The Institute of Chartered Accountants of India (ICAI) Standard on Internal Audit (SIA) 130 addresses the essential requirements for Managing the Internal Audit Function. This function, led by a Chief Internal Auditor (CIA) or equivalent head, encompasses critical activities aimed at achieving the objectives defined in the Audit Charter or Engagement Letter. These activities include defining the audit strategy, making decisions on outsourcing, devising periodic plans and methodologies (covering resources and timelines), and rigorously monitoring ongoing assignments. The ultimate goal of SIA 130 is to ensure that the overall objectives of internal audit are achieved, that adequately skilled resources are deployed, that assignments are conducted in a systematic, disciplined, and professional manner, and that the work quality provides a sound, well-documented basis for reporting, all in conformance with the Standards on Internal Audit. Where the audit activity is outsourced, the external engagement partner’s responsibility under this SIA is limited to managing the outsourced portion as defined in the terms of engagement.
SIA 130 mandates four key requirements for effective management of the internal audit function. First, the CIA must have overall responsibility for a well-defined and documented Internal Audit Process, often compiled in an Internal Audit Manual, to ensure activities are executed efficiently and effectively. Second, the function must conduct Resource Planning to ensure all planned audits are mapped to the required professional skills, whether available internally or sourced externally, with continuous monitoring of staff development and performance evaluation. Third, a set process for Monitoring Progress and Achievement of Objectives must be deployed, including continuous tracking, periodic meetings with stakeholders, and reviewing the nature of findings to ensure the audit remains focused. Finally, a formal Quality Evaluation and Improvement Program (QAIP) is required. The QAIP must be documented, implemented by a knowledgeable person with authority to intervene, and designed to ensure continual improvement and conformance with all ICAI pronouncements. All these elements—the Internal Audit Manual, Resourcing Plan, Progress Monitoring Reports, and the QAIP—must be comprehensively documented to demonstrate compliance with SIA 130.
The Institute of Chartered Accountants of India
Standard on Internal
Audit (SIA) 130
Managing the Internal Audit
Function
1. Introduction
1.1 The Internal Audit Function, generally, comprises of a Head (generally termed as Chief Internal Auditor, Head of Internal Audit, Team Lead, Engagement Partner, etc.) and a team of individuals performing internal audits for the organization.
1.2 The Internal Audit Function performs a number of activities to achieve its objectives as outlined in its Charter (or Terms of Engagement/ Scope of Internal Audit). A few of the critical activities are as follows:
(a) Define the overall objective and scope and accordingly devise the strategy of the Internal Audit Function. Redefine in case of any changes to the earlier defined objective and scope.
(b) A decision on outsourcing and co-sourcing, either partly or fully, to be made by the Chief Internal Auditor once the objective and scope are defined. The same shall be approved by the Board or Audit Committee.
(c) Thereafter, devise a plan and methodology inter-alia covering proposed timelines, resources, location(s) on a periodic basis.
(d) Monitor and supervise various audit assignments, with respect to:
– their adherence to planning along with deviations, if any
– execution and updation wherever required
– enquiry and engaging with the auditee to seek clarifications, responses and views
– assessing and evaluating the implications and impact of observations
– any scope limitations
– final conclusions
– reporting of findings/observations and
– subsequent closure of reported observations
(e) Review the performance, training and development of professional staff, talent and other resources to achieve its objectives.
(f) Identify, source, engage and manage external experts and technical solutions, if required.
(g) Communicate and engage with all key stakeholders regarding progress and achievement of objectives.
(h) Develop and maintain a quality assessment and improvement program (QAIP).
1.3 Completion of the above activities is part of the responsibility of the Chief Internal Auditor or the person who has been designated to coordinate and manage the overall performance of above-mentioned activities.
1.4 Scope: Where the internal audit activity is outsourced, the external engagement partner may not be able to assume the overall responsibility of managing the internal audit activity for the whole Company. The role of engagement partner, in such cases, is limited to managing the Internal Audit Function documented in terms of engagement with the Company. In such situations, this SIA will apply to members only to the extent of the outsourced part of the internal audit activity.
2. Effective Date
2.1 This Standard is applicable for internal audits beginning on or after a
date to be notified by the Council of the Institute.
3. Objectives
3.1 The objectives of this Standard on Managing the Internal Audit Function are to ensure the following:
(a) The achievement of overall objectives of internal audit (as outlined in the Internal Audit Charter, Scope or Engagement Letter).
(b) Adequate skilled resources and expertise are in place and adequately deployed to conduct the Internal Audit assignment.
(c) Internal audit assignments are undertaken and conducted in a systematic, disciplined, timely and professional manner.
(d) Quality of the work performed forms a sound basis for reporting and is supported by requisite evidence and documentation.
(e) Internal audit is conducted in conformance with the Standards on Internal Audit and other related pronouncements issued by the ICAI.
4. Requirements
4.1 Internal Audit Process (Refer Para. A1)
The Chief Internal Auditor has the overall responsibility to ensure the achievement of the objectives of the internal audit function through a well-defined and documented internal audit process.
4.2 Resource Planning (Refer Para. A2)
A resource planning shall be prepared to ensure that the internal audit function has the required professional skills either internally or acquired externally and assigned to conduct internal audit assignment and effectively fulfil the objective as defined in the Internal Audit Charter, Scope or Engagement Letter.
4.3 Monitoring Progress and Achievement of Objectives (Refer Para. A3)
The internal audit process shall be adequately monitored, supervised and reviewed to achieve the planned objectives.
4.4 Quality Evaluation and Improvement Program (Refer Para. A4)
The internal audit function shall have in place a formal quality evaluation and improvement program with the objective of continual improvement and designed to ensure that all the internal audit activities undertaken by the function are conducted in conformance with the pronouncements and Standards on Internal Audit.
*****
Application and Other Explanatory Material
A1. Internal Audit Process (Refer Para. 4.1): An internal audit process helps to execute internal audit activities and assignments in an effective and efficient manner. It documents the policies and procedures for conducting internal audit in a disciplined, time-bound and professional manner. It provides guidance on:
– manner in which audit assignment is to be conducted,
– the key inputs required,
– assess data document, etc. to be mandatorily covered as per the scope of engagement,
– significant steps to be completed,
– milestones to be achieved, and
– essential output and deliverables to be generated for desired quality of outcome.
Various elements of an internal audit process shall be collated in a comprehensive internal audit manual used as reference material by the internal audit staff performing the assignments.
A2. Resource Planning (Refer Para. 4.2): The resource planning shall map the skill requirements of the planned internal audits with the capabilities of the available resources of the internal audit function. These resources shall be organised and structured into audit teams such that they have the necessary knowledge, experience, expertise and skills required to conduct the planned audit assignment(s). If such expertise or skills are not available in-house, it can be outsourced with due approval from the competent authority.
The resource planning shall ensure proper deployment of the requisite resources as well as the manner in which they are periodically evaluated for performance and skill development through education and training programs.
A3. Monitoring Progress and Achievement of Objectives (Refer Para. 4.3): The Internal Auditor shall deploy a set process for monitoring and reviewing the progress by continuously tracking the assignment(s) underway. Planned timelines and constant monitoring help the Chief Internal Auditor to ensure that progress is on track. A continuous review of the nature of findings and emerging issues helps to ensure that the audit work remains focused on the objectives. This also helps in updation during the course of conducting the internal audit, if required in order to achieve the objective(s) of the internal audit assignment(s).
Monitoring includes conducting periodic meetings for sharing of progress dashboards, evaluation of deviations, etc. The Chief Internal Auditor shall engage in periodic meetings with the resources, managers, process owners, those charged with governance.
Executive management and key stakeholders shall ensure that the progress is on track and concerns, if any, in this regard, are addressed promptly.
A4. Quality Evaluation and Improvement Program (Refer Para. 4.4): A
documented quality evaluation and improvement program shall be designed and implemented to confirm the reliability of the audit work performed by internal audit staff. This program shall be drafted in line with the pronouncements and Standards on Internal Audit issued by the ICAI.
The quality evaluation and improvement program shall be implemented and monitored by a person having the requisite knowledge, domain expertise and skills as well as the authority to intervene in areas of non-compliance. It shall be supported with a system of identifying and reporting key quality parameters periodically, and corrective actions taken in case of deviations from Standards.
A5. Documentation: To confirm compliance with the Standard, all key activities which form part of the internal audit process shall be documented to expeditiously achieve the defined objective(s) of the assignment(s) while also focusing on the timelines.
Key elements of documentation are as follows:
(a) The Internal Audit Process, in the form of an Internal Audit Manual.
(b) Resourcing Plan, showing staff competencies, assignments conducted, performance evaluation and skill development needs.
(c) Progress Monitoring Reports showing the various assignments underway, their progress against budgets and anticipated time for completion.
(d) Quality Evaluation and Improvement Program appropriately cross referenced to the SIAs, where applicable.
