TIAPS Module 1 Audit and Assurance workbook

C.1.3 Assurance and Advisory Engagements Compared
There are many similarities between assurance and advisory engagements and internal
auditors will apply many common skills. In particular, both types of engagements must be
defined in the internal audit charter and internal auditors must adhere to appropriate
standards and apply due professional care. There are also important differences, as shown
below.
Feature
Purpose
Key differences between advisory and consulting services
Assurance services
Advisory services
To provide assurance through an To offer advice, usually in response
opinion on the adequacy and to a request.
effectiveness of governance, risk
management, and internal control
based on an objective assessment
of evidence.
Principal parties • Internal auditor.
• Unit manager or process owner.
• Recipient of assurance (senior
management and the governing
body).
Scope and
approach
Objectives
Governance, risk
management, and
internal control
Auditor
assignment
Conflicts of
interest
Determined by internal auditor with
consultation with relevant manager.
Based on a risk assessment, taking
account of the possibility of error,
fraud, and noncompliance.
Must be part of the engagement
scope and objectives.
The head of internal audit must
obtain the necessary skills for the
engagement, either from the team
or from other sources rather than
defer the engagement.
In accordance with Standard 1130,
internal auditors should not provide
assurance for operations for which
they were responsible within the
previous year.
• Internal auditor.
• Client.
Agreed between client and internal
auditor.
Consistent with the organization’s
goals and priorities.
May be included in the engagement
scope and objectives.
The head of internal audit must wait
until the necessary skills for the
engagement are available.
In accordance with Standard 1130,
internal auditors may provide
consulting services relating to
operations for which they had
previous responsibilities but any
potential impairments to
independence or objectivity must be
disclosed prior to accepting the
engagement.
In undertaking advisory engagements, care must be taken to ensure the independence of
the function and objectivity of auditors for future engagements. Implementing controls,
making executive decisions, enforcing policies, directing the application of resources, and in
general terms “owning the risk” are responsibilities of management which internal auditors
should not assume. In offering training, facilitating control self-assessment workshops,
48