YT YouTube2Text

YouTube2Text → Transcripts → CIA Part 1 - Unit 1: Foundation of Internal Auditing

CIA Part 1 - Unit 1: Foundation of Internal Auditing — Transcript

by Stuployer · 6,618 words · 1,017 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:01Hello everyone, this is Arif and today
0:02we are here with the CIA study course uh
0:06from CIA part one unit one foundation of
0:09internal audit.
0:12This is a brief uh intro of my career
0:15trajectory u last 16 years in the field
0:19of internal audit. Um a little bit
0:22detail about my educational and
0:24professional qualification in the
0:26industry and the sector that I have
0:27worked. Just in case if you just uh if
0:30you are interested in knowing me knowing
0:33me more uh you can post this video and
0:37read it or alternatively you can join me
0:41on LinkedIn.
0:44Uh just look into where we are today. So
0:47this is the overall CIA syllabus. uh if
0:50you look at uh CIA part one so there are
0:54mainly uh a couple of topics that we
0:57will be covering or areas we will be
0:58covering in CIA uh the fun the first one
1:02is foundation of internal audit uh then
1:05we have ethics and professionalism
1:07um and these ethics and professional
1:10basically apply in all uh related areas
1:13of internal audit be it advisory
1:15services be it uh assurance services GRC
1:19C governance risk and controls and the
1:22last one is uh assessing fraud risk. Uh
1:25so today we are focusing on the one of
1:29the key area which is the foundation of
1:31internal audit in the unit one.
1:36Unit one approximately covers about 10%
1:39of the total syllabus. This is my rough
1:41estimations. it might be um not
1:45corrected to the last digit but this is
1:47just a rough uh estimation just for your
1:50understanding purpose and you can expect
1:5210 to 12 MCQs might be coming from this
1:56area of uh CIA part one syllabus. Um
2:00overall if you look at from the glime
2:03perspective glime has 10 chapters or 10
2:06units. Today we will be covering the
2:08unit one foundation of internal audit
2:11and which comprises as I've already
2:13mentioned 10% of the total syllabus
2:18within the CIA uh unit one foundation of
2:21internal audit we will be mainly
2:23covering four areas what is the purpose
2:25of internal audit uh what are the key
2:27components about the internal audit
2:29charter um then we would also look into
2:33one of the key um um element we call it
2:38independence of internal audit. So we
2:40would see that what is the internal
2:42independence of internal audit and what
2:45are the threats that can pose to the
2:48independence of internal audit. Uh we
2:50will go in in literal and uh in a in a
2:55in a more conceptual way to understand
2:58the independence of auditor and the last
3:01one is the role of internal audit and
3:03risk management. So these are the four
3:05key topics that we will be covering from
3:08your personal understanding purpose. Um
3:12to set the foundation the basic thing we
3:16all know that we need to know why do we
3:20why do we uh exist within the
3:22organization the internal department. So
3:25it is important to know the purpose. The
3:27second thing is once we know our purpose
3:31the role and responsibilities are
3:33defined within a charter document which
3:36mandate what we are supposed to do and
3:39in order to do our job we have to be
3:42independent but if there are threats to
3:44independence how to overcome those that
3:47we will cover in the um in the third
3:51part of the unit one and the last one is
3:54what are the role and responsibilities
3:56of intel audit and risk management. It
3:58is an important because in some
4:00organization
4:02uh despite the fact that you are intel
4:03auditor you might be asked to carry out
4:07some of the risk management or entire
4:09risk management responsibility.
4:12So we have to have our safeguards and
4:15and guidelines how we can go about it
4:19and without uh hampering our
4:22independence. So there are certain uh
4:24key elements to that that we will go and
4:27discuss in the unit one uh syllabus.
4:32So here we are with our first topic
4:34which is about the purpose value and
4:36effectiveness of internal audit. The
4:39first thing we need to know is the
4:40definition of internal audit which set a
4:43solid foundation for the purpose of
4:46internal audit. Why do we exist within
4:48an organization?
4:50uh internal audit is an independent
4:53objective assurance and advisory
4:55services. It is important that I have
4:57highlighted certain words within the
4:59internal audit definition because each
5:02word is very
5:05uh important for our discussions and
5:08understanding and it has been very um
5:12carefully being
5:14uh uh used or or selected within the
5:18definition of internal audit. So
5:20independent uh the word independent
5:22means that we are the way we uh we
5:26report within the organization and the
5:28way we are positioned within the
5:30organization we have the autonomy and
5:32authority to perform our job without any
5:36due influence from the management. Uh
5:40objective assurance is objective is
5:42basically uh a free state of mind where
5:46we individually level we are objective
5:49like we are we are fair in our uh giving
5:53an assurance or giving an um uh or
5:57sharing the outcome of the internal
5:58audit and advisory services. So there is
6:01not always that we go as a police
6:03officer and check what are the controls
6:06are things doing uh or happening the
6:09right way or not. Sometime we become a
6:10consultant based on our uh expertise we
6:14share some insight or uh foresight to
6:19the management like based on the review
6:22of certain processes what might can go
6:24wrong or sometime we just assess the
6:26management without taking the
6:28responsibility. So it is very much
6:30important to understand that uh these
6:33key terms uh as part of your
6:36understanding of the internal audit
6:38concept. So let's see u internal audit
6:41is an independent objective assurance
6:45and advisory services designed to add
6:48value and improve organizational
6:50operations.
6:52It helps an organization accomplish its
6:55objectives. So we are there to help the
6:57organization to achieve its short and
7:00long-term objectives by bridging a
7:02systematic discipline approach to
7:05evaluate and improve the effectiveness
7:07of governance risk management and
7:10control pro processes. So basically as
7:13an internal audit department or as an
7:15internal auditor we have a very
7:18structured approach when we carry out
7:20our internal audit activities and once
7:23we carried our uh carry out our audit
7:26activities with a new professional care
7:30uh we provide
7:32uh an opinion and and and the
7:36recommendation to to strengthen the
7:39organization overall governance.
7:41Governance means how we the organization
7:44is being operated. Risk management how
7:47they manage their risk and control
7:48processes how they mitigate those risk.
7:51So we provide um value addition to these
7:56uh critical areas of the businesses. Now
8:00with from this definition we can form
8:03the purpose which is to deliver
8:05independent and objective assurance and
8:07advisory services. So mainly intell
8:12carry out two types of activities or it
8:14can be categorized into two types of
8:16activities. Assurance activities and
8:18advisory. Assurance is where we perform
8:21hard hardcore audit activities and we
8:25give a fair opinion about or conclusion
8:28about whether the things are happening
8:30the right way or not. and uh advisory
8:34services is basically uh consultancy
8:38assignments where we uh help the
8:41management to improve control gaps.
8:44Um secondly, what is our main focus? Our
8:47main focus is to strengthen the overall
8:49organization governance. The way the
8:51organization is being operated, the way
8:53they manage their risk and what are the
8:56key controls to mitigate those risks. So
8:59we help them to strengthen these three
9:02key areas. Our goal is as any other
9:05department within the organization that
9:07the organization may achieve its
9:09objective inside internal audit. Uh back
9:14in the days it was always said that
9:16internal audit is like postm where
9:19already u event has happened and now we
9:22come and evaluate the historical data
9:25which is not the case anymore. So
9:27internal audit not only review the in
9:30the current processes and historical
9:32data but based on those uh historical
9:36trend we also give some foresight or
9:39predictive um uh emerging risk within
9:43the company and advise the company or
9:46give recommendation that how to overcome
9:49or to be mindful about those risk to
9:51mitigate those uh risk through controls.
9:54Um we provide a risk based advice to the
9:57management which means that we focus
10:00mostly on the high-risk areas uh which
10:03are more critical uh to the organization
10:06because the organization have limited
10:07resources. So we as an internal audit
10:10prioritize on the key high-risisk area.
10:12It doesn't mean that we uh ignore or neg
10:16neglect the medium and the lowrisk but
10:18our main emphasis is to have optimum
10:22level of uh resource utilization.
10:26In terms of value, we enhance oversight
10:29over different processes within the
10:31organization.
10:33uh help management to make easy decision
10:35and we by which they they are able to
10:39gain trust within uh from the different
10:42stakeholder. So any organization which
10:45has a strong internal audit they might
10:47uh being looked by the by the banks by
10:51the financer by the regulators much more
10:54credible as an organization.
10:57uh reputation uh we build uh credibility
11:01and serve public interest obviously uh
11:05because if we provide the assurance on
11:08different services within the
11:09organization so which which helps the
11:12public interest in terms of taking the
11:15right decision whether investing within
11:17the company using the products or
11:18anything so that gives them a trust uh
11:22it might be direct or it might be
11:24indirect
11:25um in terms of uh standards. Uh internal
11:29audit has our own standards uh by the
11:32institute of internal audit. So we per
11:35we perform our audit activities in order
11:38and and within uh within the mindset of
11:42being in compliance with those standard
11:45globally and if locally if there are
11:47certain practices or regulation that has
11:50to be followed so we follow that as
11:52well. uh independence it's very much
11:54important that uh same like a jury or a
11:57judge where if they are not independent
12:00no one will trust their judgment uh on
12:02any case. So similarly internal auditor
12:05has to be independent and objective. So
12:08independence is basically comes uh from
12:12the positioning of the internal audit
12:14department within the company which
12:15means that the internal audit has to
12:17report to the uh to the board of
12:20directors or to the member of the board
12:22of directors through audit committee
12:24rather than to the CEO because if they
12:26are reporting to the CEO then they will
12:29be under the influence of the CEO uh and
12:32by which they might not report all the
12:35uh wrong things or key merging ing risk
12:37within the company. So we need to be
12:40positioned very well within the company
12:42which is uh independence and objectivity
12:44means that we have to be more objective
12:47in our mindset that we are not
12:49influenced. For example, we might not
12:53feel that because I have a friend within
12:55the department, so I might be a bit more
12:57lenient or if I might get any um benefit
13:01from someone, so I have to change my my
13:05um decisions or my um you know audit
13:10work program accordingly. So we have to
13:13be very clear and objective in our
13:15mindset as well to be a credible
13:18internal auditor. Here
13:23we are with the other slide uh under the
13:26same topic purpose, value and
13:28effectiveness of internal audit. Uh in
13:31this uh slide we will be discussing
13:35about what are the internal audit
13:36mandate uh and what is the chief audit
13:40executive responsibility.
13:42First of all, uh whatever what why we do
13:45exist and what is the purpose of
13:47internal audit that is being formally
13:50drafted and documented and approved in
13:54document called internal audit charter
13:57uh which is being approved by the
13:59highest authority within the
14:01organization or in governance system
14:03which is by the board of directors. Um
14:06they don't do it themselves. uh they do
14:08it sometime through audit committee or
14:10sometime they approve by themsel. So
14:14there we can have in this document we
14:17have the role and responsibility why we
14:19do exist and what is the purpose. It
14:22defines also um the scope area for
14:25example in in what are the key um key
14:30areas that we will be covering in our
14:32internal audit assurance services or
14:34what are the guideline for the advisory
14:36services.
14:38uh sometime when you are working with a
14:40very complex holding companies so they
14:43might say that your scope area is you
14:46have to restrict up to subsidiary level
14:49you don't have to go and audit an
14:51affiliate or other investments. So these
14:55mandates define the the scope or the
14:57boundaries uh under which we can work.
15:01It also defined the authority that
15:04internal audit has the access to uh all
15:07type of data or record within the
15:09organization,
15:11people and operations because it is very
15:13much important for us to have those free
15:16access in order to evaluate processes
15:18and give our uh conclusion based on
15:21that. and also talks about the reporting
15:25line of internal audit uh which is the
15:28dual reporting uh functional
15:30functionally internal audit report to
15:32the uh audit committee and if it doesn't
15:35have a company doesn't have an audit
15:37committee then ideally to the board and
15:40uh administratively to the CEO. So it is
15:44important for you to understand what is
15:45the difference between functional
15:46reporting and administrative reporting.
15:48Functional reporting means that our
15:51charter is being approved by the board
15:52or audit committee. The role and
15:55responsibilities are defined there. Um
15:57the audit committee make the final
15:59decision about the hiring and filing of
16:01the chief audit executive. So the co
16:03doesn't have that authority. Uh then the
16:07uh audit committee also approve our
16:09annual audit plan periodically on a
16:12quarterly basis or halfearly or there
16:14there's a frequency which is defined in
16:17the audit internal audit um uh in the
16:20audit committee charter basically the
16:23frequency at which we will be reporting
16:25to the audit committee and if we face
16:27any challenges with the management we
16:29addresses to the audit committee. So we
16:33this is our functional reporting.
16:35However, in terms of administrative
16:37reporting, the the CEO has to provide us
16:40the support for example in allocating
16:42the budget for the internal audit pro uh
16:45assisting them with the hiring of the
16:47internal audit through HR. um sometime
16:50the CA performance evaluation as part of
16:54the organiz as part of the employee of
16:56the company. However, the ultimately it
16:59is being uh reassessed by the audit
17:02committee but we follow the same
17:04organizational hierarchy as any other uh
17:07employee within the company. Uh in some
17:09companies it is purely done and and and
17:12referred to the audit committee. In
17:14other organization it is an
17:16administrative be through HR process. um
17:19the chief for executive expenses for
17:21example traveling related expenses some
17:24out of pocket expenses uh regulatory
17:26compliance to provide the support in
17:28that. So these are administrative um
17:31elements which uh is more inclined
17:35toward or provided by the support
17:38provided by the CEO.
17:40It is very much important for the chief
17:42audit executive that they um they align
17:45the internal audit charter with the laws
17:48with the local laws um standards and
17:52regulations
17:54um and and within the company strategy
17:57as well.
17:59Uh it is important for the chief audit
18:01executive that they should at least bear
18:03minimum annually review the internal
18:05audit charter and align it if there are
18:08any uh organizational change changes
18:11within the within the uh within the
18:14company or if it is changes in the in
18:18the standards or regulatory
18:19requirements. So accordingly they have
18:21to revisit annually just in case if it
18:24if it requires any changes. And lastly
18:28we have to make sure that all the
18:30internal audit activities are much more
18:32coordinated with the management and are
18:35non duplicative in nature because we
18:37have a second line of defense. Sometime
18:39we have external assurance providers. uh
18:42so we have to ensure that we are not
18:45doing uh duplicated or duplicating the
18:48job but rather we are giving more
18:51effective and uh costefficient internal
18:55audit activities to the company.
18:59So now our second topic is internal
19:02audit charter. So in the previous one we
19:04talked about the purpose of the internal
19:06audit and what are the mandate of the
19:08chief audit executive or the role uh
19:10chief audit or the role and
19:12responsibility.
19:14Those role and responsibility as we have
19:16previously discussed is defined in the
19:18charter. So now we will go a little bit
19:20more um specifically toward the intel
19:23audit charter. It it's more or less
19:25duplication but you will find such kind
19:27of duplication in the CIA course
19:29material. So here we have a specific
19:32standard by the IIA which which uh
19:37requires the charter to define the
19:39purpose, standards, scope, expectation
19:43and reporting line of uh for the
19:46internal audit activities. It is
19:48important they set the bare minimum
19:50requirement. It doesn't mean that the
19:52internal audit charter only comprises of
19:54these five components but these are the
19:57bare minimum that needs to be there. Uh
20:00in fact we have a model internal audit
20:02charter available at the IIA website
20:06just to in just to benchmark or or use
20:10it in case if we do not have an inhouse
20:13uh internal audit charter which set the
20:15bare minimum criteria for internal
20:17audit. As we have previously already
20:20discussed the scope basically comprises
20:23whether we will be performing assurance
20:25uh advisory services some investigative
20:28activities
20:29and also in terms of how much coverage
20:32within the organization we will be
20:34performing
20:35uh authority and reporting which
20:38basically reflect that we needs to have
20:41as an internal auditor unrestricted
20:43access uh people processes um operations
20:48uh documents and our dual reporting to
20:51the board and management or
20:53administrative reporting to the CEO.
20:56uh what is the responsibility of the
20:58board towards the intel audit charter
21:01that they have to review and approve the
21:04charter and the management has to
21:06provide the support in when we are
21:08drafting intel audit charter we also
21:10take input from the CEO uh just to be
21:13aligned with the company overall
21:15objective strategies uh and also for an
21:18awareness purpose so they should be much
21:20more aware and feel inclusive in the in
21:24within the governance framework of the
21:26organization.
21:27Um administrative reporting we have
21:30already discussed uh where the budgets,
21:33staffing, performance, expenses, these
21:36are the elements where the CEO can
21:38provide support to internal auditor and
21:42it has to be um it is important for the
21:46internal in order to obtain such kind of
21:48support. Without that we will not be
21:51able to deliver our services. uh
21:54customization and review it is important
21:57we are more aligned with the
21:59organization. So if there are changes
22:01within the organization or standard
22:03changes so such kind of changes needs to
22:06be reflected at least on annual basis we
22:08have to review our internal audit
22:10charter safeguards and quality. Um it is
22:13important that we ensure that the or we
22:17define clearly within the internal audit
22:19charter that the internal auditors need
22:22to be independent and objective. Uh
22:24independence will will be ensured
22:27through the right positioning of the
22:29internal audit and objectivity through
22:31the right mindset like we are not requ
22:34this the management should not request
22:37from the internal audit uh to to perform
22:40certain management activities or take
22:42certain decision on behalf of the
22:44management otherwise we would not be
22:46objective. also the pro uh communication
22:49protocol the frequency of internal audit
22:51reporting it is important and access to
22:54the CEO as well this is also part of the
22:57internal audit charter mandate um and uh
23:00and lastly the quality assurance
23:02mechanism that how internal audit has to
23:05ensure that they do a proper in a proper
23:09way internal audit activities if you
23:11remember in the purpose of internal
23:12audit we have uh dis we have uh a few
23:16terms like we do systematic
23:19uh and discipline approach we follow. So
23:21that is where the quality assurance
23:23plays it roles. So if we are following a
23:26systematic and organized way proper uh
23:29planning proper fieldwork maintaining
23:32all the documentation getting getting
23:34out proper uh performing per uh proper
23:39audit procedures then having a proper
23:42audit report communicating it properly.
23:45These are all part of the quality
23:46assurance. We also quality assurance
23:49mandate that we need to have like proper
23:52uh competence level, right people,
23:55staffing,
23:56um access to the information. This is
23:58all different component of the quality
24:00assurance. So these are all the key
24:03elements which are defined in our Intel
24:06audit charter which is being uh drafted
24:09by the chief audit executive, reviewed
24:12and endorsed by the CEO and approved by
24:14the audit committee or the board.
24:17So far we have covered the purpose of
24:19internal audit and
24:22uh and the internal audit charter uh and
24:26now we will be covering the impairment
24:28of independence. So what if um we are um
24:34our independence as we have already
24:37discussed in the previous slide about in
24:39which we were talking about the internal
24:41audit charter where one of the key
24:43element that we safeguard or we put
24:47guidelines that internal audit has to be
24:50independent and objective uh objective
24:53in in carrying out their activities and
24:56that can be assured through certain
24:59mechan mechanism. So that we will be
25:01discussing here in detail before we go
25:04and discuss about the impairment.
25:06Impairment means the threats that can
25:09lead to um uh that can lead to certain
25:13risk to the independence of income
25:16auditor uh that we will be discussing
25:18here. But initially we let's uh think or
25:21let's go into details and what what the
25:26standard says about internal audit
25:28independence.
25:29It is important to understand uh the
25:32structure of the new internal audit
25:34standards because without knowing the
25:37structure of the new internal audit
25:39standard you will be always confusing
25:40the entire CIA part one um in in your
25:45part one basically uh that how the
25:49principles take into its place within
25:52the standards. What are the standards?
25:54sort of the ethics and all just to give
25:58you an overview. Um so the new internal
26:02standards has um five main domain within
26:06the five domains they have allocated 15
26:09principle that what they believe uh we
26:12have to achieve and then in order to
26:15achieve those principles we have 52 if
26:18I'm not wrong to be precisely uh
26:21standards to how to implement certain um
26:26activities in order to ensure that we
26:29achieve those principles within the five
26:32domain of internal audit activities. If
26:34you wanted to have much more deeper
26:36understanding of the internal audit
26:38standards, I have uh I have shooted a
26:41video uh some time back on the 2025
26:45internal audit standards. So you can
26:47look into it. It will give you a
26:49comprehensive overview what uh
26:53what constitute the the new uh internal
26:56audit standards. So as I've mentioned
27:00you within the five domains we have
27:02first uh principles and how to achieve
27:05those principles we have supporting
27:07standards. So here the principle seven
27:10which talks about the independence we
27:12will read and then we will say what the
27:14standard says how we can go about it. So
27:17the principle seven says positioning
27:20which is about positioning
27:22independently.
27:23The board must establish and protect the
27:25internal audit function independence and
27:27qualification to enable objective work
27:30without interference. So this is the
27:32objective which we want to achieve that
27:35the board has to provide that support
27:37that by which we uh as an internal
27:40auditor believe that we are independent
27:42to carry out our audit activities. Now
27:45the standard will mandate how we can go
27:47about it. Organiz standard 7.1
27:51organizational standards independence
27:53sorry the CE must annually confirm to
27:56the board that the internal audit is
27:58independent and report any impairment
28:00along with safeguards taken. So here how
28:04we will ensure u that that the the
28:09internal auditors uh or the internal
28:11audit activities are being independent
28:13that every year the CA has to report and
28:16if there is an impairment to the
28:17internal audit independence they have to
28:20tell or if uh there are certain
28:22safeguards that we can take in order to
28:25preserve the independence of internal
28:26audit that we have to tell to the audit
28:29committee or to the board.
28:32So let's deep dive a little bit more
28:35specific responsibility of the board. Uh
28:38in terms of independence the chief audit
28:42uh uh executive hiring and firing can be
28:45done by the should be done by the board
28:48or audit committee. This is how we
28:51enforce independence ensure u audit
28:54independence uh through this and also
28:57the positioning of the audit committee
28:59or the reporting line that we directly
29:02report to the board and we have a free
29:04access to the board or audit committee
29:06members. So this is how what are the key
29:08responsibility of the board. Now coming
29:11to the chief audit executive
29:14responsibility annually we have as per
29:16the standard we have to confirm our
29:18independence and disclose impairment any
29:21threats that's that may pose to the
29:23independence of internal audit and
29:26recommend safeguard just in case if we
29:28cannot avoid it we have to tell what we
29:30can do about it sometime for example the
29:33internal auditor is being asked to
29:35perform certain um activities beyond
29:38internal audit for example risk
29:40management ment activities or compliance
29:42then we there are certain safeguards
29:43that we have to take that we have to u
29:48tell to the audit committee as well. Um
29:51management responsibility is to support
29:53the chief audit executives in ensuring
29:55their independence uh enabling an
29:58environment where they can have free
29:59access to the board and provide the
30:01resources that included need to perform
30:04their activities through to personnel
30:07staff through uh resources
30:10um and and allocating budgets. So these
30:14kind of uh support the management can
30:16provide.
30:20So now let's see what are the situation
30:22that lead to the impairment of internal
30:24audit independence. The most common are
30:27management restrict our access to
30:30information records people processes
30:33that could lead that that could lead to
30:36um creating bottlenecks for for carrying
30:40out the intent activities. And when we
30:42do not have access to such information,
30:44we would not be more objective in giving
30:47asurances or certain processes within
30:49the organization. So that could be one
30:52of the reason sometime they request to
30:56eliminate or to uh lower the tone of the
31:00audit findings um or change the audit
31:03findings. So this could be another way
31:06by um imposing an impairment to the
31:09intel audit. Sometime they pressure to
31:12alter the results. Um they might not
31:16allocate the proper resources in terms
31:19of budgets cuts to internal audit
31:21department. For example, we might not
31:23have expertise to carry out a cyber
31:25security audit and the management does
31:28not allocate budget to go for outsource
31:31uh for outsourcing the cyber security
31:33and within the team we do not have
31:36resources or capability. This could be a
31:38reason not letting hiring more auditors.
31:42So these could be different tactics
31:44which might be used by the management to
31:48impair our independence or undermine our
31:50work. Um and sometime there's a conflict
31:54of interest means that the uh the chief
31:57audit executive might be asked to
31:59perform certain management activities.
32:01Um and eventually when he is supposed to
32:05carry out audit activities he might not
32:07be comfortable enough to give assurance
32:11on the same activity which he has
32:13performed because if he highlight any
32:14weaknesses in that case he will be
32:16questioned that you were doing the job.
32:18So there are certain safeguards there
32:20are certain ways of overcoming those
32:23conflict of interests or there could be
32:26um other conflict of interest. Maybe uh
32:29for example the chief executive has to
32:33report on someone who is a close
32:36relative to him. Maybe the company does
32:38not have a very stringent policy where
32:41such disclosure needs to be made. Um he
32:44might have a close affiliation with some
32:47employee or may have a material interest
32:50in terms of getting some favors either
32:53in financial terms or workrelated favors
32:56while compromising on their work. So
32:58these are different kind of conflict of
33:01interest which needs to be taken care of
33:04in order to ensure that we are more
33:06independent
33:08non- audit roles uh anything that the
33:11management request or sometime the audit
33:13committee enable us to perform for
33:15example risk management activities or
33:17compliance activities
33:19um there are certain safeguard that
33:21needs to be taken care of that once we
33:23carry out such certain activities we
33:27still make sure to the manager ment that
33:28the ultimate decision maker or the
33:31responsibility responsibility falls on
33:33the management despite the fact that the
33:35intel audit auditors are performing
33:37those activities. Secondly, those who
33:40are involved in such activities needs to
33:42be not enable them or or make them
33:45responsible to carry out audit within at
33:47least for a cooling period of 12 months.
33:50Uh and there should be a timely transfer
33:53uh of that role to the management. it
33:56cannot be a permanent role where
33:58internal audit can presume such activity
34:00for a very long-term period. So these
34:02are certain safeguards that can be taken
34:05in order to ensure that internal
34:07auditors are more independent. Um lastly
34:11maintaining independence u the chief
34:14audit executive his role or
34:17responsibility is to evaluate on a
34:20yearly basis and disclose all the
34:23impairment if there is any or if he
34:26believes there could be any red flags to
34:28to the independence of a to the um board
34:32and uh yeah by this we we ensure that
34:36the the the activities which we perform
34:39are much more reliable and trustworthy
34:42by the stakeholders because if we
34:44maintain our independence we would be
34:47more objective in our carrying out our
34:49audit activities. So these are some of
34:51the key elements related to the
34:53independence of internal audit and how
34:56to safeguard the impairment of the
34:57internal audit in the uh third part of
35:00the unit.
35:02This is the last topic of our unit one
35:05the role of internal audit in risk
35:07management. There are certain uh key uh
35:10important elements that we need to take
35:12into account. Firstly, as I've already
35:15mentioned, we need to know the principle
35:18uh the objective uh and then we have to
35:22talk we have to further more understand
35:25the standards how we can achieve those
35:27objective uh related to the role of
35:30income audit and risk management. So the
35:32principle nine plan strategically states
35:36that chief audit executive must align
35:38internal audit activities or internal
35:40audit plan with the organization's risk
35:43and long-term objectives. We will
35:46diagnose this statement into much more
35:49detail uh but first go through the
35:51standard as well. The standard 9.1
35:54states uh understanding risk chief audit
35:58uh executive must understand governance
36:00risk management control to develop
36:01effective audit strategy. So basically
36:04what happened that whenever we carry out
36:06our annual audit plan activities
36:09um we have to go and refer to certain
36:14um key risk reports within the company
36:17or the activities of the risk management
36:19department. You know on a practical term
36:22internal audit uh obtain the risk
36:24register from the risk management
36:25department and see what are the key risk
36:28and they align those risk assessment
36:30with their own internal risk assessment
36:31because we have already performed
36:33certain area audit activities and
36:35follow-up activities. So we also have
36:37our own independent judgment about the
36:39risk apart from the risk management
36:42department. The risk management
36:44department have their own way of um
36:49uh compiling and consolidating and
36:52reporting the key risk uh of the
36:55organization to the management and to
36:57the risk committee. Uh they define the
36:59risk appetite which are acceptable level
37:01of risk within the company and with and
37:05risk tolerance um that how far we can
37:08tolerate and then
37:11if we if the organization breaks such uh
37:15limits then they have to report and the
37:17management has to take certain action to
37:19mitigate those risk within tolerable and
37:21acceptable level. So those reports are
37:24very much important for internal audit
37:26to review in order to carry out a
37:29effective uh internal audit plan for the
37:33year or for the long-term three years
37:35plans. Um so what are the key things
37:38that internal audit has to do? They have
37:40to understand the key risk within the
37:42organization. be it related to the data
37:45documentation,
37:47operational effectiveness, how the
37:48operations are happening within the
37:50company. It could be related to the
37:52assets and regulatory compliance. So
37:55these are the key four elements that we
37:58can drive within those um risk reports.
38:02Uh it is also important for the chief
38:05audit executive to build an insight
38:07within the organizational risk
38:09activities and engage with the
38:11leadership with the management as well.
38:14Analyze risk report and align the risk
38:17framework or appetite uh in order to
38:20better understand what is a tolerance
38:22level within the organization where the
38:24acceptable appetite and if there if
38:27there is breach of those uh is there is
38:30a proper effective reporting or not. So
38:32these are direct or indirect ways by
38:36which we become more inclusive in our uh
38:40strategic planning and our audit plan is
38:43much more aligned with the
38:44organizational direction in long-term
38:46objectives and hence we uh provide value
38:50addition to the company.
38:54Um whenever we talk about risk
38:57management it is important to have a
38:59clarity in mind in terms of um who does
39:03what. So there are there is a very
39:05beautiful model we call it the IA3 line
39:08of model which clearly define the role
39:11and responsibilities
39:14uh within the organization. and they
39:16break down within three different layers
39:20which enables the organization to
39:23strengthen it governance. Um the model
39:27clarifies basically
39:30how to manage or who manage the risk and
39:34who strengthen the governance and who
39:36provide the assurance.
39:38the first line uh or the first line
39:41previously the the same model used to
39:43call three line of defense which were
39:45which were uh much more easy to
39:48comprehend rather than threeline model.
39:51So I will be using the same but the new
39:53name is threeline model. So just stick
39:55to threeline model but the word defense
39:57is important because it it uh
40:00conceptualize that how we are providing
40:04a defense against the risk. So there are
40:06three
40:08walls you can say or three layers that
40:11the risk has to pass through in order to
40:14affect the organization. So if we have
40:17effective walls or effective layers,
40:20uh if not the first line, the second
40:23line might catch the risk. If not the
40:25second line, then third line might cash
40:27the risk. And eventually if all three
40:30fails it might expose the company to a
40:33major risk or potential negative
40:36consequences.
40:38So let's break down the organization
40:41into three lines. So the first line
40:43basically are the operation people uh
40:46which own the risk. For example, if you
40:48are in a manufacturing, the production
40:50people, the people who handle the
40:52inventory, the people um who carry out
40:56the manufacturing activities in a
40:58construction, the laborers, they are the
41:01first lines. So the these are the people
41:03who who uh roll up their sleeves and
41:06then do the dirty work and carry out the
41:09the operations. In a service- based
41:11organization, these will be the people
41:13who are uh picking up the phones and and
41:17per or providing the the the services
41:22um to their clients on the front end. So
41:25these are the people who basically are
41:27the first line which are who supposed to
41:30own the risk means that these are the
41:35people who has to ensure that they do
41:37their job in a in a in a more effective
41:40manner in order to not expose the
41:43organization to any risk. Then we have
41:46the second line. The second line are the
41:47people who support the first line in
41:50discharging their duties. For example,
41:54they are the people who are partially
41:56independent. They will be performing a
41:58check and balance on them. They will be
42:01creating for example um health and
42:04safety people, quality assurance people,
42:07compliance team, risk management team,
42:09they will be periodically reviewing
42:11their work just to ensure that they they
42:14uh they do not expose the organization
42:17to any major risk and they take care of
42:19those risks. So the second line more
42:22ensure the compliance towards the
42:24company's policies, procedures,
42:27safeguards, regulations. The third line
42:30which is completely independent is the
42:32internal audit which provide asurances
42:35whether the first line uh and second
42:38line are carrying out their their
42:40assigned responsibilities in a more
42:43effective way and if there are any gaps
42:45then we identify those gaps and
42:47recommend improvement. Um the external
42:50auditors are also part of the uh third
42:53line of uh defense
42:56value of the model. It prevents uh the
42:58role overlaps. So each um individual
43:03whoever falls in whichever uh
43:05classification of those uh defense lines
43:09they know the role and responsibility.
43:11It enforcs clear accountability and eval
43:15and and elevates the risk based decision
43:17making because uh we ensure that those
43:20risk are properly managed. So it enables
43:23us to make more risk based decisions.
43:26What are the key principle of threeline
43:28model? It uh effective governance
43:31requires board oversight, clearly
43:34defined role responsibilities
43:36uh independent audit reporting
43:38integrated. So basically these are the
43:40key principles which ensures that we are
43:43able to achieve the in the clarity of
43:46the three line of defense that we need
43:49to have a proper board oversight that
43:51the border the board uh enable or or or
43:56look after the company in terms of um
43:59whether the the management is performing
44:01their job in an in effective way or not.
44:04They clearly define the role and
44:06responsibilities. We have to ensure the
44:08internal audit is independently
44:10reporting and integrate assurance
44:13collaboration means where internal audit
44:15might collaborate with the risk
44:17management in the management compliance
44:20team to ensure that our outcome is much
44:23more effective. So we might take their
44:27work and use as an internal audit audit
44:31work but the responsibility will be on
44:33us or sometime we can use these
44:35department to avoid any duplication.
44:38There could be also possibility some
44:40external asurances are being carried out
44:42within the organization where we can
44:44collaborate with them. We have to
44:46collaborate within the within the
44:48organization to give a value addition to
44:52the company. So this is the the last
44:55topic for the unit one.
44:59Here we are at the end of the entire uh
45:02unit one in which we cover four key
45:05topics. The first one was the purpose of
45:07internal audit. The second one was about
45:10the internal audit charter. The third
45:12one was about the independence and the
45:14impairment of independence of internal
45:16auditor. The fourth one was the role of
45:19internal audit and risk management. So
45:21these are very essential uh concepts
45:24which are very much important. You need
45:26to have a very good command and clarity
45:28over it because this these topics will
45:32set the foundation for the whole entire
45:35CIA part one going forward. So try to um
45:40to to ensure that you have a clarity
45:44over these topics. If you don't have,
45:45refer back and try to revisit each topic
45:49again until you have much more clarity.
45:52Um, thank you very much for watching and
45:54hope to see you in the next video.

About this transcript

This page contains the full transcript of CIA Part 1 - Unit 1: Foundation of Internal Auditing by Stuployer, generated from the public captions YouTube serves with the video. The transcript has 6,618 words across 1,017 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.