisted by internal auditing include those in management and the board of directors. The scope of internal auditing should encompass the examination and evaluation of the adequacy and effectiveness of the organization's system of internal control and the quality of performance in carrying out assigned responsibilities. Internal auditors should: Review the reliability and the integrity of financial and operating information and the means used to identify, measure, classify, and report such information. Review the systems established to ensure compliance with those policies, plans, procedures, laws, and regulations which could have a significant impact on operations and reports, and should determine whether the organization is in compliance. Review the means of safeguarding assets and, as appropriate, verify the existence of such assets. Appraise the economy and efficiency with which resources are employed. Review operations or programs to ascertain whether results are consistent with established objectives and goals and whether the operations or programs are being carried out as planned. These paragraphs provide a kind of "target" for internal auditing activities. The target is described in terms of an overall objective, the range of internal auditing activity, and the areas and functions of the organization where internal auditing takes place. The objective is broad, providing for general assistance to various members of the organization and aiming specifically at their success in meeting their assigned responsibilities. The assistance may take any of several forms, as outlined in the Statement, and should be directed to two key concerns. First, internal auditing should be concerned with effective control. Second, internal auditing should aim at cost-effective control. Some control measures may cost more than they are worth, and therefore could be counterproductive. The scope of internal auditing, according to the Statement, has two dimensions: (1) what internal auditors do and (2) where they do it. What internal auditors do is examine and evaluate. What they examine and evaluate is the organization's system of internal controls, the quality of various functions, and employees' performance related to specifically assigned responsibilities. In the case of examining and evaluating performance, the internal auditing department restricts the scope of its coverage to specific responsibilities that are assigned to individuals or to their respective units within the organization. The internal auditing department examines and evaluates performance, comparing the actual performance to plans, specified activities, standards, objectives, policies, and goals. This evaluation of performance is actually a review of controls, since plans, specified activities, standards, objectives, policies, and goals are actually a part of the control system. This review is used as a part of the more general management performance evaluation. Internal auditing reports are used in this process, but the responsibility of internal auditing may not necessarily extend into the "softer" evaluations for which there may not be specified criteria with which

to compare actual performance. This particular aspect of internal auditing responsibility involves a differentiation between auditing and management appraisal. The key to fulfilling this responsibility successfully is to remain objective and independent of the decision process, which is the domain of administrative and operational management. On the occasions when auditors are required to examine areas that do not have formal, specified performance criteria, the auditors may be forced to compare actual performance to industry averages or standards, or to performance of similar organizations. It is important for the auditors to seek out measurable criteria those specifying a quantifiable measure and make recommendations. The decision on what to do about deviations from those criteria will be determined by management. In performing audits, those measurements taken from external sources, and any comparisons with them, should be scrutinized carefully, because the organization may not bear theiSame characteristics as the organizations for which the external measurements were computed. Often the stated goals and objectives of top management are helpful to the auditor in making such comparisons. The Statement also says the internal auditors should scrutinize the control over the organization's assets. This scrutiny helps management protect the organization's property from losses due to fire, theft, improper use, nonproductive use, and exposure to natural elements. The Statement goes on to include an appraisal by internal auditors of how well the organization's resources are being managed. At this point, the prescribed scope of the internal auditing function includes a more general appraisal ot management's performance. By evaluating the economy and the efficiency of the use of the organization's resources, the internal auditing function is, in fact, appraising management itself, since management is responsible for the use of those resources. This in itself is not contradictory to theory, but such a general evaluation may not show comparisons of actual performance with prescribed standards, because standards of efficiency and economical operations may not be available. The evaluation may, in fact, be more of a judgment call based on business and professional knowledge and experience. Where operating standards are available, there is no conflict. Many internal auditing departments restrict their appraisal of efficiency to an evaluation in terms of documented operating standards. Actual practice in many other interna! auditing departments includes a more general evaluation. Notice that such an appraisal includes suggesting recommendations but does not include the authority to decide what to do about any inefficiencies or uneconomical use of resources. Nonetheless, internal audit recommendations significantly influence management decisions. As organizations have become larger, management has had an increasingly difficult task of monitoring operations, and has been forced to focus on higher-level concerns, sometimes at the expense of the detailed operations. Since the primary concern of management is the effectiveness of operations, most of the effort has been concentrated there. Yet management hesitates to neglect efficiency because efficiency is important to performance, and if it deteriorates, effectiveness also may be threatened. Consequently, internal auditors often are called upon to examine the efficiency of operations as well as

the effectiveness of controls. This is increasingly important as domestic and international competition increases. Responsibility and Authority. The Responsibility and Authority section of the Statement is as follows: The internal auditing department is an integral part of the organization and functions under the policies established by senior management and the board. The purpose, authority, and responsibility of the internal auditing department should be defined in a formal written document (charter). The director of internal auditing should seek approval of the charter by senior management as well as acceptance by the board. The charter should make clear the purposes of the internal auditing department, specify the unrestricted scope of its work, and declare that auditors are to have no authority or responsibility for the activities they audit. Throughout the world internal auditing is performed in diverse environments and within organizations which vary in purpose, size, and structure. In addition, the laws and customs within various countries differ from one another. These differences may affect the practice of internal auditing in each environment. The implementation of the Standards for the Professional Practice of Internal Auditing, therefore, will be governed by the environment in . which the internal auditing department carries out its assigned responsibilities. Compliance with the concepts enunciated by the Standards for the Professional Practice of Internal Auditing is essential before the responsibilities of internal auditors can be met. As stated in the Code of Ethics, members of The Institute oHnternal Auditors, Inc. and Certified Internal Auditors shall adopt suitable means to comply with the Standards for the Professional Practice of Internal Auditing. By being subject to policies established only by management, the internal auditing function may jeopardize its independence of management and, consequently, its all-important objectivity. Notice, however, that the first sentence prescribes that the board also should participate in policy-setting for the internal auditing function. The rest of the first paragraph goes on to prescribe specific remedies for the risk posed by establishing an internal auditing function under management direction. First, the Statement indicates that the board of directors should review and approve internal auditing policies. Second, a formal charter should be drafted documenting the authority and responsibility of the internal auditing function. It should (a) establish the internal auditing department within the organization, (b) define its status and the scope of internal auditing authority and responsibility, (c) authorize access to records, personnel, and resources needed to conduct the audit, and (d) prescribe its various relationships to other units within the organization to those outside the organization. Outsiders include clients or customers, suppliers, subsidiaries, owners, and external auditors or other contracted service organizations. The charter should be approved by both management and the board of directors. Board approval helps protect an organization's auditors against capricious policy changes by management.

Third, the Statement specifies an unrestricted scope of internal auditing work. By including this provision in the charter, internal auditing will have the authority it needs to monitor the controls of the total system without interference from management. Finally, the Statement provides that auditors have no authority over, or responsibility for, the activities they audit. This serves to strengthen their independence and objectivity. Management, searching for know-how and minimal interruptions of normal routines, might try to persuade the internal auditors to take on operational responsibilities along with their auditing work. Provisions in the charter help protect the independence of auditors. The second paragraph of this Responsibility and Authority section specifies, by reference, the standards for professional performance and conduct. The Statement references the Standards for the Professional Practice of Internal Auditing and the Code of Ethics of The Institute of Internal Auditors, both of which are discussed in this chapter. While internal auditors may enjoy a high degree of responsibility and authority within the organization, they must not impose demands upon the organization that would unnecessarily inconvenience others or interrupt or interfere with their activities. After all, an overall responsibility of the internal auditing function is to assist the organization and those working in it to fulfill their responsibilities. This consideration requires cooperation and coordination of the internal auditing function with other organizational activities, except in rare circumstances when to do so would jeopardize what are considered to be more important audit objectives. Some situations, for example, may necessitate the element of surprise, which logically would interrupt the natural work flow of the operations under review. Independence. In addition to the previous references to the need for auditor independence, this section describes the nature of independence, the reason for its importance, and two conditions required to protect it. The section reads as follows: Internal auditors should be independent of the activities they audit. Internal auditors are independent when they can carry out their work freely and objectively. Independence permits internal auditors to render the impartial and unbiased judgments essential to the proper conduct of audits. It is achieved through organization status and objectivity. The organizational status of the internal auditing v department should be sufficient to permit the accomplishment of its audit responsibilities. The director of the internal auditing department should be responsible to an individual in the organization with sufficient authority to promote independence and to ensure a broad audit coverage, adequate consideration of audit reports, and appropriate action on audit recommendations. Objectivity is an independent mental attitude which internal auditors should maintain in performing audits. Internal auditors arc not to subordinate their judgment on audit matters to that of others. Designing, installing, and operating systems are not audit functions. Also, the drafting of procedures for systems is not an audit function. Performing such activities is presumed to impair audit objectivity.

The nature of auditor independence is described in the first paragraph as the ability to "carry out their [the auditors'] work freely and objectively." In this case "freely" means without outside interference from management or others in the organization. "Objectively" means to have a mental and an emotional detachment from the part of the organization being audited. The reason independence is so important is that it "permits internal auditors to render...impartial and unbiased judgments...." The auditor's effectiveness and, therefore, his or her value to the organization is dependent upon those judgments. The conditions necessary to protect independence are (1) organizational status and (2) auditor objectivity. The Statement indicates that the auditors' status should be such that they are taken seriously throughout the organization. What this normally means is that the more respect management gives the auditing function, the higher the regard others have for it and, consequently, the greater the attention given to audit findings and recommendations. This status is most easily achieved by placing internal auditing at a high level within the organizational hierarchy. Auditor objectivity results from mental discipline. To encourage an objective attitude, the Statement excludes auditor involvement from all operations in any decision-making capacity, except to render judgments on systems design and changes to control operations. The provisions in the Statement of Responsibilities of Internal Auditing outline a prescribed role for the internal auditing function and introduce the need for more detailed standards of professional practice and behavior for internal audi tors. In essence, this Statement establishes a setting for trn internal auditing function. The more detailed standards stau clearly the criteria governing how internal auditing should bt performed. Standards of Practice The Standards for the Professional Practice of Internal Au diting was published by The IIA in 1978. The introduction tc the Standards reiterates many of the provisions in the State ment of Responsibilities of Internal Auditing. The Standards is divided into five general sections and covers the various as pects of auditing within an organization: 1. Independence. 2. Professional Proficiency. 3. Scope of Work. 4. Performance of Audit Work. 5. Management of the Internal Auditing Department. The standards outlined in these sections have proven to be reasonably comprehensive and applicable in a variety of settingsprivate and public organizations, government, and not for-profit organizations.

Although the Standards is the official IIA pronouncement on how internal auditing should be practiced, The IIA has adopted a plan for amending the Standards when important general questions arise that the current document does not answer adequately. On such occasions, The IIA issues Statements on Internal Auditing Standards (SIAS). These statements represent extensions and interpretations of the standards set forth in the original 1978 document and are not considered to be ^hanges. Thirteen SIASs have been accepted by The IIA: "Control: Concepts and Responsibilities" (1983), "Communicating Results" (1983), "Deterrence, Detection, Investigation, and Reporting of Fraud" (1985), "Quality Assurance" (1986), "Internal Auditors' Relationships with Independent Outside Auditors" (1987), "Audit Working Papers" (1987), "Communication with the Board of Directors" (1989), "Analytical Auditing Procedures" (1991), "Risk Assessment" (1991), "Evaluating the Accomplishment of Established Objectives and Goals for Operations or Programs" (1991), "1992 Omnibus Statement" (1992), "Planning the Audit Assignment" (1992), and "Follow-up on Reported Audit Findings" (1993). Every student of internal auditing should know and understand the Standards for the Professional Practice of Internal Auditing. Because of its importance and relative brevity, we have reproduced the Standards in its entirety in Appendix I. The Standards should be read in conjunction with the coverage presented in this chapter. Later chapters discuss individual standards in more detail as they relate to specific topics. In 1981, The Institute began publishing Professional Standards Bulletins in Internal Auditor, the journal of The Institute of Internal Auditors, to address questions of general interest. Specific bulletins are referenced throughout this text where applicable. Code of Ethics Both the Statement of Responsibilities of Internal Auditing and the Standards for the Professional Practice of Internal Auditing state the necessity of internal auditors in meeting appropriate standards of conduct. The Responsibility and Authority section of the Statement of Responsibilities of Internal Auditing states that internal auditing should "serve the organization in a manner that is consistent with...professional stan-dards of conduct such as the Code of Ethics of The Institute of Internal Auditors." Guideline 240.01 of the Standards for the Professional Practice of Internal Auditing states that "Internal auditors should comply with professional standards of conduct," and it specifies The IIA's Code of Ethics as the appropriate basis for evaluation. The Institute of Internal Auditors Code of Ethics is reproduced in Exhibit 2-2. Exhibit 2-2 The Institute of Internal Auditors Code of Ethics PURPOSE: A distinguishing mark of a profession is acceptance by its members of responsibility to the interests of those it serves. Members of the Institute of Internal Auditors (Members) and Certified Internal Auditors (CIAs) must maintain high standards of conduct in order to effectively discharge this responsibility. The Institute of Internal Auditors (Institute) adopts this Code of Ethics for Members and CIAs.

APPLICABILITY: This Code of Ethics is applicable to all Members and CIAs. Membership in The Institute and acceptance of the "Certified Internal Auditor" designation are voluntary actions. By acceptance, Members and CIAs assume an obligation of self-discipline above and beyond the requirements of laws and regulations. The standards of conduct set forth in this Code of Ethics provide basic principles in the practice of internal auditing. Members and CIAs should realize that their individual judgment is required in the application of these principles....... CIAs shall use the "Certified Internal Auditor" designation with discretion and in a dignified manner, fully aware of what the designation denotes. The designation shall also be used in a manner consistent with all statutory requirements. Members who are judged by the Board of Directors of The Institute to be in violation of the standards of conduct of the Code of Ethics shall be subject to forfeiture of their membership in The Institute. CIAs who are similarly judged also shall be subject to forfeiture of the "Certified Internal Auditor" designation. STANDARDS OF CONDUCT I. Members and CIAs shall exercise honesty, objectivity, and diligence in the performance of their duties and responsibilities. II. Members and CIAs shall exhibit loyalty in all matters pertain -ing to the affairs of their organization or to whomever they may be rendering a service. However, Members and CIAs shall not knowingly be a party to any illegal or improper activity. III. Members and CIAs shall not knowingly engage in acts or activities which are discreditable to the profession of internal auditing or to their organization. IV. Members and CIAs shall refrain from entering into any activity which may be in conflict with the interest of their organization or which would prejudice their ability to carry out ob-jectively their duties and responsibilities. V. Members and CIAs shall not accept anything of value from an employee, client, customer, supplier, or business associate of their organization which would impair or be presumed to impair their professional judgment. VI. Members and CIAs shall undertake only those services which they can reasonably expect to complete with professional competence. VII. Members and CIAs shall adopt-suitable means to comply with the Standards for the Professional Practice of Internal Auditing,

VIII. Members and CIAs shall be prudent in the use of information acquired in the course of their duties. They shall not use confidential information for any personal gain nor in any manner which would be contrary to law or detrimental to the welfare of their organization. IX. Members and CIAs, when reporting on the results of their work, shall reveal all material facts known to them which, if not revealed, could either distort reports of operations under review or conceal unlawful practices. X. Members and CIAs shall continually strive for improvement in their proficiency, and in the effectiveness and quality of their service. XI. Members and CIAs, in the practice of their profession, shall be ever mindful of their obligation to maintain the high standards of competence, morality, and dignity promulgated by The Institute. Members shall abide by the Bylaws and uphold the objectives of The Institute. Adopted by Board of Directors, July 1988. The Code specifies three reasons for a formal statement of standards by The IIA to guide the professional conduct of internal auditors: 1. The members of The Institute of Internal Auditors represent the profession of internal auditing. 2. Managements rely on the profession of internal auditing. 3. Members of The Institute must maintain high standards of conduct, honor, and character in order to carry out proper and meaningful internal auditing practice. The Code goes on to state that internal auditors have "a responsibility to conduct themselves so that their good faith and integrity should not be open to question." So stating, the Code then dictates articles outlining what The Institute considers to be the standards of proper professional conduct for internal auditors: ARTICLE I Members and CIAs shall exercise honesty, objectivity, and diligence in the performance of their duties and responsibilities. This article identifies three personal characteristics that form the* foundation upon which the other articles rest. Without honesty, members of the profession cannot be entrusted with the responsibility and the authority necessary to perform the internal auditing function adequately. We already have discussed the importance of objectivity. An auditor also must be diligent when performing his or her work. A lack of diligence can, and probably will, increase the chance of errors, oversights, and misinterpretations, all of which will jeopardize the auditor's credibility and value to the organization. ARTICLE II

Members and CIAs shall exhibit loyalty in all matters pertaining to the affairs of their organi-zation or to whomever they may be rendering a service. However, Members and CIAs shall not knowingly be a party to any illegal or improper activity. In contrast to the external auditor, the internal auditor assumes an advocacy position with respect to the organization. Questions arise, however: Who is the "employer'? Does it mean the inanimate corporate entity? Does it mean management? If so, which management? (There are different levels and divisions of management responsibility.) Or is it the individual who hired the auditor? Other questions arise regarding the term "loyalty." What does it mean for an internal auditor to be loyal? Can loyalty manifest itself in different forms in different relationships? If so, could an internal auditor have conflicting loyalties due to the numerous parties representing his or her employer and others for whom a service may be rendered? How should such conflicts be resolved? These are difficult questions. Basically, however, this article states that internal auditors have an ethical responsibility to honor the trusts placed in them by their constituents (a) people in the organization to whom they answer administratively and (b) those others whom they serve who might not have direct administrative responsibility for the auditors. Internal auditors have an ethical responsibility to do their part to see that these groups are successful in fulfilling their respective duties and responsibilities. Any act that violates that trust, except in cases of illegal or improper activities, violates the spirit of this article. Suppose, for example, that during an audit of accounts payable the auditors discovered that one of the organization's major suppliers was not offering discounts for early payment, despite the fact that the supplier was offering discounts to other companies on similar purchases. The control system may have been functioning properly, no illegal activity was going on, and no accounting errors were caused by the practice. However, loyalty (and the goal of efficiency) should persuade the auditors to report this information to management. In other situations of potential conflicts of interest, the auditor's loyalty should lie with his or her employer. For example, such an occasion might occur if an auditor had close personal friends working in a division being audited, and it was discovered that the friends were involved in some potential wrongdoing. The auditor would have to choose between protecting the friends or objectively including the facts of the case in the audit report. This article dictates that the auditor should remain objective and should include the information in the report. As a related example, some internal auditing departments even have policies forbidding their auditors to fraternize with auditees. Such policies are designed to avoid the development of the close personal bonds which might compromise the auditors' objectivity. Certainly, auditors should be independent of management's decision process and of the activities they audit. They also should be objective in their judgments. But they must remember that they should be loyal to their employer's interests.

ARTICLE III Members and CIAs shall not knowingly engage in acts or activities which are discreditable to'the profession of internal auditing or to their organization. As an example, once certified as a CIA, auditors must maintain continuing professional education. Nonfulfillment of this requirement would be an act that is discreditable to the profes-sion and not in the long-term best interest of the organization. ARTICLE IV Members and CIAs shall refrain from entering into any activity which may be in conflict with the interest of their organization or which would prejudice their ability to carry out objectively their duties and responsibilities. As with the previous article, the emphasis here is on the internal auditor's relationship with the employer and his or her responsibility for the employer's interests. There may be occasions when an auditor faces circumstances where there may be two or more choices, one or more of which conflict with the employer's welfare. In these cases, the auditor has an ethical responsibility to act in the employer's best interest without prejudicing his or her objectivity. An example of a potential conflict of interest would be if the internal auditor invested in an insurance agency and was responsible for commenting on the adequacy of insurance coverage, which may be handled by the same agency. Under the circumstances, the auditor's objectivity could be questioned. In any situation where the auditor is emotionally torn between alternatives, he or she should decide in favor of the employer's interests, and still retain the objectivity necessary for fulfilling the audit responsibilities. By following generally accepted auditing methods and procedures, the auditor is better able to avoid compromising his or her objectivity. ARTICLE V Members and CIAs shall not accept anything of value from an employee, client, customer, sup-" plier, or business associate of their organization which would impair or be presumed to impair their professional judgment. In contrast to the other articles, which prescribe general prin ciples of conduct, this article identifies a specific situatior which might jeopardize the auditor's objectivity and whicl might conflict with the employer's interests. Certainly, b^ accepting personal fees or gifts, the auditor's ability to main tain a professionally objective attitude might reasonably b< questioned. In such situations, it is better to avoid even th appearance of compromise. Professional Standards Bulletin 8^ 5 specifies that such avoidance is advisable regardless of whethe the offer comes from a current auditee or from an employee o area not being audited. Plus, according to this bulletin, "intei nal auditors should report the offer of all material fees or gift immediately to their immediate supervisors." On the othe hand, small promotional items, such as pens or calendars tha are available to the general public and are of minimal valut are not likely to hinder the internal auditor's professional judg ment.

There may be occasions when a gift, even of substantial vaku may be appropriate. In these cases, the knowledge and conser of senior management likely will protect the auditor agaim an otherwise compromising situation. ARTICLE VI Members and CIAs shall undertake only those services which they can reasonably expect to complete with professional competence. Internal auditors perform a variety of audits and often are not initially knowledgeable in a specific area to be audited. Part of the audit process is obtaining an understanding of the specific area in order to adequately perform the audit. Internal auditors are expected to reach a level of competency prior to the completion of the audit process. ARTICLE VII Members and CIAs shall adopt suitable means to comply with the Standards for the Professional Practice of Internal Auditing. Internal auditing departments should incorporate the Standards into their Standard Operating Procedures manual to encourage compliance. Additionally, the Standards should be referenced in the charter as the guide for the operation of the internal auditing department. ARTICLE VIII Members and CIAs shall be prudent in the use of information acquired in the course of their duties. They shall not use confidential information for any personal gain nor in any manner which would be contrary to law or detrimental to the welfare of their organization. Internal auditors often are privy to confidential, privileged, or proprietary information. The auditors should appropriately safeguard such information. Typically, internal auditors should not be whistleblowers. ARTICLE IX Members and CIAs, when reporting on the results of their work, shall reveal all material facts known to them which, if not revealed, could either distort reports of operations under review or conceal unlawful practices. The first part of this article implies that auditors should not render an opinion without adequate information to justify the opinion. The second part stipulates that if auditors have information that would be material to management's judgments, they are ethically responsible for reporting the information. Unsubstantiated claims can seriously endanger the organization. The primary danger is that the conclusions and claims might be wrong, thereby prompting decisions and actions that otherwise would be unwarranted. Sometimes it is difficult to understand a situation clearly even when all of the available information is known,- when significant evidence has been either misinterpreted or

overlooked, it is even more difficult. It is a matter of professional propriety for the auditor to develop a strong, convincing argument for his or her opinions. Such arguments are possible only with adequate factual evidence, which requires direct support, not merely hearsay. But what about occasions when the evidence is not sufficient for a final conclusion and a report is to be issued? There are times when the auditors, for various reasons, simply cannot gather conclusive evidence. Sometimes the only way to get the necessary answers is to wait for a final outcome. A good example is a particular marketing strategy which in the beginning may violate numerous control measures, but because of the manger's hunch is adopted anyway. The auditors can only point out the observed control violations and the potential risks. At other times auditors may even suspect wrongdoing, but have not gathered enough evidence to confirm their suspicions. It is not unusual for auditors to turn their cases over to the company's security department, which then will further investigate any suspected wrongdoing. Not all firms employ such security personnel, however. In those instances, the investigation is done by the internal auditors, legal counsel, trained investigators, or even law enforcement agencies. The selection of who performs the investigation depends upon the seriousness of the suspected wrongdoing and the strength of the evidence Where evidence is inconclusive, the auditors must be careful not to state any strong, final conclusions, because their conelusions may be only as strong as the evidence. Additional information on evidence and its effect upon the audit process is included in Chapter 4. Given that it is the auditor's responsibility to assist management in its control function, the clearer and the more accurate the audit reports are, the more help the auditor will be. Distorting or concealing any relevant facts represents disloyalty to the employer and violates other articles of the Code. Generally, when such a case of concealment or distortion occurs, it results from a conflict of interest. For example, when an internal auditor discovered a sizable fraud in a medical service clinic, a party to the fraud approached the auditor in an effort to persuade him to ignore the evidence in the final report if the money was returned and the records were corrected. The auditor knew the party well and later admitted to a momentary conflict with his employer's interests. Fortunately, however, his better judgment prevailed, and he included all of the facts in his report, as he had discovered them. ARTICLE X Members and CIAs shall continually strive for improvement in their proficiency, and in the ef-fectiveness and quality of their service. Other professions have similar provisions in their codes of ethics prescribing professional development. Indeed, such a principle seems basic to our way of life in that we all seem to be striving for personal improvement. The professions often appear to make a relatively organized effort. Generally, this results from a rapidly changing state of the art. Various schools and training consultants offer opportunities for ongoing

professional development. Some organizations offer their own professional development courses. The Institute of Internal Auditors h?c on ortive international seminar program to assist internal auditors in fulfilling their responsibilities in this area. ARTICLE XI Members and CIAs, in the practice of their profession, shall be ever mindful of their obligation to maintain the high standards of competence, morality, and dignity promulgated by The Institute. Members shall abide by the Bylaws and uphold the objectives of The Institute. Like the first article, this one outlines the personal characteristics and commitment required to uphold the stature necessary for the successful practice of internal auditing as a profession that functions within the highest levels of organizational leadership. As their standard, internal auditors are instructed to use The Institute and its members. A standard of competence is outlined in the Standards for the Professional Practice of Internal Auditing. A standard of morality is outlined by the other articles in the Code of Ethics, and with this article, it also includes the consensus attitudes held by members of The Institute. These, because of the basic composition of the profession, represent relatively conservative, traditional moral values. A standard of dignity has been established by The Institute through its various activities, publications, professional development seminars, and relationships with other groups in the government and business communities. Auditor Certification In 1974, The Institute of Internal Auditors began to certify internal auditors who qualified under specified criteria. These criteria include holding a baccalaureate degree from an accredited college-level institution, two years of appropriate experience, subscription to the Code of Ethics, and passage of a four-part examination to fulfill the requirement to become a "Certified Internal Auditor" (CIA). The examination includes sections on (1) internal auditing process, (2) internal auditing skills, (3) management control and information technology, and (4) the audit environment. This certification program promotes a standard of excellence for the profession among those who call themselves professional internal auditors. Certification is not required to practice internal auditing, however, and many internal auditors practice without certification. On the other hand, the program has established a recognized standard for the profession, and tests a common body of knowledge agreed to be necessary for the internal auditing professional. Some people believe that all prac-*-;c:-g ii.uoruai auditors should be certified. Many organizations require the CIA designation for advancement within the internal auditing department. Actions by the U.S. General Accounting Office M6re than a decade ago, the General Accounting Office (GAO) of the U.S. government recognized the need for auditing standards prescribed for federal auditors. In 1972, the GAO issued Standards for Audit of Governmental Organizations, Programs, Activities, and Functions, which has become better known as "the yellow book."

This document, printed by the U.S. Government Printing Office, outlines specific standards for three kinds of audits: (1) financial and compliance audits, (2) economy and efficiency audits, and (3) program results audits. These three types of audits are described in "the yellow book" as follows: Financial and compliance determines (a) whether the financial statements of an audited entity present fairly the financial position and the results of financial operations in accordance with gen-erally accepted accounting principles and (b) whether the entity has complied with laws and regulations that may have a material effect upon the financial statements. Economy and efficiency determines (a) whether the entity is managing and utilizing its resources (such as personnel, property, space) economically and efficiently, (b) the causes of inefficiencies or uneconomical practices- ir.i (c) whether the entity has complied with iaws and regulations concerning matters of economy and efficiency. Program results determines (a) whether the desired results or benefits established by the legislature or other authorizing body are being achieved and (b) whether the agency has considered alternatives that might yield desired results at a lower cost. The financial and compliance audits are important to federal auditors because public accounting firms typically do not audit U.S. government financial statements. Consequently, government auditors fulfill this function. Notice, however, that the broad nature of the overall auditing function goes far beyond the auditing of financial statements and includes the examination of ongoing operations and programs. This broad perspective is quite in harmony with internal auditing in the private sector. In fact, "the yellow book" states that The IIA's Standards, as reprinted in this chapter, are compatible with those established by the GAO for governmental auditors. A distinctive feature of the GAO standards is that they subscribe to the AICPA standards for external audits and integrate them into the U.S. government audit function. Because of the compatibility of The IIA's and the GAO's standards and the wide applicability of The IIA's Standards, references to internal auditing standards in this textbook are made with respect to those established and published by The IIA. We believe that students who may eventually pr ;k tice auditing for the federal government will discover that the principles outlined in this text may be applied in that setting as well. Actions by Internal Auditing Departments Several measures can be taken within individual internal auditing departments to promote professionalism. The Standards for the Professional Practice of Internal Auditing outlines and discusses three important ways: j 11 proper staffing, (2) acquisition of necessary knowledge, skills, and disciplines, and (3) proper supervision of audit work. Four related measures include the following: 1. Establishing appropriate specific charter provisions. 2. Adhering to professional standards.

3. Maintaining a core of professional auditors. 4. Establishing appropriate training opportunities. Let's briefly examine each of these four measures: Charters The Standards states that charters should be written and approved by management and the board of directors, and should outline the purpose, authority, and responsibility of the internal auditing department within the organization. The specific provisions, however, are left largely to the organizations themselves. These specific provisions should include the following topics: 1. Establishment of the internal auditing function. 2. The goal or objective of the auditing function. 3. The authority granted to the department. 4. The scope of work authorized for the internal auditing department. 5. The organizational status of the department. 6. Acceptable standards of performance for the department. 7. The department's administrative and reporting relationships. 8. Responsibility for following up on audit findings. 9. Approval of the charter by executive management and the audit committee. A careful drafting of this document can promote and help maintain a high level of expectation for the professional integrity and performance within the department. It also can promote the status of the internal auditing function. Professional Standards The standards established by The IIA represent only strong encouragement. They are, however, the most widely accepted body of standards for the profession. They are a commonly held measure of excellence for internal auditors, and by accepting these standards, internal auditing departments can promote and sustain a high degree of professionalism within their respective organizations. While the GAO has published "the yellow book," comprising a similar set of standards for the practice of standard for the U.S. government, the Standards for the Professional Practice of Internal Auditing published by The IIA is recognized internationally by auditors of commercial, governmental, and not-for-profit organizations. The voluntary acceptance of The IIA's standards by internal auditing departments promotes a uniformly high quality of practice within the profession.

Professional Auditors It is the practice in many companies to use the internal auditing department as a management training school, where trainees work as auditors for anywhere from six months to three years, and then are transferred to middle management positions elsewhere in the organizations. Sometimes the auditing staff can be composed almost entirely of these "transient" auditors. Such a practice can jeopardize the quality and the professionalism of the audit function itself. There are several advantages to using the internal auditing department as a means of training prospective managers. They can gain a global, integrated perspective of the overall organization by participating in a variety of audits. This variety provides them with a good introduction to the detailed operations of individual functions and activities. The trainees also get to know many key personnel in the organization and can compare managers and operations. They all benefit the internal auditing department by bringing a fresh look to audited operations. When they graduate into management positions, they are likely to understand internal control and the audit role bet-ter, and to help expedite audits of their operations. Because of the disadvantages, however, it is a wise practice among better internal auditing departments to keep a core of highly competent professional auditors within the department. The proportion of management trainees should be kept small enough to enable the department to fulfill its duties with well-trained, well-supervised staff members who understand the audit function and can work effectively and efficiently. Although others may assist in the work, the department should maintain a core of professionals. Training Professional development, as an important responsibility of the internal auditor, can be encouraged by sponsoring in-house training programs or by sending staff members to appropriate outside training programs. Individual consulting firms and The Institute of Internal Auditors conduct a variety of seminars designed to help internal auditors keep abreast of developments within the profession and to expand and sharpen their individual skills. Continuing professional education i.e., training_also is required for Certified Internal Auditors to maintain their certification. Due to the constant changes and developments within the profession, an internal auditor's knowledge base quickly becomes outdated without ongoing training. Individual Appearance and Conduct The Standards for the Professional Practice of Internal Auditing details six areas where individual auditors can develop their professionalism. They are (1) compliance with the Code of Ethics of The Institute, (2) acquisition of the knowledge, skills, and disciplines essential for the performance of internal audits, (3) development of human relations and communications skills, (4) continuance of their

education during their careers, (5) the exercise of due professional care in performing their duties, and (6) by qualifying as a Certified Internal Auditor, the auditor demonstrates a commonly recognized measure of professionalism. These six steps represent ways that the individual can exercise professionalism in auditing. There is yet another area of importance. Although not a usual part of the university curriculum, professional appearance and personal conduct are recognized to be important by most successful business people. These two dimensions of professionalism in auditing are vital to the success of the individual auditor and, in most cases, to the success of the internal auditing department. Every internal auditor should be well versed in appropriate personal behavior in the office and be able to mesh with the organization's culture. While instruction in these and other aspects of personal etiquette is not an objective of this chapter, we strongly encourage students to study and acquire the personal traits of a business professional. These traits will be important for advancement within any organization.