20 Internal audit function

Where established, the IAF should be independent and have sufficient authority, stature and resources. In particular, investment firms should ensure that the qualification of the IAF ’s staff members and the IAF’s resources, in particular its auditing tools and risk analysis methods, are adequate for the investment firm ’s size and locations, and the nature, scale and complexity of the risks associated with the investment firm ’s business model, activities, risk culture and risk appetite.

The IAF should be independent of the audited activities. Therefore, the IAF should not be combined with other functions.

The IAF should, following a risk-based approach, independently review and provide objective assurance of the compliance of all activities and units of an investment firm, including outsourced activities, with the investment firm ’ s policies and procedures and with external regulatory requirements. Each entity within the group should fall within the scope of the IAF.

The IAF should not be involved in designing, selecting, establishing or implementing specific internal control policies, mechanisms, procedures or risk limits. However, this should not prevent the management body in its management function from requesting input from internal audit on matters relating to risk, internal controls and compliance with applicable rules.

The IAF should assess whether the investment firm ’s internal control framework as set out in Section 15 is both effective and efficient. In particular, the IAF should assess:

• a. the appropriateness of the investment firm ’ s governance framework;
• b. whether existing policies and procedures remain adequate and comply with legal and regulatory requirements and with the risk strategy and risk appetite of the investment firm;
• c. the compliance of the procedures with the applicable laws and regulations and with decisions of the management body;
• d. whether the procedures are correctly and effectively implemented (e.g. compliance of transactions, the level of risk effectively incurred, etc.); and
• e. the adequacy, quality and effectiveness of the controls carried out and the reporting conducted by the business units (first line of defence) and the risk management and compliance functions.

The IAF should verify, in particular, the integrity of the processes ensuring the reliability of the investment firm ’s methods and techniques, and the assumptions and sources of information used in its internal models (e.g. risk modelling and accounting measurements). It should also evaluate the quality and use of qualitative risk identification and assessment tools and the risk mitigation measures taken.

The IAF should have unfettered investment firm-wide access to all the records, documents, information and buildings of the investment firms. This should include access to management information systems and minutes of all committees and decision-making bodies.

The IAF should adhere to national and international professional standards. An example of the professional standards referred to here is the standards established by the Institute of Internal Auditors.

Internal audit work should be performed in accordance with an audit plan and a detailed audit programme following a risk-based approach.

An internal audit plan should be drawn up at least once a year on the basis of the annual internal audit control objectives. The internal audit plan should be approved by the management body.

All audit recommendations should be subject to a formal follow-up procedure by the appropriate levels of management to ensure and report on their effective and timely resolution.