Disclosing Nonconformance with the Standards

Introduction
Disclosing nonconformance with the Standards is a core topic in the Internal Audit Professionalism and Quality area of the CIA Challenge Exam. It deals with a simple but critical idea. If the internal audit activity, or a specific engagement, did not conform with the Standards or the Code of Ethics, stakeholders must be told. They must also be told why it happened and what effect it had.

This guide covers why the requirement matters, what it says, how it works in practice, and how to answer exam questions on it.

1. Why Disclosing Nonconformance Is Important
Credibility and trust: Boards, senior management, regulators and external auditors rely on internal audit work. Claiming conformance when it does not exist misleads them and damages the profession.

Informed reliance: Stakeholders need to know when work was limited. They can then decide how much weight to place on the assurance and whether other assurance is needed.

Integrity and honesty: Disclosure applies the Code of Ethics principle of integrity. Internal auditors must be honest and must not knowingly mislead.

Accountability for quality: Disclosure is the visible output of the Quality Assurance and Improvement Program (QAIP). It drives corrective action and prevents nonconformance from being hidden or repeated.

Governance support: The board can only oversee internal audit effectively if it knows where the function falls short. Common causes include a lack of resources, scope restrictions, or competency gaps.

2. What It Is: The Key Requirements
Under the IPPF (2017 Standards), which many CIA Challenge questions are based on:

Standard 1321: Use of 'Conforms with the International Standards for the Professional Practice of Internal Auditing'
The CAE may state that the internal audit activity conforms with the Standards only if the results of the QAIP support that statement. Support must come from both internal and external assessments.

Standard 1322: Disclosure of Nonconformance
When nonconformance with the Code of Ethics or the Standards impacts the overall scope or operation of the internal audit activity, the CAE must disclose two things to senior management and the board:

• the nonconformance;
• its impact.

Standard 2431: Engagement Disclosure of Nonconformance
When nonconformance impacts a specific engagement, the communication of results must disclose:

• the principles or rules of conduct of the Code of Ethics, or the Standards, with which full conformance was not achieved;
• the reason(s) for nonconformance;
• the impact of nonconformance on the engagement and the communicated engagement results.

Under the Global Internal Audit Standards (2024):
The same concepts are carried forward.

• Standard 4.1 (Conformance with the Global Internal Audit Standards) requires a specific response when internal auditors cannot conform with a requirement. The CAE must document and communicate a description of the circumstance, the alternative actions taken, the impact of those actions, and the rationale.
• Conformance may be claimed only when supported by quality assessments.
• Nonconformance affecting an engagement must be disclosed in the final engagement communication.
• The CAE communicates quality assessment results, including significant nonconformance, to the board and senior management (Standard 8.3, Quality).

3. How It Works in Practice
Step 1: Identify the nonconformance. It may surface through several channels:

• ongoing monitoring, such as supervision and engagement reviews;
• periodic self-assessments;
• external quality assessments, which are required at least once every five years;
• events during an engagement.

Step 2: Determine the level of impact.

• Activity-wide (Standard 1322). Examples:
  • no external quality assessment performed within five years;
  • CAE reporting lines that impair organizational independence;
  • a lack of an approved charter;
  • systemic resource shortfalls preventing risk-based coverage.
• Engagement-specific (Standard 2431). Examples:
  • an auditor who lacked the required competency;
  • insufficient evidence gathered due to time constraints;
  • work papers not reviewed before the report was issued;
  • an auditor with an undisclosed conflict of interest.

Step 3: Assess the impact. Consider whether the nonconformance affects the reliability of the conclusions, the scope of coverage, or the objectivity of the work.

Step 4: Disclose to the right party, in the right place.

• Activity-wide nonconformance: the CAE discloses to senior management and the board, often in periodic reporting or a QAIP report.
• Engagement nonconformance: disclosed within the engagement communication itself, to the recipients of the results.

Step 5: Remediate. Disclosure should be accompanied by action plans, and the CAE should stop using the conformance statement until conformance is restored.

Related but different concepts (common exam traps):

• Standard 1130, Impairment to Independence or Objectivity: details of an impairment must be disclosed to appropriate parties. The nature of the disclosure depends on the impairment. This is about independence threats, not general nonconformance.
• Standard 2421, Errors and Omissions: if a final communication contains a significant error or omission, the CAE must communicate corrected information to all parties who received the original. This is about content mistakes, not process nonconformance.
• Standard 1320, Reporting on the QAIP: the CAE communicates QAIP results, including external assessment results, to senior management and the board.
• Standard 2060 and Standard 1110: reporting on performance and confirming organizational independence annually.

Example scenario:
During an IT audit, the only staff member with relevant expertise resigned. The engagement was completed by auditors without adequate IT knowledge, and no external expert was engaged.

The final report should disclose three things:

• that the proficiency requirement (Standard 1210) was not fully met;
• the reason, which was the staff resignation and no outsourcing;
• the impact, for example that certain technical controls were not tested in depth and conclusions on those areas are limited.

Exam Tips: Answering Questions on Disclosing Nonconformance with the Standards
Tip 1: Identify the scope of impact first. Ask whether the nonconformance affects the whole internal audit activity or one engagement.

• Whole activity: the CAE discloses to senior management and the board (Standard 1322).
• One engagement: disclose in the engagement communication (Standard 2431).

Tip 2: Memorize the three elements of engagement disclosure. These are the what (which Standard or Code principle), the why (the reason), and the so what (the impact on the engagement and results). Answer options missing an element are usually wrong.

Tip 3: Know who discloses and to whom. At the activity level, the CAE is responsible, and the audience is senior management and the board. Be wary of options naming only the external auditor, the audit committee chair alone, or regulators as the required recipient.

Tip 4: The conformance statement requires evidence. If a question describes a CAE claiming conformance without an external assessment in the last five years, that claim is not permitted. The best answer usually involves not using the statement and disclosing the nonconformance.

Tip 5: Do not confuse nonconformance with errors or impairments.

• A factual mistake in an issued report is an error or omission (Standard 2421).
• A threat to objectivity is an impairment (Standard 1130).
• Failure to follow a Standard is nonconformance (Standards 1322 and 2431).

Read the stem carefully for these signals.

Tip 6: Choose transparency over concealment. Some options suggest ignoring a minor nonconformance, quietly fixing it later, or withdrawing the report entirely. These are rarely correct when the nonconformance has a real impact. The IIA favors honest disclosure plus remediation.

Tip 7: Disclosure is triggered by impact. The requirement applies when the nonconformance affects the scope or operation of the activity, or the engagement and its results. Look for words such as significant, impacts, or affects results.

Tip 8: Watch for 'BEST' or 'MOST appropriate' wording. Several answers may be partly true. Pick the one that names the correct responsible party, the correct audience, and all required content.

Tip 9: Link to the QAIP. Nonconformance is typically discovered through internal or external assessments. Questions may test that QAIP results, including identified nonconformance, must be reported to the board.

Tip 10: Recognize the 2024 GIAS terminology. Newer questions may describe the requirement in terms of documenting the circumstance, alternative actions, impact and rationale (Standard 4.1). The principle is the same: transparency about inability to conform.

Practice question:
An external quality assessment concludes that the internal audit activity generally does not conform with the Standards due to inadequate risk-based planning. What should the CAE do?

Best answer: Disclose the nonconformance and its impact to senior management and the board, stop stating that the activity conforms with the Standards, and develop an action plan to address the deficiency.

Summary
Disclosure of nonconformance protects the integrity of internal audit. The key points to remember are:

• Claim conformance only when the QAIP supports it.
• Disclose activity-wide nonconformance and its impact to senior management and the board.
• Disclose engagement-level nonconformance in the engagement communication, stating what was not met, why, and the impact.
• Distinguish this requirement from impairment disclosure and from the correction of errors and omissions.