The Accountant-May-June 2017

Financial reporting and assurance
The model distinguishes among three
groups (or lines) involved in effective risk
management:
• Functions that own and manage risk
by implementing corrective actions to
address process and control deficiencies
(operation management)
• Functions that oversee risks and assist
management in developing processes
and controls to manage risks (risk
management and compliance
functions)
• Functions that provide independent
assurance on the effectiveness of
governance, risk management and
internal controls including the manner in
which the first and second lines of defense
achieve risk management and control
objectives (internal audit function)
The position paper goes on to state that
the “three lines of defense” model is best
implemented with the active support and
guidance of the organization’s governing
body and senior management. Separately,
the IPPF recommends a dual reporting
relationship for the head of the internal
audit function; to senior management and
the Board. In light of these authoritative
views, are what we call internal audit
failures in fact failures of management
and the Board? Practice today is that the
head of internal audit functionally reports
to the Board’s audit committee. The IPPF
describes functional reporting by way of
examples to include:
• Approving the internal audit charter;
• Approving the risk based internal
audit plan;
• Approving the internal audit budget
and resource plan;
• Receiving communications from the
head of internal audit on the internal
audit activity’s performance relative to
its plan and other matters;
• Approving decisions regarding the
appointment and removal of the head
of internal audit;
• Approving the remuneration of the
head of internal audit; and
• Making appropriate inquiries of
management and the head of internal
audit to determine whether there are
inappropriate scope or resource
limitations
As functional supervisors of
the internal audit function, should
stakeholders start asking; where was
the Board’s audit committee? Brown
Governance Institute (BGI), a respected
thought leader in corporate governance
issued a publication in 2011 titled
‘Boardroom Behaviour and Governance’.
The publication explored the symptoms
of good and bad boardroom behavior
and recommended great tools and
resources that can help Boards improve
boardroom behavior and from these,
strategies that can immensely assist Board
audit committees to effectively supervise
internal audit functions.
The foregoing narratives do not
seek to entirely absolve internal audit
functions from internal control failures.
The IPPF through its attribute standards
requires internal audit engagements
to be performed with proficiency and
due professional care, and that internal
auditors independence and objectivity
must not be impaired in fact or appearance.
In addition, the head of internal audit
is required to develop and maintain
a quality assurance and improvement
program (QAIP) that covers all aspects
of the internal audit activity. Specifically,
external assessments must be conducted
at least once every five years by a qualified,
independent assessor or assessment team
from outside the organization. When
non-conformance with the Definition of
Internal Auditing, the Code of Ethics,
or the IPPF impacts the overall scope or
operation of the internal audit activity,
the head of internal audit must disclose
the non-conformance and the impact to
senior management and the board.
In conclusion, it should not be lost on
stakeholders and other interest groups that
the organization’s management has the
primary responsibility for managing risks.
This means that operational and executive
management is responsible for identifying,
analyzing, evaluating, treating, monitoring
and reviewing risks. The second and
third lines of defense provide support to
operational and executive management
but must not accept responsibility for
any of the risk management steps. The
Board’s audit committee or its equivalent
is mandated to effectively supervise the
internal audit function and is strategically
placed to counsel executive management
on risk management priorities and
strategies. Board audit committees or
their equivalent should consider assessing
themselves against BGI’s ‘Boardroom
Behavior and Governance’ standards.
Finally, effective internal audit functions
are those that fully comply with the IPPF.
References:
2013 International Professional Practices Framework (Institute of Internal Auditors website)
Debra L. Brown and David A. H. Brown, Boardroom Behaviours and Governance (2011)
2016 Report to the Nations on Occupational fraud and Abuse (Association of Certified Fraud
Examiners website)
IIA Position Paper, The Three Lines of defense in Effective Risk Management and Control (2013)
MAY - JUNE 2017 7