The Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing (“Standards”) Section 1312 requires that an external assessment of the internal audit department be conducted at least once every five years by a qualified, independent assessor from outside the organization. This external assessment evaluates the internal audit department’s conformance with the Standards and assesses the efficiency and effectiveness of the internal audit department.
The assessment can take on two forms. The first is a self-assessment conducted by the internal audit department and then validated by an external party, defined by the IIA as a Self-Assessment with Independent Validation. The second is a fully outsourced external assessment. Each has advantages and disadvantages as compared to each other, however both require the independent reviewer to be qualified. In order to be deemed qualified the external assessor must demonstrate competence with their knowledge of the Standards and their experience conducting external assessments. (IIA QAR Implementation Guide – IIA members only)
The external assessor should adhere to the IIA QAR guidelines and leverage the templates and tools prescribed by the IIA. The combination of the IIA tools and an experienced quality assessor will enable the assessment to be efficient and effective, while providing best practices and performance measures for continuous improvement.
In accordance with The IIA’s Guidance and Tools, the quality assessor should:
- Perform an off-site review of supporting documents and other advance materials prepared by the internal audit department.
- Validate the preliminary plan with the internal audit department to clarify information and add details to the work plan.
- Conduct an interview with the internal audit department to gather information and document its compliance with the Standards.
- Perform off-site work, including limited tests of source documents (risk assessments, work papers of audit and consulting projects and audit planning documents).
- Evaluate internal audit’s policies, procedures and processes against the Standards.
- Evaluate the risk assessment process, the internal audit scoping process, and annual or periodic internal audit planning process.
- Conduct brief interviews with selected members of the board (audit committee), executive management, and operating managers, to get an independent indication as to the effectiveness and credibility internal audit, the appropriateness of its authority and scope, and opportunities for improvement.
- Evaluate internal audit’s effectiveness in providing assurance and advisory services, including the accountability process for identified audit issues.
- Evaluate the capabilities, credentials, experience, and qualifications of the internal audit team.
Optional: Internal Audit Best Practice Analysis
The quality assessor can include an internal audit best practice assessment by using information found in the IIA Global Audit Information Network (“GAIN”) report. GAIN is a comprehensive annual benchmarking study conducted by the IIA with participants in 17 industries, 126 sub-industries and 44 countries. It provides the ability to benchmark internal the audit activity against those in peer groups. It enables a comparison of the internal audit department’s size, experience, and other metrics against the averages of similar organizations. Metrics include:
- Organizational statistics.
- Department staffing and costs.
- Oversight including audit committee information.
- Operational measures including audit lifecycles.
- Performance measures.
- Risk assessment and audit planning information.
Optional: Internal Audit Maturity Analysis
IIA Internal Audit Capability Maturity Model (IA-CM) is a framework that identifies the fundamentals needed for an effective Internal Audit department. Rather than aligning strictly with the Institute of Internal Audit standards, this framework provides flexibility for organizations that use internal audit in varying manners and ties to leading practices within internal audit. It illustrates the levels and stages through which an internal audit department can evolve as it defines, implements, measures, controls, and improves its processes and practices. Originally created for the Public Sector, it can be modified for use with all organizations.
The IA-CM framework identifies the fundamentals needed for effective internal auditing and classifies them into six Essential Elements.
- Services and Role of Internal Audit
- People Management
- Professional Practices
- Performance Management and Accountability
- Organizational Relationships and Culture
- Governance Structures
Each element will be evaluated based on its capability level maturity, which is detailed below:
- Initial: No sustainable repeatable capabilities
- Infrastructure: Sustainable and repeatable internal audit practices and procedures
- Integrated: Internal audit management and professional practices uniformly applied
- Managed: Internal audit integrates information from across the organization to improve governance and risk management
- Optimized: Internal audit learning from the inside and outside the organization for continuous improvement
The IIA Standards apply to both individual internal auditors and to internal audit departments. Most internal audit departments state that they adhere to the IIA Standards, which means the requirements under Section 1312 must be met. It is a critical piece to assuring quality and consistency across the profession, thereby increasing the profile of the global internal audit community.
This blog post was authored by Steven Randall. Steve is a Managing Partner with Vonya Global, a premier provider of internal audit co-sourcing, outsourcing, and consulting services; a member of the Institute of Internal Auditors (IIA) Chicago Chapter Board of Governors; a Director of the Adler-Caris Foundation, a not-for-profit dedicated to raising funds for Alzheimer’s Disease research; the President of the Oz Park Baseball Association, a not-for-profit organization dedicated to providing fundamental based baseball in a safe environment in the city of Chicago; and an Advisory Board Member of the Chicago Youth Baseball Initiative, a University of Illinois at Chicago community group dedicated to providing Chicago youth with the opportunity to play baseball in a fun and safe environment, while offering educational experiences on a world-class college campus. If you would like more information about Vonya Global or if you have a question for Steve, you may contact him through this blog, the company website, twitter, or his LinkedIn Profile.