Www.theiia.org/Quality Speaker: Who Audits the Auditors? The value of Internal and External Quality...
-
Upload
abigail-shepherd -
Category
Documents
-
view
216 -
download
1
Transcript of Www.theiia.org/Quality Speaker: Who Audits the Auditors? The value of Internal and External Quality...
www.theiia.org/Quality
Speaker:
Who Audits the Auditors?The value of Internal and External Quality Assessments
www.theiia.org/Quality
Speaker Background Information
www.theiia.org/Quality
Topics we will cover Today
www.theiia.org/Quality
Key Areas of Discussion Today
Quality Improvement & Assurance Program
External quality assessments and why your audit group should have one
What to expect from an external QA
How to get the most value from a QA
How an Audit professional should prepare for a QA
www.theiia.org/Quality
Some areas we will NOT talk about today
All of the Standards with which you need to comply to pass a QA
All of the components of an effective quality program
There just isn’t enough time to do this and the IIA and other organizations have seminars, books and CDs covering these topics
www.theiia.org/Quality
A Show of Hands
How many Internal Audit Activities have a QA&IP in place today?
www.theiia.org/Quality
A Show of Hands
How many work for an organization that has had an external QA?
www.theiia.org/Quality
A Show of Hands
How many work for an organization that has not had an external QA?
Is anyone planning to have one?
www.theiia.org/Quality
A Show of Hands
How many have been part of an external QA
team?
www.theiia.org/Quality
Does this look familiar?
http://www.theiia.org/guidance/standards-and-practices/professional-practices-framework/
www.theiia.org/Quality
Standard 1300 Quality Assurance and Improvement
Standard 1310 Quality Program Assessments
Standard 1311 Internal Assessments
Standard 1312 External Assessments
Have you read the Quality Standards?
www.theiia.org/Quality
Standard 1300: Quality Assurance and Improvement
Program (QA&IP)
The chief audit executive mustmust develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity and continuously monitors its effectiveness. The program mustmust be designed to help the internal auditing activity add value and improve the organization’s operations and to provide assurance that the internal audit activity is in conformity with the Standards and the Code of Ethics.
www.theiia.org/Quality
Why is a Quality Assurance & Improvement Program necessary?
As an Organization and its Internal Audit As an Organization and its Internal Audit shops grow, its operations undergo shops grow, its operations undergo refinement, and its internal processes refinement, and its internal processes change and evolve, its quality monitoring change and evolve, its quality monitoring process must keep pace. process must keep pace.
Quality Assurance and Improvement
Program
www.theiia.org/Quality
Quality and Improvement
ProgramWhat would be the elements of a Quality and Improvement Program?
QA
www.theiia.org/Quality
1311: Internal Assessments
Must include:
• Ongoing reviews of the performance of the internal audit activity; and
• Periodic reviews performed through self-assessment or by other persons within the organization, with knowledge of internal auditing practices and the Standards.
• Person(s) conducting assessment can be part of internal audit activity or from another area in the company.
www.theiia.org/Quality
Some Elements of a QA&IP• Staff Information (education, skills, certifications)
• Audit Plan Budget to Actual
• Audit Cycle Time
• Issues and Recommendations Tracking
• Customer Satisfaction Survey
• Staff Meeting
• Benchmarking to Best Practices
• Training
• Work Paper Review (ongoing)
• QA Review Action Plan
www.theiia.org/Quality
• List here.
Balanced Scorecard for Internal Auditing
Board/Audit Committee
OBJECTIVES MEASURES
• List here.
• List here.
Management/Audit Customers
OBJECTIVES MEASURES
• List here.
• List here
Innovation/Capabilities
OBJECTIVES MEASURES
• List here.
• List here.
Internal Audit Processes
OBJECTIVES MEASURES
• List here.
INTERNAL AUDITSTRATEGY
CORPORATESTRATEGY
• Experience
• Education
• Training
• Certification
• Reporting Relationships
• Expectations
• Perspective on IA Roles
• Satisfaction Surveys
• Requests
• Complaints
• Importance Levels
• Improvements
• Findings
• Repeat Findings
• Savings
• Quality Assessment
• Perspective on IA Roles
• Satisfaction Surveys
• Risk Concerns
• CAE/AC Private Meetings
www.theiia.org/Quality
What is the Value of Quality to Internal Audit
ABC Organization
Internal Audit
Executive Level
At this level Internal Audit is not considered a valued resource to the Organization
www.theiia.org/Quality
What is the Value of Quality to Internal Audit
ABC Organization
Internal Audit
Executive Level
As the Quality of Internal Audit increases the acceptance at the Executive Level gets Internal Audit closer
www.theiia.org/Quality
What is the Value of Quality to Internal Audit
ABC Organization
Executive LevelInternal
Audit
Once Quality is achieved Internal Audit is embraced by the Executive Level as a valuable resource within the Organization
www.theiia.org/Quality
Who’s Responsible for the Quality of Internal Audit?
• Organization
• Chief Audit Executive (CAE)
• Internal Audit Profession
• IA Stakeholders
(AC, BOD, Regulatory Body, Sr. Mgmt)
• Internal Auditor specially CIA’s
Who Will Benefit?
www.theiia.org/Quality
Professionalism & Commitment
• The Drive to be the Best
• Success (individual & organization)
• “Persistence with a Purpose”
• Professional Development
• The Pride to be an Internal Auditor
www.theiia.org/Quality
By the way, what’s an external quality assessment (QA)?
Professional standards require each internal audit function to obtain an external quality assessment at least once every five years (Standard 1312)
www.theiia.org/Quality
IIA Code of Ethics
International Standards for the Professional Practice of Internal Auditing
Audit committee & internal audit charters
Professional certification and education
Process improvement & best practices
What’s the focus of an external QA?
www.theiia.org/Quality
Interview & survey stakeholders
Assess compliance with the IIA Code of Ethics
and the Standards
Assess charters, policies & procedures
Review staff experience & qualifications
Inspect workpapers
What happens in an external QA?
www.theiia.org/Quality
What are the benefits of an external QA?
Expert advice & counsel from practitioners with decades of experience and broad exposure to the best IA functions
Sounding Board
Leverage for funding, authority, independence & training
Visibility
Pipeline to the audit committee & senior management
www.theiia.org/Quality
HBS or equivalent executive training program for CAE
Staffing increases
Training and certification support
Implementation of CAATs
Making a difference…
www.theiia.org/Quality
Why have an external QA?
Professional credibilityOrganizational credibilityLegal liabilityCompliance with StandardsContinuous improvementAudit Committee oversight
www.theiia.org/Quality
Why are some IA functions not in compliance?
28% of IA functions are less than 5 years oldInternal audit is not regulatedUnaware of the requirementUnfazed by the penaltyCosts in money and time
(The IIA Common Body of Knowledge survey reports
39% of IA functions have never had an external QA)
www.theiia.org/Quality
Inadequate Quality Assurance & Improvement Program
Consulting omitted from the mission and charter
Inadequate IT coverage or technical skills
Lack of performance measures
What problems are commonly found?
www.theiia.org/Quality
Inappropriate CAE reporting relationships
Out-of-date charters
Client perception of inadequate audit staff knowledge
No formalized risk assessment process
What problems are commonly found?
www.theiia.org/Quality
What Does It *Cost?
Number of Internal
Audit Staff
Average Size of
External QA Team
Average IA Staff
Preparation (Hours)
Avg IA Staff
Support of QA Team
(Hrs)
Average Time to
Complete QA (Days)
Average Cost
1 to 2 2 200 33.5 6.6 $13,000
3 to 6 3 110 40 4.2 $15,000
7 to 15 4 100 60 5 $22,000
16 to 20 3 90 70 9.2 $35,000
21 to 30 6 135 60 9 $42,000
31 to 50 5 N/A N/A 10.5 N/A
51 to 70 6 80 50 13 $75,000
71 to 100 3 200 120 20 $80,000
*Source: IIARF Survey April 2007
www.theiia.org/Quality
How long does an external QA take?
RFP 8/1 – 8/15Prepare background info 9/1- 9/15Stakeholder surveys 9/15 – 9/30
A sample timeline…
GAIN data input on IIA website 9/15Preliminary meeting 10/15 On-site fieldwork 10/30 – 11/3Issue draft report 11/15Receive reply to draft report 11/22Issue final report 11/29
www.theiia.org/Quality
What is a self-assessment with independent validation (SAIV)?
Perform your own internal assessment and then…
Engage an independent party to review your work
www.theiia.org/Quality
What’s the advantage of the SAIV?
It costs less!
www.theiia.org/Quality
What’s the trade-off for a SAIV?
Independence
Outside perspective
Expertise
Board leverage
Senior management leverage
Oomph
Diminished:
Requires IAA to budget more resources
www.theiia.org/Quality
What should you do?
If you can’t get the budget for an external QA, go the SAIV route to get into compliance
Consider SAIV for your 1st QA and follow-up with an external QA in 2-3 years
www.theiia.org/Quality
What about peer reviews?
“Even if he is lucky, the best barber can count on no more than the 2nd best haircut”
Issues: quality, independence, experience, industry knowledge, confidentiality, etc.
www.theiia.org/Quality
How long does an SAIV take?
RFP 8/1 – 8/31Prepare self-assessment 9/1- 9/30Stakeholder surveys 9/15 – 9/30
A sample timeline…
GAIN data input on IIA website 9/15Preliminary meeting 10/15 On-site validation 10/30 – 11/1Issue draft report 11/15Receive reply to draft report 11/22Issue final report 11/29
www.theiia.org/Quality
IIA Recognition Plaque
Organizations that have an external quality assessment completed by The IIA with a “General Conformance” opinion will receive a recognition plaque
www.theiia.org/Quality
Where to Find Quality Resources?
• Free Web-Based Resources by IIA Inc. and IIA Affiliates (www.theiia.org /Quality)
• QA training seminars by IIA Inc. and IIA Affiliates
• Local Chapters and Study Groups
• Quality Services by IIA Inc., Affiliates, and Other Service Providers
www.theiia.org/Quality
Time for….
Questions???
www.theiia.org/Quality
This presentation is from
The Institute of Internal Auditors
Global Headquarterswww.theiia.org
Contact us at [email protected]