TIAPS Module 1 Audit and Assurance workbook

• Risk management maturity.
• Control weaknesses identified by internal audit.
• The focus of the external auditors and financial inspectors (to ensure coherent
coverage and minimize unnecessary duplication to the extent to which cooperation is
possible while maintaining independence and respective missions).
• Resources and skills available to the internal audit function.
• Internal audit function strategic plan.
C.1.1 Assurance Engagements
Assurance can be defined in terms of the examination and assessment processes deployed
by auditors to evaluate governance, risk management, and internal control. This is how it is
defined by the IPPF. “Assurance” also refers to the confidence provided by an assurance
engagement and the comfort derived from it by the client of assurance services.
Assurance as a form of confidence and comfort allows for the possibility of different degrees,
amounts, or levels, ranging theoretically from total and absolute assurance to the complete
absence of assurance. In practice, it is impossible to provide absolute assurance since the
scope of an audit is always limited to what was observed and concluded at that moment.
Other activities and conditions fall outside of the scope and circumstances continue to
change. Uncertainty will always remain. For that reason, external auditors may provide
reasonable or limited assurance, although this distinction is not made for internal auditors in
the IPPF. The IPPF refers to “reasonable assurance” only in the context of the purpose of
risk management and internal control, although it does not define the term. For example, risk
management is defined as:
A process to identify, assess, manage, and control potential events or situations to
provide reasonable assurance regarding the achievement of the organization’s
objectives. 43
“Limited assurance” is not referenced at all in the IPPF. While some internal auditors choose
to make the distinction between reasonable (or positive) assurance and limited (or negative)
assurance, these are more commonly terms used by external auditors. Internal audit
engagements may provide assurance based on “sufficient, reliable, relevant, and useful
information” to support conclusions and opinions (Standard 2310 – Identifying Information).
There is no allowance for anything that falls short of this requirement. The IIA guidance on
audit opinions does allow for distinctions in the level of assurance (see section C.1.5).
C.1.2 Consulting (Advisory) Engagements
What constitutes consulting services covers a wide spectrum of activities.
43
The International Professional Practice Framework, The Institute of Internal Auditors, 2016
46