TIAPS Module 1 Audit and Assurance workbook

A.3 Governance Models
When evaluating governance, internal auditors must consider whether the organization has
used “adequate criteria” for monitoring purposes.
If adequate, internal auditors must use such criteria in their evaluation. If inadequate, internal
auditors must identify appropriate evaluation criteria through discussion with management
and/or the board.
Types of criteria may include:
• Internal (e.g., policies and procedures of the organization).
• External (e.g., laws and regulations imposed by statutory bodies).
• Leading practices (e.g., industry and professional guidance). 9
To explore governance further we will consider four important models that may be said to
represent “leading practices,” although they must always be contextualized:
• ISO 37000:2021 Governance of organizations – Guidance.
• IIA Three Lines Model.
• CIPFA International Framework: Good Governance in the Public Sector.
• King IV Corporate Governance Report, 2016.
These models have many similarities. Corporate governance codes such as the King IV
Code, while being applicable primarily to private sector companies, are also very informative
for government entities.
A.3.1 ISO 37000:2021 Governance of organizations – Guidance
The ISO model places organizational purpose at its center. Purpose is informed by values
which also determine how the organization pursues its purpose.
Diagram based on
ISO 37000:2021
Governance of Organizations
9
Standard 2210 – Engagement Objectives, International Professional Practices Framework, The IIA, 2016.
15