The ICGFM Conference Miami, Florida May 21, 2007 The IIA Research Foundation Draft Internal Auditing Capability Maturity Model (IA-CMM) The ICGFM Conference Miami, Florida May 21, 2007

Presentation Outline The IIA and The IIA Research Foundation Draft IA-CMM Objectives Background Structure Underlying Principles Next Steps

The Institute of Internal Auditors (IIA) Established in 1941, The Institute of Internal Auditors (IIA) is an international professional association of more than 125,000 members in 160 countries. Throughout the world, The IIA is recognized as the internal audit profession’s leader in certification, education, research, and technological guidance.

The Internal Auditing Capability Maturity Model Objectives GRC of The IIA recommended that an IA-CMM be developed as: A basis for implementing and institutionalizing effective internal auditing in the public sector A roadmap for orderly improvement to strengthen capabilities

Capability Maturity Models – Their History Based on Quality Management Principles Software Engineering Institute The original developers of capability maturity models ®TM Software Human Resource Management Office of the Auditor General of Canada Financial Management Capability Model

What is an IA-CMM? A tool that describes the key elements needed for effective IA Describes an evolutionary path for a public sector organization to follow in developing effective IA to meet its governance needs and meet professional expectations An advocacy tool to market IA to decision makers Model links to “recommended practices” at each level

Why in the Public Sector? IA varies widely from country to country Differences in culture, management practices and processes Need for a governance model including IA Opportunities to modernize/evolve IA, improve its effectiveness and deliver value added Critical need for a developmental model, especially in developing countries

What the IA-CMM will Provide When Completed A communication vehicle A framework for assessment A roadmap for orderly improvement

IA-CMM Capability Maturity Levels Optimizing LEVEL 4 Managed LEVEL 3 Integrated LEVEL 2 Infrastructure A LEVEL 1 Initial

Why Levels in a Capability Maturity Level? Different performance expectations and measures exist now Capacity gets built in steps/stages Need a common map/conceptual framework Roadmap to build capacity to achieve higher level of functionality Guidance to determine the capacity level that an organization wants/needs

IA-CMM Capability Maturity Levels Optimizing LEVEL 4 Managed LEVEL 3 Integrated LEVEL 2 Infrastructure LEVEL 1 Initial

Typical Structure of a Capability Maturity Model Capability Level Key Process Area Key Process Area Key Process Area Goals Activities Outputs & Outcomes Mastery

Institutionalizing a Key Process Area Commitment Verification Measurement & Analysis Activities Abilities Key Process Area

Project Approach To explore and identify: Characteristics of each capability level Elements that make up the internal auditing activity Key process areas at each capability level and within each element Goals that need to be achieved and activities and practices of each KPA that need to function effectively to move to next level

How will this be done? Through extensive consultation and validation Input from global, national organizations involved with governance, public sector auditing, internal auditing

Underlying Principles IA’s Obligations IA is an integral component of effective governance in the public sector IA assists organizations achieve their objectives and account for their results

Underlying Principles An Organization’s Obligations To determine the optimum level of internal auditing capability to support the required governance structures To achieve and maintain the desired capability

Underlying Principles Optimum Capability Three variables must be considered IA activity The organization The Environment Not every organization requires the same degree of capability or sophistication IA must be delivered in a cost-effective manner No “one size fits all”

IA-CMM Not prescriptive – what should be done rather than how to do it A universal model with comparability around principles, practices and processes to improve IA and be applied globally

What the IA-CMM will Provide When Completed A communication vehicle A framework for assessment A roadmap for orderly improvement Progress over time

Next Steps Refine and validate the draft model globally–broad-based input Benchmarking partners Illustrative recommended and leading practices Completed IA-CMM–November 2007 Summary Implementation Workbook/s