Small Internal Audit Activity Challenges Quality Assessments Small Internal Audit Activity Challenges

Presented by Judy Gunther-Grobler Max Haege From Germany From South Africa and Max Haege From Germany Co-authors of the QAIP Practice Guide

Contents Defining a small Internal Audit Activity (IAA) Standards compliance challenges Other challenges Small IAA critical success and compliance factors Questions?

Defining a small IAA It is not only how many internal auditors are appointed that classify the IAA as small. Consider also the Co-sourcing with outside service providers Size of the organization Audit universe Geographic complexity of the organisation Organisational change and expansion Size of the IAA and maturity of organization Size in comparison to required skills and scope.

Small IAA’s Can add substantial value To do this it is required that the IAA is: Versatile Flexible Professionally competent and has Broad range of expertise and knowledge

Standards compliance challenges Attribute Standards Performance Standards Std. 1110 – Organisational Independence Std. 1111 – Direct Interaction with the Board Std. 1120 – Individual Objectivity Std. 1210 - Proficiency Std. 2010 – Planning Std. 2110 – Governance Std. 2120 – Risk Assessment Std. 2130 – Control Std. 2230 – Engagement Resource Allocation Std. 2340 – Engagement Supervision

Organisational Independence/ Individual Objectivity/ Conflict of Interest Management level of the CAE Direct Interaction with the Board Reporting lines (to other than the CEO) Standing meeting invitations Auditor/s employed from within the organisation Std. 1110, 1120

Planning Limited resources to assess the adequacy of all required controls / areas => liability risk if board is not fully aware of achievable coverage compared to identified risk areas and audit needs. Limited resources in terms of staff and expertise may prevent deploying IA resources to achieve the approved plan effectively. Audit scope and depth of audit activities conducted may not be sufficiently broad due to inadequate time and resources Small IAA’s could have audit time budget challenges Frequently organizational setup in that IAA is responsible for Risk Management, Compliance etc.  potentially conflicts of interest Std 2600, 2030

Proficiency Lack of qualification and experience (IT, engineering, fraud) Limited training and development opportunities or even lack of budget Lack of time and motivation to obtain related professional certifications to demonstrate knowledge of IA topics Communication Skills including Marketing/PR Std 1210

Personnel Inappropriate staff resources to delegate leading to a lack of segregation of duties Lack of resources to perform in depth risk oriented planning Limited resources to assess the adequacy of all required controls / areas No staff rotation possibilities Consulting activities cannot be audited by the same auditor Documentation flaw Std. 2130

Independent Review/ Quality Assurance within IAA No [direct] supervision (1 person IAA/ limited audit expertise) Resource constraints (not enough time to audit, document and review, CAE also required to perform audits and not only manage). Scale for review to be applied (if quality approach is lean anyhow)? No quality assurance system implemented in some cases (1 person IAA) Std. 2340

Direct Interaction with the Board Does not exist in many cases Standing senior management meeting invitations Board knowledge and appreciation of Internal Audit Does owner manager want to be audited directly by internal auditor? (“standing tall”) Std. 1111

Overcoming Challenges Important Factors for a small IAA HR selection, induction, training, coaching and motivation. Communication skills including Marketing/PR CAE must be accepted and convincing personality, esp. in relation to Senior Management / Board Broad skills base (Engineering, Operations, IT, Finance, Accounting, Legal Compliance, Investion, etc.). Flexibility / Creativity Efficiency and effectiveness of work

Small IAA’s should Take into account the expectations of stakeholders Build their plans around an effective ERM system Develop a dynamic framework Link with the Board and AC Effectively network Align HR and skills

And as some-one once said…. “Everything will be all right in the end….. and if is not, Then trust me, it is not the end!”

Questions?