– Practice Guide

AUDITING
››

ANTI-BRIBERY AND
››

›› ANTI-CORRUPTION PROGRAMS
››

JUNE 2014
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Table of Contents

Executive Summary..................................................................................................................1

Introduction.............................................................................................................................1

Global Landscape....................................................................................................................3

Effective Anti-bribery and Anti-corruption Programs and the Role of Internal Audit.................5

Risks, Red Flags, and Audit Activities....................................................................................11

Appendix 1: Comparison of Legislation in Select Countries....................................................17

Appendix 2: Internal Controls: Update Based on COSO Elements...........................................18

Appendix 3: Sample Audit Procedures....................................................................................18

Appendix 4: References..........................................................................................................20

www.globaliia.org/standards-guidance / iii
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Executive Summary such as third-party relationships, gifts and entertainment,

political contributions, and procurement. Audit observa-
Increasing globalization, legal complexities, and the po- tions in these and other areas can be leveraged by the or-
tential for serious financial and reputational harm have ganization to prioritize its anti-bribery and anti-corruption
made the risks of bribery and corruption, and audits of initiatives as input to developing and sustaining a formal
anti-bribery and anti-corruption programs, top corporate anti-bribery and anti-corruption program.
issues. Auditing anti-bribery and anti-corruption programs
requires a team of auditors with collective skills, knowl- Auditing anti-bribery and anti-corruption programs re-
edge, and expertise in compliance, fraud, investigations, quires varying levels of collaboration and information
regulatory affairs, IT, finance, culture, and ethics. sharing with other governance functions such as regula-
tory compliance, external auditors, investigators, and the
On the global front, the U.S. Foreign Corrupt Practices governing board. Before getting started, the chief audit ex-
Act (FCPA) and the U.K. Bribery Act are examples of ecutive (CAE) or lead internal auditor should consult with
strict legal regulations, each with far-reaching interna- the organization’s general counsel or legal representative
tional implications. And evolving anti-bribery and anti- to gain a full understanding of potential legal implications
corruption legislation in China, Hong Kong, India, and of the audit scope, fieldwork, and findings.
other countries (see page 17) is further complicating the
matter. Private and public sector organizations are in-
creasing awareness of bribery and corruption exposures
Introduction
and fighting back through international accords, regional In 2009, The IIA released Internal Auditing and Fraud,
conventions, best practice guides, and information on per- a practice guide designed to increase internal auditors’
ceptions and instances of bribery and corruption. awareness of fraud and provide guidance on how to ad-
dress fraud risks on internal audit engagements. As de-
Anti-bribery and anti-corruption legislation has led to scribed in the practice guide, corruption is one of several
the development of organizational anti-bribery and anti- common fraud schemes and bribery is a form of corrup-
corruption programs with well-defined components, tion. This practice guide complements Internal Auditing
including tone at the top/governance structure, risk as- and Fraud by providing specific guidance for assessing the
sessment (including third-party due diligence), policies effectiveness of an organization’s system of internal con-
and procedures, communication and training, monitoring trol for bribery and corruption. Other related IIA guidance
and auditing, reports and investigations, enforcement and includes the following Practice Guides: Reliance by In-
sanctions, and reviews and updates. Internal auditors in ternal Audit on Other Assurance Providers and Auditing
organizations with formal anti-bribery and anti-corruption the Control Environment. As well, the IIA’s Audit Execu-
programs have the opportunity to assess the effectiveness tive Center has published a Knowledge Briefing entitled
of each component and how all of the components work Internal Auditing and the Foreign Corrupt Practices Act
together to deter, curtail and detect bribery and corrup- (membership required).
tion.
Business Significance
Internal auditors in organizations with non-existent or in-
formal anti-bribery and anti-corruption programs have the Organizations that ignore the potential impacts of bribery
opportunity to help their organizations establish a baseline and corruption do so with peril. Regardless of the country,
by identifying and investigating red flags in high-risk areas industry, or type of organization, global reach brings global

www.globaliia.org/standards-guidance / 1
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

risk. Each region, government, and project has unique Standard 1220: Due Professional Care
complexities, variables, and opportunities for bribery and
1220.A1 – Internal auditors must exercise due profes-
corruption. However, risks have traditionally been greater
sional care by considering the:
for organizations in certain geographies and industries.
• Extent of work needed to achieve the engagement’s
Related Risks
objectives;
Bribery and corruption put businesses and governments
• Relative complexity, materiality, or significance of
at risk worldwide and affect organizations, private indi-
matters to which assurance procedures are applied;
viduals, and officials. Bribery and corruption are found
in private and public sector transactions and in dealings • Adequacy and effectiveness of governance, risk
between the two. In fact, bribery and corruption have be- management, and control processes;
come major issues in the public sector and are especially • Probability of significant errors, fraud, or noncompli-
worrisome when associated with government appoint- ance; and
ments. Bribery and corruption expose organizations to
• Cost of assurance in relation to potential benefits.
risks in achieving operations, reporting, and compliance
objectives, and may result in:
Standard 2060: Reporting to Senior
• Stifled market competition. Management and the Board
• The impediment of economic growth. The chief audit executive must report periodically to se-
• Barriers to improved standards of living. nior management and the board on the internal audit ac-
tivity’s purpose, authority, responsibility, and performance
• Compromised product quality.
relative to its plan. Reporting must also include significant
• Higher prices. risk exposures and control issues, including fraud risks,
• Diminished trust. governance issues, and other matters needed or requested
by senior management and the board.
• Discouragement of foreign direct investment.
Standard 2120: Risk Management
Related IIA Standards 2120.A2 – The internal audit activity must evaluate the
The International Professional Practices Framework potential for the occurrence of fraud and how the organi-
(IPPF) outlines the following International Standards for zation manages fraud risk.
the Professional Practice of Internal Auditing (Standards)
pertaining to fraud (inclusive of bribery and corruption). Standard 2210: Engagement Objectives
2210.A2 – Internal auditors must consider the probability
Standard 1200: Proficiency and Due of significant errors, fraud, noncompliance, and other ex-
Professional Care posures when developing the engagement objectives.
1210.A2 – Internal auditors must have sufficient knowl-
edge to evaluate the risk of fraud and the manner in which
it is managed by the organization, but are not expected to
have the expertise of a person whose primary responsibil-
ity is detecting and investigating fraud.

2 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Definitions of Key Concepts

Board — the highest level of governing body charged with
Global Landscape
the responsibility to direct and/or oversee the activities Private and public sector organizations worldwide are re-
and management of the organization. Typically, this in- sponding to the risks of bribery and corruption. Responses
cludes an independent group of directors (e.g., a board of include:
directors, a supervisory board, or a board of governors or • International accords, where member countries em-
trustees). If such a group does not exist, the “board” may brace an agreed upon system of principles with the
refer to the head of the organization. “Board” may refer intent to enact them into law. The United Nations
to an audit committee to which the governing body has Convention against Corruption and The United
delegated certain functions (Standards). Nations Declaration against Corruption and Bribery
in International Commercial Transactions are two
Bribery — the offering, giving, receiving, or soliciting examples.
of anything of value to influence an outcome (Practice
• National laws.
Guide, Internal Auditing and Fraud).
• Codes of best practices.
Control — any action taken by management, the board, • Regional conventions where recognized agencies,
and other parties to manage risk and increase likelihood usually in regions with bribery and corruption prob-
that established objectives and goals will be achieved. lems, issue statements of intent.
Management plans, organizes, and directs the perfor-
• Public and private sector policy statements.
mance of sufficient actions to provide reasonable assur-
ance that objectives and goals will be achieved (Standards). • Non-profit organizations that catalog instances of
abuse, best practices, and government efforts to
Corruption — the misuse of entrusted power for private combat bribery and corruption.
gain (Practice Guide, Internal Auditing and Fraud).
Legislation
Fraud — any illegal act characterized by deceit, conceal-
ment, or violation of trust. These acts are not dependent Many developed countries have enacted legislation to
upon the threat of violence or physical force. Frauds are curb bribery and corruption. Other nations are consider-
perpetrated by parties and organizations to obtain money, ing new legislation or are in the process of adopting or
property, or services; to avoid payment or loss of services; updating current law. Appendix 1 provides comparative
or to secure personal or business advantage (Standards). legislative highlights for select countries.

Red Flag1 — a warning sign; a sign that there is a problem Several laws fundamentally affect how individuals work
that should be noticed or dealt with (Merriam-Webster. and many have international impacts. Two of the strict-
com). est legal regulations designed to combat bribery and
corruption include the FCPA and the U.K. Bribery Act.
Risk — the possibility of an event occurring that will have Transparency International (www.transparency.org) also
an impact on the achievement of objectives. Risk is mea- provides an overview of bribery and corruption legislation
sured in terms of impact and likelihood (Standards). and emerging changes.

By permission. From Merriam-Webster’s Collegiate® Dictionary, 11th Edition

1

©2014 by Merriam-Webster, Inc. (www.Merriam-Webster.com). www.globaliia.org/standards-guidance / 3

IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

U.S. Foreign Corrupt Practices Act (FCPA) in breach of his or her duty to the government or organi-
The FCPA prohibits U.S. persons and businesses from zation that has employed or appointed the individual. An
making payments to foreign government officials or politi- occasion where such assistance might be sought would
cians to influence business dealings. The FCPA also in- be in relation to the award of an export contract where a
cludes accounting rules that require transparency through bribe might be used to influence the tendering process.
appropriate accounting records, and works in tandem The U.K. Bribery Act covers bribes paid to individuals
with anti-bribery provisions. who, although not holding an appointment in a relevant
organization or national government, are nevertheless able
The IIA Audit Executive Center Knowledge Briefing, In- to exert influence over such an appointee by reason of
ternal Auditing and the Foreign Corrupt Practices Act, some personal, business, or other relationship. It also cov-
provides direction on aspects of the law and highlights ers bribes paid in advance as an inducement to a person to
best practices for CAEs and boards in assessing FCPA act inappropriately or retrospectively pursuant to a previ-
risks. Some of these best practices include: ous promise, understanding, or agreement.

• Internal auditors making sure controls are properly The act creates offenses for:
designed, well established, and documented. • Bribery.
• Assessing FCPA risk areas by evaluating policies and • The act of being bribed.
procedures. • Bribing foreign public officials.
• Organizationwide compliance initiatives to develop • Failure of a commercial organization to prevent brib-
policies and procedures that identify corrupt prac- ery on its behalf.
tices.
These actions are illegal in or outside the U.K. if the
• Board members ensuring that the organization’s bribe was paid by anyone associated with a U.K. organi-
code of conduct and policies outline the steps zation.
needed to achieve FCPA compliance.

Other Legislation and Anti-bribery and Anti-

U.K. Bribery Act 2010 corruption Measures
The U.K. Bribery Act provides prosecutors and courts Anti-bribery and anti-corruption laws and initiatives exist
with a strong framework to address bribery in the U.K. and worldwide, but it is widely recognized that better laws,
abroad. It is considered wider in scope than the FCPA be- codes of practice, and enhanced enforcement actions are
cause it generally applies to the private and public sector. still needed. The following references provide information
Compared with the FCPA, the U.K. Bribery Act defines about the global scope of anti-bribery and anti-corruption
bribery more broadly and applies a liability standard for measures (as of June 2013).
failing to prevent payment of bribes to “associated per-
sons.” • Transparency International (www.transparency.org)
• The Organisation for Economic Co-operation and
The U.K. Bribery Act defines bribery as the receiving or
Development (OECD) Anti-Bribery Convention
offering/giving of any benefit by or to any public servant or
(1999) (www.oecd.org)
officeholder or to a director or employee of a private orga-
nization to induce that person to give improper assistance

4 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

• OECD — Country Reports on the Implementa-

tion of the OECD Anti-Bribery Convention and the Effective Anti-bribery and
1997 Revised Recommendation (www.oecd.org) Anti-corruption Programs and
• United Nations — Working Group on the Review of
Implementation (www.unodc.org)
the Role of Internal Audit
• United Nations — Global Compact (www.unglobal- A comprehensive anti-bribery and anti-corruption program
compact.org) should include entity-level, process-level, and transac-
tion-level controls. The hallmark components of effective
• World Bank — Department of Institutional Integrity
anti-bribery and anti-corruption programs include tone at
(www.worldbank.org)
the top, governance structure, risk assessment, policies
• World Bank Institute — Governance and Anti-Cor- and procedures, training and communication, monitoring
ruption (www.worldbank.org) and auditing, investigations and reports, enforcement and
• World Economic Forum — Partnering against Cor- sanctions, and reviews and updates. Internal audit’s role
ruption Forum (www.weforum.org) in anti-bribery and anti-corruption programs will depend
on the organization’s governance structure. Internal au-
• The African Union Convention on Preventing and
dit’s level of involvement should be recommended by the
Combating Corruption (July 2003)
CAE and approved by the board. Internal audit can play a
• The United Nations Convention against Corruption significant reinforcing role in the importance of anti-brib-
(entered into force in December 2005) ery and anti-corruption programs.
• China — Anti-corruption measures (including the
Criminal Law and the Anti-unfair Competition Law Internal audit should assess the effectiveness of anti-
and Interim Regulations on prohibiting business bribery and anti-corruption programs to help anticipate
bribery) the risk, and identify the existence of potential and actual
incidents. Two different, but complementary, approaches
• Hong Kong — The Prevention of Bribery Ordinance
that may be used exclusively or in conjunction with each
(POBO)
other include:
• India — The Prevention of Corruption Act 1988
(PCA) • Auditing each component of the anti-bribery and
• Indonesia — Various laws including the Good anti-corruption program.
Governance Law, Eradication of Criminal Acts of • Incorporating an assessment of anti-bribery and an-
Corruption, Commission for the Eradication of Cor- ti-corruption measures in all audits, as appropriate.
ruption (KPK Law), and the Corruption Tribunal In this approach, bribery and corruption risks should
(Corruption Tribunal Law) be incorporated into the risk assessment and scop-
• Japan — Several laws such as the National Public ing process of each audit. For example, a financial
Service Ethics Act and the Political Ethics Law audit may include a review of cash transactions and
a vendor management office audit might include a
• Singapore — The Prevention of Corruption Act
review of third-party due diligence practices. Each
(PCA); the Penal Code; and the Corruption, Drug
audit may:
Trafficking, and Other Serious Crimes (Confiscation
of Benefits) Act (CDSA) ›› Include procedures to assess bribery and corrup-
tion risks.

www.globaliia.org/standards-guidance / 5
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

›› Evaluate bribery and corruption scenarios. Internal Audit’s Role

›› Evaluate the control environment and anti-bribery Internal audit should understand the attitude and tol-
and anti-corruption programs in that audit area. erance of the board and executive management toward
›› Link the scope of an area’s audit procedures to its bribery and corruption risks, assess whether that attitude
assessed risk. is sufficiently restrictive, and validate that this attitude
has been adequately communicated throughout the or-
Both approaches should utilize data analytics to look for
ganization. As such, internal audit should scrutinize the
red flags and obtain other audit evidence related to anti-
governance structure and the monitoring and oversight
bribery and anti-corruption programs1. Internal auditors
responsibilities related to anti-bribery and anti-corruption
emphasizing an established program approach may find
programs.
the guidance in this section particularly useful. Internal
auditors favoring an “all audits” approach may want to fo-
Sample Review Questions
cus on the next section, (Pg. 11) Risks, Red Flags, and Au-
diting Activities. However, both sections will likely prove For sample review questions and related guidance on au-
beneficial, regardless of approach. diting tone at the top and governance structure, see the
following IIA publications:
Tone at the Top/Governance Structure
• Practice Guide, Auditing the Control Environment.
Component Overview
• Practice Guide, Evaluating Ethics-related Programs
Effective risk mitigation starts with a strong tone at the top, and Activities.
setting the foundation for an overall compliance framework.
The tone at the top is the ethical environment fostered by • Practice Guide, Internal Auditing and Fraud.
organizational leadership and the single most important • Tone at the Top newsletters:
factor in determining the organization’s resistance to brib- ›› All Hands on Deck: Partnering to Fight Fraud
ery and corruption. No system of controls can provide abso- (December 2013).
lute assurance against the commission of bribery or corrup-
tion. The board should, however, require the organization ›› Shining a Light on Corruption (August 2012).
to develop comprehensive anti-bribery and anti-corruption
programs. Risk Assessment
Component Overview
Although each organization may have different methods for
A comprehensive risk assessment identifies and analyzes
establishing the right tone, a good starting point is to issue
bribery and corruption risks throughout the organization,
a code of conduct and an anti-bribery and anti-corruption
including all locations and types of business. The risk as-
policy endorsed by the board of directors. Once the board
sessment is a precondition for establishing the remaining
has clearly committed to a strong policy, the best approach
components of the anti-bribery and anti-corruption pro-
is zero tolerance and full compliance with anti-bribery and
gram. It is critically important to review present and poten-
anti-corruption laws. This is not just ethically right; there
tial bribery and corruption risks, and to develop mitigating
also is increased pressure for compliance from legislative
controls.
bodies and nongovernmental organizations.

Global Technology Audit Guide (GTAG®) 16: Data Analysis Technologies

1

6 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Internal Audit’s Role Internal Audit’s Role

Internal audit should understand all aspects of manage- Internal audit should sample test whether policies and
ment’s existing anti-bribery and anti-corruption program procedures:
before performing risk assessments. And internal audit
should evaluate the inherent bribery and corruption risks • Are documented appropriately.
as part of its comprehensive risk assessment. As well, the • Are approved by appropriate management.
audit plan for assessing the effectiveness of anti-bribery
• Comply with applicable laws and regulations.
and anti-corruption programs should be risk based.
• Are implemented effectively.
Sample Review Questions
1. Does the organization use business intelligence re- Sample Review Questions
sources to identify bribery and corruption risks when 1. Do the anti-bribery and anti-corruption program
exploring business opportunities in established and standards comply with applicable laws and regula-
emerging markets? tions?
2. Does the organization regularly conduct due dili- 2. Do policies and procedures address gifts and enter-
gence on third-party providers? tainment, meals and travel, charitable donations,
and facilitation payments?
3. Does the organization’s due diligence process meet
regulatory requirements for scope and thoroughness?
Communication and Training
4. Are third-party agreement approvals in place? Component Overview
5. Is there a history of lawsuits, fines, and penalties Effective anti-bribery and anti-corruption programs re-
related to bribery and corruption? quire careful and continuous communication and training
programs, updated to align with changing regulations and
Policies and Procedures evolving country norms. General training regarding what
Component Overview constitutes bribery and corruption, how it harms the or-
ganization, and how to report it should be provided to all
The organization’s anti-bribery and anti-corruption stan- members of the organization. In addition, customized train-
dards should be clearly defined in well-documented poli- ing should be provided by function or job responsibility to
cies. Detailed underlying procedures should explain how address specific bribery and corruption risks.
employees, business partners, and third parties should
behave, and clearly specify what behavior is unacceptable As an extension of training and communication, self-cer-
and noncompliant. Policies and procedures establish con- tification programs may further reduce risk. Various levels
straints and define and embed an organization’s attitudes of management periodically certify that they have not paid
and practices on fraud, bribery, and corruption. The poli- bribes and have no knowledge of other employees or service
cies and procedures should include protocols for third- providers having done so.
party dealings, payment processing, expense reporting,
and training. To safeguard against employee self-dealing,
best practice policies also address conduct outside of the
job and conflicts of interest.

www.globaliia.org/standards-guidance / 7
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Internal Audit’s Role 5. Do employees periodically certify that they are

compliant with anti-bribery and anti-corruption stan-
Internal audit should share information and work with
dards, and attest that they have no knowledge of any
other functions such as fraud investigation, legal coun-
incidence of bribery or corruption?
sel, compliance, and external audit. For example, South
Africa’s King Code of Governance makes this explicit by
Monitoring and Auditing
stating that the board should ensure there is an effective
risk-based internal audit function that can be a source of Component Overview
information about instances of fraud, bribery and corrup- Continuous monitoring activities and individual audits
tion, unethical behavior, and other irregularities. Also, in should be performed to:
some countries, information on irregularities and illegal
acts is required to be exchanged with external auditors • Ensure the effectiveness of anti-bribery and anti-
and/or a competent regulatory agency. corruption programs.
• Lower time to detection.
Some internal audit groups also play a key role in train-
• Support continuous improvement and follow
ing employees in anti-bribery and anti-corruption policies.
through on corrective action plans.
When visiting other geographical locations, internal au-
ditors may arrange meetings with employees to commu- Monitoring and auditing documentation also may provide
nicate the organization’s anti-bribery and anti-corruption evidence that the organization was proactive prior to the
message. Internal audit also may collaborate with legal discovery of misconduct.
and ethics teams on training and anti-bribery and anti-
corruption audits. During anti-bribery and anti-corruption Internal Audit’s Role
training sessions, trainers should reference the FCPA,
There can be a gap between the perception of bribery
the U.K. Bribery Act, Professional Guidance for Internal
and corruption risks on the ground, where an event would
Auditors on the U.K. Bribery Act 2010 (published by the
likely occur, and the more distant view at the board level.
Chartered Institute of Internal Auditors), and other rel-
This is especially true if effective risk assessments, analy-
evant legislation and guidance. Internal audit must con-
ses, and communication are lacking. Organizations should
sider, however, whether their training and/or communica-
establish effective monitoring systems that provide senior
tion activities could impair their objectivity in any manner.
executives and the board with periodic updates. However,
internal audit’s monitoring activities should not supplant
Sample Review Questions
management’s monitoring role.
1. Is the organization aware of its exposure to global
bribery and corruption risks? Sample Review Questions
2. Is anti-bribery and anti-corruption training manda- 1. Does the organization have a formal process for
tory for all employees? monitoring the effectiveness of its anti-bribery and
anti-corruption programs?
3. Do employees fully understand the organization’s
principal anti-bribery and anti-corruption policies? 2. Is this process established to ensure objectivity?

4. Is training and communication tailored to the geo- 3. Is this process implemented properly?
graphical region, function, and job responsibility?

8 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Investigations and Reports to understand the cultural and legal landscape of the op-
erational jurisdiction involved, and be thoroughly familiar
Component Overview
with local protocols for investigating and reporting. Inter-
Individuals at all levels should have support for resolving nal audit also should collaborate with the board and senior
ethical dilemmas and making appropriate decisions. An management to establish protocols for reporting suspect-
accessible, anonymous whistleblower hotline for report- ed or actual incidents of bribery and corruption.
ing suspected wrongdoing and seeking advice is crucial.
Where local law permits, organizations also should offer The need for an investigation may surface during the
a means to confidentially and/or anonymously report sus- course of an audit. If audit evidence indicates possible
pected bribery or corruption. irregularities, the internal auditor should:
It is the responsibility of the board to ensure that the or-
• Follow the reporting protocol and refer the matter
ganization has an effective process for confidential inves-
to the investigation group. If internal audit suspects
tigation. A consistent investigative process including pro-
that management is involved in the irregularity, it
tocols for gathering and evaluating information, assessing
should find the appropriate party to whom it can
potential wrongdoing, and administering penalties, may
report.
help mitigate loss and manage risk.
• Perform and document adequate actions to support
Investigators should have the authority and skills to evalu- the audit findings, conclusions, and recommenda-
ate allegations and take appropriate action. If an in-depth tions.
investigation is deemed appropriate, investigators should
If audit evidence points to an illegal act, the internal audi-
first secure approvals, as needed, from senior manage-
tor should seek legal advice directly or recommend that
ment, directors, legal counsel, and other appropriate
management do so. Internal audit should work with ap-
oversight bodies. In certain circumstances it also may be
propriate personnel, such as the fraud investigation unit,
necessary to make public disclosures to law enforcement,
and management (if possible, at a level above the parties
regulators, shareholders, the media, or others; however,
involved in the act) to determine whether an irregularity
this should only be done by those individuals deemed au-
or illegal act has occurred and gauge its effect.
thorized to do so on behalf of the organization.
Sample Review Questions
Internal Audit’s Role
1. What controls are in place to respond to bribery and
Investigations
corruption matters before they become significant
The role of internal audit in investigating bribery and cor- issues?
ruption allegations depends on internal audit’s resources
and the organization’s governance structure. Consider- 2. Does the organization have formal, defined process-
ation should be given to the unit’s fraud, forensic, and IT es and protocols for investigating alleged bribery or
skills. Some organizations may require bribery and corrup- corruption?
tion investigations to be conducted under the supervision
of, and in coordination with, a special board committee, 3. Do the persons responsible for investigations have
regulatory body, the legal department, or other group. the requisite skills, experience, objectivity, and orga-
nizational independence?
The suspicion, discovery, and investigation of bribery and
corruption are sensitive matters. Internal auditors need

www.globaliia.org/standards-guidance / 9
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

4. Does the organization have defined protocols for agement and the board, unless applicable regulations or
reporting alleged or confirmed bribery or corruption specific circumstances of the audit dictate otherwise. In
to the board or other authority? the public sector, some legal jurisdictions grant citizens
the right to access any and all organization documents.
Reports
According to Standard 2060, the CAE must report peri- The IIA’s Practice Guide, Internal Auditing and Fraud,
odically to senior management and the board on internal describes typical roles and responsibilities for fraud pre-
audit’s performance. These reports must cover significant vention and detection. The same roles apply to anti-brib-
risk exposures and control issues, including those relat- ery and anti-corruption. For example:
ed to fraud and governance. Reports also should include
bribery and corruption risks and exposures, potential vio- • Fraud investigators usually are responsible for the
lations, and estimated impact. detection and investigation of fraud and the recovery
of assets. They also perform a role in fraud and cor-
There may be resistance to reporting bribery and corrup- ruption prevention.
tion to the board. Management and legal counsel may • The fraud investigation unit and internal audit
downplay the wrongdoing or may ask the internal audi- should work closely together and be aware of each
tor to delay reporting until corrective actions are taken. other’s findings. Fraud investigators often also work
The internal auditor should clearly understand the board’s closely with legal counsel to bring legal action
communication requirements regarding bribery and cor- against perpetrators. The lead investigator usually
ruption, including escalation, information type, and fre- determines the resources needed for the investiga-
quency. According to IIA Standards, if in the CAE’s judg- tion and staffs the team accordingly. Internal audit
ment there is significant unmitigated risk, those risks can help in areas such as data analysis.
are to be communicated to management and then to the
board. In most organizations, the board will direct the in- • Laws of the jurisdiction often govern the role of in-
ternal auditor to report concerns in full and without delay. house legal counsel. House counsel generally acts
in the best interest of the organization and also is
External reporting may be a legal or regulatory obligation required to preserve attorney-client privilege.
of management, the individuals who detected the irregu-
larities, or both. Notwithstanding this external-facing re- • When auditing financial statements, external audi-
sponsibility, the internal auditor’s duty of confidentiality to tors have a responsibility to comply with profession-
the organization and professional ethics generally require al standards and to determine if there is reasonable
reporting the matter internally before doing so externally. assurance that the financial statements are free of
However, in certain circumstances, the internal auditor material misstatement. If there are evident misstate-
may be required to disclose an irregularity or illegal act. ments, the external auditors must ascertain whether
These circumstances could include compliance with legal they were caused by error or fraud.
or regulatory requirements. • When external auditors find evidence of irregulari-
ties and illegal acts, professional standards typically
When external reporting is required, the report should require that the matter be brought to the attention
generally be approved by legal counsel prior to external of an appropriate level of management. If senior
release. It also should be reviewed with audit client man- management is involved, the report normally goes

10 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

directly to those charged with oversight governance Review and Updates

(e.g., the board or audit committee).
Anti-bribery and anti-corruption programs require on-
• Employees can report suspicions of irregularities going monitoring of legal mandates. All components of
and illegal acts to an employee hotline, internal these programs should be updated as necessary to ensure
audit, or a member of management. To deter and alignment with changing regulations and evolving coun-
detect fraud and abuse, many experts believe an ap- try norms across all jurisdictions the organization operates
propriately monitored employee hotline is the single within.
most cost-effective tool for detecting irregularities
and illegal acts.
Risks, Red Flags, and Audit
Enforcement and Sanctions Activities
Component Overview Risks
Terminable bribery and corruption offenses should be Corruption and bribery expose organizations to a broad
clearly identified, and related sanctions should be explicit. range of risks to achieving established operations, report-
ing, and compliance objectives. Organizations should as-
Internal Audit’s Role sess the likelihood, impact, and vulnerability of each iden-
There should be a defined process that includes multiple tified risk. It should be noted that the impact of bribery
organizational disciplines to evaluate cases of bribery or and corruption on reputational risk may be severe even
corruption and implement sanctions according to a formal when financial impact is minimal — materiality may be
policy. irrelevant or secondary. Comprehensive controls are need-
ed to combat bribery and corruption risks. The develop-
Sample Review Questions ment of effective controls requires in-depth knowledge of
an organization’s internal and external operations.
1. Do employees and third-party providers (e.g., agents,
sales consultants, distributors, and vendors) comply
Risk Areas
with the code of business conduct regarding bribery
and corruption? Most bribery and corruption involves cash payments, hos-
pitality, gifts, travel, and employment. However, other in-
2. Do employees understand how anti-bribery and anti- ducements also come into play across many different areas
corruption program violations impact salary, promo- of the organization. High-risk areas for bribery and corrup-
tion, and continued employment? tion include geography and industry; hiring/employment;
third-party/vendor management; gifts, entertainment, and
3. Are cases of bribery or corruption evaluated objec- political contributions; procurement; sales; finance; IT;
tively and sanctions consistently implemented in upper management; and government relations.
accordance with policy?

www.globaliia.org/standards-guidance / 11
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Geography and Industry the organization’s policy regardless of the apparent per-
missiveness of a particular environment.
Risk Area Overview
Some countries or jurisdictions where organizations op- Hiring/Employment
erate in cash-based economies have a higher incidence
Risk Area Overview
of bribery and corruption. The local regulatory environ-
ment also impacts risks. Similarly, certain industries (e.g., The hiring process, including candidate background
construction/infrastructure) are more susceptible to brib- checks, is an important consideration for potential bribery
ery and corruption. It also is important to consider the and corruption. This is especially true in cases of mergers
respective industries of business partners and third-party and acquisitions.
relationships.
Red Flags
Through globalization, joint ventures, and partnerships, • Hiring employees with a history of wrongdoing.
organizations may set up operations in parts of the world
• Phantom employees.
where the ethical environment differs from that of the
home country or where the culture includes acts that Internal Audit Activities
would be considered bribery as an acceptable way to facil- • Review effectiveness of policies and practices for
itate business. Risks may be compounded if anti-bribery confirming that personnel considered for employ-
and anti-corruption policies are not clear, detailed, trans- ment in bribery-vulnerable roles do not have a his-
lated into local languages, and relevant to regional busi- tory of wrongdoing.
ness practices.
• Confirm existence of employees in the country/loca-
Red Flags tion.

• Operations in countries with a reputation for higher • Verify validity of employees.

risk of bribery or corruption.
• Activities with industries or specific organization’s Third-party/Vendor Management
that have a reputation for a higher risk of bribery or Risk Area Overview
corruption. Relationships with vendors, agents, lobbyists, contract
employees, consultants, and other intermediaries can be
Internal Audit Activities exploited by bribery schemes and often are at the heart of
Where a culture of bribery and corruption exists, internal corruption. Third parties that engage in bribery and cor-
auditors of the parent organization should evaluate each ruption expose the organization to compliance, financial,
situation, including those under joint venture/partnership, and reputational risks. See the section on procurement for
and discuss dilemmas with the board. additional related guidance.

When senior management does not support a bribery pol- Red Flags
icy and the organization is operating in a culture where • Unproductive or suspicious interviews with employ-
bribery and corruption are common, the line between ees, agents, and contractors.
what is and is not acceptable is likely to be blurred. The
• Close personal or familial relationships between
internal auditor should evaluate acts and actions against
employees and vendors.

12 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

• Lack of competitive bid processes for vendors or • Frequent or excessive charitable and political dona-
customers. tions.
• Use of agents or third parties to pay bribes. • Inadequate or vague gift/hospitality/entertainment
policies and/or guidelines.
Internal Audit Activities
• Review agent and other third-party selection and Internal Audit Activities
screening processes and due diligence practices. • Review appropriateness of entertainment and gift
• Review practices for staying current on third-party policies.
ownership and merger and acquisition activity. • Review payments related to travel, entertainment,
• Review policies for hiring and retaining agents and and gifts.
contractors and training them in anti-bribery and • Review approvals required for giving gifts.
anti-corruption programs. • Perform keyword searches on travel and expense
• Ensure that contracts specify the expectation of reports for inappropriate travel/gifts.
compliance with the code of conduct and anti-brib- • Review compliance with the charitable donations
ery and anti-corruption regulations. policy.
• Review contracts to ensure the existence of right-to- • Review payments to charitable and political organi-
audit clauses. zations.
• Review expenses reimbursed to third parties. Inter- • Consider relationships between charities and other
view third-party employees. parties (e.g., government officials and organization
• Evaluate use of agents and other third parties, con- management).
sidering reasonableness and necessity (i.e., whether • Confirm charities are bona fide organizations.
it is reasonable to use the third party chosen for the
specific task).
Procurement
Gifts, Entertainment, and Political Risk Area Overview
Contributions Procurement of high-value goods and services can be a
Risk Area Overview common area for corruption.

Travel, entertainment, and gifts given or received by the Red Flags

organization or the organization’s employees can be meth- • The existence of fictitious suppliers.
ods of bribery.
• Inappropriate acceptance of gifts, money, or enter-
Red Flags tainment expense payments in return for preferen-
• Excessive travel and entertainment expenses, espe- tial treatment to providers bidding for goods and
cially for entertaining government officials. services.

• Frequent or excessive entertainment and gifts • Conflicts of interest among members of assessment
provided to customers, suppliers, or government of- panels (for large procurements) and vendors submit-
ficials. ting the bids, including vendors related to govern-
ment officials.

www.globaliia.org/standards-guidance / 13
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

• Purchasing in installments with the same supplier Red Flags

(i.e., provider) to avoid the organization’s authoriza- • Providing gifts, money, or entertainment to make a
tion levels and spending limits (structuring). deal, increase sales, or otherwise gain advantage.
• Extending contracts for excessive periods of time • Inadequate policy or guidelines detailing acceptable
without “testing the market” for better terms. gifts, hospitality, and entertainment expenses.
• Making a high-value purchase with a unique or • Making a deal with suppliers to fix prices or award a
exclusive supplier. sale or contract.
• Purchasing goods inconsistent with business needs, • New or recurring sales or long-term contracts with
including overpaying for services and products. the same government entity without proper bidding
• Inadequate spend data and vendor data or inconsis- and negotiations.
tent data across procurement related systems.
Internal Audit Activities
• Use of sole-sourced vendors not properly vetted,
including low compliance with corporate preferred • Review sales function expense reports and compli-
buying guidelines. ance with related policies and procedures.

• Inappropriate vendor creation and management and • Review appropriateness of entertainment and gift
multiple appearances of the same vendor within the policies, and related training and attendance records
master file. for sales personnel.

• Duplicate payments. • Review sales contract and agreement approvals,

terms, and conditions.
• Limited segregation of duties involving payments,
credits, and reconciliation of vendors and suppliers. • Review compliance with government contract and
agreement guidelines.
Internal Audit Activities
• Review controls over supplier selection and vendor Finance
setup. Risk Area Overview
• Review vendor setup in the payment system.
Most bribery involves disbursement of cash and the re-
• Review the competitive bid process. cording of that disbursement in the financial records.
• Test that goods and services are real and at market
Red Flags
prices.
• Payments of cash to facilitate deals and transactions.
• Conduct supplier visits and interview suppliers.
• Lack of supporting documentation for cash transac-
• Validate vendor addresses.
tions.
• Validate vendor companies via publicly available
• Lack of appropriate segregation of duties for control
records.
of cash, non-routine payments, or other transac-
tions.
Sales
• Lack of, or poor supporting documentation for,
Risk Area Overview
expense reports.
Bribery is one way certain sales contracts can be obtained.
• Cash used to pay bribes.

14 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

• The existence of off-balance-sheet bank accounts. IT

• Credit notes and rebates used as a method to pay Risk Area Overview
bribes.
The IT control environment is a crucial area, especially
• Bookkeeping records insufficient to identify bribery with regard to access controls and segregation of duties
schemes. for cash, and detection of unusual transactions.
• Increasing or frequent write-offs of accounts receiv-
Red Flags
able.
• Limited segregation of duties involving payments,
Internal Audit Activities
credits, and reconciliation of vendors and suppliers.
• Review end-to-end expense processing for check/
• Any procurement red flags related to the procure-
wire/EFT, petty cash, employee payroll, and employ-
ment or acquisition of IT infrastructure (see section
ee expense reimbursement.
on procurement).
• Review controls to establish bank accounts and
signature authorities. Internal Audit Activities

• Review bank reconciliation controls and perfor- • Review and test IT access controls related to vendor
mance of monthly reconciliations. management, accounts payable, and accounts re-
ceivable.
• Review controls over petty cash.
• Test transaction level controls for segregation of du-
• Review travel and entertainment payments and ties.
reimbursements, as these are common methods of
bribery. • Review the vendor master file for additions, dele-
tions, and changes.
• Review financial information, detailed accounts,
bank accounts, and payment records to identify any • See related section on procurement.
off-balance-sheet accounts usable for bribery pur-
poses. Upper Management
• Review controls and test transactions related to Risk Area Overview
credit notes and rebates.
Upper management has a pervasive impact on the risk of
• Confirm that the nature and amount of credit notes bribery or corruption through the culture it helps foster
and rebates are consistent with business practices. and its own activities.
• Review accounting policies and practices to assess
Red Flags
regulatory compliance.
• Complacency by management or the board toward
• Reconcile balances between subledger and general
bribery and corruption risk.
ledger.
• Inordinate attention to specific investigations by the
• Evaluate accounts to determine if parallel books are
management, who may be involved.
maintained in certain countries to disguise illegal or
irregular transactions. • Lack of a clear anti-bribery or anti-corruption policy.
• Lack of an objective process to investigate suspected
cases of bribery or corruption.

www.globaliia.org/standards-guidance / 15
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Internal Audit Activities Government Relations

• The internal auditor may be unsure how to handle Risk Area Overview
bribery and corruption issues involving executives in
In certain countries, significant interactions with govern-
the organization. Even just reporting such instances
ment agencies may pose higher risk or compliance costs.
to the organization or board can be a challenge. The
CAE may want to consult the general counsel. Red Flags
• If the CEO is not involved in these matters and the • Frequent government permit granting.
reporting line between the CEO and the CAE is
• Close personal relationships between employees
effective, there may not be any reporting difficulty.
and government personnel.
However, if the CEO may have been involved, spe-
cial care is required. • A historical record of government fines or penalties.
• The CAE should communicate the matter to inde- • Use of agents or third parties to develop business
pendent personnel such as board or audit commit- relationships in foreign countries.
tee members and the lead independent director. In • Inappropriate payments to government agencies.
certain jurisdictions it may be necessary to report to
• Events sponsored for public servants including trav-
the applicable regulatory agency. If senior executives
el, expense reimbursement, or entertainment (taking
are involved, the bribery or corruption that occurred
advantage of the function directly or indirectly).
should be considered substantial to reputational
risk, even if the infraction is relatively small or in- • High level of political contributions.
volves immaterial transactions. • Use of middlemen or consultants to facilitate fast
›› Some countries have set up governmental agen- track processing with government agencies or to get
cies for such reporting in the public sector. In- business.
ternal auditors in the public sector should report • Offers of gifts or favors to government employees
matters to such agencies, as required. and officials.
• If the senior executives are engaged in bribery or Internal Audit Activities
condone an inappropriate culture, internal audit will
need strong support from independent directors to • Review payments made to government agencies.
improve the organizational environment. • Review use of third parties for such payments.
• The organization may not have an anti-bribery • Validate original receipts and related amounts for
policy, or it may operate in a bribery-tolerant envi- government payments.
ronment. If so, the CAE should discuss the situa- • Review high-risk activities such as customs clear-
tion with the board to arrive at an appropriate course ance and granting of permits.
of action.
›› In some situations, organizations do not condone
bribery but seek to operate in countries where
such activities are prone to occur. Such practices
may result in facilitation payments and, therefore,
the CAE should discuss the associated risks with
legal counsel, the board or audit committee, and
senior management.

16 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Appendix 1: Comparison of Legislation in Select Countries

Following is a summary comparison of legislation in select countries (as of December 2012).

PROVISIONS UNITED KINGDOM UNITED STATES (FCPA) AUSTRALIA (BRIBERY OF PEOPLE’S REPUBLIC OF
(BRIBERY ACT) FOREIGN OFFICIALS/SE- CHINA (PRC)
CRET COMMISSION)
Bribery of foreign public √ √ √ √
officials
Private-to-private bribery √ √ √

Receipt of bribe √ √

Intent Intent is required for sec- √ √ √

tion 1 and 2 offenses. No
“corrupt” or “improper”
intent is required for the
FPB offense.
Facilitation payments √ √
allowed

Promotional expenses √ √ √ √
allowed

Extraterritorial application √ √

Third parties √ √ √ √

Failure to keep accurate Covered by other √ √ √

books and records legislation.

Criminal penalties √ √ √ √

Perceived level of Uncertain, as Act is new High and growing High and growing High and growing
enforcement

√ indicates section applies

www.globaliia.org/standards-guidance / 17
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Appendix 2: Internal matters and their awareness of related policies and

procedures and internal audit’s role therein.
Controls: Update Based on
COSO Elements 3. Evaluate the control environment/entity-level con-
trols established by management.
COSO-recommended examples of anti-bribery and anti-
corruption controls include: 4. Through inquiry with management, obtain an under-
standing of:
• Corporate ethics and anti-corruption and anti-brib-
ery policies. • Anti-bribery and anti-corruption policies and proce-
dures.
• Provisions for compliance with anti-bribery regula-
tions included in contracts with third parties. • Third-party due diligence process.

• Anti-fraud and anti-corruption training provided to • Third-party agreement approval process.

employees. • End-to-end expense processing for check/wire/EFT,
• A whistleblower program. petty cash, employee payroll, and employee expense
reimbursement.
• Requiring employees to record events where they
had contact with government officials, political • Gift policies and procedures review process.
parties/officials, or political candidates and their • Meals and entertainment policies and procedures
families. review process.
• Enforcement of delegation-of-authority limits. • Related roles and responsibilities, segregation of
• Procurement policies and procedures and periodic duties, documentation requirements, predetermined
compliance reviews. thresholds, and delegation of authority.

• Political contributions approved by the board of • Donation policies and procedures review process.
directors. • Process for review of payment facilitation policies
• User access and segregation of incompatible duties and procedures.
controls. 5. On a sample basis, test policies and procedures over
the items stated in item 4 above and verify that:
Appendix 3: Sample Audit • Policies and procedures were documented appropri-
Procedures ately.
• Policies and procedures were approved by appropri-
1. Discuss whether the audit should be conducted
ate management.
under attorney-client privilege with the legal depart-
ment. • Policies and procedures were communicated to
staff.
2. Through inquiry with the board of directors and • Policies and procedures are in compliance with
executive management, obtain an understanding of FCPA regulations.
those groups’ role in anti-bribery and anti-corruption
6. Review and test the following, as applicable:

18 / www.globaliia.org/standards-guidance
 IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

• Tone at the top/Governance structure – Investigation and sanction procedures.

›› Leadership and support of the board, the CEO, – Use of third parties and related controls.
and senior executives. – Training programs for employees and ven-
›› Consistent communication, support, and enforce- dors.
ment of program to establish credibility. ›› Ensure controls contemplate risks of override,
›› Anti- bribery and anti-corruption program with circumvention, and collusion.
an organizational structure and formal decision- ›› Tailor controls to local environment and business
making processes. models.
›› Whistleblower hotlines, employee help lines, and • Monitoring
topical guidance to support employees in chal-
›› Design monitoring and auditing procedures
lenging situations.
around risk factors and indicators.
›› Regular exception reports to the CEO and the
›› Periodically evaluate program effectiveness by
board.
performing internal audits.
• Risk assessment
›› Survey employees’ understanding of the program.
›› Use cross-functional teams (e.g., business unit,
finance, internal audit, compliance, legal) to ›› Constantly incorporate monitoring results into the
establish credibility and consistency. program design.

›› Identify risk factors, schemes, and scenarios at a • Response and remediation

business-process level. ›› Establish formal process for initiating, tracking,
investigating, resolving, and documenting allega-
›› Assess the likelihood and impact of risks.
tions.
›› Tailor assessment to local incentives, pressures,
›› Identify and remedy control weaknesses that led
opportunities, and attitudes.
to corrupt activities.
›› Evaluate and prioritize key risks.
›› Consistently enforce sanctions across organiza-
• Program design and control activities tional units and levels.
›› Focus on design and implementation of controls ›› Monitor communications regarding anti-bribery
for key risks identified in the risk assessment. and anti-corruption compliance received by the
›› Typical policies and controls to consider: board of directors and executive management.
– Facilitation payments. 7. Based on additional information gained, determine
– Gifts, hospitality, and entertainment. whether any additional test procedures should be
designed and performed. If an investigation is re-
– Use of agents and other intermediaries. quired, seek guidance from a specialist.
– Political and charitable contributions.
– Acquisition due diligence.
– Joint ventures or similar relationships.
– Recordkeeping requirements.

www.globaliia.org/standards-guidance / 19
IPPF – Practice Guide
Auditing Anti-bribery and Anti-corruption Programs

Appendix 4: References The authors consulted Fraud and Corruption — Preven-

tion and Detection, by Nigel Iyer and Martin Samociuk,
when writing parts of this practice guide.
Following are references that would be useful to internal
auditors in understanding the bribery and corruption sce-
nario and building an appropriate strategy. Authors
• Transparency International • Princy Jain, CIA, CCSA, CRMA

• The Organisation for Economic Co-operation and • Richard Schmidt, CIA

Development (OECD) and OECD’s Anti-bribery • Andrew Macleod, CIA, CRMA
Convention (1999) • Teis Stokka, CIA, CRMA
• United Nations Convention against Corruption • Carlos Renato, CIA, CCSA
• United Nations Declaration against Corruption and • Takeshi Shimizu, CIA, CCSA, CRMA
Bribery in International Commercial Transactions
• Andy Robertson
• The African Union Convention on Preventing and
Combating Corruption
• The King Code of Governance for South Africa Reviewers
• The U.S. Federal Sentencing Guidelines • Douglas J. Anderson, CIA, CRMA
• A Resource Guide to the U.S. Foreign Corrupt • Steve Jameson, CIA, CFSA, CCSA, CRMA
Practices Act (by the Criminal Division of the U.S.
• David Zechnich, CIA, CRMA
Department of Justice and the Enforcement Division
of the U.S. Securities and Exchange Commission) • Stephen Linden
• The IIA’s Audit Executive Center 2010 Knowledge
Briefing, Internal Auditing and the Foreign Corrupt
Practices Act
• The Chartered Institute of Internal Auditors’ Profes-
sional Guidance for Internal Auditors on the U.K.
Bribery Act 2010
• Transparency International’s 2010 U.K. Bribery Act
Adequate Procedure (guidance on good practice
procedures for corporate anti-bribery programs)
• IIA Practice Guide, Evaluating Ethics-related Pro-
grams and Activities
• IIA Practice Guide, Coordinating Risk Management
and Assurance
• The IIA’s Global Technology Audit Guide (GTAG®)
16: Data Analysis Technologies

20 / www.globaliia.org/standards-guidance
About the Institute Disclaimer
Established in 1941, The Institute of Internal The IIA publishes this document for informa-
Auditors (IIA) is an international professional tional and educational purposes. This guidance
association with global headquarters in Altamonte material is not intended to provide definitive an-
Springs, Fla., USA. The IIA is the internal audit swers to specific individual circumstances and as
profession’s global voice, recognized authority, such is only intended to be used as a guide. The
acknowledged leader, chief advocate, and princi- IIA recommends that you always seek indepen-
pal educator. dent expert advice relating directly to any specific
situation. The IIA accepts no responsibility for
About Practice Guides anyone placing sole reliance on this guidance.
Practice Guides provide detailed guidance for
conducting internal audit activities. They include Copyright
detailed processes and procedures, such as tools Copyright © 2014 The Institute of Internal
and techniques, programs, and step-by-step ap- Auditors. For permission to reproduce, please
proaches, as well as examples of deliverables. contact The IIA at [email protected].
Practice Guides are part of The IIA’s IPPF. As
part of the Strongly Recommended category
of guidance, compliance is not mandatory, but
it is strongly recommended, and the guidance
is endorsed by The IIA through formal review
and approval processes. For other authoritative
guidance materials provided by The IIA, please
visit our website at https://globaliia.org/standards-
guidance.

GLOBAL HEADQUARTERS T: +1-407-937-1111

247 Maitland Ave. F: +1-407-937-1101
Altamonte Springs, FL 32701 USA W: www.globaliia.org

140590