Lifecycle review method

Under the Global Internal Audit Standards, the board and senior management establish the internal audit mandate on information the chief audit executive provides, and where law or regulation prescribes the mandate, the internal audit charter includes those legal requirements.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 6.1, p. 39Applies to Internal audit functions that conform to the Global Internal Audit Standards

The Standards require the chief audit executive to confirm the internal audit function’s organisational independence to the board at least once a year.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 7.1, p. 46Applies to Internal audit functions that conform to the Global Internal Audit Standards

Under GAGAS, auditors and audit organisations must be independent from an audited entity in all matters relating to the engagement.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 3.18Applies to United States, audits performed under GAGAS

Under ISSAI 3000 the performance auditor takes care to remain independent so that findings and conclusions are impartial.

Required INTOSAI, ISSAI 3000, Performance Audit Standard, Requirement 23Applies to Supreme audit institutions that apply the ISSAIs

A UK gate review is, in its issuer’s words, a forward-looking strategic review and not an audit.

Required Cabinet Office and NISTA, Review Team Briefing Note, version 1.1, section 3Applies to United Kingdom, central government

Under GAGAS, scope is the boundary of the audit and is directly tied to the audit objectives.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.10Applies to United States, audits performed under GAGAS

GAGAS treats planning as continuous, with objectives, scope and methodology refined as work is performed unless statute fixes them.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraphs 8.05 and 8.09Applies to United States, audits performed under GAGAS

Under the Global Internal Audit Standards, internal auditors establish and document the objectives and scope of each engagement, and the scope must be sufficient to achieve the objectives.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 13.3, p. 98Applies to Internal audit functions that conform to the Global Internal Audit Standards

GAGAS requires the objectives, scope, methodology and timing to be communicated unless that would impair the evidence.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.20Applies to United States, audits performed under GAGAS

GAGAS requires auditors to evaluate whether the audited entity has taken appropriate corrective action to address significant findings and recommendations from previous engagements.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.30Applies to United States, audits performed under GAGAS

GAGAS requires auditors to assess significance and audit risk and to use them to set scope and methodology.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.05Applies to United States, audits performed under GAGAS

GAGAS requires auditors to identify and use suitable criteria based on the audit objectives.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.07Applies to United States, audits performed under GAGAS

GAGAS describes suitable criteria as relevant, reliable, objective and understandable.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.17Applies to United States, audits performed under GAGAS

Under ISSAI 4000, where the audit institution has discretion over coverage, the compliance auditor identifies relevant criteria before the audit.

Required INTOSAI, ISSAI 4000, Compliance Audit Standard, Requirement 110Applies to Supreme audit institutions that apply the ISSAIs

The Global Internal Audit Standards require internal auditors to identify the most relevant criteria, to use the criteria the board and senior management have set where these are adequate, and otherwise to identify suitable criteria in discussion with them; for advisory services, criteria may not be needed.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 13.4, p. 100Applies to Internal audit functions that conform to the Global Internal Audit Standards

Under ISSAI 3000 the auditor discusses the audit criteria with the audited entity.

Required INTOSAI, ISSAI 3000, Performance Audit Standard, Requirement 49Applies to Supreme audit institutions that apply the ISSAIs

GAGAS requires sufficient, appropriate evidence to provide a reasonable basis for the findings and conclusions.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.90Applies to United States, audits performed under GAGAS

Under GAGAS, evidence is sufficient when it would persuade a knowledgeable person that the findings are reasonable, and how much is needed is a matter of professional judgement that rises with audit risk.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraphs 8.92 and 8.101Applies to United States, audits performed under GAGAS

GAGAS ties the choice of sampling method to the audit objectives, and requires the report to explain the relationship between the population and the items tested.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.107; paragraph 9.13Applies to United States, audits performed under GAGAS

The Global Internal Audit Standards require the information gathered for analysis to be relevant, reliable and sufficient, and treat it as sufficient when a prudent, informed and competent person could repeat the work and reach the same conclusions.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 14.1, pp. 104–105Applies to Internal audit functions that conform to the Global Internal Audit Standards

ISSAI 4000 requires audit sampling, where appropriate, to draw conclusions about the population.

Required INTOSAI, ISSAI 4000, Compliance Audit Standard, Requirement 172Applies to Supreme audit institutions that apply the ISSAIs

GAGAS requires documentation detailed enough for an experienced auditor with no previous connection to the audit to understand the work, the evidence and the conclusions.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.132Applies to United States, audits performed under GAGAS

GAGAS requires auditors who do not comply with an applicable GAGAS requirement, because of scope limitations, restricted access to records or similar issues, to document the departure and its effect.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.136Applies to United States, audits performed under GAGAS

For GAGAS performance audits, auditors develop the criteria, condition, cause and effect of a finding only to the extent these are relevant and necessary to the audit objectives.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.116Applies to United States, audits performed under GAGAS

GAGAS gives the example of an objective answered by the condition alone, where developing the other elements of a finding is not necessary.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.128Applies to United States, audits performed under GAGAS

Under the Global Internal Audit Standards, a potential finding is a difference between the criteria and the condition, determined from the evidence gathered, and each one is evaluated for its significance, with management, identifying root causes where possible.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standards 14.2 and 14.3, pp. 106–107Applies to Internal audit functions that conform to the Global Internal Audit Standards

GAGAS requires limitations or uncertainties in evidence significant to the findings to be described in the report.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraphs 8.114 and 9.20Applies to United States, audits performed under GAGAS

GAGAS requires auditors to obtain and report the views of responsible officials on findings, conclusions and recommendations, and on planned corrective actions.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 9.50Applies to United States, audits performed under GAGAS

ISSAI 3000 requires the audited entity to be given the opportunity to comment before the report is issued, and the examination of its comments to be recorded with reasons.

Required INTOSAI, ISSAI 3000, Performance Audit Standard, Requirements 129 and 130Applies to Supreme audit institutions that apply the ISSAIs

Where the entity does not comment, GAGAS requires the report to say so.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 9.53Applies to United States, audits performed under GAGAS

Under GAGAS, where the entity’s comments conflict with the findings, auditors evaluate them and, if they disagree, explain their reasons in the report.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 9.52Applies to United States, audits performed under GAGAS

A GAGAS audit report contains the objectives, scope and methodology; the findings, conclusions and recommendations; and a summary of the views of responsible officials.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 9.10Applies to United States, audits performed under GAGAS

GAGAS requires the report to describe the scope of the work and any limitations, so that users are not misled.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 9.12Applies to United States, audits performed under GAGAS

The Global Internal Audit Standards require an engagement conclusion that summarises the results against the engagement objectives; for an assurance engagement it includes a judgement on the effectiveness of the governance, risk management or control processes reviewed, acknowledging where they are effective.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 14.5, p. 110Applies to Internal audit functions that conform to the Global Internal Audit Standards

The Standards require a final communication for each engagement giving its objectives, scope, conclusions and any recommendations or action plans; for assurance engagements it also gives the findings with their significance and priority and any scope limitations, and it names those responsible for addressing the findings and the planned completion dates.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 15.1, p. 113Applies to Internal audit functions that conform to the Global Internal Audit Standards

In a UK gate review the RAG status the review team gives is non-negotiable.

Required Cabinet Office and NISTA, Review Team Briefing Note, version 1.1, section 7Applies to United Kingdom, central government

Under GAGAS, recommendations are effective when addressed to parties with the authority to act and when the actions are specific, feasible, cost-effective and measurable.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 9.28Applies to United States, audits performed under GAGAS

The Global Internal Audit Standards require internal auditors to decide whether to develop recommendations, request action plans from management or agree actions with management, to discuss recommendations with management, and to resolve disagreement over them by an established method.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 14.4, p. 109Applies to Internal audit functions that conform to the Global Internal Audit Standards

In a UK gate review the Senior Responsible Owner is responsible for ensuring action is taken on the agreed recommendations.

Required Cabinet Office and NISTA, Review Team Briefing Note, version 1.1, section 8Applies to United Kingdom, central government

ISSAI 3000 requires the auditor to follow up previous findings and recommendations as appropriate, and describes follow-up as the auditor’s examination of the corrective actions taken.

Required INTOSAI, ISSAI 3000, Performance Audit Standard, Requirement 136; Explanation 137Applies to Supreme audit institutions that apply the ISSAIs

The Global Internal Audit Standards require internal auditors to confirm, by an established method, that management has implemented the recommendations or its action plans, including enquiry into progress, risk-based follow-up and updating the status of actions in a tracking system.

Required Global Internal Audit Standards, Institute of Internal Auditors, Standard 15.2, p. 114Applies to Internal audit functions that conform to the Global Internal Audit Standards

GAGAS requires auditors to evaluate whether the audited entity has taken appropriate corrective action to address significant findings and recommendations from previous engagements.

Required Government Auditing Standards, 2024 revision, GAO-24-106786, Comptroller General of the United States, paragraph 8.30Applies to United States, audits performed under GAGAS