Internal Audit Maturity Assessment

Standards 1100, Standard 1200 Standard 1300 Standard 2000

Standard 1000
Internal Audit 1130 Proficiency and Quality Assurance Managing the Standard 2100
Purpose, Authority
Maturity Rating and Responsibility
Independence and Due Professional and Improvement Internal Audit Nature of Work
Objectivity Care Program Activity
Internal Audit Charter in Internal Audit reporting Internal Audit resources are Documented ongoing and Internal Audit policies and Internal Audit focuses on
place, reviewed and arrangements defined in credentialed, specialist periodic Quality Assurance procedures in place, Internal controls, risk and
approved by Audit Internal Audit Charter, resources are available when Program in place, Quality Audit plans linked to governance, Internal Audit
Committee on annual basis, specifies good practice required, annual Risk Assurance activities occur for corporate objectives, plans are clearly linked to
clearly linked to corporate reporting arrangements, Assessment conducted, internal audit engagements, effective Internal Audit enterprisewide view of risk
governance objectives, independence and objectivity ongoing and periodic Quality Internal Assessment reporting arrangements, and plans are periodically
Optimised specifies good practice requirements defined by Assurance processes in conducted annually, External audit client feedback sought, adjusted, Internal Audit uses
Internal Audit reporting Internal Audit policy place, training programs Assessment conducted at performance measures in recognised control
arrangements including requirement for reinforce Internal Audit least every 5 years place and used to drive frameworks in its work
conflict of interest disclosure, credentials and support continuous improvement
annual attestation required execution of Internal Audit
by Internal Audit staff work
Internal Audit Charter in Internal Audit reporting Internal Audit resources are Documented ongoing and Internal Audit policies and Internal Audit focuses on
place, reviewed and arrangements defined in credentialed, some specialist periodic Quality Assurance procedures in place, Internal controls, risk and
approved by Audit Internal Audit Charter, resources are available, Program in place, Quality Audit plans linked to governance, Internal Audit
Committee on annual basis, specifies good practice annual Risk Assessment Assurance activities occur for corporate objectives, plans are clearly linked to
clearly linked to corporate reporting arrangements, conducted, ongoing and internal audit engagements, effective Internal Audit enterprisewide view of risk
Managed governance objectives independence and objectivity periodic Quality Assurance Internal Assessment reporting arrangements, and plans are periodically
requirements defined by processes in place conducted annually audit client feedback sought adjusted
Internal Audit policy
including requirement for
conflict of interest disclosure

Internal Audit Charter in Internal Audit reporting Some Internal Audit Ongoing and periodic Quality Internal Audit policies and Internal Audit focuses on
place, reviewed and arrangements defined in resources are credentialed, Assurance Program elements procedures in place, Internal controls, risk and
approved by Audit Internal Audit Charter, some specialist resources in place, Quality Assurance Audit plans linked to governance
Committee on a periodic specifies good practice are available, annual Risk activities occur for internal corporate objectives,
Implemented basis reporting arrangements Assessment conducted, audit engagements effective Internal Audit
ongoing Quality Assurance reporting arrangements
processes in place

Internal Audit Charter in Internal Audit reporting Internal Audit resources are Some ongoing Quality Internal Audit policies and Internal Audit focuses on
place and approved by Audit arrangements defined in partially credentialed, Assurance Program elements procedures in place, Internal controls and risk
Committee Internal Audit Charter, but specialist resources may be in place, some Quality Audit plans linked to
Defined not good practice reporting available, annual Risk Assurance activities occur for corporate objectives
arrangements Assessment conducted, internal audit engagements
some ongoing Quality
Assurance processes in place
No Internal Audit Charter or Internal Audit reporting Internal Audit resources not No formal Quality Assurance No Internal Audit policies Internal Audit focuses on
in draft or not approved by arrangements not defined in credentialed, no specialist Program in place, some and procedures in place, controls
Audit Committee Internal Audit Charter or resources, no annual Risk Quality Assurance activities Internal Audit plans not
Initial reporting arrangements not Assessment, limited ongoing may occur for internal audit linked to corporate
in line with good practice Quality Assurance processes engagements objectives
in place

Copyright 2014 by The Institute of Internal Auditors. All rights reserved.

 Standard 2600
Standard 2200 Standard 2300 Standard 2400 Standard 2500
Internal Audit Communicating the
Engagement Performing the Communicating Monitoring Code of Ethics
Maturity Rating Planning Engagement Results Progress
Acceptance of
Risks
Planning performed in Internal Audit policies and Reporting protocol Followup protocol Escalation protocol defined, Organisation Code of
collaboration with procedures clearly define established for established, followup on process clearly understood Conduct established, IIA
stakeholders, planning internal audit engagement communicating results, implementation of audit by Internal Audit and Code of Ethics is embedded
adjusted for differing process, Audit Work Plans reporting done consistently recommendations performed management, collaborative in Internal Audit policies,
circumstances, planning are tailored for each from content and format consistently, reporting to approach to resolution, clear ethics training is conducted,
documented, consistent engagement, supervisory perspective, CAE reviews Audit Committee on status of definition of level of risk that Internal Audit staff complete
methodology applied to review and signoff occurs, and signsoff audit reports audit recommendations, can be assumed by annual Code of Ethics
Optimised internal audit engagements, automated audit working before issue, management automated system for Management that precludes declaration
supervisory review and sign paper system in place, input to reporting is actively receiving progress updates need for escalation protocol
off occurs CAATs and other audit sought, reports contain from management, high rate
techniques actively used management comments and of audit recommendation
agreed actions, Internal clearance
Audit prepares reports that
show systemic issues found
through its work
Planning performed in Internal Audit policies and Reporting protocol Followup protocol Escalation protocol defined, Organisation Code of
collaboration with procedures clearly define established for established, followup on process clearly understood Conduct established, IIA
stakeholders, planning internal audit engagement communicating results, implementation of audit by Internal Audit and Code of Ethics is embedded
documented, consistent process, Audit Work Plans reporting done consistently recommendations performed Management, collaborative in Internal Audit policies,
methodology applied to are tailored for each from content and format consistently, reporting to approach to resolution ethics training is conducted
Managed internal audit engagements, engagement, supervisory perspective, CAE reviews Audit Committee on status of
supervisory review and sign review and signoff occurs, and signsoff audit reports audit recommendations
off occurs may have automated audit before issue, reports contain
working paper system in management comments and
place actions to implement
recommendations
Planning performed and Internal Audit policies and Reporting protocol Followup protocol Escalation protocol defined, Organisation Code of
documented, consistent procedures clearly define established for established, followup on process clearly understood Conduct established, IIA
methodology applied to internal audit engagement communicating results, implementation of audit by Internal Audit and Code of Ethics is embedded
internal audit engagements, process, Audit Work Plans reporting done consistently recommendations performed Management in Internal Audit policies
supervisory review and sign are tailored for each from content and format consistently
Implemented off occurs engagement, supervisory perspective, CAE reviews
review and signoff occurs and signsoff audit reports
before issue

Planning performed and Some elements of Internal Reporting protocol Followup protocol No escalation protocol Organisation Code of
documented, consistent audit engagement process established for established, followup on established, Management Conduct established, IIA
methodology applied to defined, standard Audit Work communicating results, implementation of audit may assume inappropriate Code of Ethics receives some
Defined internal audit engagements Plans used reporting done inconsistently recommendations occurs but level of risk attention
from content and format not performed consistently
perspective

Planning not performed or Internal audit engagement Reporting protocol not No followup protocol No escalation protocol Organisation Code of
documented, no consistent process not clearly defined established for established, followup on established Conduct not established, IIA
methodology applied to or Audit Work Plans not communicating results, implementation of audit Code of Ethics does not
Initial internal audit engagements prepared for internal audit reporting is ad hoc recommendations not receive formal attention
engagements performed consistently or
not performed

Copyright 2014 by The Institute of Internal Auditors. All rights reserved.

Copyright 2014 by The Institute of Internal Auditors. All rights reserved.