The Institute of Internal Auditors (IIA)
1035 Greenwood Blvd., Suite 401
Lake Mary, FL 32746 USA

30 May 2023

Dear Sir or Madam,

Re: Consultation on the proposed Global Internal Audit Standards

The International Corporate Governance Network (ICGN) appreciates the opportunity to comment on the proposed Global Internal Audit Standards issued by the IIA.

Led by investors responsible for assets under management of $77 trillion, ICGN is a leading authority on global standards of corporate governance and investor stewardship to preserve and enhance long-term value. Headquartered in London, our membership is based in more than 40 countries and includes companies, advisors, and other stakeholders.

ICGN supports the effort by the IIA to offer global standards for internal audit functions, in coordination with the International Internal Audit Standards Board (IIASB). ICGN welcomes the harmonization of standards on a global scale; we hope that other standard setters will align their standards with the Global Internal Audit Standards (GIAS) proposed by the IIA. This will enhance confidence among investors and stakeholders around the governance of  a company’s internal audit function and help ensure this is conducted in a consistent and comparable manner across all markets.

The ICGN Global Governance Principles[1] emphasize on the important role of the internal audit function, including “rigorous, independent and effective internal and external audit procedures, to ensure the quality and integrity of corporate reporting”. Our Principles recommend that the board oversees the establishment and maintenance of an effective system of internal control to properly manage risk which should be measured against internationally accepted standards of internal audit and tested annually for its adequacy. Companies should have a dedicated internal audit function with clearly defined oversight and reporting structures.

Whilst we broadly agree with the principles and standards as proposed by the IIA in the public consultation, we have several recommendations for your consideration:

• Definition of governance – The IIA proposes a narrow definition of governance as “the combination of processes and structures implemented by the board to inform, direct, manage, and monitor the activities of the organization toward the achievement of its objectives”. We recommend that the IIA consider aligning its definition with the ICGN Global Governance Principles, which describe governance as “the system by which companies and boards are directed and controlled based on the principles of fairness, accountability, responsibility, and transparency within a framework of effective governance controls”.[2] This definition is consistent with the aims of the proposed standards and provide an investor focus.

• Definition of public sector – We recommend that the definition of public sector include national, regional (e.g. state, provincial, territorial) and local (e.g. city, town) authorities and their component entities (e.g. departments, agencies, boards and commissions).[3]

• Definition of stakeholders – In the proposed standards, “shareholders” are included in the definition of “stakeholders”. We strongly advocate that the standards recognise investors as a specific designated category in the Glossary. Investors are equity owners / managers of a company and are expected to exercise their share ownership rights to hold corporate boards to account for promoting the long-term success of the company. We also recommend using the term “investors”, rather than “shareholders”. While investors may be shareholders in a company, they also may hold debt or have other investment vehicles. 

• Principle 6 Authorized by the Board – According to the draft standards, p.33, “the board establishes, approves, and supports the authority, role, and responsibilities of the internal audit function”. We recommend that the following words be added “and monitors”.

• Principle 6.2 Board Support – ICGN recommends adding on p.36: “Monitoring the internal audit function on at least an annual basis”.

• Standard 7.3 Safeguarding Independence – ICGN recommends that the following language in italics be added on p. 45, “The board must protect the independence of the internal audit function by ensuring safeguards to manage the risk of impairment are designed adequately and operating effectively. The board should establish whistleblowing or anonymous reporting procedures to provide information on potential unreported impairment”.

• Standard 9.1 Understanding Governance, Risk Management, and Control Processes – ICGN recommends that the list of key risk areas, on p.60, also include: Effectiveness of programs or policies to monitor and address cyber security, systemic or reputational risks. From an audit (external or internal) perspective, we would urge alignment with the Committee of Sponsoring Organizations’ (COSO) frameworks on internal controls and enterprise risk management.[4]

• Standard 11.1 Building Relationships and Communicating with Stakeholders. ICGN recommends that “investors” be included in the Glossary as a separate entity rather than under the definition of “stakeholders” and in the outreach relating to the internal audit functions. It is important that investors are also included in paragraph one on p.82, which describes to whom the chief audit executive should build relationships and trust.

Please find below ICGN’s responses to the five questions highlighted by the IIA.

1. How do you see the new Global Internal Audit Standards affecting the organization’s internal audit quality and value? 

ICGN welcomes the broad adoption of the proposed standards globally. A company adopting these standards, albeit voluntarily, would send a positive signal to its investors and stakeholders. This would demonstrate the board’s commitment to the quality of the internal audit function, its risk management approach and effective monitoring. 

2. How do you see the new Global Internal Audit Standards affecting the organization’s ability to serve the public interest? 

The global standards will strengthen the quality of internal audit at organisations, which is an important part of the control environment. Having a more effective control environment will help protect organisations, and ultimately investors, from fraud and opportunistic behaviours.

The IIA’s effort to standardize and raise the level of internal audit practices is important. We appreciate that the IIA is working to set standards to serve the public interest, which includes the process for review being undertaken by the IIASB and overseen by the International Professional Practices Framework (IPPF) Oversight Council, which should address disclosure and transparency concerns.

We also note that market downturns in the past were, in part, due to poor governance practices, the lack of internal audit, and external audit controls and monitoring. Losses in the market were borne by investors, leading regulators to tighten standards for disclosure and reporting. Therefore, confidence in the global markets is of utmost importance.

3. How will the new Global Internal Audit Standards impact your professional environment?  

Having a global standard will assist investors in their engagement with investee companies on the effectiveness of the internal audit function. In this regard, investors will be able to engage with boards and senior leadership, including the Chief Audit Executive (CAE)’s office, and encourage them to adopt the standards. Investors may also refer to the standards when evaluating the quality of a company’s internal audits. These evaluations will help inform investors’ engagement with companies. The standards may also help companies identify fraud-related issues that can lead to lost revenue and harm returns for investors.

4. Internal auditing enhances the organization’s success by providing the board and management with objective assurance and advice. Is this new purpose statement relevant and complete? 

ICGN appreciates the effort to bring the board and management firmly into the oversight and review processes for the internal audit function. We encourage an expanded purpose statement that includes reference to the disclosure of potential risks, as well as objective assurance and advice. In general auditing standards, it is expressly stated that auditors do not discover certain types of fraud, which can range from basic to complex, for various reasons, leaving it to management to make such corrections. For example, we refer the IIA to Public Company Accounting Standards Board (PCAOB) Accounting Standards 2401, paragraphs .09-.12, which affirmatively absolves external auditors from effective accountability in fraud detection, leaving the issue to management and the company.^[5]  It is important that internal auditors accept a heightened role in preventing fraud whether committed by employees or management.

5.  A new Governing domain more clearly states the board’s role and responsibilities to authorize the internal audit function, ensure the function’s independent positioning, and oversee the function’s performance. At the same time, the CAE is required to support the board’s oversight and governance, as well as take part in responsibilities that are accomplished jointly with the board. How might the principles and standards in the Governing domain affect governance in your organization?

Internal auditing enhances the organization’s success by providing the board and management with objective assurance and advice. Do you agree with:

Internal auditing strengthens the organization’s:

• Value creation, protection, and sustainability.
• Governance, risk management, and control processes.
• Decision-making and oversight.
• Reputation and credibility with its stakeholders.
• Ability to serve the public interest.

Internal auditing is most effective when:

• It is performed by qualified internal auditors in conformance with the Global Internal Audit Standards, which are set in the public interest.
• The internal audit function is independently positioned with direct accountability to the board.
• Internal auditors are free from bias and undue influence and committed to making objective assessments.

ICGN agrees with the new language for a Governing domain that clearly defines the board’s role and responsibilities to oversee a company’s internal audit function, its independent status, and performance. We have suggested that “monitoring” be included in the board’s role as described in the Standards and Principles.

We also agree that the CAE should be required to support the board’s oversight and governance, as well as manage the responsibilities that are accomplished jointly with the board. In some companies, there is an element of shared responsibility for the CAE’s role, with board and CEO oversight as required to fulfil the responsibilities. It should be clear, however, that first and foremost, the CAE has a duty to the board. 

ICGN agrees with the statements related to how “Internal auditing strengthens the organization”, however, we would recommend adding the following language to bullet four: Reputation and credibility with its investors and stakeholders.

Thank you again for the opportunity to comment on the proposed Standards. If you would like to follow up with questions or comments, please contact our Global Policy Director, Séverine Neervoort (severine.neervoort@icgn.org) or our Governance and Stewardship Policy Manager, Carol Nolan Drake (carol.nolandrake@icgn.org).

Yours faithfully,

Kerrie Waring
Chief Executive Officer, ICGN

Cc:  James Andrus and Nga Pham, Co-chairs, ICGN Financial Capital Committee

---

[1] ICGN Global Governance Principles 2021.pdf, Principle 8, p. 30.

[2] ICGN Global Governance Principles 2021.pdf, Preamble, p. 4.

[3] See the International Federation of Accountants (IFAC)’s work on public sector reporting and professional financial management (i.e., related to International Public Sector Accounting Standards Board (IPSASB) accrual accounting standards). 

[4] COSO-Fraud-Risk-Management-Executive-Summary.pdf

[5] AS 2401: Consideration of Fraud in a Financial Statement Audit | PCAOB (pcaobus.org)