Internal and Forensic Audit · Internal Audit Engagements and Planning

Standards on Internal Audit Governing Engagements

Updated 11 October 2026 · Fact-checked

Standards on Internal Audit (SIAs) are ICAI pronouncements that set the minimum quality bar for how an internal audit engagement is planned, performed, documented and reported. IIA standards give a global parallel. To answer a question, name the standard, state its rule, apply it to the facts, and conclude.

Understand Standards on Internal Audit Governing Engagements

An internal audit engagement is a defined piece of work, such as reviewing procurement at one plant. Standards tell the internal auditor how to do that work in a consistent, defensible way. Without them, quality would depend on who happens to hold the pen.

In India, the ICAI issues Standards on Internal Audit (SIAs). They cover the full cycle: planning the engagement, understanding the entity and its controls, assessing risk, gathering evidence, documenting, using the work of others, and reporting. Think of them as grouped by stage, not as a list to memorise blindly.

The Institute of Internal Auditors (IIA) issues the global International Professional Practices Framework, including standards on independence, proficiency, due care, planning and quality assurance. The ideas match the SIAs. In an answer, you can say that ICAI standards are the Indian reference and IIA standards are the international benchmark.

The external-audit standards help you see the logic. SA 300 requires the auditor to plan, identify the engagement's scope, reporting objectives and resources, and treat an initial engagement with extra care. SA 610 (Revised) tells an external auditor how to judge an internal audit function: objectivity, competence, and a systematic and disciplined approach. Your own internal audit must be good enough to pass that test.

So the test for any engagement is simple. Was it planned with risk in mind? Was it staffed by competent and objective people? Was it done in a disciplined, documented way? Standards exist to make each answer a clear yes.

Key rules to remember

Engagement life-cycle under the standards: Plan → Understand entity and controls → Assess risk → Gather evidence → Document → Report → Follow up; Use this order to place any SIA in your answer. Do not quote SIA numbers unless you are sure of them.
SA 610 (Revised) test of an internal audit function: Objectivity + Competence + Systematic and disciplined approach; These are the three factors an external auditor evaluates before using internal audit work.
Competence factors (SA 610 A8): Resources + hiring/training policies + technical proficiency + financial reporting knowledge + professional body membership; Professional bodies oblige members to follow standards and continuing professional development.
Extent of reliance (SA 610 para 18): More judgment, higher assessed risk, weaker objectivity, lower competence → use less internal audit work and do more directly; The external auditor makes all significant judgments, so reliance is never total.
SA 300 overall strategy (para 7): Scope + reporting objectives and timing + significant factors + preliminary activities + resources; Planning is a strategy first, then a detailed plan.

How to solve Standards on Internal Audit Governing Engagements questions

Use this method for any written question on standards governing an internal audit engagement.

1Identify the stage of the engagement the question is about: planning, performance, documentation or reporting.
2Name the relevant standard or principle (ICAI SIA, IIA, or SA 300 / SA 610 where the link is to external audit). Do not invent numbers.
3State the rule in plain words with its exact conditions.
4Pick out the facts that matter: size of entity, risk level, staff skills, reporting line, first-year engagement.
5Apply the rule to those facts one by one.
6Conclude clearly: what the internal auditor or external auditor should do, and what to document.
7Add one practical point such as drafting the plan, recording the judgment, or reporting to the audit committee.

Quickest way: Stage-Rule-Facts-Conclusion

When to use it: Use when time is short and the question gives a short case with a yes/no or what-should-be-done ask.

Write the stage in one line.
Write the rule in one or two lines using the objectivity, competence, discipline test or the planning elements.
Underline two facts in the case and link each to the rule.
Write a one-line conclusion and one documentation point.

Common mistakes in Standards on Internal Audit Governing Engagements

Listing SIA numbers from memory with wrong titles.
Students try to memorise the whole list as numbers.
Fix: Group standards by stage of the engagement and quote a number only when sure. The principle earns marks.
Treating IIA standards as mandatory in India by law.
Both sets use similar language.
Fix: Say ICAI SIAs are the Indian professional standards and IIA standards are a global benchmark.
Saying an external auditor can rely fully on internal audit work.
Students overlook the external auditor's sole responsibility for the opinion.
Fix: State that the external auditor makes all significant judgments and uses less internal audit work as risk and judgment rise or objectivity and competence fall.
Confusing objectivity with competence.
Both are described as qualities of the function.
Fix: Objectivity is freedom from bias, conflict of interest and undue influence. Competence is knowledge, skills, training and resources.
Ignoring extra planning for a first-year engagement.
Students assume planning is identical every year.
Fix: Note that the objective is the same but planning may need expanding, including opening balances and predecessor communication.
Giving theory without applying the facts.
Case-based answers are treated like recall questions.
Fix: Follow rule, facts, conclusion every time.

Worked examples

Example 1

Sunrise Textiles Ltd. has an internal audit function whose head reports to the Chief Financial Officer. Its team has two staff with no relevant professional qualification and no training policy. The statutory auditor wants to use its work on inventory, an area of significant risk. Advise the statutory auditor.

Show the solution

Stage: the external auditor is deciding how far to use internal audit work, which is SA 610 (Revised) territory.
Rule: the auditor considers objectivity, competence and a systematic and disciplined approach. Under para 18, the external auditor makes all significant judgments and plans to use less internal audit work, and do more directly, in four situations: the more judgment is involved; the higher the assessed risk of material misstatement, especially for significant risks; the less the function's organizational status and policies support objectivity; and the lower the function's competence.
Facts: reporting to the CFO may weaken organisational status supporting objectivity. No qualification or training policy points to lower competence. Inventory is a significant risk area.
Apply: all of these factors push toward using less internal audit work and performing more directly.
Conclude: the auditor should place little or no reliance and test inventory directly, recording the judgment made.

Answer: The statutory auditor should use little or no internal audit work on inventory and perform the procedures directly, because objectivity and competence are doubtful and the risk is significant. The auditor must document these judgments.

Example 2

Meera & Co. has been appointed for the first time as statutory auditor of Greenfield Foods Ltd. Explain what extra planning considerations arise under SA 300.

Show the solution

Stage: planning of an initial audit engagement. SA 300 is an external-audit standard, so the question is framed for a statutory auditor. An internal auditor can use the same ideas only by analogy.
Rule: SA 300 says the purpose of planning is the same for initial and recurring engagements, but planning may need to be expanded because the auditor has no previous experience with the entity.
Before starting, the auditor performs the SA 220 procedures on acceptance of the client relationship and the engagement and, where there has been a change of auditors, communicates with the predecessor auditor in line with ethical requirements.
Additional matters: arrangements with the predecessor such as reviewing working papers unless prohibited by law; major issues discussed with management at selection and their effect on the strategy; procedures for opening balances; any firm quality control requirements, such as review of the strategy by another partner.
Apply to Greenfield Foods: Meera & Co. should gather this knowledge early and document it in the audit strategy and plan.
Conclude with a practical point: record these steps in the planning memorandum.

Answer: The objective of planning stays the same, but Meera & Co. should expand planning: complete acceptance procedures, communicate with the predecessor auditor, review its working papers where permitted, consider major issues discussed with management, plan work on opening balances, and meet any firm quality control requirements for initial audits.

Exam tips

Frame answers by stage of the engagement; examiners reward structure and application over a list of numbers.
Quote the three tests of SA 610 (Revised): objectivity, competence, systematic and disciplined approach, with their factors.
Always add a documentation or reporting point to a case answer.
Contrast ICAI SIAs and IIA standards briefly in one line if the question asks about both.
Do not cite a standard number unless you are certain of it.

Practice questions from Internal Audit Engagements and Planning

Standards on Internal Audit Governing Engagements in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Standards on Internal Audit Governing Engagements: frequently asked questions

What are the Standards on Internal Audit?

They are standards issued by the ICAI that set the professional requirements for internal audit work. They cover planning, performance, documentation and reporting. Internal auditors are expected to follow them.

Are IIA standards applicable in India?

IIA standards are international professional standards and a useful benchmark. The ICAI SIAs are the Indian professional standards. In answers, treat IIA standards as a global parallel.

How does SA 610 (Revised) connect to internal audit standards?

It sets out how an external auditor evaluates and uses the work of an internal audit function. The auditor looks at objectivity, competence and whether a systematic and disciplined approach is applied. Good adherence to internal audit standards supports all three.

Do I need to memorise every SIA number for the exam?

Not as a list. The paper is case-based and rewards applying the rule to facts. Know the main themes by stage and quote a number only if you are sure of it.