Plans: the Internal Audit Code of Practice

As a profession it is imperative that we use the current debate on the future of audit as an opportunity to enhance internal audit’s position as a cornerstone of good corporate governance. Following the collapse of Carillion, we have seen a flurry of reviews: the Brydon Review into UK Audit Standards, the BEIS Select Committee Future of Audit Inquiry and the Independent Review of the FRC led by Sir John Kingman. 

The one striking similarity between Carillion and the companies that collapsed during the financial crisis in 2008 was that a seemingly stable company turned out to be in deep financial difficulty just months after receiving a “clean” external audit report. Those collapses led to substantial job losses and eroded public trust in UK business. 

We have welcomed many of the recommendations by Sir John Kingman, along with a number of the Competition and Markets Authority’s proposals, and called for swift action. These reviews have focused particularly on the part played by external audit. However, as part of the response, we must ensure that internal audit continues to strengthen its role in ensuring good and effective corporate governance.

That is why we are planning to build on the success of the guidance we produced for internal audit in the financial services sector following the global financial crisis by developing an internal audit code of best practice for other sectors. The new code will provide greater clarity on what is expected of internal audit and what boards and management need to do to support their internal audit functions.

Research by the Chartered IIA in 2014 and 2015 found that the Financial Services Code had had a positive impact, particularly in relation to the profile, resources, skills and status of internal audit in financial services.

In 2017 the committee that drew up the Financial Services Code reviewed its impact to assess whether it had been effective at achieving its objectives. It found that the code was fundamentally sound and remained highly relevant. The clear message from stakeholders was that it had been instrumental in supporting real improvements in internal audit across the sector. It enhanced the standing and position of internal audit in organisations and made a career in internal audit more attractive. It also helped to raise the bar in some areas – such as independence and reporting to the board – and helped to clarify areas of ambiguity. 

This review was led by an independent committee of senior industry figures, with the support of regulators. We have now established a new committee, chaired by Brendan Nelson, audit committee chair of BP, to develop our Internal Audit Code of Practice. He is joined by audit committee chairs from a range of sectors and various sizes of company, along with heads of internal audit from several FTSE 250 businesses. 

The committee will develop the new code of practice, which will aim to drive up professional standards and create high quality internal audit functions across all sectors. The Internal Audit Code of Practice will help to promote best practice and raise the expectations of customers and boards so that internal audit teams can increase the benefits they provide.

During the course of the year we will consult widely with you and our stakeholders on the content of the proposed Internal Audit Code of Practice. We expect the committee to finalise its recommendations in early 2020. 

We believe the development of the code should be driven by, and for, the profession, so it is important to capture your views about how boards, audit committees and regulators can assess the effectiveness of their internal audit functions.

This article was first published in Audit & Risk May/June 2019