TIAPS Module 1 Audit and Assurance workbook

8. Ensure that its arrangements for delegation within its own structures promote
independent judgement, and assist with the balance of power and the effective
discharge of its duties.
9. Ensure that the evaluation of its own performance and that of its committees, its
chair, and its individual members support continued improvement in its performance
and effectiveness.
10. Ensure that the appointment of, and delegation to, management contribute to role
clarity and the effective exercise of authority and responsibilities.
11. Govern risk in a way that supports the organization in setting and achieving its
strategic objectives.
12. Govern technology and information in a way that supports the organization setting
and achieving its strategic objectives.
13. Govern compliance with applicable laws and adopted, non-binding rules, codes, and
standards in a way that supports the organization being ethical and a good corporate
citizen.
14. Ensure that the organization remunerates fairly, responsibly, and transparently so as
to promote the achievement of strategic objectives and positive outcomes in the
short, medium, and long term.
15. Ensure that assurance services and functions enable an effective control
environment, and that these support the integrity of information for internal decisionmaking
and of the organization’s external reports.
16. Adopt a stakeholder-inclusive approach that balances the needs, interests, and
expectations of material stakeholders over time.
17. [For institutional investor organizations] Ensure that responsible investment is
practiced by the organization and the creation of value by the companies in which it
invests. 13
In addition to these principles, the report includes recommended practices. For principle 15,
this includes a role for the audit committee and a separation of roles consistent with the
Three Lines Model (although King IV advocates for five lines of assurance, adding external
audit and the board as lines four and five respectively). Additionally, the report recommends
internal audit makes an annual statement on the effectiveness of governance and risk
management processes. This reflects the requirements of the IPPF (Standard 2100 – Nature
of Work):
The internal audit activity must evaluate and contribute to the improvement of the
organization’s governance, risk management, and control processes using a systematic,
disciplined, and risk-based approach. Internal audit credibility and value are enhanced
when auditors are proactive and their evaluations offer new insights and consider future
impact. 14
However, the requirement for annual reporting goes beyond Standard 2060 – Reporting to
Senior Management and the Board by which the CAE must report “periodically.” (Internal
audit opinions are discussed in more detail in C.1.5)
13
“Report on Corporate Governance for South Africa,” King IV, 2016.
14
The International Professional Practice Framework, The Institute of Internal Auditors, 2016
21