Tailoring IPPF Implementation

29-06-2018

In dit artikel wordt een pleidooi gehouden om als IAF gebruik te maken van maturity- of volwassenheidsmodellen. Zij kunnen helpen om de inrichting van de IAF, ofwel de toepassing van het IPPF, op maat te maken voor de organisatie, afgestemd op haar specifieke kenmerken en behoeften. Daarbij helpt het om te kijken naar best practices, naar mogelijkheden om de toegevoegde waarde te vergroten en zo invulling te geven aan continue verbetering van de IAF.

Dit past geheel bij het doel van het IPPF. Het IPPF is niet binair, in termen van wel of niet aan voldaan. In 2015 is de opzet van het IPPF gewijzigd, juist om te dienen als hulpmiddel voor de IAF om haar effectiviteit en toegevoegde waarde te vergroten. Daartoe zijn bijvoorbeeld de ’10 core principles’ benoemd waaraan elke IAF dient te voldoen, waarbij de wijze waarop daaraan wordt voldaan kan verschillen, afhankelijk van de organisatie.

Zonder dat daar naar wordt verwezen, benadrukt het artikel het belang en doel van het Nederlandse Internal Audit Ambition Model. In september zullen IIA en NBA-LIO versie 2.0 van dit model uitbrengen.

In het artikel worden diverse andere maturity modellen beschreven, deels algemeen voor de IAF en deels specifiek voor bijvoorbeeld het ‘compliance and ethics program’, risicomanagement en IT Governance. -->

Tailoring IPPF Implementation

A fundamental challenge of today’s chief audit executive (CAE) is matching internal audit to the needs of the organization and the expectations of internal audit’s key stakeholders. While there is one International Professional Practices Framework (IPPF) and one International Standards for the Professional Practice of Internal Auditing, internal audit functions vary in their practices and level of development across organizations. A primary role of the CAE is to tailor the application of the IPPF to the organization, taking into account its unique needs and environment and knowing how to leverage a maturity model view of the IPPF and Standards in striving for internal audit excellence.

A living framework

One of the strengths of the IPPF is the principles-based nature of the Standards. Being principles based allows organizations of different industries, sizes, and locations — with varying governance models and stakeholder expectations — to apply the same set of standards. The principles based nature of the Standards also helps add clarity and consistency, while still being relevant and adaptable to evolutions in society and in the organizations internal audit serves.

In 2015, the IPPF received significant enhancements that improved its ability to serve as a tool for internal audit functions to take their practice to higher levels of effectiveness and provide even greater value to their organizations. Two noteworthy changes are:

  • Creation of the 10 Core Principles for the Professional Practice of Internal Auditing, which, taken as a whole, articulate internal audit effectiveness. For an internal audit function to be considered effective, all principles should be present and operating effectively. However, with the release of these Core Principles, The IIA also recognized that how an internal audit function demonstrates achievement of the Core Principles may differ from organization to organization.
  • Implementation Guides and Supplemental Guides moved from "strongly recommended" status to "recommended" status, adding further flexibility to the IPPF for practitioners.

The ever-evolving nature of the IPPF gives practitioners the flexibility they need to align to the unique needs of the organizations they serve. The IPPF’s various layers also provide practitioners with a framework they can use to continually integrate new methodologies, tools, resources, and practices to further mature their performance.

A maturity model view

When looking at internal audit’s conformance with the Standards, many practitioners and stakeholders at first may think of it as a binary exercise — either being in conformance or not. Perhaps this is natural given the external quality assurance and improvement assessment’s common ratings scale of "generally conforms," "partially conforms," and "does not conform" are widely recognized.

Practitioners should look at using the IPPF and the Standards as part of a journey toward greater maturity and continuous improvement. Such a continuous improvement view is consistent with the IPPF, which includes in the Standards the assertion that quality is not only about assessing quality at one point, but also about improvement, as outlined in Standard 1300: Quality Assurance and Improvement Program. A maturity framework approach allows practitioners to assess the audit function’s implementation of the IPPF to continually improve audit practice.

Maturity model structure

Many organizations have used maturity models to assess and help bring continuous improvement. The IPPF, itself, includes guidance on the use of maturity models, including The IIA’s Practice Guide, Selecting, Using, and Creating Maturity Models: A Tool for Assurance and Consulting Engagements. Based on review of other maturity models, the following categories are proposed for use in the model for applying the IPPF: Level 5 – Optimized, Level 4 – Managed, Level 3 – Defined, Level 2 – Repeatable, and Level 1 – Initial/Ad hoc.

It is natural to ask how these levels align with the category of general conformance to the Standards. For consistency, and to allow the maturity model to capture performance that falls below general conformance — as well as above the base general conformance level — Level 3 on the maturity framework will be defined with attributes that achieve general conformance with the Standards (see "Maturity Model Alignment Points" on page 31).

Download the PDF Tailoring IPPF Implementation
Read Tailoring IPPF Implementation online

Terug naar het nieuwsoverzicht.

IIA Nederland

Postadres:
Postbus 22657
1100 DD Amsterdam
Bezoekadres:
Burgemeester Stramanweg 102A
1101 AA Amsterdam
Contact opnemen

Audit Magazine

Audit Magazine

Lidmaatschap

IIA is dé toonaangevende beroepsorganisatie voor internal auditors. Een lidmaatschap laat u delen in de collectieve kennis van alle vakgenoten in de wereld.
Meer informatie