WORLD TRADE  
ORGANIZATION  WT/BFA/W/175 
28 July 2008 
 
 (08-3607) 
Committee on Budget, Finance and Administration  
  
 
WTO INTERNAL AUDIT CHARTER 
 
 A. INTRODUCTION 
1. This Charter constitutes the frame work within which the Internal Audit function  of the World 
Trade Organization will operate. 
2. The purpose of Internal Auditing is to stre ngthen  accountability,  risk and  financial 
management in the Organization and ensure that  the financial resources made available to the 
organisation by its members are distributed and used effectively by the various divisions with a view to ensuring the best value for money. 
B. DEFINITION 
3. Internal Auditing is an independent, objective assurance and consulting activity designed to 
add value and improve an organi zation's operations.  It helps an  organization to accomplish its 
objectives by bringing a systematic, disciplined appro ach to evaluate and improve the effectiveness of 
risk management, control, and governance processes.
1    
C. INTERNAL  AUDIT  MISSION 
4. The Internal Audit function will examine and evaluate, in an independent and professional 
manner, WTO's financial, and budgetary c ontrol systems, and processes and provide 
recommendations for improvement, thus assisting manage ment and staff in the efficient and effective 
discharge of their responsibilities and the achieveme nt of the Organization's objectives and goals. 
D. GENERAL  OBJECTIVES  OF THE  OFFICE  OF INTERNAL  AUDIT  (OIA) 
5. The general objectives of the OIA will be as follows: 
• To promote financial efficiency and transp arency through sound practices and procedures. 
 
• To provide measurable financial benefits by identifying potential savings and recoveries. 
 
• To deter/prevent the occurrence of fraud2, waste and abuse and to instil a greater sense of 
accountability throughout the Organization, and st rengthen the ethical climate within WTO. 
 
                                                      
1 This is the official definition of Internal Auditing, as established by the Institute of Internal Auditors 
(IIA). 
2 Any illegal acts characterised by deceit, concealment, or violatio n of trust. These acts are not 
dependent upon the application of threat of violence or of physical force. Frauds are perpetuated by parties and organisations to obtain money, property, or services: to se cure personal  advantage. – As defined by the Institute 
of Internal Auditors (IIA).  WT/BFA/W/175 
Page 2  
 
  • To ensure risk mitigation through a systematic analysis of the major risks confronting WTO assets 
and resources. 
 E. SCOPE
 OF WORK 
6. The OIA  is tasked with maintaining and pr omoting the confidence of the Members in the 
integrity and credibility of the Organization's activ ities in budgetary and fina ncial matters. The  OIA 
will therefore carry out financial and complian ce audits and management performance (value-for-
money) audits with a view to verifying the following: 
(a) The reliability and integrity of financial and budgetary information, and the means 
used to identify, verify, measure, clas sify, and report such information.  
(b) Compliance with regulations, rules, policies and procedures in all financial  and 
budgetary operations. 
(c) The means by which assets are  safeguard ed and, as appropriate, verifying the 
existence of such assets.  
(d) The economy and efficiency with which financial resources are utilised and 
accounted for  and identification of opport unities for  improvement in a dynamic and 
changing environment. 
 Other activities include: 
 
(e) Identifying issues warranting investig ation and assisting in the process.  
(f) Ensuring completeness, timeliness, objectivity and accuracy in reporting the results of 
audited activities, inspections and investigations. 
(g) Establishing  and maintaining follow-up systems to determine whether effective 
remedial action has been taken, and pe riodically reporting on situations where 
adequate, timely corrective action has not been implemented.  
(h) Liaising, cooperating and coordinating with the External Auditors3  on optimum audit 
coverage  and monitoring the follow-up of their recommendations. 
(i) Reviewing specific operations at the re quest of  the Director General and 
management.    
(j) Undertaking ad hoc audits and inspections  to identify malfunctions and vulnerable 
areas, and propose corrective action. 
(k) Keeping the Director General and manage ment informed of emerging trends and 
successful practices in Internal Auditing. 
                                                      
3 Conversely, External Audit refers to independent annual audits of an organization's financial 
statements, performed by audit professionals.  At WTO,  this function is performed  according to the terms of 
reference described in Chapter XI of the WTO Financial Regulations (WT/L/156/Rev.2).  WTO's External Auditors perform the audit of the accounts of the WTO and its Pension Plan. 
  WT/BFA/W/175 
 Page 3 
 
 
  (l) Liaising and cooperating with the Internal Audit services and, more generally, the 
Internal Audit functions of Internatio nal Organizations, and representing WTO in 
relevant inter-agency meetings. 
F. AUTHORITY  AND  PREROGATIVES 
7. With stringent regard for safekeeping and c onfidentiality, the OIA is  authorised to: 
(a) Have full and unrestricted access to all WTO functions, activities, records (in both 
paper and electronic format), pr emises, property, and personnel. 
(b) Have identical levels of access to all third parties performing services delegated to 
them by WTO. Access to third parties will be handled in accordance with contractual 
terms. 
(c) Require any Officer of the organisation to supply such information and explanations 
as may be needed. 
(d) Have full and free access to the Director General.  
(e) Have discussions with Directors and staff of WTO at any reasonable time. 
(f) Allocate audit resources, set audit frequencies, select subjects for audit, determine 
scope of work in consultation with the Di rector General, and senior management and 
apply the techniques required to  accomplish audit objectives. 
(g) Obtain the necessary assistance of personnel in divisions of the organization where 
audits are performed, as well as other specialised services from within or outside the organisation. 
(h) Be available to all staff who may comm unicate confidentially with, and provide 
information under the mandate of this charter notably fraud cases, to the Head OIA, 
without fear of reprisal. This shall be gua ranteed by the Director-General.  This is 
without prejudice to measures under Staff Rules and Regulations, where information 
is transmitted to the OIA with knowledge of its  falsity, or with wilful disregard of its 
truth or falsity.  
(i) The OIA shall respect and keep the confidentia l nature of any information gathered or 
received that is applicable to an audit, and shall use such informati on only in so far as 
it is necessary for the performance of the audit. 
G. INDEPENDENCE 
(a) To provide for the independence of the Internal Audit function, the OIA  reports to 
the Director General, who is responsible for the Secretariats' budget and decisions on 
its staffing.  
(b) To permit the rendering of impartial and unbiased judgement essential to the proper 
conduct of audits, all Internal Audit activiti es  shall remain free of influence by any 
element in the organization, including matte rs of audit selection, scope, procedures, 
frequency, timing, or report content . WT/BFA/W/175 
Page 4  
 
  (c) Internal Auditors shall avoid any conflict of interest and shall have no direct 
operational responsibility or authority ov er any of the activities they review. 
Accordingly, they shall not develop nor install systems or procedures, prepare records, or engage in any other activ ity which would normally be audited.  
 The OIA is therefore not authorised to: 
• Perform any operational duties for the organiza tion, its affiliates or duties delegated to 
third parties by WTO. 
 
• Get involved in the implementation of intern al control systems, but may be consulted 
on the adequacy of controls . 
 
• Initiate or approve  transactions external to  the Internal Auditing function or direct the 
activities of any organisation employee not empl oyed by the OIA, except to the extent 
such staff have been appropriately assigned to  the audit team or to otherwise assist the 
Internal Audit function. 
 
• Implement its recommendations. 
 
(d) The Internal Audit review and appraisal process does not in anyway relieve other 
persons in WTO of the responsibiliti es assigned to them. Responsibility for 
accountability, complying  with financial and budgetary regulations, rules, policies, 
procedures, standards of conduct as well as correcting deficiencies rests with the 
respective staff members, supervisors and management. 
H. MANAGEMENT
 RESPONSIBILITIES   
(a) Provide the Internal Audit function with fu ll support and cooperation at all levels of 
operation. 
(b) Provide the Internal Audit function with co mplete access to all functions, activities, 
records (in both paper and electronic format), property, and personnel. 
(c) Provide a written response  to all Internal Audit reports submitted, on a timely basis. 
(d) Promptly inform the Internal Audit func tion of known or suspected cases of a 
fraudulent  nature or malpractices involving WTO funds, records, property and staff. 
I. PROFESSIONAL  STANDARDS 
(a) The Internal Audit function will adhere to WTO regulations, rules, policies, 
procedures and standards of conduct. 
(b) The Internal Audit Staff shall govern them selves by adherence to The Institute of 
Internal Auditors'(IIA) "Code of Ethics."  
(c) The IIA "International Standards for the Professional Practice of Internal Auditing" 
shall constitute the operating procedures fo r the OIA and shall include attribute, 
performance, and implementation standa rds to guide the audit function. 
  WT/BFA/W/175 
 Page 5 
 
 
  8. The above  two documents, the code of ethics a nd the international audit standards constitute 
Annexes 1 and 2 to the audit charter.  
(a) The Institute of Internal Auditors' "Prac tice Advisories" will be adhered to as 
applicable.  
(b) The audit function will also work in  acco rdance with best practice which is accepted 
and applied by other International organi zations and will abide by other relevant 
professional  standards  and main tain an independent attitude. 
J. AUDIT  PLANNING   
9. To effectively implement the WTO Internal A udit function, the OIA shall have responsibility 
to:  
(a) Develop a flexible annual audit plan in c oordination with the external auditors using 
an appropriate risk-based methodology, in cluding any risks or control concerns 
identified by Members through the General Council, the Director General and senior 
management, and submit the plan for review  and approval by the Director General as 
well as periodic updates.  
(b) Communicate to, and sensitise all who need to know about the audit plan, explain 
planned objectives and scope of work, the timing of audit work, and any other significant issues pertaining to the audit plan. 
(c) Implement the annual audit plan, as approve d, including as appropriate any special 
tasks or projects requested by Members through the General Council, the Director 
General and senior management.   
(d) Maintain a professional audit staff appoint ed in accordance with WTO Staff Rules 
and Regulations, with sufficient knowle dge, skills, experience, and professional 
certifications to meet the requirements of this Charter. 
(e) Prepare, publish, disseminate and maintain  an Internal Audit manual, which shall 
include the terms of reference of the In ternal Audit function and a compilation of 
audit procedures. 
(f) Develop and maintain a quality assurance/ improvement program covering all aspects 
of Internal Audit work, including periodic internal and external reviews and ongoing 
self-assessment. 
K. REPORTING 
(a) At the end of each audit, inspection or inv estigation, a report shall be issued on a 
timely basis,  presenting the objectives, scope , methodology, findings , conclusions of 
the audit, and include, if applicable, recommendations for improvement concerning 
the audited process  or activity.  
(b) For investigation cases, the decision to draw issues of concern arising out of the 
report to the attention of the managers of the areas under investigation will be left to 
the discretion of the Director General. WT/BFA/W/175 
Page 6  
 
  (c) For other cases other than investigation, a draft report shall be presented to the 
manager directly responsible for the process or  activity that has been the object of the 
audit or inspection, who shall be given the opportunity to respond within the time provided therein. 
(d) The final audit reports shall include an y relevant comments from the managers 
concerned on the facts established within th e audit report and, if applicable, on the 
recommended plans of action. The managers  concerned shall therefore have the 
opportunity to comment on the report and the OIA shall have the opportunity to reply to the comments in writing. 
(e) After each audit the final audit report will be submitted to the Director-General and 
copied to the relevant managers responsibl e for the process or activity that has been 
the object of the audit or inspection.   The External Auditor shall also receive a copy, 
along with any supporting documentation.     
(f) Audit communication may also be issued  to any concerned manager for matters of a 
routine nature, which do not necessitate formal reporting. 
(g) The OIA shall present, on an annual basis, a summary report to the Director-General, 
with a copy to the External Auditor of ac tivities including the scope of such activities, 
the schedule of work undertaken and progress on the implementation of recommendations contained in the audit re ports.  This summary report shall be 
presented to the Committee on Budget, Finance and Administration.   
L. APPOINTMENT
  
(a) The Head of the OIA and staff of OIA should be persons with integrity and 
professionalism and should possess the knowledge, skills and competencies in auditing and oversight functions.   
(b) The Head, OIA is appointed by the Director  General for a fixed, maximum period of 
5 (five) years. 
M. REVISION
 CLAUSE 
10. This Charter shall be subject to periodic assessment after its adoption.  Any necessary 
revision that may be requested by the OIA will need to be discussed with and approved by the Director General. The Committee on Budget, Fi nance and Administration will be informed 
accordingly of any revision.  WT/BFA/W/175 
 Page 7 
 
 
  ANNEX 1 
 
Code of Ethics  
  
Introduction 
1. The purpose of The Institute's Code of Ethics is to promote an ethical culture in the profession 
of internal auditing. 
2. Internal auditing is an independent, objective assurance and consulting activity designed to 
add value and improve an organization's operati ons. It helps an organization accomplish its 
objectives by bringing a systematic, disciplined approa ch to evaluate and improve the effectiveness of 
risk management, control, and governance processes.  
3. A code of ethics is necessary and appropriate for the profession of internal auditing, founded 
as it is on the trust placed in its objective assurance about risk management, control, and governance. 
The Institute's Code of Ethics extends beyond th e definition of internal auditing to include two 
essential components: 
(a) Principles that are relevant to the profession and practice of internal auditing;  
(b) Rules of Conduct that describe behavior norms  expected of internal auditors. These 
rules are an aid to interpreting the Princi ples into practical applications and are 
intended to guide the ethical conduct of internal auditors.  
4. The Code of Ethics together with The Institute's Professional Practices Framework  and other 
relevant Institute pronouncements provide guidance to internal auditors serving others. "Internal 
auditors" refers to Institute members, recipients of or candidates for IIA professional certifications, 
and those who provide internal auditing services within the definition of internal auditing. 
Applicability and Enforcement 
5. This Code of Ethics applies to both individuals and entities that provide internal auditing 
services. 
6. For Institute members and recipients of or candidates for IIA professional certifications, 
breaches of the Code of Ethics will be evaluated and administered according to The Institute's Bylaws 
and Administrative Guidelines. The fact that a par ticular conduct is not mentioned in the Rules of 
Conduct does not prevent it from being unacceptable or discreditable, and therefore, the member, certification holder, or candidate can be liable for disciplinary action. 
Principles 
7. Internal auditors are expected to apply and uphold the following principles: 
• Integrity 
8. The integrity of internal auditors establishes trust and thus provides the basis for reliance on 
their judgment. 
• Objectivity WT/BFA/W/175 
Page 8  
 
  9. Internal auditors exhibit the highest level of professional objectivity in gathering, evaluating, 
and communicating information about the activity or process being examined. Internal auditors make 
a balanced assessment of all the relevant circumst ances and are not unduly influenced by their own 
interests or by others in forming judgments 
• Confidentiality 
10. Internal auditors respect the value and owne rship of information they receive and do not 
disclose information without appropriate authority un less there is a legal or professional obligation to 
do so. 
• Competency 
11. Internal auditors apply the knowledge, skills, and experience needed in the performance of 
internal auditing services. 
Rules of Conduct  
1. Integrity 
Internal auditors: 
1.1. Shall perform their work with hon esty, diligence, and responsibility. 
1.2. Shall observe the law and make disclosures expected by the law and the profession. 
1.3. Shall not knowingly be a party to any illega l activity, or engage in acts that are 
discreditable to the profession of internal auditing or to the organization. 
1.4. Shall respect and contribute to the legitimate  and ethical objectives of the organization. 
2. Objectivity 
Internal auditors: 
2.1. Shall not participate in any activity or re lationship that may impair or be presumed to 
impair their unbiased assessment. This pa rticipation includes those activities or 
relationships that may be in conflict w ith the interests of the organization. 
2.2 Shall not accept anything that may impair or be presumed to impair their professional 
judgment. 
2.3 Shall disclose all material facts known to them that, if not disclosed, may distort the 
reporting of activities under review. 
3. Confidentiality 
Internal auditors: 
3.1 Shall be prudent in the use and protection of information acquired in the course of their 
duties. 
3.2 Shall not use information for any personal ga in or in any manner that would be contrary 
to the law or detrimental to the legitimate and ethical objectives of the organization.  WT/BFA/W/175 
 Page 9 
 
 
  4. Competency 
Internal auditors: 
4.1. Shall engage only in those services fo r which they have the necessary knowledge, 
skills, and experience. 
4.2  Shall perform internal aud iting services in accordance with the International  Standards 
for the Professional Practice of Internal Auditing . 
4.3  Shall continually improve their proficie ncy and the effectiveness and quality of their 
services. 
  
_______________ 
 WT/BFA/W/175 
Page 10  
 
   
ANNEX 2 
 
Standards for the Professional Practice of Internal Auditing
 
 
International Standards for the Prof essional Practice of Internal Auditing 
  
Introduction 
1. Internal audit activities are performed in dive rse legal and cultural environments; within 
organizations that vary in purpose, size, complexity , and structure; and by persons within or outside 
the organization. While differences may affect the practice of internal auditing in each environment, 
compliance with the International Standards for the Professional Practice of Internal Auditing 
(Standards) is essential if the responsibilities of internal aud itors are to be met. If internal auditors are 
prohibited by laws or regulations from complying with certain parts of the Standards , they should 
comply with all other parts of the Standards and make appropriate disclosures. 
2. The purpose of the Standards is to: 
(a) Delineate basic principles that represent the practice of internal auditing as it should 
be.  
(b) Provide a framework for performing and pr omoting a broad range of value-added 
internal audit activities.  
(c) Establish the basis for the evaluati on of internal audit performance.  
(d) Foster improved organizational processes and operations. 
3. The Standards consist of Attribute, Performance, a nd Implementation Standards. Attribute 
Standards address the attributes of organizations a nd individuals performing internal audit services. 
The Performance Standards describe th e nature of internal audit services and provide quality criteria 
against which the performance of these services ca n be measured. The Attribute and Performance 
Standards apply to all internal audit services.  The Implementation St andards expand upon the 
Attribute and Performance Standards, providing guid ance applicable in specific types of engagements. 
These standards ultimately may deal with industry-sp ecific, regional, or specialty types of audit 
services. 
4. There is one set of Attribute and Performance Standards; however, there are multiple sets of 
Implementation Standards: a set for each of th e major types of internal audit activity. The 
Implementation Standards have been established for assurance (A) and consulting (C) activities. 
5. Assurance services involve the in ternal auditor's objective asse ssment of evidence to provide 
an independent opinion or  conclusions regarding a process, system, or other subject matter. The 
nature and scope of the assurance engagement are determined by the internal auditor. There are 
generally three parties involved in assurance servic es: (1) the person or gro up directly involved with 
the process, system, or other subject matter - the process owner, (2) the person or group making the 
assessment - the internal audito r, and (3) the person or group using the assessment - the user. 
6. Consulting services are advisory in nature, and are generally performed at the specific request 
of an engagement client. The nature and scope of the consulting engagement are subject to agreement 
with the engagement client. Cons ulting services generally involve two parties: (1) the person or group  WT/BFA/W/175 
 Page 11 
 
 
  offering the advice - the internal auditor, and (2 ) the person or group seeking and receiving the advice 
- the engagement client. When performing consul ting services the internal auditor should maintain 
objectivity and not assume management responsibility. 
7. The Standards employ terms that have been given specific meanings that are included in the 
Glossary. 
8. The development and issuance of the Standards is an ongoing process. The Internal Auditing 
Standards Board engages in exte nsive consultation and discussion prior to the issuance of the 
Standards . This includes worldwide solicitation for public comment through the exposure draft 
process. All exposure drafts are posted on The IIA's Web site as well as being distributed to all IIA 
institutes. 
9. Suggestions and comments regarding the Standards can be sent to: 
The Institute of Internal Auditors 
Professional Practices Department 
247 Maitland Avenue 
Altamonte Springs, FL 32701-4201, USA 
E-mail: standards@theiia.org   
Web: http://www.theiia.org  
  
Attribute Standards 
1000 - Purpose, Authority, and Responsibility  
The purpose, authority, and responsibility of the intern al audit activity should be formally defined in a 
charter, consistent with the Standards , and approved by the board. 
1000.A1  - The nature of assurance services provided to th e organization should be  defined in the audit 
charter.  If assurances are to be provided to pa rties outside the organization, the nature of these 
assurances should also be defined in the charter. 
1000.C1  - The nature of consulting services shoul d be defined in the audit charter. 
1100 - Independence and Objectivity  
The internal audit activity should be independent , and internal auditors should be objective in 
performing their work. 
1110 - Organizational Independence  
The chief audit executive should report to a level within  the organization that allows the internal audit 
activity to fulfill its responsibilities. 
1110.A1  - The internal audit activity should be free from interference in determining the scope of 
internal auditing, performing work, and communicating results. 
1120 - Individual Objectivity  
Internal auditors should have an impartial, unbiased attitude and avoid conflicts of interest. 
1130 - Impairments to Independence or Objectivity  
If independence or objectivity is impaired in fact or  appearance, the details of the impairment should 
be disclosed to appropriate parties.  The nature  of the disclosure will depend upon the impairment. WT/BFA/W/175 
Page 12  
 
  1130.A1  - Internal auditors should refrain from ass essing specific operations for which they were 
previously responsible.  Objectivity is presumed to  be impaired if an internal auditor provides 
assurance services for an activity for which the internal auditor had responsibility within the previous 
year. 
1130.A2  - Assurance engagements for functions over which the chief audit executive has 
responsibility should be overseen by a part y outside the internal audit activity. 
1130.C1  - Internal auditors may provide consulting ser vices relating to operations for which they had 
previous responsibilities.  
1130.C2  - If internal auditors have potential impairme nts to independence or objectivity relating to 
proposed consulting services, disclosure should be made  to the engagement client prior to accepting 
the engagement.   
1200 - Proficiency and Due Professional Care
 
Engagements should be performed with proficiency and due professional care. 
1210 - Proficiency  
Internal auditors should possess the knowledge, sk ills, and other competencies needed to perform 
their individual responsibilities.  The internal a udit activity collectively should possess or obtain the 
knowledge, skills, and other competencies needed to perform its responsibilities .  
1210.A1  - The chief audit executive should obtain comp etent advice and assistance if the internal 
audit staff lacks the knowledge, skills, or other comp etencies needed to perform all or part of the 
engagement. 
1210.A2  - The internal auditor should have sufficient knowledge to identify the indicators of fraud but 
is not expected to have the expertise of a pe rson whose primary responsib ility is detecting and 
investigating fraud. 
1210.A3 - Internal auditors should have knowledge of key information technology risks and controls 
and available technology-based audit techniques to  perform their assigned work.  However, not all 
internal auditors are expected to have the experti se of an internal auditor whose primary responsibility 
is information technology auditing. 
1210.C1  - The chief audit executive should decline th e consulting engagement or obtain competent 
advice and assistance if the internal audit staff lacks the knowledge, skills, or other competencies 
needed to perform all or part of the engagement.   
1220 - Due Professional Care  
Internal auditors should apply the care and skill expected of a reasonably prudent and competent 
internal auditor.  Due professiona l care does not imply infallibility. 
1220.A1  - The internal auditor should exercise due professional care by considering the: 
• Extent of work needed to achi eve the engagement's objectives.  
• Relative complexity, materiality, or signi ficance of matters to which assurance 
procedures are applied.  
• Adequacy and effectiveness of risk mana gement, control, and governance processes.   WT/BFA/W/175 
 Page 13 
 
 
  • Probability of significant errors, irregularities, or noncompliance.  
• Cost of assurance in relation to potential benefits.  
1220.A2 - In exercising due professional care the inte rnal auditor should consider the use of 
computer-assisted audit tools and other data analysis techniques. 
1220.A3  - The internal auditor should be alert to th e significant risks that might affect objectives, 
operations, or resources.  However, assurance pr ocedures alone, even when performed with due 
professional care, do not guarantee that all significant risks will be identified.  
1220.C1  - The internal auditor should exercise due professional care during a consulting engagement 
by considering the: 
• Needs and expectations of clients, incl uding the nature, timing, and communication 
of engagement results.  
• Relative complexity and extent of work  needed to achieve the engagement's 
objectives.  
• Cost of the consulting engagement in relation to potential benefits.  
1230 - Continuing Professional Development  
Internal auditors should enhance their knowledge, sk ills, and other competencies through continuing 
professional development. 
1300 - Quality Assurance and Improvement Program  
The chief audit executive should develop and mainta in a quality assurance and improvement program 
that covers all aspects of the internal audit activity and continuously monitors its effectiveness. This 
program includes periodic internal and external qua lity assessments and ongoing internal monitoring.  
Each part of the program should be designed to help the internal auditing activity add value and 
improve the organization's operations and to provide assurance that the internal audit activity is in 
conformity with the Standards  and the Code of Ethics . 
1310 - Quality Program Assessments  
The internal audit activity should adopt a process to monitor and assess the overall effectiveness of 
the quality program.  The process should include both internal and ex ternal assessments. 
1311 - Internal Assessments  
Internal assessments should include: 
• Ongoing reviews of the performance of the internal audit activity; and  
• Periodic reviews performed through self-asse ssment or by other persons within the 
organization, with knowledge of internal audit practices and the Standards .  
1312 - External Assessments  
External assessments should be conducted at leas t once every five years by a qualified, independent 
reviewer or review team from outside the organiz ation.  The potential need for more frequent 
external assessments as well as the qualificatio ns and independence of the external reviewer or 
review team, including any potential conflict of interest, should be discussed by the CAE with the 
Board. Such discussions should also consider the si ze, complexity and industry of the organization 
in relation to the experience of the reviewer or review team.  WT/BFA/W/175 
Page 14  
 
  1320 - Reporting on the Quality Program
 
The chief audit executive should communicate the results of external ass essments to the board. 
1330 - Use of "Conducted in Accordance with the Standards"  
Internal auditors are encouraged to report that  their activities are "conducted in accordance with the 
International  Standards for the Professional Practice of Internal Auditing. "  However, internal 
auditors may use the statement only if assessments  of the quality improvement program demonstrate 
that the internal audit activity  is in compliance with the Standards . 
1340 - Disclosure of Noncompliance  
Although the internal audit activity sh ould achieve full compliance with the Standards  and internal 
auditors with the Code of Ethics , there may be instances in which full compliance is not 
achieved. When noncompliance impacts the overall scope  or operation of the internal audit activity, 
disclosure should be made to senior management and the board. 
Performance Standards 
2000 - Managing the Internal Audit Activity  
The chief audit executive should effectively manage th e internal audit activity to ensure it adds value 
to the organization. 
2010 - Planning  
The chief audit executive should estab lish risk-based plans to determine the priorities of the internal 
audit activity, consistent w ith the organization's goals. 
2010.A1  - The internal audit activity's plan of e ngagements should be based on a risk assessment, 
undertaken at least annually. The input of senior ma nagement and the board should be considered in 
this process. 
2010.C1  - The chief audit executive should consider  accepting proposed consulting engagements 
based on the engagement's potential to improve mana gement of risks, add value, and improve the 
organization's operations.  Those engagements that ha ve been accepted should be included in the plan. 
2020 - Communication and Approval  
The chief audit executive should communicate the internal audit activity's plans and resource 
requirements, including significant interim changes, to senior management and to the board for review 
and approval.  The chief audit executive should also  communicate the impact of resource limitations. 
2030 - Resource Management  
The chief audit executive should ensu re that internal audit resources are appropriate, sufficient, and 
effectively deployed to achieve the approved plan. 
2040 - Policies and Procedures  
The chief audit executive should establish policies and procedures to guide the internal audit activity. 
2050 - Coordination  
The chief audit executive should share information a nd coordinate activities with other internal and 
external providers of relevant assurance and c onsulting services to ensure  proper coverage and 
minimize duplication of efforts. 
2060 - Reporting to the Board and Senior Management  
The chief audit executive should report periodically  to the board and senior management on the 
internal audit activity's purpose, authority, res ponsibility, and performance relative to its plan.   WT/BFA/W/175 
 Page 15 
 
 
  Reporting should also include significant risk exposures and control issues, corporate governance 
issues, and other matters needed or requ ested by the board and senior management. 
2100 - Nature of Work  
The internal audit activity should evaluate and cont ribute to the improvement of risk management, 
control, and governance processes using a systematic and disciplined approach. 
2110 - Risk Management  
The internal audit activity should assist the orga nization by identifying and evaluating significant 
exposures to risk and contributing to the improveme nt of risk management and control systems. 
2110.A1  - The internal audit activity should monito r and evaluate the effectiveness of the 
organization's risk management system. 
2110.A2  - The internal audit activity should evaluate risk exposures relating to the organization's 
governance, operations, and information systems regarding the 
• Reliability and integrity of financ ial and operational information.  
• Effectiveness and efficiency of operations.  
• Safeguarding of assets.  
• Compliance with laws, regulations, and contracts.  
2110.C1 -  During consulting engagements, internal audito rs should address risk consistent with the 
engagement's objectives and   be alert to  the existence of other significant risks . 
2110.C2  - Internal auditors should incorporate knowledge of risks gained from consulting 
engagements into the process of identifying an d evaluating significant risk exposures of the 
organization. 
2120 - Control  
The internal audit activity should assist the orga nization in maintaining effective controls by 
evaluating their effectiveness and efficiency and by promoting continuous improvement. 
2120.A1  - Based on the results of the risk assessment, the internal audit activity should evaluate the 
adequacy and effectiveness of controls encomp assing the organization's governance, operations, and 
information systems.  This should include: 
• Reliability and integrity of financ ial and operational information.  
• Effectiveness and efficiency of operations.  
• Safeguarding of assets.  
• Compliance with laws, regulations, and contracts.  
2120.A2  - Internal auditors should ascertain the exte nt to which operating and program goals and 
objectives have been established and conform to those of the organization. 
2120.A3  - Internal auditors should review operations and programs to ascertain the extent to which 
results are consistent with established goals a nd objectives to determine whether operations and 
programs are being implemented or performed as intended. WT/BFA/W/175 
Page 16  
 
  2120.A4  - Adequate criteria are needed to evaluate c ontrols.  Internal auditors should ascertain the 
extent to which management has established ade quate criteria to determine whether objectives and 
goals have been accomplished.  If adequate, intern al auditors should use such criteria in their 
evaluation.  If inadequate, internal auditors s hould work with management to develop appropriate 
evaluation criteria. 
2120.C1 -  During consulting engagements, internal aud itors should address controls consistent with 
the engagement's objectives and   be alert to th e existence of any significant control weaknesses. 
2120.C2  - Internal auditors should incorporate k nowledge of controls gained from consulting 
engagements into the process of identifying an d evaluating significant risk exposures of the 
organization.   
2130 - Governance
 
The internal audit activity should assess and make  appropriate recommendations for improving the 
governance process in its accomplishment of the following objectives: 
• Promoting appropriate ethics and va lues within the organization.  
• Ensuring effective organizational perform ance management and accountability.  
• Effectively communicating risk and control information to appropriate areas of the 
organization.  
• Effectively coordinating the activities of and communicating information among the board, 
external and internal auditors and management.  
2130.A1  - The internal audit activity s hould evaluate the design, impl ementation, and effectiveness of 
the organization's ethics-related objectives, programs and activities. 
2130.C1  - Consulting engagement objectives should be c onsistent with the overa ll values and goals of 
the organization. 
2200 - Engagement Planning  
Internal auditors should devel op and record a plan for each engagement, including the scope, 
objectives, timing and resource allocations. 
2201 - Planning Considerations  
In planning the engagement, inte rnal auditors should consider: 
• The objectives of the activity being reviewed and the means by which the activity controls its 
performance.  
• The significant risks to the activity, its objectiv es, resources, and operations and the means by 
which the potential impact of risk is kept to an acceptable level.  
• The adequacy and effectiveness of the activity's risk management and control systems 
compared to a relevant control framework or model.  
• The opportunities for making significant improvements to the activity's risk management and 
control systems.  
2201.A1 - When planning an engagement for parties outsi de the organization, internal auditors should 
establish a written understanding with them about objectives, scope, respective responsibilities and  WT/BFA/W/175 
 Page 17 
 
 
  other expectations, including restrictions on distribu tion of the results of the engagement and access to 
engagement records. 
2201.C1  - Internal auditors should establish an unde rstanding with consultin g engagement clients 
about objectives, scope, respective responsibilities, and other client expectations. For significant 
engagements, this understandi ng should be documented. 
2210 - Engagement Objectives  
Objectives should be established for each engagement. 
2210.A1 - Internal auditors should co nduct a preliminary assessment of the risks relevant to the 
activity under review.  Engagement objectives s hould reflect the results of this assessment.  
2210.A2  - The internal auditor should  consider the probability of significant errors, irregularities, 
noncompliance, and other exposures when developing the engagement objectives. 
2210.C1  - Consulting engagement objectives should addr ess risks, controls, and governance processes 
to the extent agreed upon with the client. 
2220 - Engagement Scope  
The established scope should be sufficient to  satisfy the objectives of the engagement. 
2220.A1  - The scope of the engagement should include consideration of relevant systems, records, 
personnel, and physical properties, including those under the control of third parties. 
2220.A2 - If significant consulting opportunities arise during an assurance engagement, a specific 
written understanding as to the objectives, scope, r espective responsibilities and other expectations 
should be reached and the results of the consu lting engagement communicated in accordance with 
consulting standards. 
2220.C1  - In performing consulting engagements, internal  auditors should ensure that the scope of the 
engagement is sufficient to address the agreed -upon objectives.  If internal auditors develop 
reservations about the scope durin g the engagement, these reservations should be discussed with the 
client to determine whether to continue with the engagement.  
2230 - Engagement Resource Allocation  
Internal auditors should determin e appropriate resources to achieve  engagement objectives.  Staffing 
should be based on an evaluation of the nature and complexity of each engagement, time constraints, 
and available resources. 
2240 - Engagement Work Program  
Internal auditors should develop work programs th at achieve the engagement objectives.  These work 
programs should be recorded. 
2240.A1  - Work programs should establish the procedur es for identifying, analyzing, evaluating, and 
recording information during the engagement. The work program should be approved prior to its 
implementation, and any adju stments approved promptly.  
2240.C1 -  Work programs for consulting engagements may vary in form and content depending upon 
the nature of the engagement. WT/BFA/W/175 
Page 18  
 
  2300 - Performing the Engagement
 
Internal auditors should identify, analyze, evaluate , and record sufficient information to achieve the 
engagement's objectives. 
2310 - Identifying Information  
Internal auditors should identify sufficient, reliable,  relevant, and useful information to achieve the 
engagement's objectives. 
2320 - Analysis and Evaluation  
Internal auditors should base conclusions and engagement results on appropriate analyses and 
evaluations. 
2330 - Recording Information  
Internal auditors should record relevant inform ation to support the conc lusions and engagement 
results. 
2330.A1  - The chief audit executive should control access to engagement records.  The chief audit 
executive should obtain the approval of senior manage ment and/or legal counsel prior to releasing 
such records to external parties, as appropriate. 
2330.A2  - The chief audit executive should develop reten tion requirements for engagement records.   
These retention requirements should be consistent w ith the organization's guidelines and any pertinent 
regulatory or other requirements. 
2330.C1  - The chief audit executive should develop po licies governing the custody and retention of 
engagement records, as well as their release to internal and external parties.  These policies should be 
consistent with the organization's guidelines and an y pertinent regulatory or other requirements. 
2340 - Engagement Supervision  
Engagements should be prope rly supervised to ensure objectives are achieved, quality is assured, and 
staff is developed.       
2400 - Communicating Results  
Internal auditors should communicate the engagement results. 
2410 - Criteria for Communicating  
Communications should include the engagement's  objectives and scope as well as applicable 
conclusions, recommendations, and action plans. 
2410.A1 - Final communication of engagement results s hould, where appropriate, contain the internal 
auditor's overall opinion and or conclusions. 
2410.A2  - Internal auditors are encouraged to acknow ledge satisfactory performance in engagement 
communications. 
2410.A3 - When releasing engagement results to parties outside the organization, the communication 
should include limitations on distribution and use of the results.  
2410.C1  - Communication of the progress and results of  consulting engagements will vary in form 
and content depending upon the nature of the engagement and the needs of the client. 
2420 - Quality of Communications  
Communications should be accurate, objective, clear, concise, constructive, complete, and timely.  WT/BFA/W/175 
 Page 19 
 
 
  2421 - Errors and Omissions  
If a final communication contains a significant error or omission, the chief audit executive should 
communicate corrected information to all par ties who received the original communication. 
2430 - Engagement Disclosure of Noncompliance with the Standards  
When noncompliance with the Standards  impacts a specific engagement, communication of the 
results should disclose the: 
• Standard(s)  with which full compliance was not achieved,  
• Reason(s) for noncompliance, and  
• Impact of noncompliance on the engagement.  
2440 - Disseminating Results  
The chief audit executive should communicat e results to the appropriate parties. 
2440.A1  - The chief audit executive is responsible for communicating the final results to parties who 
can ensure that the results are given due consideration. 
2440.A2 - If not otherwise mandated by legal, statutory or regulatory requirements, prior to releasing 
results to parties outside the organization, the chief audit executive should: 
• Assess the potential risk to the organization.  
• Consult with senior management and/ or legal counsel as appropriate  
• Control dissemination by restricting the use of the results.  
2440.C1  - The chief audit executive is responsible fo r communicating the final results of consulting 
engagements to clients.  
2440.C2  - During consulting engagements, risk management, control, and governance issues may be 
identified.  Whenever these issues are significant to the organization, they should be communicated to 
senior management and the board. 
2500 - Monitoring Progress  
The chief audit executive should establish and maintain  a system to monitor the disposition of results 
communicated to management. 
2500.A1  - The chief audit executive should establish a fo llow-up process to monitor and ensure that 
management actions have been effectively implemen ted or that senior management has accepted the 
risk of not taking action. 
2500.C1  - The internal audit activity should monito r the disposition of results of consulting 
engagements to the extent agreed upon with the client. 
2600 -  Resolution of  Management's  Acceptance of Risks  
When the chief audit executive belie ves that senior management has accepted a level of residual risk 
that may be unacceptable to the organization, the chief audit executive should discuss the matter with 
senior management.  If the decision regarding residua l risk is not resolved, the chief audit executive 
and senior management should report the matter to the board for resolution. WT/BFA/W/175 
Page 20  
 
  Glossary 
 
Add Value -  Value is provided by improving opportuni ties to achieve organizational objectives, 
identifying operational improvement, and/or re ducing risk exposure through both assurance and 
consulting services.  
 
Adequate Control  - Present if management has planned a nd organized (designed) in a manner that 
provides reasonable assurance that the organization's ri sks have been managed effectively and that the 
organization's goals and objectives will be  achieved efficiently and economically. 
 
Assurance Services  - An objective examination of eviden ce for the purpose of providing an 
independent assessment on risk management, control, or governance processes for the organization.  Examples may include financial, performance, co mpliance, system security, and due diligence 
engagements.  
Board - A board is an organization's governing body, su ch as a board of directors, supervisory board, 
head of an agency or legislative body, board of governors or trustees of a non profit organization, or any other designated body of the organization, incl uding the audit committee, to whom the chief audit 
executive may functionally report.  Charter  - The charter of the internal audit activity is a formal written document that defines the 
activity's purpose, authority, and responsibility.  The charter should (a) establish the internal audit 
activity's position within the organization; (b) auth orize access to records, personnel, and physical 
properties relevant to the performance of engageme nts; and (c) define the scope of internal audit 
activities.  
Chief Audit Executive  - Top position within the organization r esponsible for internal audit activities. 
Normally, this would be the internal audit direct or.  In the case where internal audit activities are 
obtained from outside service providers, the chief audit executive is the person responsible for overseeing the service contract and the overall qua lity assurance of these activities, reporting to senior 
management and the board regardi ng internal audit activities, and follow-up of engagement results.  
The term also includes such titles as general auditor,  chief internal auditor, and inspector general. 
 
Code of Ethics - The Code of Ethics of The Institute of Inte rnal Auditors (IIA) are Principles relevant 
to the profession and practice of internal auditi ng, and Rules of Conduct that describe behavior 
expected of internal auditors.  The Code of Ethics applies to both parties and entities that provide internal audit services.  The purpose of the Code of  Ethics is to promote an ethical culture in the 
global profession of internal auditing. 
 
Compliance -  Conformity and adherence to policies, plan s, procedures, laws, regulations, contracts, 
or other requirements. 
Conflict of Interest  - Any relationship that is or appears to  be not in the best interest of the 
organization.  A conflict of interest would prejudice an individual's ability to perform his or her duties 
and responsibilities objectively. 
Consulting Services  - Advisory and related client service activities, the nature and scope of which 
are agreed with the client and which are inte nded to add value and im prove an organization's 
governance, risk management, and control pr ocesses without the internal auditor assuming 
management responsibility.  Examples include  counsel, advice, facilitation and training.  WT/BFA/W/175 
 Page 21 
 
 
  Control  - Any action taken by management, the board, and other parties to manage  risk and increase 
the likelihood that established objec tives and goals will be achieved.  Management plans, organizes, 
and directs the performance of sufficient actions to provide reasonable assurance that objectives and goals will be achieved. 
Control Environment  - The attitude and actions of the board and management regarding the 
significance of control within the organization. Th e control environment provides the discipline and 
structure for the achievement of the primary objectives of the system of internal control.  The control 
environment includes the following elements: 
• Integrity and ethical values.  
• Management's philosophy and operating style.  
• Organizational structure.  
• Assignment of authority and responsibility.   
• Human resource policies and practices.  
• Competence of personnel.  
Control Processes  - The policies, procedures, and activities that are part of a control framework, 
designed to ensure that risks are contained with in the risk tolerances established by the risk 
management process. 
Engagement  - A specific internal audit assignment, task, or  review activity, such as an internal audit, 
Control Self-Assessment review, fraud examination, or consultancy.  An engagement may include 
multiple tasks or activities designed to acco mplish a specific set of related objectives. 
Engagement Objectives  - Broad statements developed by inte rnal auditors that define intended 
engagement accomplishments. 
Engagement Work Program  - A document that lists the procedures to be followed during an 
engagement, designed to achieve the engagement plan. 
External Service Provider  - A person or firm, outside of the organization, who has special 
knowledge, skill, and experience in a particular discipline. 
Fraud  - Any illegal acts characterized by deceit, conceal ment or violation of trust.  These acts are not 
dependent upon the application of threat of violence or  of physical force.  Frauds are perpetrated by 
parties and organizations to obtai n money, property or services; to avoid payment or loss of services; 
or to secure personal or business advantage. 
Governance  - The combination of processes and structures implemented by the board in order to 
inform, direct, manage and monitor the activities of  the organization toward the achievement of its 
objectives. 
Impairments  - Impairments to individual objectivity and organizational independence may include 
personal conflicts of interest, sc ope limitations, restrictions on access to records, personnel, and 
properties, and resource limitations (funding). WT/BFA/W/175 
Page 22  
 
  Independence -  The freedom from conditions that threaten objectivity or the appearance of 
objectivity.  Such threats to objectivity must be  managed at the individual auditor, engagement, 
functional and organizational levels. 
Internal Audit Activity  - A department, division, team of c onsultants, or other practitioner(s) that 
provides independent, objective assurance and consu lting services designed to add value and improve 
an organization's operations.  The internal a udit activity helps an organization accomplish its 
objectives by bringing a systematic, disciplined appro ach to evaluate and improve the effectiveness of 
risk management, control, and governance processes. 
Objectivity  - An unbiased mental attitude that allows in ternal auditors to perform engagements in 
such a manner that they have an honest belief in their work product and that no significant quality compromises are made.  Objectivity requires intern al auditors not to subordinate their judgment on 
audit matters to that of others. 
Residual Risks - The risk remaining after management takes action to reduce the impact and 
likelihood of an adverse event, including control activities in responding to a risk. 
Risk  - The possibility of an event occurring that will have an impact on the achievement of 
objectives.  Risk is measured in terms of impact and likelihood. 
Risk Management  - A process to identify, assess, manage, and control potential events or situations, 
to provide reasonable assurance regarding the achievement of the organization's objectives. 
Should - The use of the word "should" in the St andards represents a mandatory obligation. 
Standard -  A professional pronouncement promulgated by th e Internal Auditing Standards Board that 
delineates the requirements for performing a broad range of internal audit activities, and for 
evaluating internal audit performance. 
 
__________