Yesterday the Institute of Internal Auditors released the new vision of the three lines, and the title caught my attention, as it does not mention the word “defense”, which can be either a mistake or deliberate, demonstrating that the members of each line are not there to defend, but to manage, add value, including the third line,  which makes much more sense to me.

The original model emerged with the publication on September 21, 2010 by FERMA and ECIIA in the Guidance on the 8th EU Company law as a recommendation for implementing the law's requirements for monitoring the effectiveness of the internal control system, internal audit and risk management.

This update model solved an anomaly of the previous model, which demonstrated a duality in the internal audit reporting line, an arrow for senior management, and another for the level of supervision and governance, creating some “noise” about the independence of the internal audit activity, with no much sense

In this new format, it is very clear that the reporting line should only be for the level of supervision and governance (Board and Committee), and the relationship with senior management (President, their directs) is a process of alignment, communication, coordination and collaboration. This point reinforces the importance of independence for the existence of an effective and integrated internal audit to the businesses.

This subject regarding independence is also addressed by principle 5, which objectively describes the independence of the audit in relation to management responsibility, as you may see below:

Another relevant subject, in my vision, that this model brings to our understanding to the role of the audit as a consultancy. It was a great confusion created when the definition of the audit was disclosed which includes in its statement that the audit adds value to the organization through assurance and consulting, which unfortunately, here in Brazil, allowed misunderstandings and great debates on this topic.

This new version accommodates this theme when it describes the roles of each of the lines, as we may see below, the role of the audit:

                             Internal Audit

•          Maintains primary accountability to the governing body and independence from the responsibilities of management.
•          Communicates independent and objectives assurance and advice to management and the governing body on the adequacy and effectiveness of governance and risk management (including internal control) to support the achievement of organizational objectives and to promote and facilitate continuous improvement.
•          Reports impairments to Independence and objectivity to the governing body and implements safeguards as required.

 

Observe that it describes “independent and objective assurance and advice”, remembering that objectivity is the auditor's independence in positioning and giving an opinion, based on his competence and proficiency.

I have had that the audit fulfills its role as a consultant, not implementing or executing management activities, but rather, making intelligent notes to management on opportunities for operational improvements to strengthen the efficiency, effectiveness and economy of the risk management process, controls internal and governance.

This model also stresses that independence does not mean isolation, as there must be an interaction between the three lines. The auditors have to be aligned with the organization's strategic and operational needs in order to became a “trusted advisor and strategic partner”.

However, for this to be true, the auditors must go back to basics.

When I say go back to basics, it is that the internal auditors must objectively understand their mission and the definition of what auditing is, essential points that are described in the International Structure of Professional Practices of the IIA. In addition, must be proficient in application of the standards of attributes and performance when carrying out the evaluation and / or consultancy work.

Finally, I believe that some discussions will arise about the model and its application, and this is my contribution to the understanding of this new version of the three-line model.

 

Be happy!