Www.theiia.org/Quality Speaker: Who Audits the Auditors? The value of Internal and External Quality Assessments

www.theiia.org/Quality

Speaker:

Who Audits the Auditors?The value of Internal and External Quality Assessments


Speaker Background Information


Topics we will cover Today


Key Areas of Discussion Today

Quality Improvement & Assurance Program

External quality assessments and why your audit group should have one

What to expect from an external QA

How to get the most value from a QA

How an Audit professional should prepare for a QA


Some areas we will NOT talk about today

All of the Standards with which you need to comply to pass a QA

All of the components of an effective quality program

There just isn’t enough time to do this and the IIA and other organizations have seminars, books and CDs covering these topics


A Show of Hands

How many Internal Audit Activities have a QA&IP in place today?


A Show of Hands

How many work for an organization that has had an external QA?


A Show of Hands

How many work for an organization that has not had an external QA?

Is anyone planning to have one?


A Show of Hands

How many have been part of an external QA

team?


Does this look familiar?

http://www.theiia.org/guidance/standards-and-practices/professional-practices-framework/


Standard 1300 Quality Assurance and Improvement

Standard 1310 Quality Program Assessments

Standard 1311 Internal Assessments

Standard 1312 External Assessments

Have you read the Quality Standards?


Standard 1300: Quality Assurance and Improvement

Program (QA&IP)

The chief audit executive mustmust develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity and continuously monitors its effectiveness. The program mustmust be designed to help the internal auditing activity add value and improve the organization’s operations and to provide assurance that the internal audit activity is in conformity with the Standards and the Code of Ethics.


Why is a Quality Assurance & Improvement Program necessary?

As an Organization and its Internal Audit As an Organization and its Internal Audit shops grow, its operations undergo shops grow, its operations undergo refinement, and its internal processes refinement, and its internal processes change and evolve, its quality monitoring change and evolve, its quality monitoring process must keep pace. process must keep pace.

Quality Assurance and Improvement

Program


Quality and Improvement

ProgramWhat would be the elements of a Quality and Improvement Program?

QA


1311: Internal Assessments

Must include:

• Ongoing reviews of the performance of the internal audit activity; and

• Periodic reviews performed through self-assessment or by other persons within the organization, with knowledge of internal auditing practices and the Standards.

• Person(s) conducting assessment can be part of internal audit activity or from another area in the company.


Some Elements of a QA&IP• Staff Information (education, skills, certifications)

• Audit Plan Budget to Actual

• Audit Cycle Time

• Issues and Recommendations Tracking

• Customer Satisfaction Survey

• Staff Meeting

• Benchmarking to Best Practices

• Training

• Work Paper Review (ongoing)

• QA Review Action Plan


• List here.

Balanced Scorecard for Internal Auditing

Board/Audit Committee

OBJECTIVES MEASURES

• List here.

• List here.

Management/Audit Customers

OBJECTIVES MEASURES

• List here.

• List here

Innovation/Capabilities

OBJECTIVES MEASURES

• List here.

• List here.

Internal Audit Processes

OBJECTIVES MEASURES

• List here.

INTERNAL AUDITSTRATEGY

CORPORATESTRATEGY

• Experience

• Education

• Training

• Certification

• Reporting Relationships

• Expectations

• Perspective on IA Roles

• Satisfaction Surveys

• Requests

• Complaints

• Importance Levels

• Improvements

• Findings

• Repeat Findings

• Savings

• Quality Assessment

• Perspective on IA Roles

• Satisfaction Surveys

• Risk Concerns

• CAE/AC Private Meetings


What is the Value of Quality to Internal Audit

ABC Organization

Internal Audit

Executive Level

At this level Internal Audit is not considered a valued resource to the Organization



ABC Organization

Internal Audit

Executive Level

As the Quality of Internal Audit increases the acceptance at the Executive Level gets Internal Audit closer



ABC Organization

Executive LevelInternal

Audit

Once Quality is achieved Internal Audit is embraced by the Executive Level as a valuable resource within the Organization


Who’s Responsible for the Quality of Internal Audit?

• Organization

• Chief Audit Executive (CAE)

• Internal Audit Profession

• IA Stakeholders

(AC, BOD, Regulatory Body, Sr. Mgmt)

• Internal Auditor specially CIA’s

Who Will Benefit?


Professionalism & Commitment

• The Drive to be the Best

• Success (individual & organization)

• “Persistence with a Purpose”

• Professional Development

• The Pride to be an Internal Auditor


By the way, what’s an external quality assessment (QA)?

Professional standards require each internal audit function to obtain an external quality assessment at least once every five years (Standard 1312)


IIA Code of Ethics

International Standards for the Professional Practice of Internal Auditing

Audit committee & internal audit charters

Professional certification and education

Process improvement & best practices

What’s the focus of an external QA?


Interview & survey stakeholders

Assess compliance with the IIA Code of Ethics

and the Standards

Assess charters, policies & procedures

Review staff experience & qualifications

Inspect workpapers

What happens in an external QA?


What are the benefits of an external QA?

Expert advice & counsel from practitioners with decades of experience and broad exposure to the best IA functions

Sounding Board

Leverage for funding, authority, independence & training

Visibility

Pipeline to the audit committee & senior management


HBS or equivalent executive training program for CAE

Staffing increases

Training and certification support

Implementation of CAATs

Making a difference…


Why have an external QA?

Professional credibilityOrganizational credibilityLegal liabilityCompliance with StandardsContinuous improvementAudit Committee oversight


Why are some IA functions not in compliance?

28% of IA functions are less than 5 years oldInternal audit is not regulatedUnaware of the requirementUnfazed by the penaltyCosts in money and time

(The IIA Common Body of Knowledge survey reports

39% of IA functions have never had an external QA)


Inadequate Quality Assurance & Improvement Program

Consulting omitted from the mission and charter

Inadequate IT coverage or technical skills

Lack of performance measures

What problems are commonly found?


Inappropriate CAE reporting relationships

Out-of-date charters

Client perception of inadequate audit staff knowledge

No formalized risk assessment process

What problems are commonly found?


What Does It *Cost?

Number of Internal

Audit Staff

Average Size of

External QA Team

Average IA Staff

Preparation (Hours)

Avg IA Staff

Support of QA Team

(Hrs)

Average Time to

Complete QA (Days)

Average Cost

1 to 2 2 200 33.5 6.6 $13,000

3 to 6 3 110 40 4.2 $15,000

7 to 15 4 100 60 5 $22,000

16 to 20 3 90 70 9.2 $35,000

21 to 30 6 135 60 9 $42,000

31 to 50 5 N/A N/A 10.5 N/A

51 to 70 6 80 50 13 $75,000

71 to 100 3 200 120 20 $80,000

*Source: IIARF Survey April 2007


How long does an external QA take?

RFP 8/1 – 8/15Prepare background info 9/1- 9/15Stakeholder surveys 9/15 – 9/30

A sample timeline…

GAIN data input on IIA website 9/15Preliminary meeting 10/15 On-site fieldwork 10/30 – 11/3Issue draft report 11/15Receive reply to draft report 11/22Issue final report 11/29


What is a self-assessment with independent validation (SAIV)?

Perform your own internal assessment and then…

Engage an independent party to review your work


What’s the advantage of the SAIV?

It costs less!


What’s the trade-off for a SAIV?

Independence

Outside perspective

Expertise

Board leverage

Senior management leverage

Oomph

Diminished:

Requires IAA to budget more resources


What should you do?

If you can’t get the budget for an external QA, go the SAIV route to get into compliance

Consider SAIV for your 1st QA and follow-up with an external QA in 2-3 years


What about peer reviews?

“Even if he is lucky, the best barber can count on no more than the 2nd best haircut”

Issues: quality, independence, experience, industry knowledge, confidentiality, etc.


How long does an SAIV take?

RFP 8/1 – 8/31Prepare self-assessment 9/1- 9/30Stakeholder surveys 9/15 – 9/30

A sample timeline…

GAIN data input on IIA website 9/15Preliminary meeting 10/15 On-site validation 10/30 – 11/1Issue draft report 11/15Receive reply to draft report 11/22Issue final report 11/29


IIA Recognition Plaque

Organizations that have an external quality assessment completed by The IIA with a “General Conformance” opinion will receive a recognition plaque


Where to Find Quality Resources?

• Free Web-Based Resources by IIA Inc. and IIA Affiliates (www.theiia.org /Quality)

• QA training seminars by IIA Inc. and IIA Affiliates

• Local Chapters and Study Groups

• Quality Services by IIA Inc., Affiliates, and Other Service Providers


Time for….

Questions???


This presentation is from

The Institute of Internal Auditors

Global Headquarterswww.theiia.org

Contact us at [email protected]

Documents

Www.theiia.org/Quality Speaker: Who Audits the Auditors? The value of Internal and External Quality Assessments