Disclosing Nonconformance with the Standards: CIA Exam Guide
Disclosing Nonconformance with the Standards
This guide covers a topic examined in the Quality of the Internal Audit Function area of the CIA syllabus. It explains why disclosure matters, what the requirements are, how disclosure works at the activity level and the engagement level, and how to handle exam questions on it.
1. Why Disclosing Nonconformance Is Important
Internal audit's value rests on trust. When the chief audit executive (CAE) tells the board and senior management that the function operates in conformance with the Standards, those stakeholders rely on that statement. They use it to place confidence in assurance reports, risk assessments and recommendations.
If the function does not conform but stays silent, or claims conformance it has not earned, several problems follow:
• Misplaced reliance. The board may rely on assurance that is weaker than it appears, for example where independence was impaired or scope was restricted.
• An integrity failure. The internal auditor's own ethical duty of honesty and integrity is breached.
• Lost opportunity for oversight. The board cannot address the root cause, such as a lack of resources, a scope limitation imposed by management or interference with independence.
• Reputational and regulatory risk. This risk falls on both the internal audit activity and the organization.
Disclosure therefore turns a quality failure into a governance matter that can be managed. Nonconformance is not ideal, but hiding it is far worse. The Standards accept that full conformance is sometimes not possible. What they never accept is undisclosed nonconformance.
2. What It Is: Key Concepts and Requirements
Conformance vs. nonconformance
Conformance means the internal audit activity meets the requirements of the Standards (the Global Internal Audit Standards, or, in the earlier IPPF, the Standards and the Code of Ethics). Nonconformance is a failure to meet one or more of those requirements.
Nonconformance can be:
• Activity-level (overall). It affects the overall scope or operation of the internal audit activity. Examples include:
- no external quality assessment within five years
- a CAE without direct access to the board
- a function-wide lack of competent staff
- no internal audit charter
• Engagement-level (specific). It affects a particular engagement. Examples include:
- an auditor with a conflict of interest who was assigned anyway
- insufficient evidence gathered because of time constraints
- inadequate supervision on one engagement
Use of the conformance statement
The internal audit activity may state that it operates in conformance with the Standards only when the results of the Quality Assurance and Improvement Program (QAIP) support that statement. Under the legacy IPPF this was Standard 1321. Under the Global Internal Audit Standards it is reflected in Standard 4.1 and Domain IV, Standards 8.3 and 8.4.
The QAIP includes:
• Ongoing monitoring. Examples are engagement supervision, checklists and performance metrics.
• Periodic self-assessments.
• External quality assessments (EQA). These are conducted at least once every five years by a qualified, independent assessor or assessment team.
If the QAIP has not been carried out, for example because no EQA has been done in five years, the function cannot claim general conformance.
Activity-level disclosure
Under legacy Standard 1322 (Disclosure of Nonconformance), when nonconformance affects the overall scope or operation of the internal audit activity, the CAE must disclose the nonconformance and its impact to senior management and the board.
Under the Global Internal Audit Standards (Standard 4.1, Conformance with the Global Internal Audit Standards), the same idea applies. When internal auditors cannot conform with a requirement, the CAE must document and communicate to the board and senior management:
• a description of the circumstance
• any alternative actions taken
• the impact of those actions
• the rationale
Where laws or regulations prevent conformance, internal audit should still conform with all other parts of the Standards and make appropriate disclosures.
Engagement-level disclosure
Under legacy Standard 2431 (Engagement Disclosure of Nonconformance), when nonconformance affects a specific engagement, the communication of results must disclose three things:
• the principles or rules of conduct of the Code of Ethics, or the Standards, with which full conformance was not achieved
• the reason(s) for nonconformance
• the impact of the nonconformance on the engagement and the communicated engagement results
The Global Internal Audit Standards keep this requirement in the final engagement communication requirements: identify the requirement not met, the reason, and the impact on the engagement and its results.
3. How It Works in Practice
Step 1: Identify the nonconformance.
Sources include:
• ongoing monitoring, such as supervisory review that finds an engagement lacked sufficient evidence
• periodic internal self-assessments
• external quality assessments
• auditors self-reporting impairments, such as a conflict of interest discovered after fieldwork
Step 2: Assess its significance and level.
Ask whether it affects one engagement or the overall scope and operation of the activity. The answer determines where and how disclosure happens.
Step 3: Determine the appropriate disclosure.
• Engagement-level: disclose in the final engagement communication (the audit report). State the Standard or Code element not met, the reason, and the impact on the results. Recipients are those who receive the engagement results.
• Activity-level: the CAE discloses the nonconformance and its impact to senior management and the board. This usually happens through periodic reporting on QAIP results, which includes EQA results and corrective action plans.
Step 4: Stop or qualify the conformance claim.
If the nonconformance is significant at the activity level, the function must stop using the unqualified statement that it conforms with the Standards until conformance is restored and verified.
Step 5: Take corrective action and follow up.
Develop action plans, discuss resource or independence issues with the board, and track remediation through the QAIP.
Illustrative scenarios
• The EQA is overdue by two years. This is an activity-level nonconformance. The CAE must disclose it to senior management and the board and cannot claim general conformance.
• An auditor previously managed the area being audited (within the past year) and performed the assurance engagement. Objectivity is impaired, which is an engagement-level nonconformance. The engagement report must disclose the impairment, the reason and its impact on the results. The impairment should also be reported to appropriate parties.
• Management restricted access to records, so a key area could not be tested. This is a scope limitation. It must be communicated to the board, and the impact must be disclosed in the engagement communication.
• Local law requires internal audit to report to a government body in a way that conflicts with a Standard. The function follows the law, conforms with all other requirements, and discloses the situation.
Who does what
• CAE: responsible for the QAIP, for activity-level disclosure to the board and senior management, and for ensuring engagement reports include the required disclosures.
• Board: receives disclosures, oversees corrective actions, and supports resources and independence.
• Engagement supervisor or auditors: identify engagement-level issues and draft the disclosure in the report.
4. Exam Tips: Answering Questions on Disclosing Nonconformance with the Standards
Tip 1: Decide the level first.
Ask whether the issue concerns one engagement or the whole internal audit activity.
• One engagement: the disclosure goes in the engagement communication.
• The whole activity: the CAE discloses to senior management and the board.
Many questions are designed to test whether you can tell these two apart.
Tip 2: Memorize the three engagement disclosure elements.
1. The Standard or Code element not conformed with.
2. The reason(s).
3. The impact on the engagement and its results.
Distractors may offer the name of the responsible auditor, the cost of the engagement, or a recommendation to discipline staff. These are not required elements.
Tip 3: Know the right audience.
Activity-level nonconformance goes to senior management and the board. Distractors may suggest:
• only the external auditor
• only the CFO
• the IIA
• regulators as the primary recipient
The Standards point to the board and senior management.
Tip 4: Conformance claims require QAIP support.
If a question asks when the function may state that it conforms with the Standards, the answer is: only when supported by the results of the QAIP, including an EQA within five years. A statement based solely on the CAE's opinion, or on internal assessments alone when the EQA is overdue, is incorrect.
Tip 5: Never choose the cover-up option.
Some answer options suggest one of the following:
• omitting the disclosure because the impact was minor and nobody asked
• delaying it until the next EQA
• correcting the problem quietly without telling anyone
• removing the conformance statement without explanation
These are almost always wrong. The ethical and Standards-based answer is transparent disclosure along with corrective action.
Tip 6: Watch for impairment scenarios.
Independence and objectivity impairments are common triggers. Examples include:
• auditing an area the auditor recently managed (usually within the prior year)
• accepting gifts
• a CAE with operational responsibilities
Remember that impairments discovered after the report is issued may still require disclosure of the nonconformance and its impact.
Tip 7: Distinguish nonconformance disclosure from errors and omissions.
If a final communication contains a significant error or omission, the CAE must communicate corrected information to all parties who received the original. That requirement is separate from nonconformance disclosure. Read the question carefully to see which situation applies.
Tip 8: Legal or regulatory conflicts.
If laws or regulations prevent conformance with part of the Standards, the best answer is to:
• follow the law
• conform with all other requirements
• disclose appropriately
It is not to abandon the Standards entirely, and it is not to break the law.
Tip 9: Use the BEST-answer approach.
Several options may be partly correct. Prefer the option that is most complete and timely and that involves the board when the issue is significant. For example, disclosing to the board and also developing an action plan beats simply developing an action plan.
Tip 10: Know the terminology.
Older study materials refer to Standards 1321, 1322 and 2431. The Global Internal Audit Standards (effective January 2025) carry the same concepts into Domain IV (Standards 8.3 and 8.4), Standard 4.1 and the final engagement communication requirements. Focus on the concepts of level, audience, content and QAIP support, which hold under both frameworks.
Quick summary
• Nonconformance must be disclosed, never hidden.
• Engagement-level: disclose in the engagement report the requirement not met, the reason and the impact on the results.
• Activity-level: the CAE discloses the nonconformance and its impact to senior management and the board.
• The conformance claim is permitted only when QAIP results, including an EQA at least every five years, support it.
• Disclosure should always be paired with corrective action and board oversight.
