Proficiency and Due Professional Care

Primary Related Standard
1200 – Proficiency and Due Professional Care
Engagements must be performed with proficiency and due professional care.
1. Proficiency and due professional care are the responsibility of the chief audit executive
(CAE) and each internal auditor. As such, the CAE ensures that persons assigned to each
engagement collectively possess the necessary knowledge, skills, and other competencies
to conduct the engagement appropriately.
2. Due professional care includes conforming with the Code of Ethics and, as appropriate, the
organization’s code of conduct as well as the codes of conduct for other professional
designations the internal auditors may hold. The Code of Ethics extends beyond the
Definition of Internal Auditing to include two essential components:
• Principles that are relevant to the profession and practice of internal auditing: integrity,
objectivity, confidentiality, and competency.
• Rules of conduct that describe behavioral norms expected of internal auditors. These
rules are an aid to interpreting the principles into practical applications and are intended
to guide the ethical conduct of internal auditors.

Organizational Independence

Primary Related Standard
1110 – Organizational Independence
The chief audit executive must report to a level within the organization that allows the internal
audit activity to fulfill its responsibilities. The chief audit executive must confirm to the board, at
least annually, the organizational independence of the internal audit activity.
1. Support from senior management and the board assists the internal audit activity in gaining
the cooperation of engagement clients and performing their work free from interference.
2. The chief audit executive (CAE), reporting functionally to the board and administratively to
the organization’s chief executive officer, facilitates organizational independence. At a
minimum the CAE needs to report to an individual in the organization with sufficient authority
to promote independence and to ensure broad audit coverage, adequate consideration of
engagement communications, and appropriate action on engagement recommendations.
3. Functional reporting to the board typically involves the board:
• Approving the internal audit activity’s overall charter.
• Approving the internal audit risk assessment and related audit plan.
• Receiving communications from the CAE on the results of the internal audit activities or
other matters that the CAE determines are necessary, including private meetings with
the CAE without management present, as well as annual confirmation of the internal
audit activity’s organizational independence.
• Approving all decisions regarding the performance evaluation, appointment, or removal
of the CAE.
• Approving the annual compensation and salary adjustment of the CAE.
• Making appropriate inquiries of management and the CAE to determine whether there is
audit scope or budgetary limitations that impede the ability of the internal audit activity to
execute its responsibilities.
4. Administrative reporting is the reporting relationship within the organization’s management
structure that facilitates the day-to-day operations of the internal audit activity.
Administrative reporting typically includes:
• Budgeting and management accounting.
• Human resource administration, including personnel evaluations and compensation.
• Internal communications and information flows.
• Administration of the internal audit activity’s policies and procedures.

Internal Audit Charter

Primary Related Standard
1000 – Purpose, Authority, and Responsibility
The purpose, authority, and responsibility of the internal audit activity must be formally defined
in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of
Ethics, and the Standards. The chief audit executive must periodically review the internal audit
charter and present it to senior management and the board for approval.
Interpretation:
The internal audit charter is a formal document that defines the internal audit activity's purpose,
authority, and responsibility. The internal audit charter establishes the internal audit activity's
position within the organization; authorizes access to records, personnel, and physical
properties relevant to the performance of engagements; and defines the scope of internal audit
activities. Final approval of the internal audit charter resides with the board.
1. Providing a formal, written internal audit charter is critical in managing the internal audit
activity. The internal audit charter provides a recognized statement for review and
acceptance by management and for approval, as documented in the minutes, by the board.
It also facilitates a periodic assessment of the adequacy of the internal audit activity’s
purpose, authority, and responsibility, which establishes the role of the internal audit activity.
If a question should arise, the internal audit charter provides a formal, written agreement
with management and the board about the organization’s internal audit activity.
2. The chief audit executive (CAE) is responsible for periodically assessing whether the
internal audit activity’s purpose, authority, and responsibility, as defined in the internal audit
charter, continue to be adequate to enable the activity to accomplish its objectives. The
CAE is also responsible for communicating the result of this assessment to senior
management and the board.