Standard Of Internal Audit : Communication with the Management

Introduction

1. This Standard on Internal Audit provides a framework for the internal

auditor’s communication with management and identifies some specific

matters to be communicated with the management as described in the

terms of the engagement.

2. The internal auditor while performing audit should :

a. Communicate clearly the responsibilities of the internal auditor,

and an overview of the planned scope and timing of the audit

with the management;

b. Obtain information relevant to the internal audit from the

management;

c. Provide timely observations arising from the internal audit that

are significant and relevant to their responsibility as described

in the scope of the engagement to the management; and

d. Promote effective two-way communication between the internal

auditor and the management.

Matters to be Communicated

The Internal Auditor’s Responsibilities in Relation to the Terms of

Engagement

3. The internal auditor is responsible for performing the internal audit in

accordance with the terms of engagement.

Planned Scope and Timing of the Internal Audit

4. Communication regarding the planned scope and timing of the internal

audit may:

a. Assist the management:

 to understand better the objectives of the internal auditor’s

work; to discuss issues of risk and materiality with the internal auditor;

and

 to identify any areas in which they may request the internal

auditor to undertake additional procedures;

b. Assist the internal auditor to understand better the entity and its

environment.

5. When communicating to management about planned scope and timing of

the internal audit, the internal auditor would need to ensure that such

communication does not reduce the effectiveness of internal audit. For

example, communicating the nature and timing of detailed audit

procedures may make those procedures predictable.

6. Matters communicated may include:

 How the internal auditor proposes to address the significant risks of

material misstatement, whether due to fraud or error.

 The internal auditor’s approach to internal control relevant to the

internal audit.

 The application of materiality in the context of an internal audit.

7. Communication with management may assist the internal auditor to plan

the scope and timing of the internal audit. It does not, however, change

the internal auditor’s sole responsibility to establish the overall internal

audit strategy and the internal audit plan, including the nature, timing and

extent of procedures necessary to obtain sufficient appropriate audit

evidence.

Significant Findings from the Internal Audit

8. Paragraph 25 of the Standard on Internal Audit (SIA) 4, “Reporting”, states:

“25. The internal audit report contains the observations and comments of

the internal auditor, presents the audit findings, and discusses

recommendations for improvements. To facilitate communication and

ensure that the recommendations presented in the final report are practical

from the point of view of implementation, the internal auditor should discuss the draft with the entity’s management prior to issuing the final

report.

The different stages of communication and discussion should

be as under:

Discussion Draft - At the conclusion of fieldwork, the internal auditor

should draft the report after thoroughly reviewing his working papers

and the discussion draft before it is presented to the entity’s

management for auditee’s comments. This discussion draft should be

submitted to the entity management for their review before the exit

meeting.

Exit Meeting - The internal auditor should discuss with the

management of the entity regarding the findings, observations,

recommendations, and text of the discussion draft. At this meeting,

the entity’s management should comment on the draft and the

internal audit team should work to achieve consensus and reach an

agreement on the internal audit findings.

Formal Draft - The internal auditor should then prepare a formal draft,

taking into account any revision or modification resulting from the

exit meeting and other discussions. When the changes have been

reviewed by the internal auditor and the entity management, the final

report should be issued.

Final Report - The internal auditor should submit the final report to

the appointing authority or such members of management, as

directed. The periodicity of the Report should be as agreed in the

scope of the internal audit engagement. The internal auditor should

mention in the Report, the dates of discussion draft, exit meeting,

Formal Draft and Final Report.”

Establishing the Communication Process

9. Clear communication of the internal auditor’s responsibilities, the planned

scope and timing of the internal audit, and the expected general content of

communications helps establishing the basis for effective two-way

communication.10. Matters that contribute to effective two-way communication include:

 Clarity in the purpose of communications which makes the internal

auditor and the management better placed to have a mutual

understanding of relevant issues and the expected actions arising

from the communication process.

 Clarity in the form in which communications will be made.

 Identifying the person(s) in the internal audit team and the

management who will be responsible for communicating particular

matters.

 The internal auditor’s expectation that communication will be two-way,

and that the management will communicate with the internal auditor,

matters they consider relevant to the internal audit, for example,

strategic decisions that may significantly affect the nature, timing and

extent of internal audit procedures, the suspicion or the detection of

fraud, and concerns with the integrity or competence of senior

management.

 The process for taking action and reporting back on matters

communicated by the internal auditor and the management.

Forms of Communication

11. Effective communication may involve structured presentations and written

reports as well as less structured communications, including discussions.

The internal auditor may communicate matters other than those described

in the terms of engagement, either orally or in writing.

12. In addition to the significance of a particular matter, the form of

communication (e.g., whether to communicate orally or in writing, the

extent of detail or summarization in the communication, and whether to

communicate in a structured or unstructured manner) may be affected by

such factors as:

a. Whether the matter has been satisfactorily resolved.

b. Whether management has previously communicated the matter. c. The size, operating structure, control environment, and legal structure

of the entity.

d. In the case of an internal audit of a specific aspect of an operation,

whether the internal auditor also audits the entire operation or the

entity.

e. The expectations of the management, including arrangements made

for periodic meetings or communications with the auditor.

f. The amount of ongoing contact and dialogue the internal auditor has

with the management.

g. Whether there have been significant changes in the membership of a

governing body.

Timing of Communications

13. The appropriate timing for communications will vary with the

circumstances of the engagement. Relevant circumstances include the

significance and nature of the matter, and the action expected to be taken

by the management. For example:

 Communications regarding planning matters may often be made early

in the audit engagement.

 It may be appropriate to communicate a significant difficulty

encountered during the internal audit as soon as practicable.

 Similarly, it may be appropriate to communicate material weaknesses

in the design, implementation or operating effectiveness of internal

control that have come to the internal auditor’s attention as soon as

practicable.

 Communications regarding independence may be appropriate

whenever significant judgments are made about threats to

independence and related safeguards.

 The exit meeting may also be an appropriate time to communicate

findings from the internal audit.

Adequacy of the Communication Process

14. The internal auditor need not design specific procedures to support the

evaluation of the two-way communication with the management, rather,

that evaluation may be based on observations resulting from audit

procedures performed for other purposes. Such observations may include:

 The appropriateness and timeliness of actions taken by the

management in response to matters raised by the internal auditor.

Where significant matters raised in previous communications have

not been dealt with effectively, it may be appropriate for the internal

auditor to inquire as to why appropriate action has not been taken,

and to consider raising the point again. This avoids the risk of giving

an impression that the internal auditor is satisfied that the matter has

been adequately addressed or is no longer significant.

 The apparent openness of the management in their communications

with the internal auditor.

 The apparent ability of the management to fully comprehend matters

raised by the internal auditor, for example, the extent to which the

management probes issues and questions recommendations made to

them.

 Difficulty in establishing the management, a mutual understanding of

the form, timing and expected general content of communications.

 Whether the two-way communication between the internal auditor and

the management meets applicable legal and regulatory requirements.

15. Inadequate two-way communication may indicate an unsatisfactory control

environment and influence the internal auditor’s assessment of the risks of

material misstatements. There is also a risk that the internal auditor may

not have obtained sufficient appropriate internal audit evidence to support

his findings or opinion.

Documentation

16. Where matters required by this SIA to be communicated are

communicated orally, the internal auditor shall document them, and when and to whom they were communicated. Where matters have been

communicated in writing, the auditor shall retain a copy of the

communication as part of the internal audit documentation.

Effective Date

17. This Standard on Internal Audit is effective for all internal audits beginning

on or after _____________. Earlier application of the Standard is

encouraged.

Standard Of Internal Audit : Enterprise Risk Management

Introduction

1. The purpose of this Standard on Internal Audit is to establish standards

and provide guidance on review of an entity’s risk management system

during an internal audit or such other review exercise with the objective

of providing an assurance thereon. This Standard applies where the

internal auditor has been requested by the management to provide such

an assurance on the effectiveness of its enterprise risk management

system.

2. Enterprise risk management enables management to effectively deal

with risk, associated uncertainty and enhancing the capacity to build

value to the entity or enterprise and its stakeholders. Internal auditor

may review each of these activities and focus on the processes used by

management to report and monitor the risks identified.

Risk and Enterprise Risk Management

3. Risk is an event which can prevent, hinder, fail to further or otherwise

obstruct the enterprise in achieving its objectives. A business risk is the

threat that an event or action will adversely affect an enterprise’s ability

to maximize stakeholder value and to achieve its business objectives.

Risk can cause financial disadvantage, for example, additional costs or

loss of funds or assets. It can result in damage, loss of value and /or

loss of an opportunity to enhance the enterprise operations or activities.

Risk is the product of probability of occurrence of an event and the

financial impact of such occurrence to an enterprise.

4. Risk may be broadly classified into Strategic, Operational, Financial and

Knowledge. Strategic Risks are associated with the primary long-term

purpose, objectives and direction of the business. Operational Risks are

associated with the on-going, day-to-day operations of the enterprise.

Financial Risks are related specifically to the processes, techniques and

instruments utilised to manage the finances of the enterprise, as well as those processes involved in sustaining effective financial relationships with customers and third parties. Knowledge Risks are associated with the management and protection of knowledge and information within the

enterprise.

Process of Enterprise Risk Management and Internal audit

5. Enterprise Risk Management is a structured, consistent and continuous

process of measuring or assessing risk and developing strategies to

manage risk within the risk appetite. It involves identification,

assessment, mitigation, planning and implementation of risk and

developing an appropriate risk response policy. Management is

responsible for establishing and operating the risk management

framework.

6. The Enterprise Risk Management process consists of Risk

identification, prioritization and reporting, Risk mitigation, Risk

monitoring and assurance. Internal audit is a key part of the lifecycle of

risk management. The corporate risk function establishes the policies

and procedures, and the assurance phase is accomplished by internal

audit.

Role of the Internal Auditor in Relation to Enterprise Risk

Management

7. The role of the internal auditor in relation to Enterprise Risk

Management is to provide assurance to management on the

effectiveness of risk management. Due consideration should be given

to ensure that the internal auditor protects his independence and

objectivity of the assurance provided. The role of the internal auditor is

to ascertain that risks are appropriately defined and managed.

8. The scope of the internal auditor’s work in assessing the effectiveness

of the enterprise risk management would, normally, include:

(a) assessing the risk maturity level both at the entity level as well as the auditable unit level;

(b) assessing the adequacy of and compliance with the risk management

policy and framework; and

(c) for the risks covered by the internal audit plan:

(i) Assessing the efficiency and effectiveness of the risk response;

and

(ii) Assessing whether the score of the residual risk is within the risk

appetite.

9. The extent of internal auditor’s role in enterprise risk management will

depend on other resources, internal and external, available to the board

and on the risk maturity of the organisation. The nature of internal

auditor’s responsibilities should be adequately documented and

approved by those charged with governance. The internal auditor

should not manage any of the risks on behalf of the management

or take risk management decisions. The internal auditor should not

assume any accountability for risk management decisions taken by

the management. Internal auditor has a role only in commenting and

advising on risk management and assisting in the effective mitigation of

risk.

10. The internal auditor has to review the structure, effectiveness and

maturity of an enterprise risk management system. In doing so, he

should consider whether the enterprise has developed a risk

management policy setting out roles and responsibilities and framing a

risk management activity calendar. The internal auditor should review

the maturity of an enterprise risk management structure by

considering whether the framework so developed, inter alia:

a) protects the enterprise against surprises;

b) stabilizes overall performance with less volatile earnings;

c) operates within established risk appetite;

d) protects ability of the enterprise to attend to its core business;

and

e) creates a system to proactively manage risks.

11. The internal auditor should review whether the enterprise risk

management coordinators in the entity report on the results of the

assessment of key risks at the appropriate levels, which are, inter

alia:

 Risk Management Committee.

 Enterprise Business and Unit Heads.

 Audit Committee.

Internal Audit Plan and Risk Assessment

12. The internal auditor will normally perform an annual risk assessment of

the enterprise, to develop a plan of audit engagements for the

subsequent period. This plan will be reviewed at various frequencies in

practice. This typically involves review of the various risk assessments

performed by the enterprise (e.g., strategic plans, competitive

benchmarking, etc.), consideration of prior audits, and interviews with a

variety of senior management. It is designed for identifying internal

audit key areas and, not for identifing, prioritizing, and managing risks

directly for the enterprise. The internal audit plan, which should be

approved by the audit committee, should be based on risk

assessment as well as on issues highlighted by the audit

committee and senior management. The risk assessment process

should be of a continuous nature so as to identify not only residual

or existing risks, but also emerging risks. The risk assessment

should be conducted formally at least annually, but more often in

complex enterprises. To serve this objective, the internal auditor

should design the audit work plan by aligning it with the objectives

and risks of the enterprise and concentrate on those issues where

assurance is sought by those charged with governance.

13. The risk review process to be carried out by the internal auditor

provides the assurance that there are appropriate controls in place for

the risk management activities and that the procedures are understood

and followed. Effective enterprise risk management requires a

monitoring structure to ensure that the risks are effectively identified

and assessed and that the appropriate mitigation plans are in place.

14. The review process conducted by internal auditors will help to

determine, inter alia:

a) whether the adopted measures result in what was intended;

b) whether the procedures adopted and information gathered for

undertaking the assessment were appropriate; and

c) further, improved knowledge would help in reaching better decisions

and identifying the lessons to improve future assessment and

management of risks.

15. The internal auditor should submit his report to the Board or its

relevant Committee, delineating the following information:

 Assurance rating (segregated into High, Medium or Low) as a result

of the review;

 Tests conducted;

 Samples covered; and

 Observations and recommendations.

Effective Date

16. This Standard on Internal Audit is applicable to all internal audits

commencing on or after ______. Earlier application of the SIA is

encouraged.

Standard Of Internal Audit : Quality Assurance

Introduction

1. Paragraph 3.1 of the Preface to the Standards on Internal Audit,

describes the internal audit as follows:“Internal audit is an independent management function, which involves a continuous and critical appraisal of the functioning of an entity with a

view to suggest improvements thereto and add value to and strengthen the overall governance mechanism of the entity, including the entity’s strategic risk management and internal control system.Internal audit, therefore, provides assurance that there is transparency

in reporting, as a part of good governance.”

2. Paragraphs 7 and 8 of the Standard on Internal Audit (SIA) 2, Basic

Principles Governing Internal Audit, state as follows:

The internal auditor should either have or obtain such skills and

competence, acquired through general education, technical

knowledge obtained through study and formal courses, as are

necessary for the purpose of discharging his responsibilities.

8. The internal auditor also has a continuing responsibility to maintain

professional knowledge and skills at a level required to ensure that the

client or the employer receives the advantage of competent professional

service based on the latest developments in the profession, the economy,

the relevant industry and legislation.”

Scope

3. This Standard on Internal Audit shall apply whenever an internal audit is

carried out, whether carried out by an in house internal audit department

or by an external firm of professional accountants. For the purpose of this

Standard, the term “firm” means a sole practitioner/ proprietor, partnership

or any such entity of professional accountants as may be permitted by

law1.

Objective

4. The purpose of this Standard on Internal Audit (SIA) is to establish

standards and provide guidance regarding quality assurance in internal

audit.

5. A system for assuring quality in internal audit should provide

reasonable assurance that the internal auditors comply with

professional Standards, regulatory and legal requirements, so that

the reports issued by them are appropriate in the circumstances.

6. In order to ensure compliance with the professional Standards,

regulatory and legal requirements, and to achieve the desired

objective of the internal audit, a person within the organization

should be entrusted with the responsibility for the quality in the

internal audit, whether done in – house or by an external agency.

7. In the case of the in – house internal audit or a firm carrying out

internal audit, the person entrusted with the responsibility for the

quality in internal audit should ensure that the system of quality

assurance include policies and procedures addressing each of the

following elements:

a) Leadership responsibilities for quality in internal audit - The

person entrusted with the responsibility for the quality in

internal audit should take responsibility for the overall quality in

internal audit.

b) Ethical requirements - The person entrusted with the

responsibility for the quality in internal audit should establish

policies and procedures designed to provide it with reasonable

assurance that the personnel comply with relevant ethical

requirements. If matters come to his attention that indicate that

the members of the internal audit engagement team have not

complied with relevant ethical requirements, he should, in

consultation with the appropriate authority in the entity,

determine the appropriate course of action.

c) Acceptance and continuance of client relationship and specific

engagement, as may be applicable– The person entrusted with

the responsibility for the quality in internal audit should

establish policies and procedures for the acceptances andcontinuance of client relationships and specific engagements,

designed to provide reasonable assurance that it will undertake

or continue relationships and engagements.

d) Human resources - The person entrusted with the responsibility

for the quality in internal audit should establish policies and

procedures regarding assessment of the staff’s capabilities and

competence designed to provide it with reasonable assurance

that there are sufficient personnel with the capabilities,

competence, and commitment to ethical principles necessary to:

 Perform engagements in accordance with professional

standards and regulatory and legal requirements; and

 Enable the firm or engagement partner to issue reports that

are appropriate in the circumstances.

e) Engagement performance- The person entrusted with the

responsibility for the quality in internal audit should establish

policies and procedures designed to provide it with reasonable

assurance that engagements are performed in accordance with

the applicable professional Standards and regulatory and legal

requirements and that the reports issued by the internal auditors

are appropriate in the circumstances.

f) Monitoring - The person entrusted with the responsibility for the

quality in internal audit should establish policies and

procedures designed to provide reasonable assurance that the

policies and procedures relating to the system of quality

assurance are relevant, adequate, operating effectively and

complied with in practice.

8. In order to improve the functionalities of the organisation,

transparency in reporting and good governance, the person

entrusted with responsibility for the quality in internal audit, while

establishing the quality assurance framework, should consider the

following parameters of the internal audit activity:

 Terms of engagement and their adequacy.

 Professional standards and compliance therewith.

 Internal audit goals and the extent to which they are being

achieved.

 Recommendations for improving the quality of internal audit

and the extent to which they are being implemented and their

effectiveness.

 Skills and technology used in carrying out internal audit.

9. The person entrusted with the responsibility for the quality in internal audit

needs to ensure that the quality assurance framework is embedded in the

internal audit. This can, for example, be achieved in the following manner:

 Developing an internal audit manual clearly defining the specific

role and responsibilities, policies and procedures, documentation

requirements, reporting lines and protocols, targets and training

requirements for the staff, internal audit performance measures

and the indicators.

 Ensuring that the internal audit staff at all levels is appropriately

trained and adequately supervised and directed on all

assignments.

 Identifying the customers of the internal audit activity.

 Establishing a formal process of feedback from the users of the

internal audit services, such as the senior management

executives, etc. Some of the attributes on which the feedback may

be sought include quality, timeliness, value addition, efficiency,

innovation, effective communication, audit team, time

management. The responses received from the users of the

internal audit services should also be shared with the

appropriate levels of management and those charged with

governance.

 Establishing appropriate performance criteria for measuring

the performance of the internal audit function. In case the

internal audit activity is performed by an external agency, the

contract of the engagement should contain a clause for

establishment of performance measurement criteria and

periodic performance review. These performancemeasurement criteria should be approved by the management.

 Identify and benchmark with industry/ peer group performance.

10. The quality assurance framework established by the person

entrusted with the responsibility for the quality in internal audit

should, therefore, cover all the elements of the internal audit activity.

For example,

 Development and implementation of the internal audit policies and

procedures.

 Maintenance and monitoring of the budget for the internal audit

activity.

 Maintenance and updations of the overall internal audit plan.

 Identification of the risk areas and the internal audit plan to

address these risks.

 Acquisition and deployment of audit tools and use of technology to

enhance the efficiency and effectiveness of the internal audit

activity.

 Co-ordination with the external auditors.

 Staffing related aspects of internal audit – recruitment, training,

etc.

 Planning and implementation of the training and professional

development of the internal audit staff.

 Implementation of the performance metrics for the internal audit

activity and periodic monitoring of the same.

 Review of the follow up actions taken on the findings of the internal

audit activity.

Internal Quality Reviews

11. The internal quality review framework should be designed with a

view to provide reasonable assurance to that the internal audit is

able to efficiently and effectively achieve its objectives of adding

value and strengthening the overall governance mechanism of theentity, including the entity’s strategic risk management and internal

control system.

Internal Quality Reviewer

12. The internal quality review should be done by the person entrusted

with the responsibility for the quality in internal audit and/ or other

experienced member(s) of the internal audit function.

13. The internal quality reviews should be undertaken on an ongoing

basis. The person entrusted with the responsibility for the quality in

internal audit should ensure that recommendations resulting from

the quality reviews for the improvements in the internal audit activity

are promptly implemented.

Communicating the Results of the Internal Quality Review

14. The person entrusted with the responsibility for the quality in

internal audit should also ensure that the results of the internal

quality reviews are also communicated to the appropriate levels of

management and those charged with governance on a timely basis

along with the proposed plan of action to address issues and

concerns raised in the review report.

External Quality Review

15. External quality review is a critical factor in ensuring and enhancing the

quality of internal audit. The frequency of the external quality review

should be based on a consideration of the factors such as the

maturity level of the internal audit activity in the entity, results of the

earlier internal audit quality reviews, feedbacks as to the usefulness

of the internal audit activity from the customers of the internal audit,

costs vis a vis perceived benefits of the frequent external reviews.

The frequency should not in any case be less than once in three

years.

External Quality Reviewer

16. The external quality review should be done by a professionally

qualified person having an in depth knowledge and experience of,

inter alia, the professional Standards applicable to the internalauditors, the processes and procedures involved in the internal

audit generally and those peculiar to the industry in which the entity

is operating, etc. The external quality reviewer should be appointed

in consultation with the person entrusted with the responsibility for

the quality in internal audit, senior management and those charged

with governance.

Communicating Results of the External Quality Review

17. The external quality reviewer should discuss his findings with the

person entrusted with the responsibility for the quality in internal

audit. His final report should contain his opinion on all the

parameters of the internal audit activity, as discussed in paragraph

10, and should be submitted to the person entrusted with the

responsibility for the quality in internal audit and copies thereof be

also sent to those charged with governance. The person entrusted

with the responsibility for the quality in internal audit should, also

submit to those charged with governance, a plan of action to

address the issues and concerns raised by the external quality

reviewers in his report.

Effective Date

18. This SIA is effective for all quality assessments/ reviews of internal audit

undertaken on or after ……………………………. Earlier application of the

SIA is encouraged.

Standard Of Internal Audit : Documentation

Introduction

1. The purpose of this Standard on Internal Audit (SIA) is to establish

Standards and provide guidance on the documentation requirements in

an internal audit.

2. Paragraph 10 of the Standard on Internal Audit (SIA) 2, Basic Principles

Governing Internal Audit, states as follows:

“10. The internal auditor should document matters, which are

important in providing evidence that the audit was carried out in

accordance with the Standards on Internal Audit and support his

findings or the report submitted by him. In addition, the working

papers also help in planning and performing the internal audit, review and

supervise the work and most importantly, provide evidence of the work

performed to support his findings or report(s).”

Definitions

3. (a) “Internal audit documentation” means the record of audit

procedures performed, including audit planning as discussed in

the Standard on Internal Audit (SIA) 1, Planning an Internal Audit,

relevant audit evidence obtained, and conclusions the auditor

reached (terms such as “working papers” or “workpapers” are also

sometimes used). Thus, documentation refers to the working

papers prepared or obtained by the internal auditor and retained

by him in connection with the performance of his internal audit.

(b) “Experienced internal auditor” or “a reviewer” means an individual

(whether internal or external to the entity) who has:

(i) reasonable knowledge and experience of internal audit

processes;

(ii) reasonable knowledge of SIAs, other relevant

pronouncements of the Institute and applicable legal and

regulatory requirements;

(iii) reasonable understanding of the business environment in

which the entity operates; and

(iv) reasonable understanding of internal audit issues relevant

to the entity’s industry.

4. Internal audit documentation:

 Aid in planning and performing the internal audit.

 Aid in supervision and review of the internal audit work.

 Provide evidence of the internal audit work performed to support

the internal auditor’s findings and opinion.

 Aid in third party reviews, where so done.

 Provide evidence of the fact that the internal audit was performed

in accordance with the scope of work as mentioned in the

engagement letter, SIAs and other relevant pronouncements

issued by the Institute of Chartered Accountants of India.

Form and Content

5. Internal audit documentation may be recorded on paper or on electronic

or other media. It includes, for example, audit programmes, analyses,

issues memoranda, summaries of significant matters, letters of

confirmation and representation, checklists, and correspondence

(including e-mail) concerning significant matters. Abstracts or copies of

the entity’s records, for example, significant and specific contracts and

agreements, may be included as part of internal audit documentation, if

considered appropriate. Internal audit documentation, however, is not a

substitute for the entity’s accounting records. The internal audit

documentation for a specific internal audit engagement is assembled in

an audit file.

6. Internal audit documentation should record the internal audit

charter, the internal audit plan, the nature, timing and extent of audit

procedures performed, and the conclusions drawn from the

evidence obtained. In case the internal audit is outsourced, the

documentation should include a copy of the internal audit

engagement letter, containing the terms and conditions of the

appointment.

7. Internal audit documentation should be designed and properly

organised to meet the requirements and circumstances of each audit

and the internal auditor’s needs in respect thereof. The internal

auditor should formulate policies that help in standardization of the

internal audit documentation. The standardization may be in the form

of checklists, specimen letters, questionnaires, etc.

8. Internal audit documentation should be sufficiently complete and

detailed for an internal auditor to obtain an overall understanding of

the audit. The extent of documentation is a matter of professional

judgment since it is neither practical nor possible to document every

observation, finding or conclusion in the internal audit documentation. All

the significant matters which require exercise of judgment, together

with the internal auditor’s conclusion thereon should be included in

the internal audit documentation. However, the documentation

prepared by the internal auditor should be such that enables an

experienced internal auditor (or a reviewer), having no previous

connection with the internal audit to understand:

(a) the nature, timing and extent of the audit procedures

performed to comply with SIAs and applicable legal and

regulatory requirements;

(b) the results of the audit procedures and the audit evidence

obtained;

(c) significant matters arising during the audit and the

conclusions reached thereon; and

(d) terms and conditions of an internal audit

engagement/requirements of the internal audit charter, scope

of work, reporting requirements, any other special conditions,

affecting the internal audit.

9. The form, extent and contents of the documentation would also be

affected by the nature and terms of the engagement, and any statutory or

regulatory requirements in that regard. The form, content and extent of

internal audit documentation depend on factors such as:

 the nature and extent of the audit procedures to be performed;

 the identified risks of material misstatement;

 the extent of judgment required in performing the work and

evaluating the results;

 the significance of the audit evidence obtained;

 the nature and extent of exceptions identified;

 the need to document a conclusion or the basis for a conclusion

not readily determinable from the documentation of the work

performed or audit evidence obtained; and

 the audit methodology and tools used.

It is, however, neither necessary nor practicable to document every matter

the auditor considers during the audit.

10. The internal audit documentation should cover all the important

aspects of an engagement viz., engagement acceptance,

engagement planning, risk assessment and assessment of internal

controls, evidence obtained and examination/ evaluation carried out,

review of the findings, communication and reporting and follow up.

The internal audit documentation would, therefore, generally, include:

 Engagement letter or the internal audit charter, as the case may

be.

 Internal audit plan and programme.

 Papers relating to the staff requirement and allocation.

 Papers relating to requirements for technical experts, if any .

 Time and cost budgets.

 Copies of significant contracts and agreements or management

representations on terms and conditions of those contracts.

 Internal review reports.

 Evaluation questionnaires, checklists, flowcharts, etc.

 Papers relating to discussions/ interviews with the various

personnel including legal experts, etc.

 Chart of the organizational structure, job profile of the persons

listed in the chart and rules of delegation of powers.

 Annual budget and development plan.

 Progress report, MIS report.

 Reconciliation statements.

 Communication with the client personnel and third parties, if any.

 Certification and representations obtained from management.

 Copies of relevant circulars, extracts of legal provisions.

 Results of risk and internal control assessments.

 Analytical procedures performed and results thereof.

 List of queries and resolution thereof.

 Copy of draft audit report, along with the comments of the auditee

thereon and final report issued.

 Records as to the follow up on the recommendations/ findings

contained in the report.

Identification of the Preparer and the Reviewer

11. It is also essential that the internal audit documentation identify the

following:

(i) who performed that task and the date such work was completed;

(ii) who reviewed the task performed and the date and extent of such

review;

(iii) reasons for creating the particular internal audit documentation;

(iv) source of the information contained in the internal audit

documentation; and

(v) any cross referencing to any other internal audit documentation.

The preparers and reviewers of the internal audit documentation

should also sign them.

12. The internal audit file should be assembled within sixty days after

the signing of the internal audit report. Assembly of the internal audit

documentation file is only an administrative process and does not involve

performance of any new audit procedures or formulation of newif such changes are administrative in nature. For example:

 deleting or discarding superseded documentation;

 sorting, collating and cross referencing internal audit

documentation;

 signing off on completion checklists relating to file assembly

process;

 documenting audit evidence that the internal auditor has obtained,

discussed and agreed with the relevant members of the internal

audit team before the date of the internal auditor’s report.

13. When exceptional circumstances arise after the date of the

submission of the internal audit report that require the internal

auditor to perform new or additional audit procedures or that lead

the internal auditor to reach new conclusions, the internal auditor

should document:

(i) the details of circumstances encountered along with the

documentary evidence, if any, thereof;

(ii) the new or additional audit procedures performed, audit

evidence obtained, and conclusions reached; and

(iii) when and by whom the resulting changes to the audit

documentation were made, and (where applicable) reviewed.

Document Retention and Access

14. The internal auditor should formulate policies as to the custody and

retention of the internal audit documentation within the framework of

the overall policy of the entity in relation to the retention of

documents. The internal auditor retains the ownership of the internal

audit documentation. While formulating the documentation retention

policy, any legal or regulatory requirements in this regard also need to be

taken into consideration. Management and other designated personnel

may seek access to the internal audit documentation of the internal auditdepartment subject to the approval of the internal auditor and client or

such other third party may seek access if there is any legal or regulatory

requirement or as may be permitted by the client.

15. After the assembly of the audit file, the internal auditor should not

delete or discard internal audit documentation before the end of the

retention period.

Standard Of Internal Audit : Basic Principles

BASIC PRINCIPLES GOVERNING INTERNAL AUDIT*

Introduction:

1. The purpose of this Standard on Internal Audit (SIA) is to establish

standards and provide guidance on the general principles governing

internal audit.

2. Paragraph 3.1 of the Preface to the Standards on Internal Audit, issued by

the Institute of Chartered Accountants of India defines internal audit as

follows:“Internal audit is an independent management function, which involves a

continuous and critical appraisal of the functioning of an entity with a view

to suggest improvements thereto and add value to and strengthen the

overall governance mechanism of the entity, including the entity’s risk

management and internal control system.”

3. The other Standards on Internal Audit to be issued by the Institute of

Chartered Accountants of India will elaborate the principles set out herein

to give guidance on internal auditing procedures and reporting practices.

Compliance with the basic principles requires the application of internal

auditing procedures and reporting practices appropriate to the particular

circumstances.

Integrity, Objectivity and Independence:

4. The internal auditor should be straightforward, honest and sincere in

his approach to his professional work. He must be fair and must not

allow prejudice or bias to override his objectivity. He should maintain an

impartial attitude. He should not only be independent in fact but

also appear to be independent. The internal auditor should not,

therefore, to the extent possible, undertake activities, which are or

might appear to be incompatible with his independence and

objectivity. For example, to avoid any conflict of interest, the internal

auditor should not review an activity for which he was previously

responsible. It is also expected from the management to take steps

necessary for providing an environment conducive to enable the internal

auditor to discharge his responsibilities independently and also report his

findings without any management interference. For example, in case of a

listed company, the internal auditor may be required to report directly to

those charged with governance, such as the Audit Committee instead of

the Chief Executive Officer or the Chief Financial Officer. The internal

auditor should immediately bring any actual or apparent conflict of

interest to the attention of the appropriate level of management so

that necessary corrective action may be taken.

Confidentiality:

5. The internal auditor should maintain the confidentiality of the

information acquired in the course of his work and should not

disclose any such information to a third party, including the

employees of the entity, without the specific authority of the

management/ client or unless there is a legal or a professional

responsibility to do so. The internal auditor, therefore, needs to ensure

that there are well laid out policies and controls to protect confidentiality of

the information.

Due Professional Care, Skills and Competence:

6. The internal auditor should exercise due professional care,

competence and diligence expected of him while carrying out the

internal audit. Due professional care signifies that the internal auditor

exercises reasonable care in carrying out the work entrusted to him in

terms of deciding on aspects such as the extent of work required to

achieve the objectives of the engagement, relative complexity and

materiality of the matters subjected to internal audit, assessment of risk

management, control and governance processes and cost benefit

analysis. Due professional care, however, neither implies nor guarantees

infallibility, nor does it require the internal auditor to travel beyond the

scope of his engagement.

7. The internal auditor should either have or obtain such skills and

competence, acquired through general education, technical

knowledge obtained through study and formal courses, as are

necessary for the purpose of discharging his responsibilities.

8. The internal auditor also has a continuing responsibility to maintain

professional knowledge and skills at a level required to ensure that the

client or the employer receives the advantage of competent professional

service based on the latest developments in the profession, the economy,

the relevant industry and legislation.

Work Performed by Others

9. The internal auditor would often need to delegate work to assistants. The

internal auditor should carefully direct, supervise and review the

work delegated to assistants. Similarly, the internal auditor may also

need to use the work performed by other auditors or experts. Though the

internal auditor will be entitled to rely on the work performed by other

auditors and experts, he should exercise adequate skill and care in

ascertaining their competence and skills and also in evaluating, analysing

and using the results of the work performed by the experts. He must also

look into the assumptions, if any, made by such other experts and obtain

reasonable assurance that the work performed by other auditors and

experts is adequate for his purposes. He should be satisfied that he

has no reasons to believe that he should not have relied on the work

of the expert. The reliance placed on the work done by the assistants

and/ or other auditors and experts notwithstanding, the internal auditor will

continue to be responsible for forming his opinion on the areas/ processes

being subject to internal audit or his findings.

Documentation

10. The internal auditor should document matters, which are important

in providing evidence that the audit was carried out in accordance

with the Standards on Internal Audit and support his findings or the

report submitted by him. In addition, the working papers also help in

planning and performing the internal audit, review and supervise the work

and most importantly, provide evidence of the work performed to support

his findings or the report(s).

Planning

11. The internal auditor should plan his work to enable him to conduct

an effective internal audit in a timely and efficient manner, ensuring

that appropriate attention is devoted to significant areas of audit,

identification of potential problems and appropriate utilisation of

skills and time of the staff.

12. The internal audit plan should be based on the knowledge of the

business of the entity. The internal audit plan would normally cover

aspects such as:

(i) obtaining the knowledge of the legal and regulatory framework

within which the entity operates;

(ii) obtaining the knowledge of the entity’s accounting and internal

control systems and policies;

(iii) determining the effectiveness of the internal control procedures

adopted by the entity;

(iv) identifying the activities warranting special focus based on the

materiality and criticality of such activities, and its overall effect on

presentation of the financial statements of the entity;

(v) identifying and allocating staff to each of the above activities;

(vi) determining the nature, timing and extent of procedures to be

performed;

(vii) setting the time budget for each of the above activities;

(viii) identifying the reporting responsibilities; and

(ix) benchmark against which the actual results of the activities, the

actual time spent, the cost incurred would be measured.

13. A plan once prepared should be continuously reviewed by the

internal auditor to identify any modifications to the plan required to

bring the same in line with the changes, if any, to the audit universe.

Audit universe comprises the activities, operations, units, etc., to be

subjected to audit during the planning period.

Evidence:

14. The internal auditor should, based on his professional judgment,

obtain sufficient appropriate evidence to enable him to draw

reasonable conclusions therefrom on which to base his opinion or

findings. Factors affecting the professional judgment include the activity

under audit, possible errors and their materiality and the risk of

occurrence of such errors.

Internal Control and Risk Management Systems:

15. While the management is responsible for establishment and maintenance

of appropriate internal control and risk management systems, the role of

the internal auditor is to suggest improvements to those systems. For

this purpose, the internal auditor should:

(i) Obtain an understanding of the risk management and internal

control framework established and implemented by the

management.

(ii) Perform steps for assessing the adequacy of the framework

developed in relation to the organisational set up and

structure.

(iii) Review the adequacy of the framework.

(iv) Perform risk-based audits on the basis of risk assessment

process.

Internal auditor may, however, also undertake work involving identification

of risks as well as recommend design of controls or gaps in existing

controls to address those risks.

Reporting:

16. The internal auditor should carefully review and assess the

conclusions drawn from the audit evidence obtained, as the basis

for his findings contained in his report and suggest remedial action.

However, in case the internal auditor comes across any actual or

suspected fraud or any other misappropriation of assets, it would be more

appropriate for him to bring the same immediately to the attention of the

management.

Effective Date

17. This Standard on Internal Audit is effective for all internal audits beginning

on or after…………………… Earlier application of the SIA is encouraged.

Standard Of Internal Audit

STANDARD ON INTERNAL AUDIT

The following is the text of the Standard on Internal Audit

Planning an Internal Audit , issued by the Council

of the Institute of Chartered Accountants of India.

The Standards shall become mandatory from such

date as notified by the Council.

1. The purpose of this Standard on Internal Audit is to establish

standards and provide guidance in respect of planning an internal

audit. An internal audit plan is a document defining the scope,

coverage and resources, including time, required for an internal audit

over a defined period. The internal auditor should, in consultation

with those charged with governance, including the audit

committee, develop and document a plan for each internal audit

engagement to help him conduct the engagement in an efficient

and timely manner. Adequate planning ensures that appropriate

attention is devoted to significant areas of audit, potential problems

are identified, and that the skills and time of the staff are appropriately

utilised. Planning also ensures that the work is carried out in

accordance with the applicable pronouncements of the Institute of

Chartered Accountants of India.

2. The overall objectives of an internal audit, as defined in the Preface to

the Standards on Internal Audit are:

 to suggest improvements to the functioning of the entity; and

 to strengthen the overall governance mechanism of the entity,

including its strategic risk management as well as internal

control system.

3. Internal audit, therefore, helps inter alia in:

(i) Understanding and assessing the risks and evaluate the

adequacies of the prevalent internal controls.

(ii) Identifying areas for systems improvement and strengthening

controls.

(iii) Ensuring optimum utilisation of the resources of the entity, for

example, human resources, physical resources etc.

(iv) Ensuring proper and timely identification of liabilities, including

contingent liabilities of the entity.

(v) Ensuring compliance with internal and external guidelines and

policies of the entity as well as the applicable statutory and

regulatory requirements.

(vi) Safeguarding the assets of the entity.

(vii) Reviewing and ensuring adequacy of information systems

security and control.

(viii) Reviewing and ensuring adequacy, relevance, reliability and

timeliness of management information system.

4. The internal audit plan should be comprehensive enough to

ensure that it helps in achieving of the above overall objectives of

an internal audit. The internal audit plan should, generally, also

be consistent with the goals and objectives of the internal audit

function as listed out in the internal audit charter as well as the

goals and objectives of the organisation. An internal audit charter

is an important document defining the position of the internal audit vis

a vis the organisation. The internal audit charter also outlines the

scope of internal audit as well as the duties, responsibilities and

powers of the internal auditor(s). In case the entire internal audit or

the particular internal audit engagement has been outsourced,

the internal auditor should also ensure that the plan is consistent

with the terms of the engagement.

5. Planning involves developing an overall plan for the expected scope

and conduct of audit and developing an audit programme showing the

nature, timing and extent of audit procedures. Planning is a

continuous exercise. A plan once prepared should be continuously

reviewed by the internal auditor to identify any modifications

required to bring the same in line with the changes, if any, in the

audit environment. However, any major modification to the

internal audit plan should be done in consultation with those

charged with governance. Further, the internal auditor should

also document the changes to the internal audit plan.

6. The internal auditor may also discuss the significant elements of his

overall plan, including important procedures, with those charged with

governance. This would help the internal auditor as well as the client

to assess whether the internal audit is directed to achieve the

objectives as set out in the terms of engagement. The discussion

would also help the internal auditor to gauge whether the client’s

perception of the role and responsibilities of the internal auditor is

appropriate. The internal auditor should also assess the client

expectations as to the assurance level on different aspect of

entity’s operations and controls. For instance, the client may feel

assured if inventories are verified once in a quarter, while for cash

verification, monthly interval may be specified. This will enable the

auditor to plan the frequency and extent of audit procedures to be

adopted.

7. The internal audit plan should be based on the knowledge of the

entity’s business. While developing the internal audit plan, the

internal auditor should have regard to the objectives of the

internal audit engagement as well as the time and resources

required for conducting the engagement. In addition, the internal

audit plan should also reflect the risk management strategy of the

entity. Planning an internal audit involves establishing the overall

strategy for the engagement so as to keep the risks associated with

the assignment at the acceptable level. Therefore, the planning

process is also influenced by the internal auditor’s understanding and

assessment of:

 The objectives of the activity being subjected to internal audit.

 The significant risks associated with the above activity.

 The risk management and internal control system instituted in

the organisation to reduce the above risks to an acceptable

level.

 The possible areas in which the internal audit can suggest

improvement to the risk management and/ or internal control

system associated with the concerned activity.

 The selection of engagement team (including, where

necessary, the engagement team quality control reviewer) and

the assignment of audit work to the team members, including

the assignment of appropriately experienced team members.

 Business developments affecting the entity, including changes

in information technology and business processes, changes in

key management, and acquisitions, mergers and divestments.

 Industry developments such as changes in industry regulations

and new reporting requirements.

 Changes in the financial reporting framework, such as changes

in accounting standards.

 Other significant relevant developments, such as changes in

the legal environment affecting the entity.

8. Internal audit plan should cover areas such as:

 Obtaining the knowledge of the legal and regulatory

framework within which the entity operates.

 Obtaining the knowledge of the entity’s accounting and

internal control systems and policies.

 Determining the effectiveness of the internal control

procedures adopted by the entity.

 Determining the nature, timing and extent of procedures to

be performed.

 Identifying the activities warranting special focus based on

the materiality and criticality of such activities, and their

overall effect on operations of the entity.

 Identifying and allocating staff to the different activities to

be undertaken.

 Setting the time budget for each of the activities.

 Identifying the reporting responsibilities.

The internal audit plan should also identify the benchmarks

against which the actual results of the activities, the actual time

spent, the cost incurred would be measured.

9. The scope of an internal audit is normally affected by factors such as:

 Terms of the engagement.

 Nature of accounting system – manual or IT-based - and the

degree of reliance placed by the auditor on the same.

 Accounting policies adopted by the entity.

 Nature of information technology system used by the client in

the various business processes and the exception reports

generated by the system.

 Authorization and delegation of authority in the systems

environment and data entry checks and data security measures

including generation of day end logs of security and

authorisation violations.

 The nature of management information system in vogue and

the extent to which the management information system reports

are used by the client in establishing and reviewing internal

controls.

 Expected audit coverage, including identification of areas of

audit requiring special attention, number and locations to be

included, nature of business segments to be audited and the

need, if any, for specialized knowledge.

 Materiality thresholds established in respect of various areas of

audit especially, those areas requiring special attention.

 Nature and extent of audit evidence to be obtained.

 Experience and skills of the staff and the need for supervising,

directing, coordinating and reviewing their work.

 Requirements of the applicable pronouncements of the Institute

of Chartered Accountants of India.

 Statutory or regulatory framework in which the entity operates.

Planning Process

10. The internal auditor should obtain a level of knowledge of the

entity sufficient to enable him to identify events, transactions,

policies and practices that may have a significant effect on the

financial information. Following are some of the sources wherefrom

the internal auditor can obtain such knowledge:

 Previous experience, if any, with the entity and the industry.

 Legislation and regulations that significantly affect the entity.

 Entity’s policy and procedures manual.

 Minutes of the meetings of the shareholders, board of directors,

and important committees of the board such as the audit

committee, remuneration committee, shareholders’ grievances

committee.

 Management reports/ internal audit reports of prior periods.

 Newspaper/ industry journals.

 Discussion with client’s management and staff.

 Visits to entity’s plant facilities etc., to obtain first hand

information regarding the production processes of the entity.

 Visits to the entity’s department where the accounting and other

documents are generated, maintained, and the administrative

procedures followed.

 Other documents produced by the entity, for example, material

sent to the shareholders and the regulatory authorities,

management policy manuals, manuals relating to accounting

and internal controls, organizational charts, job description

charts, etc.

Knowledge of the entity’s business, among other things, helps the

internal auditor to identify areas requiring special focus, evaluate the

appropriateness of the accounting policies and disclosures,

accounting estimates and management representations. Knowledge

of the business would also help the auditor to identify the priorities of

the business, critical factors or constraints in the smooth running of

the business as also understand the trends in respect of various

financial and operating ratios, etc.

11. The next step in audit planning is establishment of the audit universe

or the audit territory. Audit universe comprises the activities,

operations, units etc., to be subjected to audit during the planning

period. The audit universe is designed to reflect the overall business

objectives and therefore includes components from the strategic plan

of the entity. Thus, the audit universe is affected by the risk

management process of the client. The audit universe and the

related audit plan should also reflect changes in the

management’s course of action, corporate objectives, etc.

12. As discussed in paragraph 4, planning is a continuous exercise. The

internal auditor should periodically, say half yearly, review the

audit universe to identify any changes therein and make

necessary amendments, to make the audit plan responsive to

those changes.

13. The next stage in planning is establishing the specific objectives of the

internal audit engagement. The establishment of such objectives

should be based on the auditor’s knowledge of the client’s

business, especially a preliminary understanding and review of

the risks and controls associated with the activities forming

subject matter of the internal audit engagement. The preliminary

understanding and review involves gathering necessary information by

means of a combination of the following procedures:

 Observation of the activity being performed.

 Inquiry of the staff associated with performing the activity.

 Discussion with the client.

 Reading through the internal audit reports, management

reports etc., of previous periods.

 Performing analytical procedures.

 Performing actual walk-through tests.

14. The internal auditor would use the information so gathered to

determine the objective(s) of the engagement as also to decide the

nature, timing and extent of his procedures. The internal auditor

should also document the results of his preliminary review so

conducted. The documented results would, normally, cover aspects

such as:

 Preliminary assessment and understanding the risks and

controls associated with the activity, viz., sufficiency and

appropriateness of the controls, procedures for identification

and management of risks associated with the activity.

 Significant issues thrown up by such a review, for example,

significant errors, non-compliance with any significant law.

 Procedures proposed to be adopted by the internal auditor to

resolve the above issues.

 Preliminary time budget for completing the engagement.

15. The next stage in planning an internal audit is establishing the scope

of the engagement. The scope of the engagement should be

sufficient in coverage so as to meet the objectives of the

engagement. The internal auditor should consider the information

gathered during the preliminary review stage to determine the

scope of his audit procedures. The nature and extent of the internal

auditor’s procedures would also be affected by the terms of the

engagement. In case the internal auditor is of the view that

circumstances exist which would restrict the auditor from

carrying out the procedures, including any alternative

procedures, considered necessary by him, he should discuss the

matter with the client to reach a conclusion whether or not to

continue the engagement. The scope of his engagement should

documented comprehensively to avoid misunderstanding on the

areas covered for audit. The internal auditors are often confronted

with a situation where client denies access to certain information or

has a negative list of areas where internal audit is not desired. There

are also situations where while the client requires internal audit

procedures to be carried but findings are not to form part of the report

but to be reported separately.

16. Further, in case of information technology based environment, the

scope of engagement would include the extent to which internal

auditor are permitted to access the system and reports which can be

viewed and those which can be exported. Further, system based

audit tools that an internal auditor can use to draw and analyze

the data should be clearly understood in the scope of his

engagement.

17. Once the scope of the internal audit procedures is established, the

next phase is that of deciding upon the resource allocation. Efficient

resource allocation is essential to achieve the desired objective, within

the constraints of time and cost as well as optimum utilization of

resources. For this purpose, the internal auditor should prepare

an audit work schedule, detailing aspects such as:

 activities/ procedures to be performed;

 engagement team responsible for performing these

activities/ procedures; and

 time allocated to each of these activities/ procedures.

18. While preparing the work schedule, the internal auditor should

have regard to aspects such as:

 any significant changes to the entity’s missions and

objectives, business processes, and management’s

strategies to counter these changes, for example, changes

in the entity’s controls structure or changes in the risk

assessment and management structures

 any changes or proposed changes to the governance

structure of the entity

 composition of the engagement team in terms of skills and

experience and any changes thereto

The engagement work schedule should, however, be flexible

enough to accommodate any unanticipated changes as well as

professional judgment of the engagement team in the

components of the audit universe as discussed above. The work

schedule should also reflect the internal auditor’s assessment of

risks associated with various areas covered by the particular

internal audit engagement and the priority attached thereto.

19. The internal auditor should also prepare a formal internal audit

programme listing the procedures essential for meeting the

objective of the internal audit plan. Though the form and content

of the audit programme and the extent of its details would vary

with the circumstances of each case, yet the internal audit

programme should be so designed as to achieve the objectives of

the engagement and also provide assurance that the internal

audit is carried out in accordance with the Standards on Internal

Audit. As a corollary, the audit plan developed by the internal auditor

would need to be a risk-based plans, appropriately reflecting and

addressing the priorities of the internal audit activity, consistent with

the organisation’s goals. The internal audit programme should also

be finalised in consultation with the appropriate authority before

the commencement of the work. The internal audit programme

identifies, in appropriate details, the objectives of the internal audit in

respect of each area, the procedures to be performed to achieve those

objectives, the staff responsible for carrying out the particular activity,

the time allocated to each activity as also the sufficiently detailed,

instructions to the staff as to how to carry out those procedures. The

internal audit programme may also have provision for information such

as the procedures actually performed, reasons for not performing the

originally identified procedures, actual time consumed in carrying out

the relevant procedure, reasons for deviations from budgeted time etc.

A well prepared, comprehensive audit programme helps proper

execution of the work as well as of the proper supervision, direction

and control of the performance of the engagement team.

20. This Standard on Internal Audit is applicable to all internal audits

commencing