Why the Basics of Internal Auditing Matters

Myron Sta. Ana said and I quote Never forget the basics. They are the foundation of what you’re capable of now.?

The internal auditing profession is evolving as a result of its value and relevance in fostering the achievements of organizational objectives. We can also attribute this evolution to the ever-dynamic business risks. However, as the profession evolves to include previously unconventional areas of auditing such as environmental, social, governance, and culture; internal auditors are building advanced knowledge, skills, and other competencies on a poor foundation of internal auditing. For internal auditors to evolve in delivering quality assurance and consulting services at the pace of this current evolution, they must never forget the basics that made the internal auditors.

For over one year of my private internal audit practice, I have facilitated over one hundred and twenty hours of Certified Internal Auditor (CIA?) Part One (Essentials of Internal Auditing) review classes and many other specific topics related to Essentials of Internal Auditing. In these classes, one thing is common, experienced professional internal auditors ask questions about the fundamentals of internal auditing or seek clarifications on the basic elements therein. Sometimes we argue about these basics. Also, I’m always engaged (pro bono) by Chief Audit Executives (CAEs), who discuss relevant internal audit challenges in their environment and how best they can be addressed. You will be surprised that we do not discuss complex topics or use sophisticated techniques to solve problems, the solutions were always derived from basic knowledge gained from the Essentials of Internal Auditing.

In the words of Jon Taber CPA, CIA, CFE, CFF, these basics are the ' common sense of internal auditing'.

With my experience in the professional practice of internal auditing so far, I believe now is the time to go back to the basic building blocks of professional practice of internal auditing by developing incoming generations of internal auditors and helping current practicing internal auditors to unlearn, learn, and relearn. In March 2022, we (with Vuyo Gwayi) hosted a free webinar on ‘Answer 10+ CIA1 Questions with the Definition of Internal Auditing’ and I was amazed by the positive feedback and statements of appreciation received from professional colleagues around the world. But the question is, what is new about The Institute of Internal Auditors’ (The IIA) definition of internal auditing? It is not new! However, because internal auditing is practiced in different countries and cultural environments, by people from different academic and professional backgrounds, trained by either conventional or modern internal audit professionals, we have experienced divergence in practice where the focus has been on complexities at the expense of valuable basics of our noble profession.

The IIA as the most respected and globally recognized standard-setting body for the professional practice of internal auditing has done great work to promote the required knowledge, skills, and other competencies for an internal auditor through the International Professional Practices Framework (IPPF) and others such as The IIA’s Global Internal Audit Competency Framework (2013), and recently, Assessing Internal Audit Competency - Minding the Gaps to Maximize Insights. The basics of internal auditing can be found in any of the referenced materials. If you are a practicing internal auditor, you should be able to answer the following questions practically:

1. What does an internal audit strive to achieve within an organization?
2. What is the role of the internal audit function in an organization?
3. What is the purpose, nature, and scope of internal auditing?
4. What are governance, risk, control, and fraud?
5. What are internal audit’s roles in governance, risk, control, and fraud?
6. Which formal document establishes the internal audit’s purpose, authority, and responsibility?
7. What is the organizational position of an internal audit function within the organization?
8. Why is the organizational positioning of the internal audit function important?
9. Why should we avoid personal bias or conflict of interest in delivering our responsibilities?
10. What is the need for promoting and applying professional ethics as an internal auditor?
11. Why do you need to apply the care and skill expected of a reasonably prudent and competent internal auditor in delivering your responsibilities?
12. What is the essence of professional development?
13. What are internal audit best practices and where can you find them before asking Google?

These basic questions that can be asked based on the fundamental concepts in internal auditing are by no means an exhaustive list, however, it indicates basic expectations.?The above questions are the basic knowledge that every professional internal auditor should acquire from the foundation and build on them throughout their career. Some of the concepts that answer the questions from the IPPF are the mission of internal audit, the definition of internal auditing, nature of work, charter, organizational independence, individual objectivity, code of ethics/ethical behavior, due professional care, and professional development, etc.

The basics of internal auditing are inestimably relevant in every day’s work of a professional internal auditor. They are the foundation of our professional practice. Although most training and development programs are now focusing on current shifts and trends, we must not forget or leave the basics behind. One of the reasons why these basics are missing is because there are few undergraduate courses in colleges or universities specifically focusing on students becoming internal auditors. For example, most internal auditors came from different academic or professional backgrounds such as accounting or finance, banking, business administration, economics, computer science/engineering/IT, etc. In most cases, these professionals join internal audit functions without basic internal auditing training or orientation on internal audit standards and best practices. They learn the practice from current internal auditors whom we cannot be sure of having the prerequisite knowledge, skills, and other competencies such as proficiency in internal audit standards, procedures, and techniques required in performing audit engagements. This knowledge gap is agelong and it should be addressed by The IIA through low-cost internal audit basic training and collaborations with academic institutions around the world to establish undergraduate and postgraduate courses on internal auditing.

Another area that is also important about the neglect of basic internal auditing knowledge, skills, and other competencies is the acquisition of the wrong certification or lack of required certification. According to IIA’s CIA Learning System v6.0, “certification is the systematic measurement of characteristics such as education and experience that results in recognition of an individual as one who meets the suggested knowledge and other minimum requirements for a position or a profession.” Because most internal auditors came from different academic or professional backgrounds that may be unrelated to internal auditing, they tend to prioritize certifications related to their initial backgrounds while neglecting the most important certification for professionalism and credibility in the field of internal auditing – CIA?! The average global pass rate for all CIA? exam parts from 2016 to 2020 is 41.6%. The question is, why is this rate low? I guessed practicing internal auditors were learning new things through the CIA? certification program: some of these new things should have been a fundamental part of their practice.

Among the 58.4% of candidates who failed the CIA? exams from 2016 to 2021, you will find qualified professionals from different academic or professional backgrounds with certifications in their chosen fields.

I assume that they are the best in their first chosen profession but failed to solidify their position in the internal auditing field as soon as they joined the profession.

Regardless of any initial academic or professional background, internal auditors should develop the requisite knowledge, skills, and other competencies by learning the profession from the basics (Essentials of Internal Auditing) while aspiring to acquire certification in the same internal auditing field. If you want to be a professional internal auditor develop your internal auditing skill set first, then acquire any other skills needed to add value to your organization. Learn the basics, and build any other skills on it.