Regulating the Internal Audit Profession: A South African Perspective

Introduction

The internal audit profession plays a critical role in promoting accountability, governance, and transparency across both public and private sectors. In South Africa, the regulatory and legal framework governing this vital profession has notable gaps that limit its impact and efficiency.

Drawing from the insights provided by IIA Global’s Public Policy Position Paper: A Legal, Regulatory, and Policy Framework for the Internal Audit Profession, this article examines South Africa's current regulatory landscape, the essential and optional policy initiatives proposed by the IIA, and the steps needed to align the profession with international best practices.

IIA Global’s Framework

The IIA Global’s policy paper serves as a reference document for national institutes to advocate for a robust legal and regulatory framework for the internal audit profession. It outlines Essential Public Policies that all countries should adopt and Optional Policy Initiatives that countries may consider based on their unique contexts.

The five essential policies are:

1. Defining the core concepts of “internal auditing” and the “internal audit function” in law or regulation.
2. Adoption of the International Professional Practices Framework (IPPF), including the Global Internal Audit Standards.
3. Protecting the self-regulatory model of the profession.
4. Mandating internal audit functions in sectors where it serves the public interest.
5. Aligning regulations governing accountants and external auditors with internal audit standards.

The four optional policies are:

1. Enhancing protections for internal auditors facing threats or harassment.
2. Strengthening whistleblowing frameworks.
3. Encouraging initiatives to support the internal audit talent pipeline.
4. Updating corporate governance and public sector frameworks to properly integrate internal auditing.

South Africa’s Regulatory Landscape: Current Status and Gaps

South Africa has made some progress in addressing these essential public policies but still faces critical gaps.

• Defining Internal Auditing and Internal Audit Function

While the IIA’s Standards offer a global definition of internal auditing and Internal Audit Function, South Africa’s Public Finance Management Act (PFMA), Municipal Finance Management Act (MFMA), and Companies Act lack explicit definitions. The King IV Code provides guidance, stating that governing bodies must ensure internal audit functions contribute to effective governance, risk management, and control processes.

• Mandating Internal Audit Functions in Key Sectors

The PFMA and MFMA require internal audit functions for entities they govern. King IV mandates internal audits for companies listed on the Johannesburg Stock Exchange (JSE). Unregulated sectors, such as privately held entities and non-profits, often lack mandated internal audit requirements, leaving critical accountability gaps.

• Adopting the IPPF and Global Internal Audit Standards

The PFMA prescribes compliance with the Global Internal Audit Standards, while the MFMA does not. King IV requires governing bodies to adopt internal audit standards but does not explicitly prescribe the Global Internal Audit Standards.

• Protecting the Self-Regulatory Model

The internal audit profession in South Africa largely adheres to a self-regulatory model as per IIA Global’s principles, though this is not explicitly formalised.

• Ensuring that laws and regulations regulating accountants and external auditors are complementary and/or aligned with the interests of the internal audit profession.

Laws regulating accountants and external auditors in South Africa do not currently seem to have any explicit conflicts with the Interests of the Internal Audit Profession. However, a big bone of contention continues to be the practice of appointing accountants and external auditors who do not have Internal Audit Certification in positions of Internal Audit Leadership.

Building Effective Advocacy Programmes: A Roadmap for National Institutes

The Institute of Internal Auditors (IIA) acknowledges that national institutes will adopt the legal and regulatory framework proposed in varying ways, depending on their advocacy programme maturity. While some institutes have advanced, well-staffed advocacy operations, others are volunteer-driven and at the early stages of developing their capabilities.

For institutes beginning their advocacy journey or those with less developed programmes, the IIA offers the following guidance:

1. Analyse the Environment and Assess Feasibility

Begin by evaluating the legal and regulatory landscape and identifying opportunities for improvement. Institutes should align their advocacy goals with current governance policies and assess the political feasibility of achieving these objectives. Start with manageable initiatives for short-term impact while planning more complex goals over a multi-year horizon.

2. Develop an Advocacy Engagement Strategy

Craft a detailed strategy outlining steps to achieve advocacy goals. Ensure buy-in from executive management and governing bodies to foster alignment and a shared vision.

3. Resource Planning

Effective advocacy requires dedicated resources, including budgets and personnel. Institutes should outline costs and assign responsibilities to specific individuals or committees to drive accountability and enhance success.

4. Build Coalitions and Address Opposition

Collaboration with like-minded organisations can amplify resources and influence. At the same time, identify potential opposition early, understand their concerns, and seek compromise where feasible to minimise resistance.

5. Engage Legislative and Regulatory Champions

Success in policy advocacy often hinges on strong relationships with policymakers who can champion proposals. Institutes should invest in cultivating these alliances as part of their strategy.

6. Adopt a Long-Term Perspective

Advocacy is an incremental, long-term endeavour. Institutes should view their advocacy strategies as an evolving component of their broader organisational goals, adapting to changes in technology, business, and societal landscapes.

The Way Forward for South Africa

To address these gaps and ensure the internal audit profession fulfils its role in governance, risk management, and control, South Africa could consider the following measures:

• Codify Definitions in Law

Including clear definitions of internal auditing and the internal audit function in the PFMA, MFMA, and Companies Act would provide consistency and clarity.

• Expand Mandates for Internal Auditing

Extending the requirement for internal audit functions to unregulated sectors, where public interest is significant, could strengthen governance and accountability.

• Prescribe Global Standards Across the Board

Making the adoption of the Global Internal Audit Standards mandatory under the MFMA and King IV would enhance consistency in practice.

• Strengthen Professional Standards for Leadership

Mandating that only certified internal auditors lead internal audit functions would safeguard the profession’s credibility and align it with global expectations.

• Enhance Whistleblower Protections

Strengthening frameworks that protect internal auditors from threats and harassment could improve the effectiveness of audit functions.

In Conclusion

The internal audit profession holds immense potential to drive governance and accountability in South Africa. By addressing gaps in its regulatory framework and aligning with global best practices, the country can unlock the full value of this critical function.

Sources:

• Public Finance Management Act (PFMA)
• Municipal Finance Management Act (MFMA)
• King IV Code of Corporate Governance
• Companies Act of South Africa
• Global Internal Audit Standards
• IIA Global’s Public Policy Position Paper: A Legal, Regulatory, and Policy Framework for the Internal Audit Profession