Proposed mission: “To enhance and protect organisational value … · 2015-01-22 · Proposed mission: “To enhance and protect organisational value by providing stakeholders with

Aviva plc response to consultation questions re: the International Professional

Practices Framework (IPPF) of The Institute of Internal Auditors (The IIA)

Jackie Cain; 30/10/2014 Page 1 20141031 IIA IPPF Avivagia Response Final (1)

1. Mission of Internal Auditing

Proposed mission: “To enhance and protect organisational value by providing stakeholders with

risk-based, objective and reliable assurance, advice and insight.”

1.1 To what extent do you support the addition of a Mission of Internal Auditing to the IPPF?

Completely Support Do Not Support

5 4 3 2 1

12 To what extent do you agree that the proposed Mission of Internal Auditing captures what internal audit strives and/or aspires to accomplish in organizations?

Completely Agree Do Not Agree

5 4 3 2 1

Comments

The use of the word “assurance” is problematic. We have two objections.

Firstly, the everyday usage of assurance conveys notions of comfort and satisfaction, being a confirmation that “things are OK”. It creates a risk that internal auditors develop a positive desire to say that things are working well and introduces an element of confirmation bias into the audit process.

Secondly, in its more specialist usage, assurance refers to something that can be given only when a number of quite specific conditions are true. Very often, in the real world in which internal audit works, these conditions are not true and therefore, assurance is not what can be given. In particular, assurance as used in the external audit and accounting world refers solely to providing an opinion on someone else’s assertions. While that might be the case in the context of external audit’s assurance on financial reporting, it very often is not in the context of internal auditing.

By using the word “assurance” in a way so different from its everyday meaning, we risk creating an expectations gap that will damage the reputation of the profession. This is inconsistent with internal auditors adopting user-friendly language and telling it like it is.

We suggest that, in the Mission, you replace the word “assurance” with the word “assessments”. We would also suggest that you simply delete the phrase, “assurance and consulting” from the Definition.

In general, the proposed mission is full of jargon that will mean little to ordinary managers in the public or private sectors. As an alternative, it might be useful to consider the purpose statement, adopted after public consultation, in the Code for Effective Internal Audit in the (UK) Financial Services Sector and amend it to include other sectors: e.g.

“The primary role of Internal Audit should be to help Board and Executive Managementthose responsible for governance to protect the delivery of services, assets, reputation and sustainability of the organisation.”




2. Core Principles for the Professional Practice Of Internal Auditing

2.1 To what extent do you support adding Core Principles for the Professional Practice of Internal Auditing as an element of the IPPF?


5 4 3 2 1

Comments

We support the idea of principles but only if they are appropriate. We have two broad recommendations for improvements.

The proposed “principles” appear more like characteristics of effective internal auditing, not principles. It may be that some redrafting with clear subjects of the sentences would address this. It might be better to redraft in the style of “Core Principles for Effective Banking Supervision”, published by the Bank for International Settlements. The current, 2012, edition of these can be seen here: http://www.bis.org/publ/bcbs230.pdf

In addition, we suggest they will be more properly called: “The Core Principles for Effective Internal Auditing”. This makes clear what they are describing, even as they are part of the International Professional Practices Framework.

2.2 Do you agree with the three "input-related" Principles as proposed?


5 4 3 2 1

Comments

Why is “confidentiality” of all the Code of Ethics principles excluded?

It seems inappropriate to demonstrate only a commitment to competence. We should demonstrate competence and a commitment to maintaining it.

An alternative is to replace all three draft principles with one single one: Effective Internal Audit requires adherence to the Code of Ethics.

2.3 Do you agree with the six "process-related" Principles as proposed?


5 4 3 2 1

Comments

Principle 5 should refer to “organisation” not “enterprise” to cover the public sector.

Principle 6 should not be about addressing risks but about “meeting the organisation’s needs for an evaluation of how it manages its risks”

There should be a principle about identifying the right work to do.

http://www.bis.org/publ/bcbs230.pdf




There should be a principle about relative role of internal audit and how we fit in with the lines of defence.

There should a principle about applying a systematic method and being evidence-based.

2.4 Do you agree with the three "output-related" Principles as proposed?


5 4 3 2 1

Comments

As noted in the answer to Q2, we believe the use of the word “assurance” is problematic. In addition, your draft principle 10 appears to be a restatement of the Definition, providing little extra information and, therefore, should be deleted.

If you retain principle 10, replace “those charged with governance” with “stakeholders” to be consistent with the Mission and remove “reliable”.

In addition, considering aligning further with the Mission: risk-based, objective and reliable assurance, advice and insight?

“Insightful, proactive and future-focused” would be enhanced using Value Proposition wording: “catalyst, analysis, etc.”

2.5 Do you agree with the order of the 12 Principles as proposed?


5 4 3 2 1

Comments

We suggest our proposed Pre-conditions should go first, followed by the output principles in the spirit of “starting with the end in mind”.

We believe that in including three sections: inputs, processes and outputs, you have omitted an important section: context or environment.

Internal audit is heavily dependent on the environment in which it operates. Without certain conditions in place, however hard the internal auditors strive to meet the core principles or characteristics of effective internal auditing, internal auditors may still be unable to fulfil their mission effectively. We recommend that the Institute consider setting out the pre-conditions for effective internal auditing to complement its core characteristics of effective internal auditing. This follows the example set by the Bank of International Settlements with its Core Principles and Preconditions for Effective Banking Supervision. The current, 2012, edition of these can be seen here: http://www.bis.org/publ/bcbs230.pdf

For example, in the context of internal auditing, internal audit is effective only if:

Management is committed to doing the right thing.

http://www.bis.org/publ/bcbs230.pdf




Management is committed to the effectiveness of governance, management of risk andcontrol.

Those charged with governance are committed to those things as well.

Management is committed to providing adequate and sufficiently skilled resources to theinternal audit function.

Etc.

We believe that the profession would welcome such a statement of pre-conditions and this would further support your stated aim of facilitating more effective communication with stakeholders.

2.6 To what extent do you agree with the view that all Principles must be "present and operating effectively" for an internal audit function to be considered effective?


5 4 3 2 1

Comments

The nature of principles is such that you can never conclude that they are 100% complied with. It is not so black and white. Therefore, it is not essential that “all principles must be ‘present and operating effectively’”.

What is important is that professionals must understand them and then use professional judgement to apply the principles to their own circumstances and to improve progressively. Therefore, the more appropriate phrase is that the leaders of the internal audit function should be able to explain clearly how they have applied all the principles to their circumstances in order for their function to be considered effective.

2.7 Do you agree that the Principles, if adopted, would require guidance to help demonstrate to practitioners what the Principles might look like in practice?


5 4 3 2 1

Comments

The benefit of principles is that they are higher level statements and a guide to the exercise of professional judgement. If we seek to develop more detailed material or guidance we increase the difficulty of reaching agreement and reduce the potential usefulness of the material.

We see the provision of further implementation guidance as being the role of the rest of the IPPF; it is not necessary to have another element or type of guidance.




3. Implementation Guidance & Supplemental Guidance

3.1 To what extent do you support the restructure of guidance elements from "Practice Advisories" to a more comprehensive layer entitled "Implementation Guidance" as part of the framework?


5 4 3 2 1

Comments

3.2 To what extent do you support the restructure of guidance elements from "Practice Guides" to "Supplemental Guidance" as part of the framework?


5 4 3 2 1

Comments

4. Addressing Emerging Issues

4.1 To what extent do you support the introduction of a new IPPF element to address emerging

issues?


5 4 3 2 1

Comments

We support the purpose of guidance to address emerging issues. However, we believe that it is important that The IIA is highly selective in determining which topics to explore – only topics of global significance should claim its resources.

4.2 To what extent do you agree that Emerging Issues Guidance, due to its quicker development process, should be less authoritative than Supplemental Guidance as part of the framework?


5 4 3 2 1

Comments

Given that the emerging guidance is recommended rather than required section, we don’t think

the distinction between different layers of guidance is relevant. Its authority – in this case the

respect it garners for its expertise – will be decided on a case-by-case basis for each piece of

guidance that is issued.




5. Position Papers

5.1 To what extent do you support the deletion of "Position Papers" as an element of the IPPF?


5 4 3 2 1

Comments

6. Required and Recommended

6.1 To what extent do you support revision of the words "Mandatory" and "Strongly Recommended" to "Required" and "Recommended," respectively?


5 4 3 2 1

Comments

What will the status of the Mission Statement be?

7. Summary of the Elements of the Proposed Revised IPPF

7.1 Overall, to what extent do you support the changes regarding the IPPF as detailed on the

previous page?


5 4

3 2 1

Comments




7.2 To what extent do you agree that the pictorial representation adequately depicts the hierarchy and interrelationships of each element of the new proposed IPPF?


5 4 3 2 1

Comments

We don’t think the mission should bind the other elements – it should be at the core, or as a

support.

The outer ring should be better presented as a key to the side.

We attach a demonstration of another way of presenting the IPPF.

7.3 To what extent do you agree that the pictorial representation of the proposed new IPPF is visually appealing?


5 4 3 2 1

Comments

Not at all.

Core principles

Definition

Required

New

Recommended

Implementation guidance

MISSION

Demonstration of alternative view of the new IPPF

Documents

Proposed mission: “To enhance and protect organisational value … · 2015-01-22 · Proposed mission: “To enhance and protect organisational value by providing stakeholders with