Your Questions Answered

Q&A

IIA-Australia issues an email News Update every fortnight. Your Questions Answered is a feature in conjunction with our IIA Assist Ask A Question service. Your Questions Answered seeks to provide insights to issues that affect many Chief Audit Executives and Internal Auditors.

IIA-Australia resources are intended to support the application of the IPPF, for information and educational purposes. This material is not intended to provide definitive answers to specific individual circumstances and as such is only intended to be used for assistance.

Members can access previously asked questions below.

Latest Questions

Your Questions Answered

Local Government ARIC & IA Review

Is a NSW local council's four yearly independent review of the internal audit function the same as an external quality assessment?

View the Answer
Your Questions Answered

Ethical Considerations in IA process

How do I incorporate my organisation's ethical expectations into my internal audit plan and internal audit engagements?

View the Answer
Your Questions Answered

Resourcing IA Function

What factors should I consider when deciding to use (and develop) in-house staff or a service provider to complete internal audits?

View the Answer

Members Only Resources

Your Questions Answered

Fraud Risk Indicators

What are behavioural fraud indicators and what should organisations watch out for?

View the Answer
Your Questions Answered

Internal Audit Quality and AI

How do I meet the quality requirements of the GIAS when I use generative or agentic artificial intelligence to perform some of my internal audit processes?

View the Answer
Your Questions Answered

GRC

What does GRC mean?

View the Answer
Your Questions Answered

Internal Audit Quality Checklists

Where do I find the quality checklists from IIA-Australia to review my internal audit charter and internal audit strategy?

View the Answer
Your Questions Answered

Engagement Supervision

I am the sole internal auditor of my internal audit function. How do I meet the requirements of engagement supervision under the GIAS?

View the Answer
Your Questions Answered

EQA and Small IA Functions

I work in a small internal audit function with limited budget. What are my options for a cost-effective external quality assessment?

View the Answer
Your Questions Answered

Governance Framework

I work for a small organisation, how can we develop a governance framework that is appropriate for our size?

View the Answer
Your Questions Answered

Findings Outside of Scope

What should an internal auditor do if, during an engagement, they identify a finding (observation) that falls outside of the scope of the engagement?

View the Answer
Your Questions Answered

Key Controls

What is a key control?

View the Answer
Your Questions Answered

Risk Management Frameworks

We have an established risk management process based on AS ISO 31000 but one of our audit and risk committee members thinks that COSO ERM is a better framework. Is it possible to use the best of both?

View the Answer
Your Questions Answered

Internal Audit Excellence Framework

What is value-based internal audit methodology?

View the Answer
Your Questions Answered

Management Requests

I have been asked by management to design and implement a framework for my organisation, is this appropriate for internal audit to do?

View the Answer
Your Questions Answered

Chief Audit Executive and Quality

I am an inhouse CAE, do I need to ensure the service providers I engage for internal audit services adhere to the 'Global Internal Audit Standards'?

View the Answer
Your Questions Answered

Admin Reporting Role

What is the role of the chief audit executive administrative report and how often should I meet with them?

View the Answer
Your Questions Answered

Internal Audit Charter Review

How often should the internal audit charter be reviewed by the Audit Committee?

View the Answer
Your Questions Answered

Advisory Engagement Examples

What are examples of advisory engagements that can performed by an internal audit function?

View the Answer
Your Questions Answered

Accountable Authority

Who is an organisation’s accountable authority?

View the Answer
Your Questions Answered

Cybersecurity Topical Requirement

Does the existence of the new Cybersecurity Topical Requirement mean that I must have a Cybersecurity audit in my internal audit plan?

View the Answer
Your Questions Answered

External Audit

Who is responsible for external audit recommendation close-out?

View the Answer
Your Questions Answered

Business Improvement Opportunities

Should internal audit reports include unrated business improvement opportunities that are outside the risk rating process?

View the Answer
Your Questions Answered

EQA Reports and the Audit Committee

Should the Audit Committee receive a copy of the External Quality Assessment report from the assessor?

View the Answer
Your Questions Answered

Objectives and Scope Approval

Who approves internal audit engagement objectives and scope?

View the Answer
Your Questions Answered

Remote Technology auditing

Is it good audit practice to perform a technology audit remotely without going onsite?

View the Answer
Your Questions Answered

Issuing Reports

Can a CAE perform an internal audit and issue an internal audit report themselves?

View the Answer
Your Questions Answered

Projects

If a project has gateway reviews, is other assurance also necessary?

View the Answer
Your Questions Answered

Ethics Training for Members

How many hours of ethics related training do I need to complete as part of my IIA-Australia membership?

View the Answer
Your Questions Answered

Assertions and Declarations

What annual assertions and declarations are required by the CAE and the internal audit team members?

View the Answer
Your Questions Answered

Artificial Intelligence

Can I apply Artificial Intelligence (AI) within the internal audit process?

View the Answer
Your Questions Answered

New Audit Committee Chair

I have a new audit committee chair. As CAE, how can I help them to become familiar with my internal audit function?

View the Answer
Your Questions Answered

UAT

Is technology project assurance user acceptance testing (UAT) considered to be assurance?

View the Answer
Your Questions Answered

Internal Audit Strategy & Service Providers

How does a service provider contracted to provide a full scope internal audit service with a limited budget apply Global Internal Audit Standard 9.2‘Internal Audit Strategy’?

View the Answer
Your Questions Answered

Service Provider Workpapers

When I engage a service provider to complete an internal audit, should I obtain a copy of their workpapers? I am an in-house CAE.

View the Answer
Your Questions Answered

Evaluation Ctitera

What are the requirements surrounding ‘evaluation criteria’ in an internal audit and how do I document this?

View the Answer
Your Questions Answered

Audit committee membership

Should audit committees have internal members from within the organisation?

View the Answer
Your Questions Answered

Audit actions

Should internal audit actions be followed up with management for closure using a risk-based approach?

View the Answer
Your Questions Answered

Types of outsourced engagements

What types of internal audit engagements are generally outsourced?

View the Answer
Your Questions Answered

Formats of audit reports

Can an internal audit engagement report be presented in other formats instead of in writing?

View the Answer
Your Questions Answered

Statement of GIAS

When can I say that an internal audit has been completed inline with the ‘Global Internal Audit Standards’?

View the Answer
Your Questions Answered

Internal Audit Quality

What should be the frequency of periodic internal quality assessments against the ‘Global Internal Audit Standards’?

View the Answer
Your Questions Answered

Annual internal audit report

Should internal audit prepare an annual report at the end of each year?

View the Answer
Your Questions Answered

Compliance

Can the internal audit plan be considered to be an organisation’s compliance program?

View the Answer
Your Questions Answered

Internal Audit Report Data Leak

What should I do if an internal audit service provider emails a confidential internal audit report outside my organisation?

View the Answer
Your Questions Answered

IA Mandate

What is the internal audit mandate in the new ‘Global Internal Audit Standards’?

View the Answer
Your Questions Answered

CAE approve IA documentation

Does the chief audit executive need to review and approve internal audit engagement documentation?

View the Answer
Your Questions Answered

IA Strategy

The new ‘Global Internal Audit Standards’ mention an Internal Audit Strategy – what is that?

View the Answer
Your Questions Answered

Sharing Service Provider Reports

Should internal audit reports prepared by a previous internal audit service provider be provided to a new service provider?

View the Answer
Your Questions Answered

CAE required to be CIA

Does the chief audit executive need to be a Certified Internal Auditor?

View the Answer
Your Questions Answered

Names in IA Reports

Is there an ethical issue using people’s names instead of job titles in internal audit reports?

View the Answer
Your Questions Answered

EQA by CIA

Do the people performing external audit quality assessments of internal audit functions need to be Certified Internal Auditors?

View the Answer
Your Questions Answered

Assurance Framework

Who should own an organisation’s assurance framework?

View the Answer
Your Questions Answered

Board Chair & ARC

Should a board chair attend audit committee meetings?

View the Answer

Ask A Question

Members may like to ask a question by emailing us.