I. ISACA Definition and Function
Treadstone Company has an internal audit department consisting of a director and four (4) staff auditors. The director of internal audit, Mark Tan, reports to the corporate controller, who receives copies of all internal audit reports. Also, copies of all internal audit reports are sent to the audit committee of the board of directors and the individual responsible for the area of activity being audited.
In the past, the company’s external auditors have relied on the work of the internal audit department to a substantial degree. However, in recent months, Mark has become concerned that some standards in the performance of the internal audit function are being affected by the non-audit work being performed by the department. The possible failure to meet such standards could result in more extensive testing and analysis by the external auditors. The percentage of non-audit work performed by the internal auditors has steadily increased to about 25% of the total hours worked. A sample of 5% non-audit activities follows:
- One of the internal auditors assisted in the preparation of policy statements on internal control. These statements included such things as policies regarding sensitive payments and the safeguarding of assets.
- Reconciling the corporation's bank statements each month is a regular assignment of one of the internal auditors. The corporate controller believes this strengthens the internal control function because the internal auditor is not involved in either the receipt or the disbursement of cash.
- The internal auditors are asked to review the annual budget each year for relevance and reasonableness before the budget is approved. At the end of each month, the corporate controller’s staff analyzes the variances from the budget and prepares explanations of these variances. The internal audit staff then reviews these variances and explanations.
- One of the internal auditors has been involved in the design, installation, and initial operation of a new computerized inventory system. The auditor was primarily concerned with the design and implementation of internal accounting controls and evaluated these controls during the test runs.
- The internal auditors are sometimes asked to make the accounting entries in the accounting system for complex transactions as the accounting department employees are not adequately trained to handle such transactions. The corporate controller believes this gives an added measure of assurance to the accurate recording of these transactions.
Requirement
a. Give at least one (1) ISACA standard that was being violated from the above case. Justify your answer in no more than five (5) sentences.
b. Concerning question number 1, what are the requirements in the code of ethics that have been violated, supposing that the auditors are ISACA members? Justify your answer in no more than five (5) sentences.
c. In connection with number 1, give possible actions that can be done to uphold the standard being violated.