Persandingan Standar Baru (Edisi 2011) dan Exiiting (edisi 2009)

No Standard # NEW EXISTING

1 1000 Purpose, The internal audit charter establishes the internal audit The internal audit charter establishes the internal audit
Authority, and activity's position within the organization, including the activity's position within the organization,
Responsibility nature of the chief audit executives functional
reporting relationship with the board
2 1100 Independence is the freedom from conditions that Independence is the freedom from conditions that
Independence and threaten the ability of the internal audit activity or the threaten the ability of the internal audit activity or the
Objectivity chief audit executive to carry out internal audit chief audit executive to carry out internal audit
responsibilities in an unbiased manner responsibilities in an unbiased manner
3 1110 Interpretation: --
Organizational Organizational independence is effectively
Independence achieved when the chief audit executive reports
functionally to the board. Examples of
functional reporting to the board involve the
board:
Approving the internal audit charter;
Approving the risk based internal audit plan;
Receiving communications from the chief
audit executive on the internal audit activitys
performance relative to its plan and other
matters;
Approving decisions regarding the
appointment and removal of the chief audit
executive; and
Making appropriate inquiries of management
and the chief audit executive to determine
whether there are inappropriate scope or
resource limitations.

4 1312 External Interpretation: Interpretation:

Assessments A qualified reviewer or review team demonstrates A qualified reviewer or review team consists of
individuals who are competent in the professional
No Standard # NEW EXISTING
competence in two areas: the professional practice of practice of internal auditing and the external
internal auditing and the external assessment process. assessment process. The evaluation of the
Competence can be demonstrated through a mixture competency of the reviewer and review team is a
of experience and theoretical learning. Experience judgment that considers the professional internal
gained in organizations of similar size, complexity, audit experience and professional credentials of the
sector or industry, and technical issues is more individuals selected to perform the review. The
valuable than less relevant experience. In the case of a evaluation of qualifications also considers the size
and complexity of the organizations that the
review team, not all members of the team need to
reviewers have been associated with in relation to
have all the competencies; it is the team as a whole
the organization for which the internal audit activity
that is qualified. The chief audit executive uses is being assessed, as well as the need for particular
professional judgment when assessing whether a sector, industry, or technical knowledge.
reviewer or review team demonstrates sufficient
competence to be qualified.
5 1321 Use of Interpretation: --
Conforms with the The internal audit activity conforms with the
International Standards when it achieves the outcomes described in
Standards for the the Definition of Internal Auditing, Code of Ethics, and
Professional Practice Standards. The results of the quality assurance and
of Internal Auditing improvement program include the results of both
internal and external assessments. All internal audit
activities will have the results of internal assessments.
Internal audit activities in existence for at least five
years will also have the results of external
assessments.
6 2000 Managing the Interpretation: Interpretation:
Internal Audit ... ...
Activity The individuals who are part of the internal audit The individuals who are part of the internal audit
activity demonstrate conformance with the Code of activity demonstrate conformance with the Code of
Ethics and the Standards. Ethics and the Standards.

The internal audit activity adds value to the

organization (and its stakeholders) when it
No Standard # NEW EXISTING
provides objective and relevant assurance, and
contributes to the effectiveness and efficiency
of governance, risk management, and control
processes.
7 2010 Planning 2010.A2 The chief audit executive must identify and --
consider the expectations of senior management, the
board, and other stakeholders for internal audit
opinions and other conclusions.
8 2070-External 2070 External Service Provider and --
Service Provider and Organizational Responsibility for Internal
Organizational Auditing
Responsibility for When an external service provider serves as the
Internal Auditing internal audit activity, the provider must make
the organization aware that the organization
has the responsibility for maintaining an
effective internal audit activity.
Interpretation
This responsibility is demonstrated through the
quality assurance and improvement program
which assesses conformance with the
Definition of Internal Auditing, the Code of
Ethics, and the Standards.
9 2110 Governance 2110.A2 The internal audit activity must assess 2110.A2 The internal audit activity must assess
whether the information technology governance of the whether the information technology governance of the
organization sustains and supports the organizations organization sustains and supports the organizations
strategies and objectives. strategies and objectives.
10 2210 Engagement 2110.C12210.C2 Consulting engagement objectives 2110.C1 Consulting engagement objectives must be
Objective must be consistent with the overall organization's consistent with the overall values and goals of the
values, strategies, and objectives goals of the organization
organization
11 2120 Risk
Management Relevant risk information is captured and Relevant risk information is captured and
communicated in a timely manner across the communicated in a timely manner across the
No Standard # NEW
organization, enabling staff, management, and the
board to carry out their responsibilities.
The internal audit activity may gather the
information to support this assessment during
multiple engagements. The results of these
engagements, when viewed together, provide
an understanding of the organizations risk
management processes and their effectiveness.
12 2120.A1 The internal audit activity must evaluate
risk exposures relating to the organizations
governance, operations, and information systems
regarding the:
Reliability and integrity of financial and
operational information;
Effectiveness and efficiency of operations and
programs;
Safeguarding of assets; and
Compliance with laws, regulations, policies,
procedures, and contracts.
13 2130 Control 2130.A1 The internal audit activity must evaluate
the adequacy and effectiveness of controls in
responding to risks within the organizations
governance, operations, and information systems
regarding the:
Reliability and integrity of financial and
operational information;
Effectiveness and efficiency of operations and
programs;
Safeguarding of assets; and
Compliance with laws, regulations, policies,
procedures, and contracts.
14 2130.A2 Internal auditors should ascertain the
EXISTING
organization, enabling staff, management, and the
board to carry out their responsibilities.
2120.A1 The internal audit activity must evaluate
risk exposures relating to the organizations
governance, operations, and information systems
regarding the:
Reliability and integrity of financial and
operational information;
Effectiveness and efficiency of operations;
Safeguarding of assets; and
Compliance with laws, regulations, and
contracts.
2130.A1 The internal audit activity must evaluate
the adequacy and effectiveness of controls in
responding to risks within the organizations
governance, operations, and information systems
regarding the:
Reliability and integrity of financial and
operational information;
Effectiveness and efficiency of operations;
Safeguarding of assets; and
Compliance with laws, regulations, and
contracts.
2130.A2 Internal auditors should ascertain the
No Standard # NEW
extent to which operating and program goals and
objectives have been established and conform to
those of the organization.
15 2130.A3 Internal auditors should review
operations and programs to ascertain the extent to
which results are consistent with established goals
and objectives to determine whether operations
and programs are being implemented or performed
as intended.
16 2220 Engagement 2130.C12220.C2 During consulting engagements,
Scop internal auditors must address controls consistent with
the engagements objectives and be alert to significant
control issues
17 2130.C21 Internal auditors must incorporate
knowledge of controls gained from consulting
engagements into evaluation of the organizations
control processes.
18 2400 Internal auditors must communicate the engagement
Communicating results of engagements
Result
19 2410 Criteria for 2410.A1 - Final communication of engagement
Communication results must, where appropriate, contain the
internal auditors overall opinion and/or
conclusions. When issued, an opinion or
conclusion must take account of the
expectations of senior management, the board,
and other stakeholders and must be supported
by sufficient, reliable, relevant, and useful
information.
Interpretation:
Opinions at the engagement level may be ratings,
conclusions, or other descriptions of the results. Such
an engagement may be in relation to controls around
EXISTING
extent to which operating and program goals and
objectives have been established and conform to
those of the organization.
2130.A3 Internal auditors should review
operations and programs to ascertain the extent to
which results are consistent with established goals
and objectives to determine whether operations
and programs are being implemented or performed
as intended.
2130.C1 During consulting engagements, internal
auditors must address controls consistent with the
engagements objectives and be alert to significant
control issues
2130.C2 Internal auditors must incorporate
knowledge of controls gained from consulting
engagements into evaluation of the organizations
control processes.
Internal auditors must communicate the engagement
results
2410.A1 - Final communication of engagement
results must, where appropriate, contain internal
auditors overall opinion and/or conclusions.
No Standard # NEW EXISTING
a specific process, risk, or business unit. The
formulation of such opinions requires consideration of
the engagement results and their significance
20 2450 Overall When an overall opinion is issued, it must take --
Opinion into account the expectations of senior
management, the board, and other stakeholders
and must be supported by sufficient, reliable,
relevant, and useful information.
Interpretation: The communication will identify:
The scope, including the time period to which
the opinion pertains;
Scope limitations;
Consideration of all related projects including
the reliance on other assurance providers;
The risk or control framework or other criteria
used as a basis for the overall opinion; and
The overall opinion, judgment, or conclusion
reached.

The reasons for an unfavorable overall opinion must be

stated
21 Glossary Add Value Add Value
Value is provided by improving opportunities to Value is provided by improving opportunities to
achieve organizational objectives, identifying achieve organizational objectives, identifying
operational improvement, and/or reducing risk operational improvement, and/or reducing risk
exposure through both assurance and consulting exposure through both assurance and consulting
services. services.
The internal audit activity adds value to the
organization (and its stakeholders) when it provides
objective and relevant assurance, and contributes to
the effectiveness and efficiency of governance, risk
management, and control processes.
22 Adequate Control Present if management has planned Adequate Control Present if management has planned
No Standard # NEW
and organized (designed) in a manner that provides
reasonable assurance that the organization's risks have
been managed effectively and that the organization's
goals and objectives will be achieved efficiently and
economically.
23 Chief Audit Executive
Chief audit executive is a senior position within the
organization responsible for internal audit activities.
Normally, this would be the internal audit director.
In the case where internal audit activities are
obtained from external service providers, the chief
audit executive is the person responsible for
overseeing the service contract and the overall
quality assurance of these activities, reporting to
senior management and the board regarding
internal audit activities, and follow-up of
engagement results. The term also includes titles
such as general auditor, head of internal audit,
chief internal auditor, and inspector general.
Chief audit executive describes a person in a senior
position responsible for effectively managing the
internal audit activity in accordance with the internal
audit charter and the Definition of Internal Auditing,
the Code of Ethics, and the Standards. The chief audit
executive or others reporting to the chief audit
executive will have appropriate professional
certifications and qualifications. The specific job title of
the chief audit executive may vary across
organizations
24 Control Environment
The attitude and actions of the board and management
regarding the significance importance of control within
the organization...
EXISTING
and organized (designed) in a manner that provides
reasonable assurance that the organization's risks have
been managed effectively and that the organization's
goals and objectives will be achieved efficiently and
economically.
Chief Audit Executive
Chief audit executive is a senior position within the
organization responsible for internal audit activities.
Normally, this would be the internal audit director.
In the case where internal audit activities are
obtained from external service providers, the chief
audit executive is the person responsible for
overseeing the service contract and the overall
quality assurance of these activities, reporting to
senior management and the board regarding
internal audit activities, and follow-up of
engagement results. The term also includes titles
such as general auditor, head of internal audit,
chief internal auditor, and inspector general.
Control Environment
The attitude and actions of the board and management
regarding the significance of control within the
organization...
No Standard # NEW
25 Information Technology Governance
Consists of the leadership, organizational structures,
and processes that ensure that the enterprises
information technology sustains and supports the
organizations strategies and objectives.
26 Independence
The freedom from conditions that threaten
objectivity or the appearance of objectivity. Such
threats to objectivity must be managed at the
individual auditor, engagement, functional, and
organizational levels.
The freedom from conditions that threaten the
ability of the internal audit activity to carry out
internal audit responsibilities in an unbiased
manner.
27 Objectivity
An unbiased mental attitude that allows internal
auditors to perform engagements in such a manner
that they have an honest beliefbelieve in their work
product and that no significant quality compromises
are made. Objectivity requires that internal auditors
do not to subordinate their judgment on audit
matters to others.
EXISTING
Information Technology Governance
Consists of the leadership, organizational structures,
and processes that ensure that the enterprises
information technology sustains and supports the
organizations strategies and objectives.
Independence
The freedom from conditions that threaten
objectivity or the appearance of objectivity. Such
threats to objectivity must be managed at the
individual auditor, engagement, functional, and
organizational levels.
Objectivity
An unbiased mental attitude that allows internal
auditors to perform engagements in such a manner
that they have an honest belief in their work product
and that no significant quality compromises are
made. Objectivity requires internal auditors not to
subordinate their judgment on audit matters to
others.