Which of the following actions by the internal audit activity requires disclosure to the board of nonconformance with the Standards?

According to the Institute of Internal Auditors (IIA) Standards, an external assessment of the internal audit activity must be conducted at least once every five years (Standard 1312). Failure to complete this assessment within the required timeframe, such as the seven years mentioned, constitutes a significant nonconformance. This type of nonconformance impacts the overall operation and credibility of the internal audit activity. Standard 1322 explicitly requires the chief audit executive (CAE) to disclose such nonconformance and its impact to senior management and the board. This ensures that governance bodies are aware of significant deviations from mandatory professional practices.

B. This describes an engagement-level proficiency issue. While it is a nonconformance with proficiency standards (Standard 1210), it does not necessarily impact the overall operation of the activity requiring board disclosure.
C. This is a failure in engagement planning (Standard 2201). It is a serious lapse for a single audit but is typically managed by the CAE and does not usually rise to the level of board disclosure.
D. This action does not violate the Standards. Standard 1130.A1 presumes objectivity is impaired if an auditor provides assurance for an activity they were responsible for within the previous year. Ten years is well outside this period. ---

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 1312 – External Assessments: "External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization."

Standard 1322 – Disclosure of Nonconformance: "When nonconformance with the Code of Ethics or the Standards impacts the overall scope or operation of the internal audit activity, the chief audit executive must disclose the nonconformance and the impact to senior management and the board."

Standard 1130.A1 – Impairment to Independence or Objectivity: "Objectivity is presumed to be impaired if an internal auditor provides assurance services for an activity for which the internal auditor had responsibility within the previous year."

Standard 1210 – Proficiency: "Internal auditors must possess the knowledge, skills, and other competencies needed to perform their individual responsibilities."

Standard 2201 – Planning Considerations: "In planning the engagement, internal auditors must consider... The risks to the activity’s objectives, resources, and operations..."