Pub. 1 2013 Issue 2

www.uba.org 14 of security. That is, although the auditors’ experience may give them insight into how to correct an issue or the ability to produce a product to assist the bank in implement- ing a specific finding, allowing the auditor to produce the policy or procedure would remove the independence, because in es- sence the auditor would then be auditing their own work. Given the importance of independence and objectivity to the internal audit func- tion, it is of the utmost importance to consider this opinion. The credibility and effectiveness of the entire audit function is at stake if, by engaging in certain activities, auditors are risking their independence. Based upon the Standards for the Professional Practice of Internal Auditing (SPPIA), the requirement for independence and objectivity can be summarized as follows: “Internal auditors should be independent of the activities they audit. Such indepen- dence permits internal auditors to perform their work freely and objectively. Without independence, the desired results of internal auditing cannot be realized. ... (Indepen- dence) is achieved through organizational status and objectivity…” Objectivity is an independent mental attitude, that internal auditors should maintain in performing audits. Internal auditors are not to subordinate their judg- ment on audit matters to that of others. It is important to note that external auditors are governed by guidelines as strict as those of internal auditors. Designing, installing and operating systems are not audit functions. Also, the drafting of procedures for systems is not an audit function. Performing such activities is presumed to impair audit objectivity. These are the primary citations in the SPPIA: GENERAL STANDARD 100 - Independence. Internal Auditors should be independent of the activities they audit. Guideline 100.01. Internal auditors are inde- pendent when they can carry out their work freely and objectively. Independence permits internal auditors to render the impartial and unbiased judgments essential to the proper conduct of audits. It is achieved through organizational status and objectivity. SPECIFIC STANDARD 110 -Organizational Status. The organizational status of the internal auditing department should be sufficient to permit the accomplishment of its audit responsibilities. Guideline 110.01.1. The director of the internal auditing department should be responsible to an individual in the organiza- tion with sufficient authority to promote independence and to ensure broad audit coverage, adequate consideration of audit reports and appropriate action on audit recommendations. Guideline 110.01.2 the director of internal auditing should have direct communication with the board. Regular communication with the board helps assure independence and provides a means for the board and the director to keep each other informed on matters of mutual interest. SIAS #7 - Communicating with the Board of Directors The term “board,” as used in the Standards and in this statement, includes boards of directors, audit committees of such board, heads of agencies or legislative bodies to whom internal auditors report, boards of governors or trustees on nonprofit organiza- tions and any other designated governing bodies of organizations. SPECIFIC STANDARD 120 - Objectivity. Internal auditors should be objective in performing audits. Guideline 120.01. Objectivity is an inde- pendent mental attitude which internal auditors should maintain in performing audits. Internal auditors are not to subor- dinate their judgment on audit matters to that of others. Guideline 120.02. Objectivity requires internal auditors to perform audits in such a manner that they have an honest belief in their work product and that no significant quality compromises are made. Internal auditors are not to be placed in situations in which they feel unable to make objective professional judgments. Staff assignments should be made so that potential and actual conflicts of interest and bias are avoided. The director should periodically obtain information from the audit staff concerning potential conflicts of interest and bias. Internal auditors should report to the direc- tor any situations in which a conflict of interest or bias is present or may reasonably be inferred. The director should then reas- sign such auditors. Staff assignments of internal auditors should be rotated periodically whenever practicable to do so. Internal auditors should not assume operating responsi- bilities. If on occasion senior management directs internal auditors to perform non-audit work, it should be understood that they are not functioning as internal auditors. Moreover, objectivity is presumed to be impaired when internal auditors audit any activity for which they had authority or responsibility, which would include having the ability to create policies. Persons transferred to or temporarily en- gaged by the internal auditing department should not be assigned to audit those activities they previously performed until a reasonable period of time has elapsed. Such assignments are presumed to impair objectivity and should be considered when supervising the audit work and reporting audit results. Guideline 120.03. The internal auditor’s objectivity is not adversely affected when the auditor recom- mends standards of control for systems or reviews procedures before they are imple- mented. Designing, installing and operating systems are not audit functions. Also, the drafting of procedures for systems is not an  Compliance Corner — continued from page 12