The new edition of the institute’s ‘Guidance on Effective Internal Audit in Financial Services’, widely known as the Financial Services Code, will be published on 1 September.

It has been produced following consultation with the industry and with the support of the Bank of England, Prudential Regulation Authority, Financial Conduct Authority, and Financial Reporting Council.  

The key changes to the code include requiring internal audit to report annually to the board on whether firms are adhering to their own risk appetite framework, and to review the action taken by the firm following any significant adverse event, such as regulatory breaches, including the roles of all the key actors.

The code also spells out that internal audit’s plans must be regularly reviewed to take account of new and emerging risks, as well as underlining the central role that internal audit should play in assessing the culture of the firm.

The IIA says the code emphasises that internal audit should look not only at the ‘tone at the top’, but also at whether behaviours right across organisations are in line with its stated values, ethics, risk appetite and policies, and report on its findings.

Under the code’s new provisions, internal audit is also required to look critically at the work of the organisation’s other control functions, in terms not only of their processes but also their quality.
Ian Peters, IIA’s chief executive, said: ‘The new code should make internal audit an even stronger watchdog in managing risk effectively in UK financial services.

‘The code has already made a real difference to the profile and authority of internal audit since it was published in 2013.  It has driven real improvements in performance across the sector, especially in the area of culture.  But the time has come to go further.

‘It is not just about changing the “tone at the top” but about helping to achieve a sea change in culture in banks and financial services firms – a shift in attitudes and behaviours. To achieve this, there needs to be systematic and objective assessment of behaviour at the frontline, not just in the boardroom.’

The original code was published by the institute in July 2013, in the aftermath of the 2008 global financial crisis, and was prompted by an analysis of its causes and by governance, risk management and control failures including LIBOR and rogue trader scandals.   

The latest review was conducted by an independent committee of senior industry figures, chaired by Mike Ashley, chair of the audit committee of Barclays, with the support of regulators and involved two rounds of consultation with the sector.