Who Audits the Auditors Presentation

7/29/2019 Who Audits the Auditors Presentation

1/43

www.theiia.org/Quality

Speaker:

Who Aud its the Aud itors?

The value of In ternal andExternal QualityAssessments


2/43


Speaker Background Information


3/43


Topics we will cover Today


4/43


Key Areas o f Discussion Today

Quality Improvement & Assurance Program

External quality assessments and why youraudit group should have one

What to expect from an external QAHow to get the most value from a QA

How an Audi t

profess ional should

prepare for a QA


5/43


Some areas we wi l l NOT talk about today

All of the Standards with which you need to complyto pass a QA

All of the components of an effective quality

program

There just isnt enough time to

do this and the IIA and other

organizations have seminars,

boo ks and CDs cover ing these

topics


6/43


A Show of Hands

How many Internal

Audit Activities have aQA&IP in place today?


7/43


A Show of Hands

How many work for an

organization that hashad an external QA?


8/43


A Show of Hands

How many work for an

organization that has not

had an external QA?

Is anyone planning tohave one?


9/43


A Show of Hands

How many have been

part of an external QAteam?


10/43


Does this look

famil iar?

http://www.theiia.org/guidance/standards-and-practices/professional-practices-framework/


11/43


Standard 1300

Quality Assurance and Improvement

Standard 1310

Quality Program Assessments

Standard 1311

Internal Assessments

Standard 1312

External Assessments

Have you read the Quality

Standards?


12/43


Standard1300: QualityAssurance and Improvement

Program (QA&IP)The chief audit executive must develop andmaintain a quality assurance and improvementprogram that covers all aspects of the internalaudit activity and continuously monitors itseffectiveness. The program must be designedto help the internal auditing activity add valueand improve the organizations operations and

to provide assurance that the internal auditactivity is in conformity with the Standards andthe Code of Ethics.


13/43


Why is a Quality Assurance &Improvement Program necessary?

As an Organization and its Internal Auditshops grow, its operations undergorefinement, and its internal processes

change and evolve, its quality monitoringprocess must keep pace.

Quality Assurance and

Improvement Program


14/43


Quality and

Improvement ProgramWhat would be the elements of a Qualityand Improvement Program?

QA


15/43


1311: Internal Assessments

Must include:

Ongoing reviews of the performance of the internalaudit activity; and

Periodic reviews performed through self-assessment or by other persons within theorganization, with knowledge of internal auditingpractices and the Standards.

Person(s) conducting assessment can be part ofinternal audit activity or from another area inthe company.


16/43


Some Elements of a QA&IP

Staff Information (education, skills, certifications)

Audit Plan Budget to Actual

Audit Cycle Time

Issues and Recommendations Tracking

Customer Satisfaction Survey

Staff Meeting

Benchmarking to Best Practices

Training Work Paper Review (ongoing)

QA Review Action Plan


17/43


List here.

Balanced Scorecard for Internal Auditing

Board/Audit Committee

OBJECTIVES MEASURES

List here.

List here.

Management/Audit Customers

OBJECTIVES MEASURES List here.

List here

Innovation/Capabilities

OBJECTIVES MEASURES

List here.

List here.

Internal Audit Processes

OBJECTIVES MEASURES

List here.

INTERNAL AUDIT

STRATEGY

CORPORATE

STRATEGY

Experience

Education

Training

Certification

Reporting Relationships

Expectations

Perspective on IA Roles

Satisfaction Surveys

Requests

Complaints

Importance Levels

Improvements

Findings

Repeat Findings

Savings

Quality Assessment

Perspective on IA Roles

Satisfaction Surveys

Risk Concerns

CAE/AC Private Meetings


18/43


What is the Value of Quality

to Internal AuditABC Organization

InternalAudit

Executive Level

At this level Internal Audit is notconsidered a valued resource tothe Organization


19/43




InternalAudit

Executive Level

As the Quality of Internal Audit increases theacceptance at the Executive Level gets Internal Auditcloser


20/43




Executive LevelInternal

Audit

Once Quality is achieved Internal Audit is embraced by

the Executive Level as a valuable resource within theOrganization


21/43


Whos Responsible for the

Quality of Internal Audit? Organization Chief Audit Executive (CAE)

Internal Audit Profession

IA Stakeholders

(AC, BOD, Regulatory Body, Sr. Mgmt)

Internal Auditor specially CIAs

Who Will Benefit?


22/43


Professionalism &

Commitment The Drive to be the Best

Success (individual & organization)

Persistence with a Purpose

Professional Development

The Pride to be an Internal Auditor


23/43


By the way, whats an external

qual i ty assessment (QA)?

Professional standards require each

internal audit function to obtain anexternal quality assessment at least

once every five years (Standard 1312)


24/43


IIA Code of Ethics

International Standards for the ProfessionalPractice of Internal Auditing

Audit committee & internal audit charters

Professional certification and education

Process improvement & best practices

Whats the focus of an external QA?


25/43


Interview & survey stakeholdersAssess compliance with the IIA Code of Ethics

and the Standards

Assess charters, policies & procedures

Review staff experience & qualifications

Inspect workpapers

What happens in an external QA?


26/43


What are the benefits of an external QA?

Expert adv ice & counsel from pract it ioners w i thdecades of exper ience and broad expo su re to thebest IA func t ions

Sounding Board

Leverage for fund ing, authori ty, independence &training

Visibi l i ty

Pipel ine to the aud it comm ittee & seniormanagement


27/43


HBS or equivalent executive trainingprogram for CAE

Staffing increasesTraining and certification support

Implementation of CAATs

Making a difference


28/43


Why have an external QA?

Professional credibilityOrganizational credibility

Legal liabilityCompliance with Standards

Continuous improvementAudit Committee oversight


29/43


Why are some IA functions

not in compliance?

28% of IA functions are less than 5 years oldInternal audit is not regulatedUnaware of the requirementUnfazed by the penalty

Costs in money and time

(The IIA Common Body o f Knowledge survey reports

39% of IA funct ions have never had an external QA)


30/43


Inadequate Quality Assurance &Improvement Program

Consulting omitted from the mission and

charter

Inadequate IT coverage or technical skills

Lack of performance measures

What prob lems are commonly found?


31/43


Inappropriate CAE reportingrelationships

Out-of-date chartersClient perception of inadequate auditstaff knowledge

No formalized risk assessment process

What prob lems are commonly found?


32/43


What Does It *Cost?

Number ofInternalAudit Staff

Average

Size ofExternal QATeam

Average

IA StaffPreparation(Hours)

Avg IAStaff

Support ofQA Team(Hrs)

Average

Time toCompleteQA (Days)

AverageCost

1 to 2 2 200 33.5 6.6 $13,000

3 to 6 3 110 40 4.2 $15,000

7 to 15 4 100 60 5 $22,000

16 to 20 3 90 70 9.2 $35,000

21 to 30 6 135 60 9 $42,000

31 to 50 5 N/A N/A 10.5 N/A

51 to 70 6 80 50 13 $75,000

71 to 100 3 200 120 20 $80,000

*Source: IIARF Survey April 2007


33/43


How long does an external QA take?

RFP 8/1 8/15

Prepare background info 9/1- 9/15

Stakeholder surveys 9/15 9/30

A sample timeline

GAIN data input on IIA website 9/15Preliminary meeting 10/15

On-site fieldwork 10/30 11/3

Issue draft report 11/15Receive reply to draft report 11/22

Issue final report 11/29


34/43


What is a sel f-assessment w ith

independen t val idat ion (SAIV)?

Perform your own internalassessment and then

Engage an independent

party to review your work


35/43


Whats the advantage of the SAIV?

It costs less!


36/43


Whats the trade-o ff fo r a SAIV?

Independence

Outside perspective

Expertise

Board leverage

Senior management leverage

Oomph

Diminished:

Requires IAA to budget more resources


37/43


What shou ld you do?

If you cant get the budget for an

external QA, go the SAIV route

to get into compliance

Consider SAIV for your 1st QA

and follow-up with an external

QA in 2-3 years


38/43


What about peer reviews?

Even if he is lucky, the best

barber can coun t on no more than

the 2ndbest haircut

Issues: quality, independence,

experience, industry knowledge,

confidentiality, etc.


39/43


How long does an SAIV take?

RFP 8/1 8/31

Prepare self-assessment 9/1- 9/30

Stakeholder surveys 9/15 9/30

A sample timeline

GAIN data input on IIA website 9/15Preliminary meeting 10/15

On-site validation 10/30 11/1

Issue draft report 11/15Receive reply to draft report 11/22

Issue final report 11/29


40/43


IIA Recognition Plaque

Organizations that have anexternal qualityassessment completed by

The IIA with a GeneralConformance opinion willreceive a recognitionplaque


41/43


Where to Find Quality

Resources? Free Web-Based Resources by IIA Inc. and IIA

Affiliates (www.theiia.org /Quality)

QA training seminars by IIA Inc. and IIAAffiliates

Local Chapters and Study Groups

Quality Services by IIA Inc., Affiliates, and OtherService Providers
http://www.theiia.org/http://www.theiia.org/


42/43


Time for.

Questions???


43/43


This presentationis from

The Institute of Internal AuditorsGlobal Headquarters

www.theiia.orgContact us at [email protected]

Who Audits the Auditors Presentation

Documents

Transcript of Who Audits the Auditors Presentation