![](media/image1.png){width="1.5631944444444446in" height="11.0in"}

IIA Response to Treasury Advisory Committee on the Auditing Profession

June 13, 2008

Page 2 of 4

> According to the IIA and thought-leading organizations such as the New
> York Stock Exchange and the National Association of Corporate
> Directors, the four cornerstones of effective corporate governance are
> the audit committee, executive management, the internal auditors, and
> the external auditors. When these entities work together well with
> healthy interdependence, internal controls are strong, reporting --
> including financial reporting -- is accurate, ethics are maintained,
> oversight is effective, risks are mitigated, and investments are
> protected.
>
> The primary goal of internal audit is to aid an organization to
> achieve its business objectives. Internal auditing is concerned with
> all aspects of the organization -- both financial and non-financial.
> Internal auditors spend most or all of their time working in the
> organization; as a result they have a keen understanding of the
> culture and the workings of the company. This allows internal auditors
> to see things external auditors may not be aware of, and provide their
> unique perspectives, expertise, and recommendations to address
> organizational issues.
>
> The professional internal audit practitioner adheres to guidance set
> forth in the Code of Ethics and the International Standards for the
> Professional Practice of Internal Auditing, pursues and achieves the
> Certified Internal Auditor (CIA) or other professional auditing
> certifications, conducts internal assessments, and undergoes
> independent, external quality reviews to verify compliance with the
> standards.
>
> The targets of internal audit attention may include: operational
> effectiveness and efficiency of business processes; reliability of
> information systems -- including those that feed into financial
> reporting -- and the quality of decision making information formed by
> those systems; safeguarding assets against loss; and compliance with
> organizational policies, contracts, laws, and regulations.
>
> Internal auditors also provide financial reporting assurance services.
> The main difference is that internal auditors provide their financial
> reporting assurance service primarily for the benefit of management
> and the board of directors.
>
> The work of external and internal auditors should be coordinated for
> optimal effectiveness and efficiency. The internal and external
> auditors should meet periodically to discuss common interest; to be
> satisfied with the propriety of each others work; gain an
> understanding of each other's scope of work and methods; and jointly
> assess areas of risk.

In addition, we have the following comments related to the
recommendations in the report surrounding human capital and fraud
detection.

***Human Capital***

We agree that auditing professionals need to be educated and trained to
review, judge, and question all accounting and auditing matters with
skepticism and a critical perspective.

Recommendation 1 -- We also agree with Recommendation 1 to implement
market driven, dynamic curricula and content for accounting students
that continuously evolve to meet the needs of the auditing profession
and help prepare new entrants to the profession to perform high quality
audits.

IIA Response to Treasury Advisory Committee on the Auditing Profession

June 13, 2008

Page 3 of 4

We believe this recommendation should include internal auditing
curricula and promotion of internal audit education. Internal auditing
is fundamental to the governance process of any well-run organization,
so internal audit education should also be a part of business
curriculum. This curriculum would include a focus on professional and
ethical standards, new developments and emerging trends, and changes in
the business environment.

Recommendation 5 -- While we agree that it would be useful for the AICPA
and the AAA to jointly form a commission to provide a timely sturdy of
the possible future of higher organization structure for the accounting
profession, we believe that this should be expanding to the entire
auditing profession -- including internal auditing. The Internal
Auditing Education Partnership Program (IAEP) was developed to respond
to the growing interest in internal audit education at institutions of
higher learning. This program could serve as part of the valuable member
of the committee to bring forth an internal audit prospective, and
internal auditing as an viable option in the career path for
accountants.

***Fraud***

We agree with that continued enhancement of auditors' fraud prevention
and detection skills will improve financial reporting and audit quality.
Internal audit also has a role in prevention and detection of fraud, as
such internal audit also contributes to improve financial reporting.
Competent professional internal auditors are highly proficient in
techniques used to evaluate internal controls. That proficiency, coupled
with the understanding of the indicators of fraud, enables internal
auditors to assess an organization's fraud risks; help ensure controls
to prevent and detect fraud are in place and effective; analyze the
breakdown in controls that could enable fraud; and make recommendations
for improvement.

The IIA recently participated in a two-year effort to produce Managing
the Business Risk of Fraud: A Practical Guide, which is sponsored by the
Association of Certified Fraud Examiners, the AICPA, and The IIA. The
guide outlines principles for establishing effective fraud risk
management, regardless of the type or size of an organization. The
guidance provides a practical approach for companies committed to
preserving stakeholder value. It can be used to assess or improve an
organization's fraud risk management program, or to develop an effective
program where none exists. Five key principles within the guidance
address governance, risk assessment, fraud prevention and detection,
investigation, and corrective action.

Recommendation 1-a - Based on the rationale noted above, we believe The
IIA should be included with other organizations in providing best
practices regarding fraud prevention and detection.

The IIA welcomes the opportunity to discuss any and all of these
recommendations with you, as well as involvement in future committee
meetings and draft reports. If I can be of further assistance, please
contact me.

Best Regards,

![](media/image2.png){width="2.8048611111111112in"
height="0.5763888888888888in"}

David A. Richards, CIA

IIA Response to Treasury Advisory Committee on the Auditing Profession

June 13, 2008

Page 4 of 4

**About The Institute of Internal Auditors**

The IIA is the global voice, acknowledged leader, principal educator,
and recognized authority of the internal audit profession and maintains
the *International Standards for the Professional Practice of Internal
Auditing (Standards)*. These principles-based standards are recognized
globally and are available in 29 languages. The IIA represents more than
150,000 members across the globe, and has 99 institutes in 165 countries
that serve members at the local level.