Which two statements are least appropriate?

The situation where a newly formed internal audit function has to be developed is not unusual and key issues include:

a. The Audit charter: This sets out the role and objectives of internal audit and is at the core of the delivery of audit services. This is the starting place for a new audit function.

b. Audit standards: The CAE has to decide on two types of standards before the new audit function can be developed – professional and operational standards. The former may be based on those provided by a professional auditing body. Operational standards are more readily achievable since they represent a local interpretation of the professional base.

c. The code of conduct: Another consideration when setting up a new audit service is whether to set standards of conduct before recruiting staff. This is an ideal opportunity where people join only if they feel they can meet the high standards. Once in post, it is difficult to impose new requirements.

d. Recruitment and selection: It is essential that the ‘rounded person’ is acquired with a whole package of attributes. Training can only go so far, and we are not talking only about formal qualifications and experience.

e. Training: A training budget is essential for the newly formed internal audit unit. This should cover the types of training that will be undertaken for any junior staff who are being employed.

f. The business risk assessment: This is an important part of the development of a new audit function. The general risk survey represents the justification for the new service in that it defines those areas that should be subject to audit coverage.

g. Information systems (IS) audit: One matter that should be high on the agenda for the CAE when designing the new internal audit service relates to computer audit.

h. Fraud work: There is a need to define a clear policy on the detection and investigation of fraud and irregularities.

i. Business planning: The new CAE should devise and publish a business plan that covers the internal audit unit.

j. Assurance and consulting services: One question to be tackled early on in the life of the newly formed unit is related to the type of services that will be provided by internal audit.

k. Budgets: While the CAE must seek to negotiate a large budget, there is great scope to secure extensive funding at the outset.

l. The launch of the new service: The new service must be introduced to the organization.
All the well-known devices that this entails should be applied. A good way to do this is to undertake presentations to senior management and the audit committee as well as preparing the all-important audit brochure and web-based facility.
m. The audit manual: We have kept the audit manual as the last topic to be dealt with when setting up a new internal audit department. The extreme view of the audit manual is that of a process that forces audit management to document its objectives, policies and procedures in a formal and publicized fashion.