7/29/2019 Who Audits the Auditors Presentation
1/43
www.theiia.org/Quality
Speaker:
Who Aud its the Aud itors?
The value of In ternal andExternal QualityAssessments
7/29/2019 Who Audits the Auditors Presentation
2/43
www.theiia.org/Quality
Speaker Background Information
7/29/2019 Who Audits the Auditors Presentation
3/43
www.theiia.org/Quality
Topics we will cover Today
7/29/2019 Who Audits the Auditors Presentation
4/43
www.theiia.org/Quality
Key Areas o f Discussion Today
Quality Improvement & Assurance Program
External quality assessments and why youraudit group should have one
What to expect from an external QAHow to get the most value from a QA
How an Audi t
profess ional should
prepare for a QA
7/29/2019 Who Audits the Auditors Presentation
5/43
www.theiia.org/Quality
Some areas we wi l l NOT talk about today
All of the Standards with which you need to complyto pass a QA
All of the components of an effective quality
program
There just isnt enough time to
do this and the IIA and other
organizations have seminars,
boo ks and CDs cover ing these
topics
7/29/2019 Who Audits the Auditors Presentation
6/43
www.theiia.org/Quality
A Show of Hands
How many Internal
Audit Activities have aQA&IP in place today?
7/29/2019 Who Audits the Auditors Presentation
7/43
www.theiia.org/Quality
A Show of Hands
How many work for an
organization that hashad an external QA?
7/29/2019 Who Audits the Auditors Presentation
8/43
www.theiia.org/Quality
A Show of Hands
How many work for an
organization that has not
had an external QA?
Is anyone planning tohave one?
7/29/2019 Who Audits the Auditors Presentation
9/43
www.theiia.org/Quality
A Show of Hands
How many have been
part of an external QAteam?
7/29/2019 Who Audits the Auditors Presentation
10/43
www.theiia.org/Quality
Does this look
famil iar?
http://www.theiia.org/guidance/standards-and-practices/professional-practices-framework/
7/29/2019 Who Audits the Auditors Presentation
11/43
www.theiia.org/Quality
Standard 1300
Quality Assurance and Improvement
Standard 1310
Quality Program Assessments
Standard 1311
Internal Assessments
Standard 1312
External Assessments
Have you read the Quality
Standards?
7/29/2019 Who Audits the Auditors Presentation
12/43
www.theiia.org/Quality
Standard1300: QualityAssurance and Improvement
Program (QA&IP)The chief audit executive must develop andmaintain a quality assurance and improvementprogram that covers all aspects of the internalaudit activity and continuously monitors itseffectiveness. The program must be designedto help the internal auditing activity add valueand improve the organizations operations and
to provide assurance that the internal auditactivity is in conformity with the Standards andthe Code of Ethics.
7/29/2019 Who Audits the Auditors Presentation
13/43
www.theiia.org/Quality
Why is a Quality Assurance &Improvement Program necessary?
As an Organization and its Internal Auditshops grow, its operations undergorefinement, and its internal processes
change and evolve, its quality monitoringprocess must keep pace.
Quality Assurance and
Improvement Program
7/29/2019 Who Audits the Auditors Presentation
14/43
www.theiia.org/Quality
Quality and
Improvement ProgramWhat would be the elements of a Qualityand Improvement Program?
QA
7/29/2019 Who Audits the Auditors Presentation
15/43
www.theiia.org/Quality
1311: Internal Assessments
Must include:
Ongoing reviews of the performance of the internalaudit activity; and
Periodic reviews performed through self-assessment or by other persons within theorganization, with knowledge of internal auditingpractices and the Standards.
Person(s) conducting assessment can be part ofinternal audit activity or from another area inthe company.
7/29/2019 Who Audits the Auditors Presentation
16/43
www.theiia.org/Quality
Some Elements of a QA&IP
Staff Information (education, skills, certifications)
Audit Plan Budget to Actual
Audit Cycle Time
Issues and Recommendations Tracking
Customer Satisfaction Survey
Staff Meeting
Benchmarking to Best Practices
Training Work Paper Review (ongoing)
QA Review Action Plan
7/29/2019 Who Audits the Auditors Presentation
17/43
www.theiia.org/Quality
List here.
Balanced Scorecard for Internal Auditing
Board/Audit Committee
OBJECTIVES MEASURES
List here.
List here.
Management/Audit Customers
OBJECTIVES MEASURES List here.
List here
Innovation/Capabilities
OBJECTIVES MEASURES
List here.
List here.
Internal Audit Processes
OBJECTIVES MEASURES
List here.
INTERNAL AUDIT
STRATEGY
CORPORATE
STRATEGY
Experience
Education
Training
Certification
Reporting Relationships
Expectations
Perspective on IA Roles
Satisfaction Surveys
Requests
Complaints
Importance Levels
Improvements
Findings
Repeat Findings
Savings
Quality Assessment
Perspective on IA Roles
Satisfaction Surveys
Risk Concerns
CAE/AC Private Meetings
7/29/2019 Who Audits the Auditors Presentation
18/43
www.theiia.org/Quality
What is the Value of Quality
to Internal AuditABC Organization
InternalAudit
Executive Level
At this level Internal Audit is notconsidered a valued resource tothe Organization
7/29/2019 Who Audits the Auditors Presentation
19/43
www.theiia.org/Quality
What is the Value of Quality
to Internal AuditABC Organization
InternalAudit
Executive Level
As the Quality of Internal Audit increases theacceptance at the Executive Level gets Internal Auditcloser
7/29/2019 Who Audits the Auditors Presentation
20/43
www.theiia.org/Quality
What is the Value of Quality
to Internal AuditABC Organization
Executive LevelInternal
Audit
Once Quality is achieved Internal Audit is embraced by
the Executive Level as a valuable resource within theOrganization
7/29/2019 Who Audits the Auditors Presentation
21/43
www.theiia.org/Quality
Whos Responsible for the
Quality of Internal Audit? Organization Chief Audit Executive (CAE)
Internal Audit Profession
IA Stakeholders
(AC, BOD, Regulatory Body, Sr. Mgmt)
Internal Auditor specially CIAs
Who Will Benefit?
7/29/2019 Who Audits the Auditors Presentation
22/43
www.theiia.org/Quality
Professionalism &
Commitment The Drive to be the Best
Success (individual & organization)
Persistence with a Purpose
Professional Development
The Pride to be an Internal Auditor
7/29/2019 Who Audits the Auditors Presentation
23/43
www.theiia.org/Quality
By the way, whats an external
qual i ty assessment (QA)?
Professional standards require each
internal audit function to obtain anexternal quality assessment at least
once every five years (Standard 1312)
7/29/2019 Who Audits the Auditors Presentation
24/43
www.theiia.org/Quality
IIA Code of Ethics
International Standards for the ProfessionalPractice of Internal Auditing
Audit committee & internal audit charters
Professional certification and education
Process improvement & best practices
Whats the focus of an external QA?
7/29/2019 Who Audits the Auditors Presentation
25/43
www.theiia.org/Quality
Interview & survey stakeholdersAssess compliance with the IIA Code of Ethics
and the Standards
Assess charters, policies & procedures
Review staff experience & qualifications
Inspect workpapers
What happens in an external QA?
7/29/2019 Who Audits the Auditors Presentation
26/43
www.theiia.org/Quality
What are the benefits of an external QA?
Expert adv ice & counsel from pract it ioners w i thdecades of exper ience and broad expo su re to thebest IA func t ions
Sounding Board
Leverage for fund ing, authori ty, independence &training
Visibi l i ty
Pipel ine to the aud it comm ittee & seniormanagement
7/29/2019 Who Audits the Auditors Presentation
27/43
www.theiia.org/Quality
HBS or equivalent executive trainingprogram for CAE
Staffing increasesTraining and certification support
Implementation of CAATs
Making a difference
7/29/2019 Who Audits the Auditors Presentation
28/43
www.theiia.org/Quality
Why have an external QA?
Professional credibilityOrganizational credibility
Legal liabilityCompliance with Standards
Continuous improvementAudit Committee oversight
7/29/2019 Who Audits the Auditors Presentation
29/43
www.theiia.org/Quality
Why are some IA functions
not in compliance?
28% of IA functions are less than 5 years oldInternal audit is not regulatedUnaware of the requirementUnfazed by the penalty
Costs in money and time
(The IIA Common Body o f Knowledge survey reports
39% of IA funct ions have never had an external QA)
7/29/2019 Who Audits the Auditors Presentation
30/43
www.theiia.org/Quality
Inadequate Quality Assurance &Improvement Program
Consulting omitted from the mission and
charter
Inadequate IT coverage or technical skills
Lack of performance measures
What prob lems are commonly found?
7/29/2019 Who Audits the Auditors Presentation
31/43
www.theiia.org/Quality
Inappropriate CAE reportingrelationships
Out-of-date chartersClient perception of inadequate auditstaff knowledge
No formalized risk assessment process
What prob lems are commonly found?
7/29/2019 Who Audits the Auditors Presentation
32/43
www.theiia.org/Quality
What Does It *Cost?
Number ofInternalAudit Staff
Average
Size ofExternal QATeam
Average
IA StaffPreparation(Hours)
Avg IAStaff
Support ofQA Team(Hrs)
Average
Time toCompleteQA (Days)
AverageCost
1 to 2 2 200 33.5 6.6 $13,000
3 to 6 3 110 40 4.2 $15,000
7 to 15 4 100 60 5 $22,000
16 to 20 3 90 70 9.2 $35,000
21 to 30 6 135 60 9 $42,000
31 to 50 5 N/A N/A 10.5 N/A
51 to 70 6 80 50 13 $75,000
71 to 100 3 200 120 20 $80,000
*Source: IIARF Survey April 2007
7/29/2019 Who Audits the Auditors Presentation
33/43
www.theiia.org/Quality
How long does an external QA take?
RFP 8/1 8/15
Prepare background info 9/1- 9/15
Stakeholder surveys 9/15 9/30
A sample timeline
GAIN data input on IIA website 9/15Preliminary meeting 10/15
On-site fieldwork 10/30 11/3
Issue draft report 11/15Receive reply to draft report 11/22
Issue final report 11/29
7/29/2019 Who Audits the Auditors Presentation
34/43
www.theiia.org/Quality
What is a sel f-assessment w ith
independen t val idat ion (SAIV)?
Perform your own internalassessment and then
Engage an independent
party to review your work
7/29/2019 Who Audits the Auditors Presentation
35/43
www.theiia.org/Quality
Whats the advantage of the SAIV?
It costs less!
7/29/2019 Who Audits the Auditors Presentation
36/43
www.theiia.org/Quality
Whats the trade-o ff fo r a SAIV?
Independence
Outside perspective
Expertise
Board leverage
Senior management leverage
Oomph
Diminished:
Requires IAA to budget more resources
7/29/2019 Who Audits the Auditors Presentation
37/43
www.theiia.org/Quality
What shou ld you do?
If you cant get the budget for an
external QA, go the SAIV route
to get into compliance
Consider SAIV for your 1st QA
and follow-up with an external
QA in 2-3 years
7/29/2019 Who Audits the Auditors Presentation
38/43
www.theiia.org/Quality
What about peer reviews?
Even if he is lucky, the best
barber can coun t on no more than
the 2ndbest haircut
Issues: quality, independence,
experience, industry knowledge,
confidentiality, etc.
7/29/2019 Who Audits the Auditors Presentation
39/43
www.theiia.org/Quality
How long does an SAIV take?
RFP 8/1 8/31
Prepare self-assessment 9/1- 9/30
Stakeholder surveys 9/15 9/30
A sample timeline
GAIN data input on IIA website 9/15Preliminary meeting 10/15
On-site validation 10/30 11/1
Issue draft report 11/15Receive reply to draft report 11/22
Issue final report 11/29
7/29/2019 Who Audits the Auditors Presentation
40/43
www.theiia.org/Quality
IIA Recognition Plaque
Organizations that have anexternal qualityassessment completed by
The IIA with a GeneralConformance opinion willreceive a recognitionplaque
7/29/2019 Who Audits the Auditors Presentation
41/43
www.theiia.org/Quality
Where to Find Quality
Resources? Free Web-Based Resources by IIA Inc. and IIA
Affiliates (www.theiia.org /Quality)
QA training seminars by IIA Inc. and IIAAffiliates
Local Chapters and Study Groups
Quality Services by IIA Inc., Affiliates, and OtherService Providers
http://www.theiia.org/http://www.theiia.org/7/29/2019 Who Audits the Auditors Presentation
42/43
www.theiia.org/Quality
Time for.
Questions???
7/29/2019 Who Audits the Auditors Presentation
43/43
www.theiia.org/Quality
This presentationis from
The Institute of Internal AuditorsGlobal Headquarters
www.theiia.orgContact us at [email protected]