TIAPS Module 1 Audit and Assurance workbook

second line roles depends on many factors, including organizational size, complexity of
operations, culture, laws and regulations, external environment, skills and resources, and
the relative strength and maturity of internal auditing. In some cases, the head of risk
management reports directly to the governing body (rather than the CEO) and may be
required to do so by regulation. A degree of independence between those with first and
second line roles strengthens the effectiveness of risk management and internal control.
However, risk management and internal control remain the responsibility of management
and ultimately the CEO.
Assurance: The internal audit function provides management and the governing body
with independent and objective assurance and advice on the adequacy and
effectiveness of governance, risk management, and internal control. Independence
means being accountable to the governing body (directly or via an audit committee),
being free from interference by management and from responsibility for the activities
being audited, and having access to the resources, people, and information needed to
complete the work of the function. However, independence should not entail isolation.
Internal auditing must be fully aligned with the needs of the organization and supportive
of its purpose. Cooperation and collaboration with management are encouraged. The
head of the internal audit function (the chief audit executive) should engage with and
provide reports to senior management on a regular basis as well as communicating with
the governing body.
The Three Lines Model focuses primarily on the internal elements of an organization.
However, external assurance providers (principally the Supreme Audit Institution for
government entities, although other external service providers may be used subject to
statutory requirements) are also recognized as contributing to governance and the success
of organizations. The role of external audit is discussed in more detail in Module T3
Accounting Fundamentals.
Where governments are focused on implementing public internal financial control (PIFC),
financial and managerial control (FMC) and internal auditing are two of the central
components (the third being the Central Harmonization Unit (CHU)). This is strongly
reflective of the Three Lines Model in identifying control responsibilities as part of the role of
management and internal audit as an independent function. PIFC and FMC are discussed in
more detail in Module T3 Accounting Fundamentals. Countries seeking accession to the
European Union are required to satisfy, among other things, best practice standards,
frameworks, and policies relating to PIFC on a holistic sector-wide basis. These expectations
are detailed in Chapter 32 Financial Control of the EU requirements. These include:
• Effective and transparent management systems, including accountability
arrangements for the achievement of objectives.
• A functionally independent internal audit.
• Relevant organizational structures, including central co-ordination of PIFC
development across the public sector. 10
10
See, for example, the European Commission Staff Working Document: Albania 2022 report.
18