{"id":7712,"date":"2026-10-23T21:21:55","date_gmt":"2026-10-23T14:21:55","guid":{"rendered":"https:\/\/audithink.com\/?p=7712"},"modified":"2026-10-29T13:56:59","modified_gmt":"2026-10-29T06:56:59","slug":"internal-audit-standards","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/standar-audit-internal\/","title":{"rendered":"Differences between SPAP and Internal Audit Standards in Corporate Governance"},"content":{"rendered":"<figure class=\"wp-block-image size-full is-resized\"><img fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"360\" src=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-38.jpeg\" alt=\"internal audit standards\" class=\"wp-image-7713\" style=\"width:800px;height:auto\" title=\"\" srcset=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-38.jpeg 640w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-38-300x169.jpeg 300w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-38-18x10.jpeg 18w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\">Photo by Vitaly Gariev on Unsplash<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/audithink.com\/en\/article\/external-auditor-profession\/\" data-type=\"link\" data-id=\"https:\/\/audithink.com\/blog\/profesi-auditor-eksternal\/\">External Auditor<\/a> assess the fairness of financial statements, while internal auditors evaluate a company's business processes and controls. Both have different professional standards and responsibilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Read this article to understand the difference between SPAP and <a href=\"https:\/\/audithink.com\/en\/article\/internal-audit-standards-in-indonesia\/\" data-type=\"link\" data-id=\"https:\/\/audithink.com\/blog\/standar-audit-internal-di-indonesia\/\">internal audit standards<\/a>, including the role of KAP, SKAI, and the synergy between the two in strengthening corporate governance.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Understanding the Foundations of Financial and Operational Business Oversight<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SPAP are the Professional Standards for Public Accountants, which serve as a professional reference for public accounting engagements. Meanwhile, internal audit standards regulate the implementation of the internal audit function in evaluating governance, risk management, and organizational controls.<br><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The two are not interchangeable. SPAP is relevant for the professional work of public accountants, while the Institute of Internal Auditors' (IIA) Global Internal Audit Standards (GIAS) serve as the professional framework for internal auditing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Role of External Auditors and Internal Auditors in the Three Lines Model<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">External and internal auditors have different relationships with the organizations they audit. External auditors provide independent assurance through specific engagements, while internal auditors systematically evaluate organizational processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the Three Lines Model, the responsibilities of governance, management, and internal audit are differentiated based on their respective functions.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>First line:<\/strong> Operational management carries out activities and manages day-to-day risks.<\/li>\n\n\n\n<li><strong>Second line:<\/strong> The risk and compliance function provides support, monitoring, and challenges to risk management.<\/li>\n\n\n\n<li><strong>Third line:<\/strong> Internal audit provides an independent and objective assessment of governance, risk, and control.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">External auditors are not a separate entity within this model. They contribute as external assurance providers and coordinate with the organization as mandated.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Urgency of Independence in Maintaining Organizational Accountability<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The independence of external auditors is necessary to maintain the objectivity of the opinion on the financial statements. Auditors must meet the independence and ethical requirements applicable to their engagement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/audithink.com\/en\/article\/internal-audit\/\" data-type=\"link\" data-id=\"https:\/\/audithink.com\/blog\/internal-audit\/\">Internal audit<\/a> It also requires organizational independence and individual objectivity. The internal audit function ideally has access to the board or audit committee and protection from interference that could impair its judgment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The difference lies in the context of independence and mandate. External auditors must be independent of the entity as per the terms of the engagement, while internal auditors work within the organizational structure with adequate independence safeguards.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Dissecting the SPAP Standard Guidelines for Public Accounting Firms (KAP)<\/h2>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img decoding=\"async\" width=\"640\" height=\"427\" src=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-39.jpeg\" alt=\"\" class=\"wp-image-7714\" style=\"aspect-ratio:1.5;width:800px;height:auto\" title=\"\" srcset=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-39.jpeg 640w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-39-300x200.jpeg 300w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/10\/image-39-18x12.jpeg 18w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/figure>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\">Photo by Giorgio Tomassetti on Unsplash<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The SPAP covers professional standards for various types of public accounting engagements. In a financial statement audit, Auditing Standards (SAs) address the auditor's responsibilities in obtaining evidence and forming an opinion. For an overview of the framework, see <a href=\"https:\/\/audithink.com\/en\/article\/audit-standards\/\">audit standards<\/a>, read the explanation on Audithink.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">These standards cover audit planning, assessing the risks of material misstatement, testing procedures, documentation, and reporting. The auditor must base his or her conclusions on sufficient appropriate audit evidence.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">IAPI Institution Mandate and Financial Report Opinion Regulations<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The Indonesian Institute of Certified Public Accountants (IAPI) plays a role in developing professional standards for public accountants in Indonesia. Its published standards include Auditing Standards and other standards appropriate to the type of engagement.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a financial statement audit, the auditor issues an opinion based on the audit results and the applicable financial reporting framework. This opinion helps users assess whether the financial statements are presented fairly in all material respects.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An audit opinion is not a guarantee that a company is free from all fraud or error. An audit provides reasonable assurance, not absolute assurance, regarding the financial statements being reviewed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Focus of Historical Testing and Materiality of Financial Transactions<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A financial statement audit generally assesses financial information for a prior period. The auditor identifies the risks of material misstatement and designs appropriate procedures.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Materiality helps determine whether an error or omission could potentially influence the decisions of users of financial statements. Its assessment involves professional judgment, not just a specific nominal threshold.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/audithink.com\/en\/article\/audit-procedures\/\" data-type=\"link\" data-id=\"https:\/\/audithink.com\/blog\/prosedur-audit\/\">Audit procedure<\/a> may include testing of transactions, examining supporting documents, external confirmations, analytical procedures, and tests of controls. The selection of procedures depends on the risk and evidence needed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Internal Audit Standards Framework Based on Global Internal Audit Standards (IIA)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The 2024 edition of the Global Internal Audit Standards became effective on January 9, 2025. These standards are part of the International Professional Practices Framework (IPPF) and govern the professional practice of internal auditing globally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">GIAS covers five domains: the purpose of internal audit, ethics and professionalism, governance of the internal audit function, management of the internal audit function, and implementation of internal audit services.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Its implementation must take into account the mandate, governance, and applicable regulations of the organization. Companies must also ensure that the standards are adopted in accordance with relevant needs and obligations. In practice, these internal audit standards serve as guidelines for internal audit leaders in developing policies and methodologies.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Duties of the Internal Audit Unit (SKAI) and the Role of Management Consulting<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Internal Audit Unit (SKAI) is a term commonly used for the internal audit function in the banking sector. Non-banking companies may use different names, such as internal audit division or internal audit unit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This function evaluates controls, identifies process weaknesses, and provides recommendations for improvement. Internal auditors may also provide consulting services within their mandate without assuming management responsibilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For example, internal auditors can assess procurement effectiveness, information system security, inventory management, and procedural compliance. The results help management improve processes before weaknesses develop into larger problems.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Continuous Risk-Based Audit Approach<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/audithink.com\/en\/article\/risk-based-audit\/\" data-type=\"link\" data-id=\"https:\/\/audithink.com\/blog\/risk-based-audit\/\">Risk-based audit<\/a> Prioritize areas that could potentially hinder the achievement of organizational objectives. Audit planning considers the impact of risks, the likelihood of occurrence, business changes, and the effectiveness of controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unlike audits that focus solely on historical transactions, internal audits can assess emerging operational and strategic risks. Examples include supply chain disruptions, system access vulnerabilities, and non-compliance risks.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Audit plans need to be reviewed as the risk profile changes. This approach makes oversight more relevant to the organization's needs, without diminishing the importance of documentation and audit evidence.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Comparative Analysis of IAPI SPAP vs IIA Standards<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The main differences between SPAP and internal audit standards lie in the purpose, mandate, and users of audit results. SPAP regulates the professional work of public accountants, while GIAS regulates the internal audit function.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison Table of Differences between KAP and SKAI<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Aspect<\/strong><\/td><td><strong>External auditor (KAP)<\/strong><\/td><td><strong>Internal auditor (SKAI\/internal audit function)<\/strong><\/td><\/tr><tr><td>Primary standard<\/td><td>SPAP, including SA for auditing financial statements<\/td><td>GIAS and relevant internal or sectoral provisions<\/td><\/tr><tr><td>Purpose<\/td><td>Provide opinions or conclusions according to the type of engagement<\/td><td>Evaluate and improve governance, risk and control<\/td><\/tr><tr><td>Position<\/td><td>External parties appointed for the engagement<\/td><td>Functions within the organization<\/td><\/tr><tr><td>Scope<\/td><td>In accordance with the engagement letter and related standards<\/td><td>Based on the mandate, audit plan and risk assessment<\/td><\/tr><tr><td>Orientation<\/td><td>Much focus is placed on the fairness of financial statements in financial statement audits.<\/td><td>Can include financial, operational, compliance, and technology processes.<\/td><\/tr><tr><td>Reporting<\/td><td>Auditor's report for intended users<\/td><td>Report findings and recommendations to the authorities<\/td><\/tr><tr><td>Frequency<\/td><td>Following the requirements and provisions of the agreement<\/td><td>Following the audit plan and risk changes<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The table provides a general overview. The actual scope depends on the type of engagement, functional mandate, regulations, and organizational requirements.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Synergy of External Auditors vs Internal Auditors in Internal Control Systems<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Coordination between external and internal auditors can reduce duplication of work and help identify risk areas. However, coordination does not eliminate the responsibilities of each auditor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The external auditor remains responsible for the opinion he or she issues. The use of internal audit work may only be made if it meets the requirements of relevant internal auditing standards, including an evaluation of the function's objectivity and competence.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Companies can support coordination through consistent documentation, risk mapping, and follow-up on findings. Access to evidence must also comply with confidentiality and information security requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SPAP and GIAS have different functions, but both can support stronger governance. External auditors focus on their engagement mandate, while internal audit helps the organization continuously evaluate risks and controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To organize documentation and audit processes in a more structured manner, <a href=\"https:\/\/audithink.com\/en\/\">visit Audithink<\/a> and <a href=\"https:\/\/audithink.com\/en\/demo\/\">schedule a demo<\/a> to discuss oversight needs and evaluate the system's suitability for your company's audit processes.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is the difference between SPAP and internal audit standards?<\/summary>\n<p class=\"wp-block-paragraph\">SPAP regulates the professional standards of public accountants, while GIAS is the professional framework for internal audit to evaluate governance, risk, and control.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Who uses SPAP in conducting audits?<\/summary>\n<p class=\"wp-block-paragraph\">Public accountants use relevant standards in carrying out their professional engagements, including audits of financial statements by KAP.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>What is the difference between an external auditor and an internal auditor?<\/summary>\n<p class=\"wp-block-paragraph\">External auditors perform independent engagements according to their mandate, while internal auditors evaluate organizational processes and provide recommendations for improvement.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Are GIAS standards mandatory for all companies?<\/summary>\n<p class=\"wp-block-paragraph\">Implementation depends on the internal audit function's mandate, organizational adoption, and applicable regulations. Companies should review their sectoral obligations and governance.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>How does audit software help the internal audit function?<\/summary>\n<p class=\"wp-block-paragraph\">Audit software can help manage documentation, monitor findings, and track follow-up actions based on available features. The system does not replace the auditor's professional judgment.<\/p>\n<\/details>","protected":false},"excerpt":{"rendered":"<p>External auditors assess the fairness of financial statements, while internal auditors evaluate comprehensive business processes. Learn how the roles of Public Accounting Firms (KAP) and Internal Audit Units (SKAI) differ, and the importance of synergy between the two in strengthening corporate governance.<\/p>","protected":false},"author":24,"featured_media":7726,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","rank_math_title":"Perbedaan SPAP dan Standar Audit Internal Perusahaan","rank_math_description":"Kenali perbedaan SPAP dan standar audit internal, mulai dari peran KAP dan SKAI hingga risiko, independensi, dan tata kelola.","rank_math_canonical_url":"","rank_math_focus_keyword":"standar audit internal","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_twitter_title":"","rank_math_twitter_description":"","_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"","_yoast_wpseo_canonical":"","_yoast_wpseo_focuskw":"","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","rank_math_robots":[]},"categories":[15],"tags":[30],"class_list":["post-7712","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-kebijakan-audit"],"acf":[],"_links":{"self":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/7712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/users\/24"}],"replies":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/comments?post=7712"}],"version-history":[{"count":2,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/7712\/revisions"}],"predecessor-version":[{"id":7727,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/7712\/revisions\/7727"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media\/7726"}],"wp:attachment":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media?parent=7712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/categories?post=7712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/tags?post=7712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}