Navigating the Future of Assurance: Understanding the New IIA UK Internal Audit Code.

September 2024 marked a significant milestone for the internal audit profession in the UK with the release of the new IIA UK Internal Audit Code. This updated framework provides a robust foundation for internal audit practitioners and stakeholders alike, ensuring the function remains relevant, effective, and aligned with best practices in corporate governance. But why was a new code necessary, and how does it elevate the standards of assurance in the UK? Let's delve into the key aspects of this important development.

The Imperative for Evolution: Why a New Code?

The business landscape is in constant flux, driven by technological advancements, evolving regulatory requirements, and increasing stakeholder expectations. The previous IIA UK Code, while valuable, needed to adapt to these dynamic forces. The new code has been developed to:

• Reflect contemporary best practices: It incorporates lessons learned, emerging trends in risk management and governance, and feedback from the internal audit community.

• Enhance clarity and consistency: The updated language aims to provide clearer guidance and reduce ambiguity in the application of internal audit principles.

• Strengthen the value proposition of internal audit: By emphasising quality, independence, and insight, the code seeks to ensure internal audit remains a critical function for organisational success.

• Align more closely with the Global IIA Standards: While building upon the global framework, the UK code provides specific guidance relevant to the UK context.

Building on Global Foundations: A UK-Specific Lens

The new IIA UK Internal Audit Code is firmly rooted in the Global IIA Standards. These international standards provide the overarching principles and requirements for the professional practice of internal auditing. The UK code takes these global standards and contextualises them for the unique regulatory and business environment within the United Kingdom. It provides more detailed guidance on how the global principles should be applied in practice within UK organisations, considering aspects such as corporate governance structures, legal frameworks, and stakeholder expectations. This ensures that internal audit in the UK operates to a high global benchmark while remaining relevant to the local context.

The Cornerstone of Quality: Introducing the QAIP

One of the most significant additions introduced by the new IIA UK Internal Audit Code is the formal emphasis on the Quality Assurance and Improvement Programme (QAIP). While the Global IIA Standards also mandate a QAIP, the UK code brings a sharper focus and provides more specific expectations for its implementation.

The QAIP is a comprehensive and ongoing assessment of the entire internal audit activity. Its purpose is to evaluate the effectiveness and efficiency of the internal audit function and identify opportunities for improvement. The new UK code underscores that the QAIP is not a one-off exercise but an integral part of the internal audit function's operational rhythm.

The QAIP encompasses both internal and external assessments:

• Internal Assessments: These are ongoing self-assessments and periodic reviews conducted within the internal audit function. They involve monitoring internal audit activities, reviewing policies and procedures, and assessing the skills and competencies of the internal audit team. For example, regular file reviews by senior auditors or periodic surveys of audit staff can form part of the internal assessment.

• External Assessments: These are independent assessments conducted at least once every five years by a qualified external assessor or assessment team. External assessments provide an objective evaluation of the internal audit function's conformance with the IIA UK Code and the effectiveness of its practices. This brings an independent perspective and helps identify areas for improvement that might not be apparent internally.

The introduction of a more explicit and robust QAIP within the UK code signifies a commitment to continuous improvement and enhancing the credibility of the internal audit profession. It provides stakeholders with greater confidence in the quality and reliability of internal audit's work.

Beyond the QAIP: Other Key Enhancements

While the introduction of a more defined QAIP is a major highlight, the new IIA UK Internal Audit Code also brings other significant additions and refinements, including:

• Enhanced Focus on Independence and Objectivity: The code reinforces the fundamental principles of independence and objectivity, providing clearer guidance on managing potential impairments and ensuring that internal auditors can perform their work without bias. This might include more explicit requirements around declaring potential conflicts of interest and the organisational positioning of the internal audit function.

• Emphasis on Value and Insight: The new code stresses the importance of internal audit providing valuable insights and recommendations that contribute to the achievement of organisational objectives. This moves beyond simply reporting on compliance and focuses on how internal audit can be a strategic partner to management. For instance, the code encourages internal auditors to provide forward-looking perspectives on emerging risks and opportunities.

• Strengthened Requirements for Professional Proficiency and Due Care: The code emphasises the need for internal auditors to possess the necessary knowledge, skills, and competencies to perform their responsibilities effectively and with due professional care. This includes staying updated on relevant industry trends, regulations, and auditing techniques, and exercising sound judgment in their work.

• Greater Clarity on Communication and Reporting: The updated code provides clearer expectations for the communication of audit results and recommendations to relevant stakeholders. It emphasises the need for reports to be clear, concise, and actionable, facilitating effective decision-making. For example, reports should clearly articulate the impact of findings and provide practical recommendations for remediation.

• Increased Emphasis on Stakeholder Engagement: The code highlights the importance of internal auditors engaging effectively with key stakeholders, including the audit committee, senior management, and other assurance providers. This collaborative approach helps ensure that internal audit's work is aligned with organisational needs and that its findings are understood and acted upon.

Conclusion: A New Era for UK Internal Audit:

The new IIA UK Internal Audit Code represents a significant step forward for the profession in the United Kingdom. By building upon the Global IIA Standards and introducing key enhancements such as a more robust QAIP, it sets a higher benchmark for quality, independence, and value creation. This updated framework will empower internal auditors to navigate the complexities of the modern business environment and provide even greater assurance and insight to their organisations, ultimately contributing to stronger governance and greater organisational success. Embracing and effectively implementing this new code is crucial for all internal audit professionals and the organisations they serve.