|
MINISTRY OF
FINANCE
-------
|
THE SOCIALIST
REPUBLIC OF VIETNAM
Independence - Freedom - Happiness
-------------
|
|
No. 8/2021/TT-BTC
|
Hanoi, January
25, 2021
|
CIRCULAR
PROMULGATION
OF VIETNAMESE STANDARDS AND THE CODE OF ETHICS FOR INTERNAL AUDITING
Pursuant to the Law on Accounting No.
88/2015/QH13 on November 20, 2015;
Pursuant to Decree No. 05/2019/ND-CP dated
January 22, 2019 of the Government on internal auditing;
Pursuant to Government's Decree No.
87/2017/ND-CP dated July 26, 2017 on functions, tasks, powers and
organizational structure of the Ministry of Finance;
At the request of Director of Department of
Accounting and Auditing Management and Supervision;
The Minister of Finance promulgates a Circular
on the Vietnamese Standards and the Code of Ethics for Internal Auditing.
Article 1. Scope
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Article 2. Regulated entities
1. The Vietnamese Standards and the Code of Ethics
for internal auditing apply to enterprises, regulatory agencies, public sector
entities prescribed in Articles 8, 9 and 10 of Decree No. 05/2019/ND-CP dated
January 22, 2019 of the Government on internal audit and relevant entities in
the internal audit activity of these organizations.
2. Organizations not specified in clause 1 hereof
are recommended to perform Vietnamese Standards for Internal Auditing and the
Code of Ethics for Internal Auditing in Appendix I and II hereto appended.
Article 3. Implementation
1. This
Circular comes into force as of April 1, 2021.
2. Director
of Department of Accounting and Auditing Management and Supervision, the Chief
of the Ministry Office and heads of relevant organizations shall provide
guidelines and implement this Circular.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
APPENDIX I
VIETNAMESE STANDARDS FOR INTERNAL AUDITING
(Issued together with Circular No. 8/2021/TT-BTC dated January 25, 2021 of
the Minister of Finance)
Introduction to the Standards
Internal auditing is conducted for organizations
that vary in purpose, size, complexity, and structure; and by persons within or
outside the organization. Conformance with Vietnamese Standards for Internal
Auditing (Standards) is essential in meeting the responsibilities of internal
auditors and the internal audit activity.
The purpose of the Standards is to
1. Provide a framework for performing and promoting
a broad range of value-added internal auditing services.
2. Establish the basis for the evaluation of
internal audit performance.
3. Foster improved organizational processes and
operations.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Statements of core requirements for the
professional practice of internal auditing and for evaluating the effectiveness
of performance that are internationally applicable at organizational and
individual levels.
- Interpretations clarifying terms or concepts
within the Standards.
The Standards comprise two main categories:
attribute standards and performance standards.
Attribute Standards: address the attributes of
organizations and individuals performing internal auditing.
Performance Standards: describe the nature of internal
auditing and provide quality criteria against which the performance of these
services can be measured. Attribute and Performance Standards apply to
all internal audit services.
Implementation Standards expand upon the Attribute
and Performance Standards by providing the requirements applicable to assurance
(.A) or consulting (.C) services.
Assurance services involve the internal
auditor’s objective assessment of evidence to provide opinions or conclusions
regarding an entity, operation, function, process, system, or other subject
matters. The nature and scope of an assurance engagement are determined
by the internal auditor.
Generally, three parties are participants in
assurance services:
(1) the person or group directly involved with the
entity, operation, function, process, system, or other subject matter - the
process owner,
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
(3) the person or group using the assessment - the
user.
Consulting services are advisory in nature and
are generally performed at the specific request of an engagement client.
The nature and scope of the consulting engagement are subject to
agreement with the engagement client. Consulting services generally
involve two parties:
(1) the person or group offering the advice - the
internal auditor,
(2) the person or group seeking and receiving the
advice - the engagement client.
When performing consulting services the internal
auditor should maintain objectivity and not assume management responsibility.
The Standards apply to individual internal auditors
and the internal audit activity. All internal auditors are accountable
for conforming with the standards related to individual objectivity,
proficiency, and due professional care and the standards relevant to the
performance of their job responsibilities. Chief audit executives are
additionally accountable for the internal audit activity’s overall conformance
with the Standards.
If internal auditors or the internal audit activity
is prohibited by law or regulation from conformance with certain parts of the
Standards as prohibited by law or regulations, conformance with all other parts
of the Standards and appropriate disclosures are needed.
If the Standards are used in conjunction with
requirements issued by other authoritative bodies, internal audit
communications may also cite the use of other requirements, as
appropriate. In such a case, if the internal audit activity indicates
conformance with the Standards and inconsistencies exist between the Standards
and other requirements, internal auditors and the internal audit activity must
conform to the Standards and may conform with the other requirements if such
requirements are more restrictive.
Definition
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Board: means the highest level of governing
body in an organization (e.g., a board of directors/council of
members/president of enterprise, Minister, Head of ministerial-level agency,
Head of Governmental agency, the President of People’s Committee of province or
central-affiliated city, Head of public sector entity) charged with the
responsibility to direct and/or oversee the organization’s activities and hold
senior management accountable. Furthermore, “board” in the Standards may
refer to a committee or another body to which the governing body has delegated
certain functions (e.g., an audit committee affiliated to the board of
directors).
Senior management: refers to boards of
general directors and chief executives of enterprises; leaders of Ministries,
ministerial-level agencies, Governmental agencies, the People’s Committees of
provinces/central-affiliated cities, public sector entities; heads of
affiliated entities of Ministries, ministerial-level agencies, Governmental
agencies, the People’s Committees of provinces/central-affiliated cities,
public sector entities.
Chief audit executive: describes the role of
a person, as prescribed by law or the organization, responsible for the
internal audit activity of an organization.
Internal auditor: a person who perform the
internal audit activity of an organization.
Relevant persons of internal auditor: natural
father, natural mother, adoptive father, adoptive mother, father-in-law,
mother-in-law, spouse, natural children, adoptive children, biological
brothers, biological sisters, brothers-in-law, sisters-in-law.
ATTRIBUTE
STANDARDS
1000 - Purpose, Authority, and Responsibility
The purpose, authority, and responsibility of the
internal audit activity must be formally defined in an internal audit charter,
consistent with the Mission of Internal Audit and the mandatory elements of the
Vietnamese Standards for Internal Auditing, the Code of Ethics. The chief audit
executive must periodically review the internal audit charter and present it to
senior management and the board for approval.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
The internal audit charter is a formal document
that defines the internal audit activity's purpose, authority, and
responsibility. The internal audit charter establishes the internal audit
activity's position within the organization, including the nature of the chief
audit executive’s functional reporting relationship with the board; authorizes
access to records, personnel, and physical properties relevant to the performance
of assurance and consulting engagements; and defines the scope of internal
audit activities. Final approval of the internal audit charter resides
with the board.
1000.A1 - The nature of assurance services
provided to the organization must be defined in the internal audit charter.
1000.C1 - The nature of consulting services
provided to the organization must be defined in the internal audit charter.
1010 - Recognizing Mandatory Guidance in the
Internal Audit Charter
The mandatory nature of the Vietnamese Standards
for Internal Auditing and the Code of Ethics must be recognized in the internal
audit charter. The chief audit executive should discuss the purpose,
scope, authority and responsibility of the internal audit activity and the
mandatory elements of the Vietnamese Standards for Internal Auditing, the Code
of Ethics.
1100 - Independence and Objectivity
The internal audit activity must be independent,
and internal auditors must be objective in performing their work.
Interpretation:
Independence is the freedom from conditions that
threaten the ability of the internal audit activity to carry out internal audit
responsibilities in an unbiased manner. To achieve the degree of
independence necessary to effectively carry out the responsibilities of the
internal audit activity, the chief audit executive has direct and unrestricted
access to senior management and the board. This can be achieved through a
dual-reporting relationship. Threats to independence must be managed at the
individual auditor, assurance and consulting engagements, functional, and
organizational levels.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
1110 - Organizational Independence
The chief audit executive must report to a level
within the organization that allows the internal audit activity to fulfill its
responsibilities. The chief audit executive must confirm to the board, at
least annually, the organizational independence of the internal audit activity.
Interpretation:
Organizational independence is effectively achieved
when the chief audit executive reports functionally to the board.
Examples of functional reporting to the board involve the board:
- Approving the internal audit charter;
- Approving the risk-based internal audit plan;
- Approving the internal audit budget and resource
plan;
- Receiving communications from the chief audit
executive on the internal audit activity’s performance relative to its plan and
other matters;
- Approving decisions regarding the appointment and
removal of the chief audit executive;
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Making appropriate inquiries of management and
the chief audit executive to determine whether there are inappropriate scope or
resource limitations.
1110.A1 - The internal audit activity must be
free from interference in determining the scope of internal auditing,
performing work, and communicating results. The chief audit executive
must disclose such interference to the board and discuss the implications.
1111 - Direct Interaction with the Board
The chief audit executive must communicate and
interact directly with the board.
1112 - Chief Audit Executive Roles Beyond
Internal Auditing
Where the chief audit executive has or is expected
to have roles and/or responsibilities that fall outside of internal auditing,
safeguards must be in place to limit impairments to independence or
objectivity.
Interpretation:
The chief audit executive may be asked to take on
additional roles and responsibilities outside of internal auditing, such as
responsibility for compliance or risk management activities. These roles
and responsibilities may impair, or appear to impair, the organizational
independence of the internal audit activity or the individual objectivity of
the internal auditor. Safeguards are those oversight activities, often
undertaken by the board, to address these potential impairments, and may
include such activities as periodically evaluating reporting lines and
responsibilities and developing alternative processes to obtain assurance
related to the areas of additional responsibility.
1120 - Individual Objectivity
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Interpretation:
Conflict of interest is a situation in which an
internal auditor has a competing professional or personal interest. Such
competing interests can make it difficult to fulfill his or her duties
impartially. A conflict of interest exists even if no unethical or improper act
results. A conflict of interest can create an appearance of impropriety that
can undermine confidence in the internal auditor, the internal audit activity,
and the profession. A conflict of interest could impair an individual's ability
to perform his or her duties and responsibilities objectively.
1130 - Impairment to Independence or Objectivity
If independence or objectivity is impaired in fact
or appearance, the details of the impairment must be disclosed to appropriate
parties. The nature of the disclosure will depend upon the impairment.
Interpretation:
Impairment to organizational independence and
individual objectivity may include, but is not limited to, personal conflict of
interest, scope limitations, restrictions on access to records, personnel, and
properties, and resource limitations, such as funding.
The determination of appropriate parties to which
the details of an impairment to independence or objectivity must be disclosed
is dependent upon the expectations of the internal audit activity’s and the
chief audit executive’s responsibilities to senior management and the board as
described in the internal audit charter, as well as the nature of the
impairment.
1130.A1 - Internal auditors must refrain
from assessing specific operations for which they were previously responsible.
Objectivity is presumed to be impaired if an internal auditor provides
assurance services for an activity for which the internal auditor had engaged
or had responsibility within 3 years before they are asked to stop doing that.
1130.A2 - Assurance engagements for functions
over which the chief audit executive has responsibility must be overseen by a
party outside the internal audit activity.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
1130.C1 - Internal auditors may provide
consulting services relating to operations for which they had previous
responsibilities.
1130.C2 - If internal auditors have
potential impairments to independence or objectivity relating to proposed
consulting services, disclosure must be made to the engagement client prior to
accepting the engagement.
1200 - Proficiency and Due Professional Care
Internal auditing must be performed with
proficiency and due professional care.
1210 - Proficiency
Internal auditors must possess the knowledge,
skills, and other competencies needed to perform their individual
responsibilities. The internal audit activity collectively must possess
or obtain the knowledge, skills, and other competencies needed to perform its
responsibilities.
Interpretation:
Proficiency is a collective term that refers to the
knowledge, skills, and other competencies required of internal auditors to
effectively carry out their professional responsibilities. It encompasses
consideration of current activities, trends, and emerging issues, to enable
relevant advice and recommendations. Internal auditors are encouraged to
demonstrate their proficiency by obtaining appropriate professional
certifications and qualifications regarding internal auditing.
1210.A1 - The chief audit executive must
obtain competent advice and assistance if the internal auditors lack the knowledge,
skills, or other competencies needed to perform all or part of the engagement.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
1210.A3 - Internal auditors must have
sufficient knowledge of key information technology risks and controls and
available technology-based audit techniques to perform their assigned work.
However, not all internal auditors are expected to have the expertise of
an internal auditor whose primary responsibility is information technology
auditing.
1210.C1 - The chief audit executive must
decline the consulting engagement or obtain competent advice and assistance if
the internal auditors lack the knowledge, skills, or other competencies needed
to perform all or part of the engagement.
1220 - Due Professional Care
Internal auditors must apply the care and skill expected
of a reasonably prudent and competent internal auditor. Due professional
care does not imply infallibility.
1220.A1 - Internal auditors must exercise
due professional care by considering the:
- Extent of work needed to achieve the engagement’s
objectives.
- Relative complexity, materiality, or significance
of matters to which assurance procedures are applied.
- Adequacy and effectiveness of governance, risk
management, and control processes.
- Probability of significant errors, fraud, or
noncompliance.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
1220.A2 - In exercising due professional
care internal auditors must consider the use of technology-based audit and
other data analysis techniques.
1220.A3 - Internal auditors must be alert to
the significant risks that might affect objectives, operations, or resources.
However, assurance procedures alone, even when performed with due
professional care, do not guarantee that all significant risks will be
identified.
1220.C1 - Internal auditors must exercise
due professional care during a consulting engagement by considering the:
- Needs and expectations of clients, including the
nature, timing, and communication of engagement results.
- Relative complexity and extent of work needed to
achieve the engagement’s objectives.
- Cost of the consulting engagement in relation to
potential benefits.
1230 - Continuing Professional Development
Internal auditors must enhance their knowledge,
skills, and other competencies through continuing professional development.
1300 - Quality Assurance and Improvement Program
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Interpretation:
A quality assurance and improvement program is
designed to enable an evaluation of the internal audit activity’s conformance
with the Standards and an evaluation of whether internal auditors apply the
Code of Ethics. The program also assesses the efficiency and
effectiveness of the internal audit activity and identifies opportunities for
improvement. The chief audit executive should encourage board oversight
in the quality assurance and improvement program.
1310 - Requirements of the Quality Assurance and
Improvement Program
The quality assurance and improvement program must
include both internal and external assessments.
1311 - Internal Assessments
Internal assessments must include:
- Ongoing monitoring of the performance of the
internal audit activity.
- Periodic self-assessments
Interpretation:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Periodic assessments are conducted to evaluate
conformance with the Standards and the Code of Ethics.
Sufficient knowledge of internal audit practices
requires at least an understanding of all elements of the Standards.
1312 - External
Assessments
External assessments must be conducted at least
once every five years by a qualified, independent assessor or assessment team
from outside the organization. The chief audit executive must discuss
with the board:
- The form and frequency of external assessment.
- The qualifications, skills and independence of
the external assessor or assessment team, including any potential conflict of
interest.
Interpretation:
External assessments may be accomplished through a
full external assessment, or a self-assessment with independent external
validation.
A qualified assessor or assessment team
demonstrates competence in two areas: the professional practice of
internal auditing and the external assessment process. Competence can be
demonstrated through a mixture of experience and theoretical learning.
Experience gained in organizations of similar size, complexity, sector or
industry, and technical issues is more valuable than less relevant experience.
In the case of an assessment team, not all members of the team need to
have all the competencies; it is the team as a whole that is qualified.
The chief audit executive uses professional judgment when assessing
whether an assessor or assessment team demonstrates sufficient competence to be
qualified.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
1320 - Reporting on the Quality Assurance and
Improvement Program
The chief audit executive must communicate the
results of the quality assurance and improvement program to senior management
and the board. Disclosure should include:
- The scope and frequency of both the internal and
external assessments.
- The qualifications and independence of the
assessor(s) or assessment team, including potential conflicts of interest.
- Conclusions of assessors.
- Corrective action plans.
Interpretation:
The form, content, and frequency of communicating
the results of the quality assurance and improvement program is established
through discussions with senior management and the board and considers the
responsibilities of the internal audit activity and chief audit executive as
contained in the internal audit charter. To demonstrate conformance with
the Standards and the Code of Ethics, the results of external and periodic
internal assessments are communicated upon completion of such assessments, and
the results of ongoing monitoring are communicated at least annually. The
results include the assessor’s or assessment team’s evaluation with respect to
the degree of conformance.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2000 - Managing the Internal Audit Activity
The chief audit executive must effectively manage
the internal audit activity to ensure it adds value to the organization.
Interpretation:
The internal audit activity is effectively managed
when:
- It achieves the purpose and responsibility
included in the internal audit charter.
- It conforms to the Standards.
- The internal auditors conform to the Code of
Ethics and the Standards.
- It considers trends and emerging issues that
could impact the organization.
The internal audit activity adds value to the
organization and its stakeholders when it considers strategies, objectives, and
risks; strives to offer ways to enhance governance, risk management, and
control processes; and objectively provides relevant assurance.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
The chief audit executive must establish a
risk-based plan to determine the priorities of the internal audit activity,
consistent with the organization’s goals.
Interpretation:
To develop the risk-based plan, the chief audit
executive consults with senior management and the board and obtains an
understanding of the organization’s strategies, key business objectives,
associated risks, and risk management processes. The chief audit
executive must review and adjust the plan, as necessary, in response to changes
in the organization’s business, risks, operations, programs, systems, and
controls.
2010.A1 - The internal audit activity’s plan
of engagements must be based on a documented risk assessment, undertaken at
least annually. The input of senior management and the board must be
considered in this process.
2010.A2 - The chief audit executive must
identify and consider the expectations of senior management, the board, and
other stakeholders for internal audit opinions and other conclusions.
2010.C1 - The chief audit executive should
consider accepting proposed consulting engagements based on the engagement’s
potential to improve management of risks, add value, and improve the
organization’s operations. Accepted engagements must be included in the
plan.
2020 - Communication and Approval
The chief audit executive must communicate the
internal audit activity’s plans and resource requirements, including
significant interim changes, to senior management and the board for review and
approval. The chief audit executive must also communicate the impact of
resource limitations.
2030 - Resource Management
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Interpretation:
Appropriate refers to the mix of knowledge, skills,
and other competencies needed to perform the plan. Sufficient refers to
the quantity of resources needed to accomplish the plan. Resources are
effectively deployed when they are used in a way that optimizes the achievement
of the approved plan.
2040 - Policies and Procedures
The chief audit executive must establish policies
and procedures to guide the internal audit activity.
Interpretation:
The form and content of policies and procedures are
dependent upon the size and structure of the internal audit activity and the
complexity of its work.
2050 - Coordination and Reliance
The chief audit executive should share information,
coordinate activities, and consider relying upon the work of other internal and
external assurance and consulting service providers to ensure proper coverage
and minimize duplication of efforts.
Interpretation:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2060 - Reporting to Senior Management and the
Board
The chief audit executive must report periodically
to senior management and the board on the internal audit activity’s purpose,
authority, responsibility, and performance relative to its plan and on its
conformance with the Standards and the Code of Ethics. Reporting must
also include significant risk and control issues, including fraud risks, governance
issues, and other matters that require the attention of senior management
and/or the board.
Interpretation:
The frequency and content of reporting are
determined collaboratively by the chief audit executive, senior management, and
the board. The frequency and content of reporting depends on the
importance of the information to be communicated and the urgency of the related
actions to be taken by senior management and/or the board.
The chief audit executive’s reporting and
communication to senior management and the board must include information
about:
- The audit charter.
- Independence of the internal audit activity.
- The audit plan and progress against the plan.
- Resource requirements.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Conformance with the Standards and the Code of
Ethics, and action plans to address any significant conformance issues.
- Management’s response to risk that, in the chief
audit executive’s judgment, may be unacceptable to the organization.
These and other chief audit executive communication
requirements are referenced throughout the Standards.
2070 - External Service Provider and
Organizational Responsibility for Internal Auditing
When an external service provider serves as the
internal audit activity, the provider must make the organization aware that the
organization has the responsibility for maintaining an effective internal audit
activity.
Interpretation:
This responsibility is demonstrated through the
quality assurance and improvement program which assesses conformance with the Standards
and the Code of Ethics.
2100 - Nature of Work
The internal audit activity must evaluate and
contribute to the improvement of the organization’s governance, risk
management, and control processes using a systematic, disciplined, and
risk-based approach. Internal audit credibility and value are enhanced when
auditors are proactive and their evaluations offer new insights and consider
future impact.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
The internal audit activity must assess and make
appropriate recommendations to improve the organization’s governance processes
for:
- Making strategic and operational decisions.
- Overseeing risk management and control.
- Promoting appropriate ethics and values within
the organization.
- Ensuring effective organizational performance
management and accountability.
- Communicating risk and control information to
appropriate areas of the organization.
- Coordinating the activities of, and communicating
information among, the board, external and internal auditors, other assurance
providers, and management.
2110.A1 - The internal audit activity must
evaluate the design, implementation, and effectiveness of the organization’s
ethics-related objectives, programs, and activities.
2110.A2 - The internal audit activity must
assess whether the information technology governance of the organization
supports the organization’s strategies and objectives.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
The internal audit activity must evaluate the
effectiveness and contribute to the improvement of risk management processes.
Interpretation:
Determining whether risk management processes are
effective is a judgment resulting from the internal auditor’s assessment that:
- Organizational objectives support and align with
the organization’s mission.
- Significant risks are identified and assessed.
- Appropriate risk responses are selected that
align risks with the organization’s risk appetite.
- Relevant risk information is captured and
communicated in a timely manner across the organization, enabling staff,
management, and the board to carry out their responsibilities.
The internal audit activity may gather the
information to support this assessment during multiple engagements. The
results of these engagements, when viewed together, provide an understanding of
the organization’s risk management processes and their effectiveness.
Risk management processes are monitored through
ongoing management activities, separate evaluations, or both.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Achievement of the organization’s strategic
objectives.
- Reliability and integrity of financial and
operational information.
- Effectiveness and efficiency of operations and
programs.
- Safeguarding of assets.
- Compliance with laws, regulations, policies,
procedures, and contracts.
2120.A2 - The internal audit activity must
evaluate the potential for the occurrence of fraud and how the organization
manages fraud risk.
2120.C1 - During consulting engagements,
internal auditors must address risk consistent with the engagement’s objectives
and be alert to the existence of other significant risks.
2120.C2 - Internal auditors must incorporate
knowledge of risks gained from consulting engagements into their evaluation of
the organization’s risk management processes.
2120.C3 - When assisting management in
establishing or improving risk management processes, internal auditors must
refrain from assuming any management responsibility by actually managing risks.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
The internal audit activity must assist the
organization in maintaining effective controls by evaluating their
effectiveness and efficiency and by promoting continuous improvement.
2130.A1 - The internal audit activity must
evaluate the adequacy and effectiveness of controls in responding to risks
within the organization’s governance, operations, and information systems
regarding the:
- Achievement of the organization’s strategic
objectives.
- Reliability and integrity of financial and
operational information.
- Effectiveness and efficiency of operations and
programs.
- Safeguarding of assets.
- Compliance with laws, regulations, policies,
procedures, and contracts.
2130.C1 - Internal auditors must incorporate
knowledge of controls gained from consulting engagements into evaluation of the
organization’s control processes.
2200 - Assurance or Consulting engagement
Planning
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2201 - Planning Considerations
In planning the engagement, internal auditors must
consider:
- The strategies and objectives of the activity
being reviewed and the means by which the activity controls its performance.
- The significant risks to the activity’s
objectives, resources, and operations and the means by which the potential
impact of risk is kept to an acceptable level.
- The adequacy and effectiveness of the activity’s
governance, risk management, and control processes compared to a relevant
framework or model.
- The opportunities for making significant
improvements to the activity’s governance, risk management, and control
processes.
2201.C1 - Internal auditors must establish
an understanding with consulting engagement clients about objectives, scope,
respective responsibilities, and other client expectations. For
significant engagements, this understanding must be documented.
2210 - Assurance or Consulting engagement
Objectives
Objectives must be established for each engagement.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2210.A2 - Internal auditors must consider
the probability of significant errors, fraud, noncompliance, and other
exposures when developing the engagement objectives.
2210.A3 - Adequate criteria are needed to
evaluate governance, risk management, and controls. Internal auditors must
ascertain the extent to which management and/or the board has established
adequate criteria to determine whether objectives and goals have been
accomplished. If adequate, internal auditors must use such criteria in
their evaluation. If inadequate, internal auditors must identify appropriate
evaluation criteria through discussion with management and/or the board.
Interpretation:
Types of criteria may include:
- Internal (e.g., policies and procedures of the
organization).
- External (e.g., laws and regulations imposed by
statutory bodies).
- Leading practices (e.g., industry and
professional guidance).
2210.C1 - Consulting engagement objectives
must address governance, risk management, and control processes to the extent
agreed upon with the client.
2210.C2 - Consulting engagement objectives
must be consistent with the organization's values, strategies, and objectives.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
The established scope must be sufficient to achieve
the objectives of the engagement.
2220.A1 - The scope of the engagement must
include consideration of relevant systems, records, personnel, and physical
properties, including those under the control of third parties.
2220.A2 - If significant consulting
opportunities arise during an assurance engagement, a specific written
understanding as to the objectives, scope, respective responsibilities, and
other expectations should be reached and the results of the consulting
engagement communicated in accordance with consulting standards.
2220.C1 - In performing consulting
engagements, internal auditors must ensure that the scope of the engagement is
sufficient to address the agreed-upon objectives. If internal auditors
develop reservations about the scope during the engagement, these reservations
must be discussed with the client to determine whether to continue with the
engagement.
2220.C2 - During consulting engagements,
internal auditors must address controls consistent with the engagement’s
objectives and be alert to significant control issues.
2230 - Engagement Resource Allocation
Internal auditors must determine appropriate and
sufficient resources to achieve engagement objectives based on an evaluation of
the nature and complexity of each engagement, time constraints, and available
resources.
Interpretation:
Appropriate refers to the mix of knowledge, skills,
and other competencies needed to perform the engagement. Sufficient refers
to the quantity of resources needed to accomplish the engagement with due
professional care.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Internal auditors must develop and document work
programs that achieve the engagement objectives.
2240.A1 - Work programs must include the
procedures for identifying, analyzing, evaluating, and documenting information
during the engagement. The work program must be approved prior to its
implementation, and any adjustments approved promptly.
2240.C1 - Work programs for consulting engagements
may vary in form and content depending upon the nature of the engagement.
2300 - Performing the Engagement
Internal auditors must identify, analyze, evaluate,
and document sufficient information to achieve the engagement’s objectives.
2310 - Identifying Information
Internal auditors must identify sufficient,
reliable, relevant, and useful information to achieve the assurance or
consulting engagement’s objectives.
Interpretation:
Sufficient information is factual, adequate, and
convincing so that a prudent, informed person would reach the same conclusions
as the auditor. Reliable information is the best attainable information
through the use of appropriate assurance or consulting engagement techniques.
Relevant information supports engagement observations and recommendations
and is consistent with the objectives for the assurance or consulting
engagement. Useful information helps the organization meet its goals.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
Internal auditors must base conclusions and
assurance or consulting engagement results on appropriate analyses and
evaluations.
2330 - Documenting Information
Internal auditors must document sufficient,
reliable, relevant, and useful information to support the engagement results
and conclusions.
2330.A1 - The chief audit executive must
control access to engagement records. The chief audit executive must obtain the
approval of senior management and/or legal counsel prior to releasing such
records to external parties, as appropriate.
2330.A2 - The chief audit executive must
develop retention requirements for engagement records, regardless of the medium
in which each record is stored. These retention requirements must be consistent
with the organization’s guidelines and any pertinent regulatory or other requirements.
2330.C1 - The chief audit executive must
develop policies governing the custody and retention of consulting engagement
records, as well as their release to internal and external parties. These
policies must be consistent with the organization’s guidelines and any
pertinent regulatory or other requirements.
2340 - Engagement Supervision
Engagements must be properly supervised to ensure
objectives are achieved, quality is assured, and staff is developed.
Interpretation:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2400 - Communicating Results
Internal auditors must communicate the results of
assurance or consulting engagements.
2410 - Criteria for Communicating
Communications must include the engagement’s
objectives, scope, and results.
2410.A1 - Final communication of engagement
results must include applicable conclusions, as well as applicable
recommendations and action plans. Where appropriate, the internal
auditors’ opinion should be provided. An opinion must take into account
the expectations of senior management, the board, and other stakeholders and
must be supported by sufficient, reliable, relevant, and useful information.
Interpretation:
Opinions at the engagement level may be ratings,
conclusions, or other descriptions of the results. Such an engagement may be in
relation to controls around a specific process, risk, or business unit.
The formulation of such opinions requires consideration of the engagement
results and their significance.
2410.A2 - Internal auditors are encouraged
to acknowledge satisfactory performance in engagement communications.
2410.A3 - When releasing engagement results
to parties outside the organization, the communication must include limitations
on distribution and use of the results.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2420 - Quality of Communications
Communications must be accurate, objective, clear,
concise, constructive, complete, and timely.
Interpretation:
Accurate communications are free from errors and
distortions and are faithful to the underlying facts. Objective
communications are fair, impartial, and unbiased and are the result of a
fair-minded and balanced assessment of all relevant facts and circumstances. Clear
communications are easily understood and logical, avoiding unnecessary
technical language and providing all significant and relevant information.
Concise communications are to the point and avoid unnecessary
elaboration, superfluous detail, redundancy, and wordiness. Constructive
communications are helpful to the engagement client and the organization and
lead to improvements where needed. Complete communications lack nothing
that is essential to the target audience and include all significant and
relevant information and observations to support recommendations and
conclusions. Timely communications are opportune and expedient, depending on
the significance of the issue, allowing management to take appropriate
corrective action.
2421 - Errors and Omissions
If a final communication contains a significant
error or omission, the chief audit executive must communicate corrected
information to all parties who received the original communication.
2430 - Use of “Conducted in Conformance with the
Vietnamese Standards for Internal Auditing”
Indicating that assurance and consulting
engagements are conducted in conformance with the Vietnamese Standards for
Internal Auditing.
2431 - Engagement Disclosure of Nonconformance
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Principle(s) or rule(s) of conduct of the
Standard(s) or the Code of Ethics with which full conformance was not achieved.
- Reason(s) for nonconformance.
- Impact of nonconformance on the engagement and
the communicated engagement results.
2440 - Disseminating Results
The chief audit executive must communicate results
to the appropriate parties.
Interpretation:
The chief audit executive is responsible for
reviewing and approving the final engagement communication before issuance and
for deciding to whom and how it will be disseminated. When the chief
audit executive delegates these duties, he or she retains overall
responsibility.
2440.A1 - The chief audit executive is
responsible for communicating the final results to parties who can ensure that
the results are given due consideration.
2440.A2 - If not otherwise mandated by
legal, statutory, or regulatory requirements, prior to releasing results to
parties outside the organization the chief audit executive must:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Consult with senior management and/or legal
counsel as appropriate.
- Control dissemination by restricting the use of
the results.
2440.C1 - The chief audit executive is
responsible for communicating the final results of consulting engagements to
clients.
2440.C2 - During consulting engagements,
governance, risk management, and control issues may be identified. Whenever
these issues are significant to the organization, they must be communicated to
senior management and the board.
2450 - Overall Opinions
When an overall opinion is issued, it must take
into account the strategies, objectives, and risks of the organization; and the
expectations of senior management, the board, and other stakeholders. The
overall opinion must be supported by sufficient, reliable, relevant, and useful
information.
Interpretation:
The communication will include:
- The scope, including the time period to which the
opinion pertains.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
- Consideration of all related projects, including
the reliance on other assurance providers.
- A summary of the information that supports the
opinion.
- The risk or control framework or other criteria
used as a basis for the overall opinion.
- The overall opinion, judgment, or conclusion
reached.
The reasons for an unfavorable overall opinion must
be stated.
2500 - Monitoring Progress
The chief audit executive must establish and maintain
a system to monitor the disposition of results communicated to management.
2500.A1 - The chief audit executive must
establish a follow-up process to monitor and ensure that management actions
have been effectively implemented or that senior management has accepted the
risk of not taking action.
2500.C1 - The internal audit activity must
monitor the disposition of results of consulting engagements to the extent
agreed upon with the client.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
When the chief audit executive concludes that
management has accepted a level of risk that may be unacceptable to the
organization, the chief audit executive must discuss the matter with senior
management. If the chief audit executive determines that the matter has not
been resolved, the chief audit executive must communicate the matter to the
board.
Interpretation:
The identification of risk accepted by management
may be observed through an assurance or consulting engagement, monitoring
progress on actions taken by management as a result of prior engagements, or
other means. It is not the responsibility of the chief audit executive to
resolve the risk.
APPENDIX II
THE CODE OF ETHICS FOR INTERNAL AUDITING
(Issued together with Circular No. 8/2021/TT-BTC dated January 25, 2021 of
the Minister of Finance)
1. Internal
auditors are expected to apply and uphold the following principles:
a) Integrity
The integrity of internal auditors establishes
trust and thus provides the basis for reliance on their judgment.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
b) Objectivity
Internal auditors shall ensure objectivity,
accuracy, honesty and fairness in the process of performing the tasks of the
internal audit. Internal auditors exhibit the highest level of
professional objectivity in gathering, evaluating, and communicating
information about the activity or process being examined. Internal
auditors make a balanced assessment of all the relevant circumstances and are
not unduly influenced by their own interests or by others in forming judgments.
c) Confidentiality
Internal auditors respect the value and ownership
of information they receive and do not disclose information without appropriate
authority unless there is a legal or professional obligation to do so.
d) Professional competence and due care
Internal auditors apply the knowledge, skills, and
experience needed in the performance of internal audit services. And act
diligently in accordance with applicable technical and professional standards.
dd) Professional behavior
Internal auditors must comply with the relevant
laws and regulations, avoid any action that may discredit the profession.
2. Chief
audit executives, in addition to ensuring the code of ethics specified in
Clause 1, Appendix II - Part of code of ethics for internal auditing, must also
have measures to monitor, evaluate, management aims to ensure that the internal
auditors comply with the code of ethics of internal auditing.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
RULES OF CONDUCT
1. Integrity
Internal auditors:
1.1. Shall perform their work with honesty,
diligence, and responsibility.
1.2. Shall observe the law and make disclosures
expected by the law and the profession.
1.3. Shall not knowingly be a party to any illegal
activity, or engage in acts that are discreditable to the profession of
internal auditing or to the organization.
1.4. Shall respect and contribute to the legitimate
and ethical objectives of the organization.
2. Objectivity
Internal auditors:
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
2.2. Shall not accept anything that may impair or
be presumed to impair their professional judgment.
2.3. Shall disclose all material facts known to
them that, if not disclosed, may distort the reporting of activities under
review.
3. Confidentiality
Internal auditors:
3.1. Shall be
prudent in the use and protection of information acquired in the course of
their duties.
3.2. Shall not use
information for any personal gain or in any manner that would be contrary to
the law or detrimental to the legitimate and ethical objectives of the
organization.
4. Proficiency
and due professional care
Internal auditors:
4.1. Shall engage only in those services for which
they have the necessary knowledge, skills, and experience.
...
...
...
Bạn phải
đăng nhập hoặc
đăng ký Thành Viên
TVPL Pro để sử dụng được đầy đủ các tiện ích gia tăng liên quan đến nội dung TCVN.
Mọi chi tiết xin liên hệ:
ĐT: (028) 3930 3279 DĐ: 0906 22 99 66
4.3. Shall continually improve their proficiency
and the effectiveness and quality of their services.
4.4. Shall act diligently in accordance with
applicable technical and professional standards.
5. Professional behavior
Internal auditors:
5.1. Shall comply with relevant laws and
regulations.
5.2. Shall avoid any action that the internal
auditor knows may discredit the profession.