{"id":5271,"date":"2026-06-22T15:01:36","date_gmt":"2026-06-22T08:01:36","guid":{"rendered":"https:\/\/audithink.com\/?p=5271"},"modified":"2026-06-22T15:01:41","modified_gmt":"2026-06-22T08:01:41","slug":"internal-audit-standards-in-indonesia","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/standar-audit-internal-di-indonesia\/","title":{"rendered":"Internal Audit Standards in Indonesia and Guidelines for Their Implementation"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Internal audit standards in Indonesia are guidelines used to ensure that the internal audit function is carried out professionally, independently, objectively, risk-based, and provides added value to the organization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, there is no single standard that applies uniformly to all organizations. The guidelines that must be used depend on the organization's status, industry sector, and applicable regulations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Private companies can generally refer to the Global Internal Audit Standards issued by the Institute of Internal Auditors (The IIA). Meanwhile, the Government Internal Audit Apparatus uses the Indonesian Government Internal Audit Standards. Issuers, public companies, banks, and financial services institutions must also comply with specific provisions from the Financial Services Authority.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Therefore, business owners need to understand which standards are relevant before establishing or evaluating an internal audit function in their company.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Are Internal Audit Standards?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/audithink.com\/en\/article\/audit-standards\/\" data-type=\"post\" data-id=\"2991\">Audit standards<\/a><\/strong> Internal audit is a set of professional principles and requirements that govern how the internal audit function is established, managed, performed, and evaluated.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These guidelines not only regulate audit procedures. The standards also regulate the position of the internal audit function within an organization. <strong><a href=\"https:\/\/audithink.com\/en\/article\/what-is-auditor\/\" data-type=\"post\" data-id=\"576\">auditor competency<\/a><\/strong>, relations with directors and board of commissioners, management of conflicts of interest, to monitoring follow-up on recommendations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing standards is necessary to ensure that audits are not merely administrative audits. Internal audits should help organizations evaluate and improve the effectiveness of:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/audithink.com\/en\/article\/what-is-grc\/\" data-type=\"post\" data-id=\"4254\">Corporate governance<\/a><\/strong>.<\/li>\n\n\n\n<li>Risk management.<\/li>\n\n\n\n<li>Internal control.<\/li>\n\n\n\n<li>Compliance with regulations and policies.<\/li>\n\n\n\n<li>Operational process efficiency.<\/li>\n\n\n\n<li>Protection of company assets and information.<\/li>\n\n\n\n<li>Prevention and detection of fraud risks.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">With clear standards, management can obtain audit results that are more consistent, accountable, and relevant to business objectives.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What are the Internal Audit Standards in Indonesia?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The selection of Indonesian audit standards must take into account the organization's structure and environment. Below are some of the most relevant frameworks and regulations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Global Internal Audit Standards from The IIA<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Global Internal Audit Standards or GIAS are professional standards published by The Institute of Internal Auditors.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GIAS 2024 was published as a mandatory part of the International Professional Practices Framework or IPPF and became effective on January 9, 2025. This standard is a global reference in establishing, managing, and evaluating internal audit functions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GIAS consists of five main domains.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Domain I: Purpose of Internal Auditing<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This domain describes the purpose of internal audit and the value it should provide to the organization and its stakeholders.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Internal audit is expected to strengthen the organization's ability to create, protect, and maintain value through independent and risk-based assurance, advisory, insight, and foresight activities.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Domain II: Ethics and Professionalism<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This domain governs the professional conduct of internal auditors, including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Integrity.<\/li>\n\n\n\n<li>Objectivity.<\/li>\n\n\n\n<li>Competence.<\/li>\n\n\n\n<li>Professional due diligence.<\/li>\n\n\n\n<li>Confidentiality of information.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Auditors must be free from bias, conflicts of interest, and interventions that could influence audit conclusions.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Domain III: Governing the Internal Audit Function<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This domain regulates how the internal audit function obtains adequate mandate, standing, independence and oversight from the board or party carrying out the oversight function.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Things to pay attention to include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Approval of the internal audit charter.<\/li>\n\n\n\n<li>Authority to access information.<\/li>\n\n\n\n<li>Position of head of internal audit.<\/li>\n\n\n\n<li>Communication channels with the board of directors and board.<\/li>\n\n\n\n<li>Supervision of the performance of the internal audit function.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Domain IV: Managing the Internal Audit Function<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This domain regulates the management of the internal audit function, from strategy development, audit planning, resource management, communication with stakeholders, to quality improvement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The head of internal audit must ensure that the resources, competencies, methodologies, and technologies used are aligned with the organization's needs.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Domain V: Performing Internal Audit Services<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">This domain regulates the execution of each audit assignment, including:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Assignment planning.<\/li>\n\n\n\n<li>Determining objectives and scope.<\/li>\n\n\n\n<li>Collection and testing of information.<\/li>\n\n\n\n<li>Analysis of audit evidence.<\/li>\n\n\n\n<li>Preparation of findings and conclusions.<\/li>\n\n\n\n<li>Submission of recommendations.<\/li>\n\n\n\n<li>Communication of audit results.<\/li>\n\n\n\n<li>Monitoring the implementation of the action plan.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Private companies can use GIAS as a primary foundation for building professional internal audit methodologies and systems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Indonesian Government Internal Audit Standards<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Indonesian Government Internal Audit Standards or SAIPI are used in internal audit activities within the government.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SAIPI was established by the Association of Indonesian Government Internal Auditors (AAIPI) through Regulation Number PER-01\/AAIPI\/DPN\/2021. These standards must be implemented by leaders of Government Internal Audit Apparatus and auditors in internal audit activities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SAIPI 2021 has two main groups.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Attribute Standards<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Attribute standards regulate the characteristics of organizations and individuals who carry out internal audits. Their scope includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Purpose, authority, and responsibility.<\/li>\n\n\n\n<li>Internal audit charter.<\/li>\n\n\n\n<li>Independence and objectivity.<\/li>\n\n\n\n<li>Professional competence and due diligence.<\/li>\n\n\n\n<li>Continuing professional development.<\/li>\n\n\n\n<li>Quality assurance and improvement program.<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">Performance Standards<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Performance standards govern how internal audit activities are managed and implemented. Their scope includes:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internal control management.<\/li>\n\n\n\n<li>Risk-based planning.<\/li>\n\n\n\n<li>Resource management.<\/li>\n\n\n\n<li>Coordination with other assurance providers.<\/li>\n\n\n\n<li>Evaluation of governance, risk management, and control.<\/li>\n\n\n\n<li>Planning each assignment.<\/li>\n\n\n\n<li>Collection and documentation of information.<\/li>\n\n\n\n<li>Communication of assignment results.<\/li>\n\n\n\n<li>Follow-up monitoring.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As of June 2026, AAIPI still lists SAIPI 2021 as its government internal audit standard. However, the revision and alignment process with GIAS 2024 is underway. Government organizations should monitor AAIPI's official publications for future standard updates.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. OJK Regulations for Issuers and Public Companies<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Issuers and public companies must pay attention to POJK Number 56\/POJK.04\/2015 concerning the Formation and Guidelines for the Preparation of Internal Audit Unit Charters.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This regulation requires issuers or public companies to have an Internal Audit Unit. The number of auditors should be adjusted to the scale and complexity of the company's business activities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Internal auditors are also expected to have integrity, independence, objectivity, communication skills, audit knowledge, understanding of regulations, and competencies relevant to their field of business.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Public companies are required to have an Internal Audit Charter which at least regulates:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Structure and position of the Internal Audit Unit.<\/li>\n\n\n\n<li>Duties and responsibilities.<\/li>\n\n\n\n<li>Internal auditor authority.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/audithink.com\/en\/article\/code-of-ethics-internal-audit\/\" data-type=\"post\" data-id=\"3644\">Internal audit code of ethics<\/a><\/strong>.<\/li>\n\n\n\n<li>Internal auditor requirements.<\/li>\n\n\n\n<li>Accountability of the Internal Audit Unit.<\/li>\n\n\n\n<li>Prohibition on concurrent duties with operational functions.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The charter is established by the board of directors after obtaining approval from the board of commissioners.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Internal Audit Unit must also be able to access relevant information, communicate with the board of directors, board of commissioners and audit committee, and monitor the implementation of follow-up on audit recommendations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Special Regulations Based on Industrial Sector<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In addition to provisions for issuers and public companies, some sectors have more specific internal audit regulations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Examples include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>General bank.<\/li>\n\n\n\n<li>People's Economic Bank.<\/li>\n\n\n\n<li>Insurance company.<\/li>\n\n\n\n<li>Finance company.<\/li>\n\n\n\n<li>Venture capital firm.<\/li>\n\n\n\n<li>Pension fund.<\/li>\n\n\n\n<li>Microfinance institutions.<\/li>\n\n\n\n<li>State-owned enterprises.<\/li>\n\n\n\n<li>Central and regional government organizations.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Companies operating in regulated sectors need to map all applicable regulations. GIAS can be used as a professional standard, while OJK regulations, ministerial regulations, or other sector regulations serve as compliance requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Differences between Internal Audit Standards and Financial Statement Audit Standards<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The term \u201cIndonesian audit standards\u201d can cause confusion because internal audits and financial statement audits use different guidelines.<\/p>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table class=\"has-fixed-layout\"><thead><tr><th>Aspect<\/th><th>Internal Audit<\/th><th>Financial Statement Audit<\/th><\/tr><\/thead><tbody><tr><td>Executor<\/td><td>Internal auditor or internal audit service provider<\/td><td>Public accountant or Public Accounting Firm<\/td><\/tr><tr><td>Main purpose<\/td><td>Evaluate governance, risk, control, compliance, and operations<\/td><td>Providing an opinion on the fairness of financial statements<\/td><\/tr><tr><td>Main user<\/td><td>Board of directors, board of commissioners, audit committee, and management<\/td><td>Shareholders, investors, regulators, creditors, and the public<\/td><\/tr><tr><td>General references<\/td><td>GIAS, SAIPI, POJK, and sector provisions<\/td><td>Public Accountant Professional Standards<\/td><\/tr><tr><td>Scope<\/td><td>Financial and non-financial<\/td><td>Especially information and financial reports<\/td><\/tr><tr><td>Frequency<\/td><td>Sustainable according to the audit plan<\/td><td>Generally based on the financial reporting period<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The Professional Standards for Public Accountants (SPAP) are not the primary guidelines for managing a company's internal audit function. They are used by public accountants in providing professional services, including audits of financial statements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nevertheless, internal auditors and external auditors can still coordinate so that assurance coverage does not overlap and significant risks can be adequately evaluated.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Principles in Internal Audit Standards<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While each sector may have different requirements, there are a number of principles that generally form the foundation of internal auditing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Integrity and objectivity<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auditors must carry out their work honestly, professionally, impartially and based on evidence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Personal relationships, financial interests, management pressure, or the auditor's involvement in the operational processes being audited may affect objectivity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Any potential conflicts of interest need to be identified, reported and managed before the assignment begins.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Independence of the internal audit function<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/audithink.com\/en\/article\/internal-audit\/\" data-type=\"link\" data-id=\"https:\/\/audithink.com\/blog\/internal-audit\/\">Internal audit function<\/a><\/strong> must have a position that enables the auditor to carry out his duties without undue intervention.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Independence can be strengthened through:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Internal audit charter approved by management.<\/li>\n\n\n\n<li>Direct communication channels with the board of directors and board of commissioners.<\/li>\n\n\n\n<li>Access to the audit committee.<\/li>\n\n\n\n<li>Authority to access documents, systems, personnel, and assets.<\/li>\n\n\n\n<li>Prohibition on carrying out operational tasks that will be audited.<\/li>\n\n\n\n<li>Protection from audit scope limitations.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Independence does not mean the auditor is completely separate from the organization. Auditors still need to understand the business and communicate with management without assuming management responsibilities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Professional competence and due care<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auditors must have knowledge and skills appropriate to the risks and scope of the assignment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The required competencies extend beyond accounting. Audit teams may require an understanding of information technology, cybersecurity, law, taxation, operations, risk management, fraud, data analytics, and the company's industry.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Due professional care means that the auditor performs the work with a reasonable degree of care, not providing assurance that all errors or fraud will be discovered.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Risk-based planning<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The audit plan should not just repeat the audit objects from the previous year.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Planning needs to consider:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>The company's strategic objectives.<\/li>\n\n\n\n<li>The organization's main risks.<\/li>\n\n\n\n<li>Regulatory changes.<\/li>\n\n\n\n<li>Changes in processes and systems.<\/li>\n\n\n\n<li>Audit findings history.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/audithink.com\/en\/article\/fraud-audit\/\" data-type=\"post\" data-id=\"3860\">Potential fraud<\/a><\/strong>.<\/li>\n\n\n\n<li>Level of control effectiveness.<\/li>\n\n\n\n<li>Input from the board of directors, board of commissioners, and management.<\/li>\n\n\n\n<li>Availability of audit resources.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Objects with higher risks should receive more adequate priority and audit coverage.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Audit evidence and documentation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The auditor's conclusions must be supported by sufficient, relevant, reliable, and usable information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Audit documentation may include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><a href=\"https:\/\/audithink.com\/en\/article\/audit-plan\/\" data-type=\"post\" data-id=\"4640\">Audit plan<\/a><\/strong>.<\/li>\n\n\n\n<li>Letter of assignment.<\/li>\n\n\n\n<li>Risk and control matrix.<\/li>\n\n\n\n<li>Audit work program.<\/li>\n\n\n\n<li>Interview results.<\/li>\n\n\n\n<li>Proof of transaction.<\/li>\n\n\n\n<li>Test result data.<\/li>\n\n\n\n<li>Auditor analysis.<\/li>\n\n\n\n<li>List of findings.<\/li>\n\n\n\n<li>Response <strong><a href=\"https:\/\/audithink.com\/en\/article\/auditee-definition\/\" data-type=\"post\" data-id=\"756\">auditee<\/a><\/strong>.<\/li>\n\n\n\n<li>Action plan.<\/li>\n\n\n\n<li>Evidence of supervisor review.<\/li>\n\n\n\n<li>Audit report.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Good documentation creates an audit trail so that the auditor's processes, evidence, considerations, and conclusions can be traced back.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Communication of audit results<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Audit reports must be accurate, objective, clear, concise, constructive, complete, and delivered in a timely manner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each finding should ideally explain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Conditions found.<\/li>\n\n\n\n<li>Criteria or conditions that must be met.<\/li>\n\n\n\n<li>Cause of the problem.<\/li>\n\n\n\n<li>Risk or impact.<\/li>\n\n\n\n<li>Recommendations for improvement.<\/li>\n\n\n\n<li>Management response.<\/li>\n\n\n\n<li>Responsible for follow-up.<\/li>\n\n\n\n<li>Target completion time.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The use of risk level categories also needs to have consistent definitions and methodologies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7. Follow-up monitoring<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The audit work is not completed when the report is issued.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The internal audit function needs to monitor whether the action plan has been implemented and whether the actions actually resolve the root cause of the problem.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Follow-up status can be classified into:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not started yet.<\/li>\n\n\n\n<li>Being processed.<\/li>\n\n\n\n<li>Done and waiting for verification.<\/li>\n\n\n\n<li>Completed and verified.<\/li>\n\n\n\n<li>Past the deadline.<\/li>\n\n\n\n<li>Risk accepted by management.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If management accepts a risk that is deemed too high for the organization, the head of internal audit needs to communicate this to those with oversight authority.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8. Quality assurance and improvement<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The internal audit function needs to have a quality assurance and improvement program.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This program may include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Supervise each assignment.<\/li>\n\n\n\n<li>Ongoing internal review.<\/li>\n\n\n\n<li>Periodic self-assessment.<\/li>\n\n\n\n<li>Evaluation of auditor competency.<\/li>\n\n\n\n<li>Internal audit performance measurement.<\/li>\n\n\n\n<li>Gathering input from stakeholders.<\/li>\n\n\n\n<li>External assessment by an independent party.<\/li>\n\n\n\n<li>Preparation of quality improvement plans.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The goal is not only to demonstrate compliance, but also to increase the effectiveness and value of the audit function to the organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Stages of Implementing Internal Audit Standards in Companies<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Companies can implement internal audit standards through the following stages.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Determine relevant regulations and standards<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Identify company status, business sector, regulator, ownership structure, and governance obligations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Public companies need to adhere to OJK regulations, while government organizations use SAIPI. Private companies can use GIAS as their primary professional reference.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Conduct a gap analysis<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Compare the current state of the audit function with the requirements of the standard.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Gap analysis can include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Organizational position.<\/li>\n\n\n\n<li>Internal audit charter.<\/li>\n\n\n\n<li>Independence.<\/li>\n\n\n\n<li>Team competency.<\/li>\n\n\n\n<li>Audit methodology.<\/li>\n\n\n\n<li>Audit universe.<\/li>\n\n\n\n<li>Risk assessment.<\/li>\n\n\n\n<li>Documentation.<\/li>\n\n\n\n<li>Reporting.<\/li>\n\n\n\n<li>Follow-up monitoring.<\/li>\n\n\n\n<li>Quality improvement program.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The results are used to determine improvement priorities.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Develop or update the Internal Audit Charter<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The internal audit charter should describe the audit function's mandate, scope, authority, responsibilities, and reporting lines.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The charter also needs to regulate the auditor's access to documents, systems, personnel, locations and other relevant parties.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Build an audit universe and risk assessment<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The audit universe is a list of all units, processes, systems, projects, entities and activities that have the potential to be audit objects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Each object is then assessed based on risk, materiality, complexity, change, history of findings, and level of control.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. Develop a risk-based audit plan<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The audit plan needs to include the object, initial objectives, time estimates, resources, schedule, and assignment priorities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The plan must be flexible enough to respond to new risks or significant business changes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6. Standardize methodology and working papers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Companies need to have a consistent methodology from the planning stage to follow-up.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Standard templates and procedures can be used to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Assignment planning.<\/li>\n\n\n\n<li>Preparation of audit programs.<\/li>\n\n\n\n<li>Testing of controls.<\/li>\n\n\n\n<li>Sampling.<\/li>\n\n\n\n<li>Documentation of evidence.<\/li>\n\n\n\n<li>Compilation of findings.<\/li>\n\n\n\n<li>Supervisor reviewed.<\/li>\n\n\n\n<li>Reporting.<\/li>\n\n\n\n<li>Recommendation monitoring.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>See also:<\/strong> <a href=\"https:\/\/audithink.com\/en\/article\/company-audit-working-paper-examples\/\" data-type=\"post\" data-id=\"4544\">Examples of Corporate Audit working papers for operational improvement<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7. Improve auditor competence<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Develop a competency matrix and development plan based on audit needs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Development can be done through training, certification, mentoring, assignment rotation, case studies, and utilization of experts.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">8. Implement quality assurance<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Establish audit function performance indicators and conduct regular evaluations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Management also needs to assess whether internal audit has provided relevant insights, delivered reports in a timely manner, and driven tangible control improvements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>See also:<\/strong> <a href=\"https:\/\/audithink.com\/en\/article\/quality-assurance\/\" data-type=\"post\" data-id=\"3305\">Quality Assurance: Understanding, Salary, Duties, &amp; Responsibilities<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Documents that Companies Need to Prepare<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To support the implementation of internal audit standards in Indonesia, companies need to prepare at least:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Internal Audit Charter.<\/li>\n\n\n\n<li>Internal auditor code of ethics.<\/li>\n\n\n\n<li>Audit manual or methodology.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/audithink.com\/en\/article\/audit-universe\/\" data-type=\"post\" data-id=\"3775\">Audit universe<\/a><\/strong>.<\/li>\n\n\n\n<li>Risk assessment.<\/li>\n\n\n\n<li>Annual audit plan.<\/li>\n\n\n\n<li>Audit resource plan.<\/li>\n\n\n\n<li>Letter of assignment.<\/li>\n\n\n\n<li>Audit work program.<\/li>\n\n\n\n<li>Worksheet template.<\/li>\n\n\n\n<li>Evidence storage mechanism.<\/li>\n\n\n\n<li>Findings assessment matrix.<\/li>\n\n\n\n<li><strong><a href=\"https:\/\/audithink.com\/en\/article\/internal-audit-report-quality-standards\/\" data-type=\"post\" data-id=\"3916\">Audit report template<\/a><\/strong>.<\/li>\n\n\n\n<li>List of recommendations and action plans.<\/li>\n\n\n\n<li>Follow-up monitoring procedures.<\/li>\n\n\n\n<li>Quality assurance and improvement program.<\/li>\n\n\n\n<li>List of competencies and auditor training.<\/li>\n\n\n\n<li>Conflict of interest management policy.<\/li>\n\n\n\n<li>Document retention and confidentiality policy.<\/li>\n\n\n\n<li>Internal audit function performance report.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The document needs to be tailored to the size, characteristics, risks and level of complexity of the company.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Challenges of Implementing Internal Audit Standards<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some of the challenges that companies often face include:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Insufficient independence<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Auditors may experience difficulties when their reporting lines are below the unit being audited or when the scope of the audit is limited by management.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Planning is not yet risk-based<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Audit programs still focus on routine cycles without connecting them to strategic risks and business changes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Documentation is scattered<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Working papers, audit evidence, auditee responses, and monitoring recommendations are stored in separate emails or files, making them difficult to trace.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Auditor competency is not yet evenly distributed<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Changing technology and business models require auditors who understand not only finance, but also digital risk, information security, operations, and data analysis.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Late follow-up<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Audit recommendations are not resolved promptly due to the lack of clear accountability, deadlines, reminders, and escalation mechanisms.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The audit has not yet produced strategic insights<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The report focused too much on administrative errors without identifying root causes, business risks, or process improvement opportunities.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The Role of Technology in Supporting Compliance with Audit Standards<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing standards doesn't just depend on policy documents. Companies also need consistent, documented, and easily monitored processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The use of internal audit applications can help companies in:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Compile audit universe and risk assessment.<\/li>\n\n\n\n<li>Manage the annual audit plan.<\/li>\n\n\n\n<li>Distribute tasks to team members.<\/li>\n\n\n\n<li>Store paperwork centrally.<\/li>\n\n\n\n<li>Documenting evidence and test results.<\/li>\n\n\n\n<li>Carrying out review and approval processes.<\/li>\n\n\n\n<li>Managing findings and recommendations.<\/li>\n\n\n\n<li>Monitor action plans.<\/li>\n\n\n\n<li>Send follow-up reminders.<\/li>\n\n\n\n<li>Provides an audit status dashboard.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Technology does not replace the auditor's professional judgment. However, an integrated system can improve the traceability, consistency, transparency, and efficiency of the audit process.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Internal audit standards in Indonesia do not consist of just one guideline that applies to all organizations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Private companies can refer to The IIA's Global Internal Audit Standards. Government Internal Auditors use SAIPI, while issuers, public companies, and financial services institutions must comply with OJK regulations and their respective sector regulations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Regardless of the standards used, the internal audit function needs to meet the principles of integrity, objectivity, independence, competence, risk-based planning, adequate documentation, communication of results, follow-up monitoring, and continuous quality improvement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing the right standards will help companies transform internal audit from a mere audit function to a strategic partner in strengthening governance, managing risk, and improving operational effectiveness.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently Asked Questions <\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What internal audit standards apply in Indonesia?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">The standards used depend on the type of organization. Companies can refer to The IIA's Global Internal Audit Standards. Government organizations use SAIPI, while issuers and public companies must comply with OJK regulations regarding Internal Audit Units and Charters.<br><\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is the difference between GIAS and SAIPI?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">GIAS is a global standard published by The IIA and can be used by various types of organizations. SAIPI is a standard specifically used in government internal audit activities in Indonesia.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>Is SPAP used by internal auditors?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">SPAP is primarily used by public accountants in providing professional services, including audits of financial statements. Internal auditors use internal audit professional standards and regulations appropriate to their organization or industry.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>How does a company know that the audit function is up to standard?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Companies can conduct gap analysis, self-assessments, internal reviews, performance measurements, and external assessments by competent and independent parties. The evaluation results are then used to develop quality improvement plans.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What internal audit standards apply in Indonesia?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Yes. Internal audit applications can help standardize workflows, centralize documentation, maintain audit trails, manage reviews, and monitor findings and follow-up. However, audit decisions and conclusions still require the auditor's professional judgment.<\/p>\n<\/details>\n\n\n\n<h2 class=\"wp-block-heading\">Improve Internal Audit Management with Audithink<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing audit standards requires a structured process, consistent documentation, and transparent follow-up monitoring.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong><a href=\"https:\/\/audithink.com\/en\/\" data-type=\"page\" data-id=\"794\">Audithink<\/a><\/strong> helps organizations digitize and manage internal audit processes in one more integrated system. <strong><a href=\"https:\/\/audithink.com\/en\/demo\/\" data-type=\"page\" data-id=\"1010\">Try the free demo now<\/a><\/strong> to get various access\/features offered by Audithink.<\/p>","protected":false},"excerpt":{"rendered":"<p>Standar audit internal di Indonesia merupakan pedoman yang digunakan untuk memastikan fungsi audit internal dilaksanakan secara profesional, independen, objektif, berbasis risiko, dan memberikan nilai tambah bagi organisasi. Namun, tidak terdapat satu standar yang diterapkan secara seragam kepada seluruh organisasi. Pedoman yang harus digunakan bergantung pada status organisasi, sektor industri, serta regulasi yang berlaku. Perusahaan swasta [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5272,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[15],"tags":[27],"class_list":["post-5271","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-manajemen-audit"],"acf":[],"_links":{"self":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/5271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/comments?post=5271"}],"version-history":[{"count":1,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/5271\/revisions"}],"predecessor-version":[{"id":5273,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/5271\/revisions\/5273"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media\/5272"}],"wp:attachment":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media?parent=5271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/categories?post=5271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/tags?post=5271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}