Legal, finance and accounting
Certified Internal Auditor
Provide independent, objective assurance and consultancy to add value and improve an organisation's operations
Summary
This occupation is found in all organisations that require oversight of their risk management and internal processes. Organisations that employ Certified Internal Auditors are typically medium to large public, third-sector or private organisations. This includes companies that deal in goods and services, financial institutions, and government departments. Accountancy firms employ Certified Internal Auditors to perform internal audits on behalf of their clients within those clients' businesses and organisations. Companies may employ their own Certified Internal Auditors to perform in-house internal audits. Alternatively, they may choose to outsource their internal audit activities to third parties. In the public sector, an internal audit function will carry out in-house internal audits in organisations such as central government departments, local authorities, regulators, and higher education institutions. Certified Internal Auditors are qualified and recognised globally by the Institute of Internal Auditors (IIA) and in the UK and Ireland by the Chartered Institute of Internal Auditors (CIIA). They carry out their activities with reference to the Global Internal Audit Standards.
The broad purpose of the occupation is to provide an independent and objective assurance and advisory service that adds value and improves an organisation's operations. Certified Internal Auditors support organisations in accomplishing their objectives by bringing a systematic and disciplined approach to evaluating and improving the effectiveness of governance, risk management, and control processes. Internal audit activities assess the adequacy and effectiveness of all areas of an organisation, including risk management, compliance, and financial functions. Internal audit must remain impartial and independent in its work across all areas of the organisation. Certified Internal Auditors are recognised professionals in risk management, internal audit, governance, and control. They are globally recognised as professional internal auditors. They communicate complex concepts to both technical and non-technical stakeholders, ensuring that stakeholders understand audit outcomes and areas for improvement. Certified Internal Auditors provide challenging and sometimes provocative insights into risks and internal controls. They always act independently and objectively, representing the interests of the organisation's stakeholders. They maintain the highest standards of professional conduct and competence, and they consistently uphold ethical behaviour and integrity.
In their daily work, an employee in this occupation interacts with an internal audit team and may manage other internal audit professionals. A Certified Internal Auditor typically reports to an Internal Audit Manager or Chief Audit Executive. They interact with stakeholders across the organisation who have an interest in audit activities, whether they are subject to internal audit activity, receive assurance, or own the outcomes.
An employee in this occupation will work both independently and as part of a team to deliver internal audit engagements. This includes tasks such as planning, testing processes for design, effectiveness, and accuracy, and report writing. Their work is supervised to ensure quality, but they manage their workflow in line with a rigorous methodology and with reference to the Global Internal Audit Standards and sector-specific practice. They ensure that audits are conducted in accordance with the organisation's internal audit manual.
Typical job titles include
- Certified Internal Auditor
Knowledge, skills and behaviours (KSBs)
K1:
The purpose of internal auditing according to the Global Internal Audit Standards.
K2:
The internal audit mandate and responsibilities of the board and chief audit executive.
K3:
The requirements of an internal audit charter.
K4:
The differences between assurance services and advisory services provided by the internal audit function.
K5:
The purpose and responsibilities of the audit committee.
K6:
The types of assurance and advisory services performed by the internal audit function.
K7:
Situations in which the independence of the internal audit function may be impaired.
K8:
The internal audit function's role in the organisation's risk management process.
K9:
Ethics and professionalism in accordance with the Global Internal Audit Standards.
K10:
The concept of organisational governance.
K11:
The impact of organisational culture on the overall control environment and individual engagement risks and controls.
K12:
Fundamental concepts of risk types.
K13:
Fundamental concepts of the risk management process and its operation within organisations.
K14:
Internal control concepts and types of controls, including the importance of the design, effectiveness, and efficiency of both financial and non-financial internal controls.
K15:
Concepts of fraud risk and types of fraud, and how to determine whether fraud risks require special consideration during an engagement.
K16:
The potential for fraud and how organisations detect, manage, and prevent fraud through controls.
K17:
Fraud investigation techniques and the internal audit function’s role in fraud investigations.
K18:
Approaches to determine internal audit engagement objectives and scope.
K19:
Approaches to assessing key risks and controls and determining evaluation criteria.
K20:
Principles of conducting detailed risk assessments of each activity under review.
K21:
Approaches to engagement procedures and preparing an engagement work program.
K22:
Approaches to resource and skills planning needed for internal audit engagements.
K23:
Approaches to identifying sources of information to support internal audit engagement objectives and procedures.
K24:
Approaches to evaluating the relevance, sufficiency, and reliability of evidence gathered to support internal audit engagement objectives.
K25:
The different types of technology internal auditors may use to develop and support engagement findings and conclusions, including emerging technologies such as artificial intelligence.
K26:
Appropriate analytical approaches and process mapping techniques.
K27:
Approaches to determining the difference between evaluation criteria and existing conditions, and to evaluating the significance of each finding.
K28:
Principles for the preparation of workpapers, including relevant information to support conclusions and engagement results.
K29:
Approaches to summarising and developing engagement conclusions.
K30:
Principles of appropriate supervision throughout internal audit engagements.
K31:
Approaches to appropriate communication with stakeholders throughout internal audit engagements.
K32:
Methodologies for the planning, organising, directing, and monitoring of internal audit operations, taking account of sustainability and the environment.
K33:
Key activities for managing financial, human, and IT resources within the internal audit function.
K34:
The key elements required to align internal audit strategy to stakeholder expectations.
K35:
The chief audit executive’s responsibilities for building relationships and communicating with senior management and the board on various matters.
K36:
Sources of potential internal audit engagements.
K37:
The processes to develop a risk-based internal audit plan.
K38:
The required elements of the quality assurance and improvement programme.
K39:
The importance for internal auditors to coordinate with other assurance providers and leverage their work.
K40:
Practical methods for establishing internal audit key performance indicators (KPIs) and scorecard metrics that the chief audit executive communicates to senior management and the board.
K41:
Appropriate disclosure of non-conformance with the Global Internal Audit Standards.
K42:
Attributes of effective engagement results communication.
K43:
The concept and different approaches to root cause analysis.
K44:
Approaches to developing recommendations, requesting action plans from management, or collaborating with management to agree on actions.
K45:
The engagement closing communication and reporting process.
K46:
The process for communicating risk acceptance when management has accepted a level of risk that may be unacceptable to the organisation.
K47:
The chief audit executive’s responsibility for assessing residual risk for the engagement.
K48:
The process for monitoring and confirming the implementation of management action plans.
K49:
The escalation process if management has not adequately implemented an action plan.
K50:
Approaches for the chief audit executive to assess and report an organisational-level opinion on governance, risk management, and internal control arrangements.
Technical Educational Products
- ST1487: Certified internal auditor (Level 6) Development stage
- Reference:
- OCC1487
- Status:
Occupational standard in development
- SOC 2020 code:
- 0
- SOC 2020 sub unit groups:
S1:
Identify situations where the independence of the internal audit function may be impaired.
S2:
Determine engagement objectives, scope, key risks, controls, and evaluation criteria.
S3:
Evaluate the potential for fraud in individual engagements and how the organisation could detect and manage fraud risks.
S4:
Determine whether fraud risks require special consideration during an engagement.
S5:
Identify sources of information to support engagement objectives.
S6:
Identify the level of resources and skills needed for the engagement.
S7:
Use appropriate technology options to develop and support engagement findings and conclusions.
S8:
Determine and prepare the engagement work programme.
S9:
Complete a detailed risk assessment of each activity under review.
S10:
Evaluate the relevance, sufficiency, and reliability of evidence gathered to support engagement objectives.
S11:
Apply appropriate analytical review and process mapping techniques.
S12:
Determine whether there is a difference between evaluation criteria and existing conditions, and evaluate the significance of each finding.
S13:
Undertake a root cause analysis of any differences between the evaluation criteria and existing conditions.
S14:
Prepare workpapers, including relevant information to support conclusions and engagement results.
S15:
Summarise and develop engagement conclusions.
S16:
Communicate appropriately with stakeholders throughout the engagement.
S17:
Communicate engagement results with clarity and precision to ensure understanding.
S18:
Develop recommendations, request action plans from management, or collaborate with management to agree on actions.
S19:
Undertake the engagement closing communication and reporting process.
S20:
Evaluate management’s responses to recommendations or proposed action plans, identify any inappropriate levels of risk acceptance when management has accepted a level of risk that may be unacceptable to the organisation, and escalate accordingly.
S21:
Monitor and confirm the implementation of management action plans.
Technical Educational Products
- ST1487: Certified internal auditor (Level 6) Development stage
- Reference:
- OCC1487
- Status:
Occupational standard in development
- SOC 2020 code:
- 0
- SOC 2020 sub unit groups:
B1:
Is honest in conducting internal audit activities, demonstrating integrity and professional courage.
B2:
Is rigorous in ensuring the factual accuracy of internal audit activities.
B3:
Is respectful when carrying out internal audit activities with stakeholders, including through communications.
B4:
Is compliant with policies, procedures, laws, and regulations relevant to the organisation, sector, and jurisdictions in which they operate.
B5:
Is ethical, demonstrating professional objectivity and an impartial, unbiased mindset when making judgements.
Technical Educational Products
- ST1487: Certified internal auditor (Level 6) Development stage
- Reference:
- OCC1487
- Status:
- Occupational standard in development
- SOC 2020 code:
- 0
- SOC 2020 sub unit groups:
