Институт внутренних аудиторов

А вот еще практический опыт от Kimberley Laris:

"In unhealthy organizations, the executives rapport with the Board can allow executives to control the Audit Committee agenda and communications with the Internal Auditors. When Audit Committees do not know any better, the execs handling of IA communications would indicate that the Audit Committee has minimal "polite" access to the Internal Auditors without the executive "gatekeeper".

IA gets concerned, because their job effectiveness is predicated on Audit Committee reporting independence, but a CAE is likely to be perceived as "breaking the chain of command" to independently contact the A/C in these situations - without an understanding from the historically A/C-assigned executive. And, if an A/C does not act to create the communication link they have the authority to make, it can make it very, very hard for IA' to fulfill their role well.

Finally, if IA is under a great deal of executive "management" of the IA scope and methods, IA can be constantly frustrated that they have not been provided an adequate avenue for open communications with the board. For this reason, executive sessions should always be scheduled - even when there isn't a need. This can be the only opening that some CAE's ever get that is not pre-managed by execs. Some CAE's are also intuitive enough to know when their execs are playing games, and do not feel empowered to say anything without losing their jobs due to being misunderstood in the 2 minutes they've been given by the execs to communicate internal control status.

Many CAE's do not feel comfortable enough to just call their Audit Committee Chairperson out of the blue to meet for lunch. However, in a perfect world, this would be the most appropriate way to encourage an open communication relationship. If this communication does not occur top-down from the Audit Committee, the CAE usually feels it is their executive's job to make the introduction. But - some executives do not want that much open communication with IA.Some A/C's do not want to know anything that will cause them to be responsible with governance information, either.

I hope that helps. These are just worst case scenarios that can make for difficult times - but there are many audit committees that do proactively seek and have a valuable and healthy relationship with their IA Dept. If there is contentiousness - these are just some of the situations that can be part of the challenge."

"Our IIA standards state that IA should functionally report to the Audit Committee. The Audit Commitee is (supposed to be) the #1 boss of IA, to prevail over all others, to provide the necessary independence. See below.

The relationship is atypical from a normal employee - but is best arranged when defined in the Audit Committee's Charter (a legal working document of the organizations By-laws), with a direct tie to the Audit Department's Charter - the IA's marching orders.

The Audit Committee can increase or decrease the IA Depts staff, budget, activities, or change their purpose and even training and certification requirements, or replace the Chief Audit Executive. The balance of independent audit (via reporting to a group of independent directors) and consulting - is literally - entirely up to the Audit Committee. In practice, the CAE should not be able to be fired by Management without approval from the Audit Committee.

If the Audit Committee doesn't appear to show any interest in assuming their reins, the professional CAE does in a vacuum, the best they can to promote what they believe the Audit Committee would want them to do if they understood their governance role and were actively engaged in their role. CAE's do their best to comply with the IPPF Standards when the conditions are less than ideal.

And, CAE's will likely work a lot harder to do the right thing - without much political support or governance protection - and the organization may have little understanding for the enormous responsibilities they are attempting to carry as the Audit Committee role is effectively absent.

Our IIA IPPF Standards are a great read - but they are not exactly mandatory reading for all future executives and board directors in MBA programs."

Complete discussion "Why are Internal auditors unhappy and angry with Board audit Committee?
Most of the internal auditors do not seem to get adequate support from their
board audit committee. What is the problem?"

https://app.box.com/s/l2plv4b6rt9knllzpmbo

Хорошая новость для IIA IPPF в Госкомпаниях.

http://rosim.ru/press/194535

"Приказом Росимущества №86 от 20.03.2014 утверждены Методические рекомендации по организации работы комитетов по аудиту советов директоров акционерных обществ с участием Российской Федерации.
Цель Методических рекомендаций оказать содействие советам директоров госкомпаний в определении роли и задач комитетов по аудиту в соответствии с лучшими международными корпоративными практиками.
Комитет по аудиту является одним из важнейших инструментов корпоративного управления компании и призван обеспечить содействие эффективному выполнению функций совета директоров в части предварительного рассмотрения вопросов, связанных с контролем за финансово-хозяйственной деятельностью компании: надзор за формированием финансовой отчетности, системой внутреннего контроля и управления рисками, обеспечение соблюдения нормативно-правовых требований и информирования исполнительных органов о нарушениях, налаживание взаимодействия между внешними и внутренними аудиторами и другими.
Проект Методических рекомендаций разработан Экспертно-консультационным советом Росимущества. В экспертном анализе проекта Методических рекомендаций принимали участие представители экспертных и профессиональных сообществ, а также крупнейших госкомпаний."

В частности:

"2.6.7. Комитет по аудиту рассматривает результаты оценки качества работы функции внутреннего аудита, проводимой подразделением внутреннего аудита в соответствии с общепринятыми стандартами деятельности внутреннего аудита, обсуждает с руководителем подразделения внутреннего аудита план мероприятий по совершенствованию функции.

2.6.8. Комитет по аудиту не реже одного раза в пять лет организует проведение независимой оценки качества деятельности внутреннего аудита. Результаты оценки функции внутреннего аудита доводятся до сведения совета директоров."

Кажется, что советы директоров и комитеты по аудиту становятся все более продвинутыми: http://goo.gl/78H0PE