Internal audit strategy
1. The internal audit strategy shall outline the vision and strategic objectives for exercising the internal audit function.
2. The Internal Auditor shall develop and implement initiatives supporting the internal audit strategy that cover all IAS audit activities, and continuously monitor their effectiveness.
3. The supporting initiatives shall include:
(a)
a quality assurance and improvement programme;
(b)
a human resources strategy;
(c)
a digital auditing and transformation strategy.
4. The Internal Auditor shall develop a mutual expectations paper as a guidance document that describes the relationship between auditor and auditee to clarify responsibilities and align mutual expectations so that audits are efficient and effective.
Work programme
1. The Internal Auditor shall adopt annually the work programme, containing the audit plan and resource management plan.
2. The Internal Auditor shall:
(a)
carry out a risk assessment at least on an annual basis, that will consider any risks identified by management and, where relevant, the independent assessment by the Chief Risk Officer of the financial risks arising from Union’s financial operations;
(b)
develop an audit plan, aligned with the priorities of the internal audit strategy, indicating the engagements planned for the next two years and consulting with the Directorates-Generals and Services for the purpose of providing optimal audit coverage and including as appropriate any special tasks or projects requested by the Audit Progress Committee, Directors-General, Heads of Service and Directors of executive agencies;
(c)
submit the audit plan to the Audit Progress Committee for consideration;
(d)
adopt the audit plan and submit it to the Commission;
(e)
update the audit plan as needed to take into account new and/or emerging risks that could impact the organisation, or any requests by the Commission to carry out audits after informing the Audit Progress Committee;
(f)
ensure audit coordination with the European Court of Auditors as appropriate.
3. The Internal Auditor shall:
(a)
ensure that the work programme is properly implemented;
(b)
ensure that audits are performed in line with the mutual expectations paper;
(c)
ensure findings are promptly validated and recommendations are discussed with the auditee, with the auditee’s position reflected in the final report, particularly in the case of disagreement;
(d)
ensure a continuous dialogue with the auditee is in place, to ensure the relevance of the findings and the quality and feasibility of the recommendations for action to be taken;
(e)
effectively and in a timely manner communicate the results of assurance and non-assurance engagements to Directors-General, Heads of Service, Directors of executive agencies and the Audit Progress Committee;
(f)
establish a follow-up process monitoring that recommendations have been implemented and inform the Audit Progress Committee accordingly, with special attention for the overdue recommendations and the related risks.
International internal audit standards
1. The Internal Auditor shall ensure conformance with the Global Internal Audit Standards and, for its assurance services, with Topical Requirements issued by the Institute of Internal Auditors, subject to paragraph 3.
2. The Internal Auditor shall ensure that an independent external quality assessment is performed at least every 5 years.
3. Requirements originating from Union law shall take precedence over the Global Internal Audit Standards and Topical Requirements.
Access to documents
No access to documents being part of internal audit engagements shall be granted, unless the applicant demonstrates an overriding public interest in providing access prevailing over the interests protected by Article 4(2) of Regulation (EC) No 1049/2001 of the European Parliament and of the Council ( 14 ) .
This Decision shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union .
