Differences between SPAP and Internal Audit Standards in Corporate Governance

Photo by Vitaly Gariev on Unsplash

External Auditor assess the fairness of financial statements, while internal auditors evaluate a company's business processes and controls. Both have different professional standards and responsibilities.

Read this article to understand the difference between SPAP and internal audit standards, including the role of KAP, SKAI, and the synergy between the two in strengthening corporate governance.

Understanding the Foundations of Financial and Operational Business Oversight

SPAP are the Professional Standards for Public Accountants, which serve as a professional reference for public accounting engagements. Meanwhile, internal audit standards regulate the implementation of the internal audit function in evaluating governance, risk management, and organizational controls.

The two are not interchangeable. SPAP is relevant for the professional work of public accountants, while the Institute of Internal Auditors' (IIA) Global Internal Audit Standards (GIAS) serve as the professional framework for internal auditing.

The Role of External Auditors and Internal Auditors in the Three Lines Model

External and internal auditors have different relationships with the organizations they audit. External auditors provide independent assurance through specific engagements, while internal auditors systematically evaluate organizational processes.

In the Three Lines Model, the responsibilities of governance, management, and internal audit are differentiated based on their respective functions.

• First line: Operational management carries out activities and manages day-to-day risks.
• Second line: The risk and compliance function provides support, monitoring, and challenges to risk management.
• Third line: Internal audit provides an independent and objective assessment of governance, risk, and control.

External auditors are not a separate entity within this model. They contribute as external assurance providers and coordinate with the organization as mandated.

The Urgency of Independence in Maintaining Organizational Accountability

The independence of external auditors is necessary to maintain the objectivity of the opinion on the financial statements. Auditors must meet the independence and ethical requirements applicable to their engagement.

Internal audit It also requires organizational independence and individual objectivity. The internal audit function ideally has access to the board or audit committee and protection from interference that could impair its judgment.

The difference lies in the context of independence and mandate. External auditors must be independent of the entity as per the terms of the engagement, while internal auditors work within the organizational structure with adequate independence safeguards.

Dissecting the SPAP Standard Guidelines for Public Accounting Firms (KAP)

Photo by Giorgio Tomassetti on Unsplash

The SPAP covers professional standards for various types of public accounting engagements. In a financial statement audit, Auditing Standards (SAs) address the auditor's responsibilities in obtaining evidence and forming an opinion. For an overview of the framework, see audit standards, read the explanation on Audithink.

These standards cover audit planning, assessing the risks of material misstatement, testing procedures, documentation, and reporting. The auditor must base his or her conclusions on sufficient appropriate audit evidence.

IAPI Institution Mandate and Financial Report Opinion Regulations

The Indonesian Institute of Certified Public Accountants (IAPI) plays a role in developing professional standards for public accountants in Indonesia. Its published standards include Auditing Standards and other standards appropriate to the type of engagement.

In a financial statement audit, the auditor issues an opinion based on the audit results and the applicable financial reporting framework. This opinion helps users assess whether the financial statements are presented fairly in all material respects.

An audit opinion is not a guarantee that a company is free from all fraud or error. An audit provides reasonable assurance, not absolute assurance, regarding the financial statements being reviewed.

Focus of Historical Testing and Materiality of Financial Transactions

A financial statement audit generally assesses financial information for a prior period. The auditor identifies the risks of material misstatement and designs appropriate procedures.

Materiality helps determine whether an error or omission could potentially influence the decisions of users of financial statements. Its assessment involves professional judgment, not just a specific nominal threshold.

Audit procedure may include testing of transactions, examining supporting documents, external confirmations, analytical procedures, and tests of controls. The selection of procedures depends on the risk and evidence needed.

Internal Audit Standards Framework Based on Global Internal Audit Standards (IIA)

The 2024 edition of the Global Internal Audit Standards became effective on January 9, 2025. These standards are part of the International Professional Practices Framework (IPPF) and govern the professional practice of internal auditing globally.

GIAS covers five domains: the purpose of internal audit, ethics and professionalism, governance of the internal audit function, management of the internal audit function, and implementation of internal audit services.

Its implementation must take into account the mandate, governance, and applicable regulations of the organization. Companies must also ensure that the standards are adopted in accordance with relevant needs and obligations. In practice, these internal audit standards serve as guidelines for internal audit leaders in developing policies and methodologies.

Duties of the Internal Audit Unit (SKAI) and the Role of Management Consulting

Internal Audit Unit (SKAI) is a term commonly used for the internal audit function in the banking sector. Non-banking companies may use different names, such as internal audit division or internal audit unit.

This function evaluates controls, identifies process weaknesses, and provides recommendations for improvement. Internal auditors may also provide consulting services within their mandate without assuming management responsibilities.

For example, internal auditors can assess procurement effectiveness, information system security, inventory management, and procedural compliance. The results help management improve processes before weaknesses develop into larger problems.

Continuous Risk-Based Audit Approach

Risk-based audit Prioritize areas that could potentially hinder the achievement of organizational objectives. Audit planning considers the impact of risks, the likelihood of occurrence, business changes, and the effectiveness of controls.

Unlike audits that focus solely on historical transactions, internal audits can assess emerging operational and strategic risks. Examples include supply chain disruptions, system access vulnerabilities, and non-compliance risks.

Audit plans need to be reviewed as the risk profile changes. This approach makes oversight more relevant to the organization's needs, without diminishing the importance of documentation and audit evidence.

Comparative Analysis of IAPI SPAP vs IIA Standards

The main differences between SPAP and internal audit standards lie in the purpose, mandate, and users of audit results. SPAP regulates the professional work of public accountants, while GIAS regulates the internal audit function.

Comparison Table of Differences between KAP and SKAI

The table provides a general overview. The actual scope depends on the type of engagement, functional mandate, regulations, and organizational requirements.

Synergy of External Auditors vs Internal Auditors in Internal Control Systems

Coordination between external and internal auditors can reduce duplication of work and help identify risk areas. However, coordination does not eliminate the responsibilities of each auditor.

The external auditor remains responsible for the opinion he or she issues. The use of internal audit work may only be made if it meets the requirements of relevant internal auditing standards, including an evaluation of the function's objectivity and competence.

Companies can support coordination through consistent documentation, risk mapping, and follow-up on findings. Access to evidence must also comply with confidentiality and information security requirements.

Conclusion

SPAP and GIAS have different functions, but both can support stronger governance. External auditors focus on their engagement mandate, while internal audit helps the organization continuously evaluate risks and controls.

To organize documentation and audit processes in a more structured manner, visit Audithink and schedule a demo to discuss oversight needs and evaluate the system's suitability for your company's audit processes.

FAQ