About

Through the Institute of Internal Auditors (IIA), Kaya Kwinana in 2007:

1. successfully completed the Certified Internal Auditor (CIA) examination and

2. was certified to assess internal audit functions for conformance with the International Professional Practices Framework (IPPF) then in force.

Kaya has since then written six books on internal auditing:

1. Understand Internal Auditing
The message: Internal auditors have a specific area of expertise. They are not jacks of all trades and masters of none. They operate as internal auditors only when operating within that area of expertise.

2. Developing The Internal Audit Plan
The message: An appropriate internal audit plan proposes engagement areas objectively and on a top down basis.

3. Internal Audit Engagement Planning
The message: Adequate internal control is a pre-requisite for assurance engagements and the source of the criteria for assessing its implementation. Secondly, the engagement plan should distinguish between internal control concerns (which are part of the area of expertise of internal auditing) and operational concerns (which are not).

4. Internal Audit Plans Need Revisiting
The message: Adequate internal control requires no less than full coverage of an organisation. Incorporating the concept of self-assessment with independent validation in the development of internal audit plans makes this possible.

5. Risk Based Internal Auditing
The message: Risk Based Internal Auditing (RBIA) is not the same thing as Risk Based Auditing (RBA). The book shows how an internal audit engagement conducted in accordance with the mandatory IPPF guidance does constitute RBIA.

6. Risk Appetite
The message: The manner in which risk appetite is developed, by whom, when and consequences should be addressed and prescribed by adequate internal control, but are often not. The books suggests how this should be done.

The foundation laid in the above books remains valid:

Internal auditing is a service that provides consulting (advice) on adequate internal control and assurance (independent assessments) on the implementation of that adequate system of internal control.

Internal control is the framework through which a governing body communicates to employees how the organisations expects them to anticipate and appropriately address risks (opportunities and threats) facing their respective organisations.

Every employee must implement his/her organisation's system of internal control in his/her responsibility area.