The Chartered Institute of Internal Auditors (Chartered IIA) has unveiled its long-awaited new Internal Audit Code of Practice. Designed to equip organizations with the tools to navigate today’s increasingly complex risk environment, the new Code sets a higher standard for internal audit practices across the UK and Ireland, bolstering corporate governance and contributing to economic stability.
In a time of rapid change, the Code offers Audit Committees and internal audit professionals a comprehensive roadmap and set of principles to ensure the effectiveness of internal audit functions. For the first time, the Code offers a unified approach encompassing the financial services, private and third sectors, elevating the standards of internal audit practices across the board.
Spearheaded by an independent committee established by the Chartered IIA and chaired by Sally Clark, Audit Committee Chair at Citigroup Global Markets, the Code has received input from several key UK and Irish regulators, including the Bank of England, Central Bank of Ireland, Financial Conduct Authority, and Financial Reporting Council. The Code’s development was also shaped by extensive public consultation, involving hundreds of internal audit professionals and other stakeholders including business leaders, regulators, standard setters, and other professional bodies.
The new Code applies to all internal audit functions in the financial services, private, and third sectors across the UK and Ireland.
Building on the new Global Internal Audit Standards and the revised UK Corporate Governance Code, the updated Internal Audit Code of Practice aligns with these frameworks while introducing several key enhancements, including:
- Enhanced reporting: chief Internal Auditors should collaborate with their Audit Committee to ensure the Annual Report and Accounts include a summary of the internal audit function’s activities and conclude on its impact and effectiveness.
- Culture audits: internal audit functions should conduct risk-based reviews of organizational culture, extending beyond risk and control culture to encompass broader cultural risks.
- Wider scope: internal audit functions across all sectors should assess capital and liquidity risks and risks stemming from poor customer treatment, not limited to financial services.
- Inclusion of emerging risks: the new Code states that internal audit functions should address emerging risks, including environmental sustainability, climate change, social issues, financial and economic crime, and technology risks such as AI and cybersecurity.
- Alignment with governance disclosures: internal audit’s assessments of risk management and internal controls should now support board disclosures on material controls, aligning with the revised UK Corporate Governance Code.
- Coordination with assurance providers: internal audit functions should coordinate with other assurance providers on key risks and assurance timing, ensuring comprehensive risk coverage.
- Diversity and Technology: the code requires internal audit teams to comprise individuals with diverse backgrounds, skills, and experiences, and for Chief Internal Auditors to ensure access to the necessary tools and technology, such as data analytics and AI, to enhance audit effectiveness.
The Internal Audit Code of Practice will be effective from January 2025.
