Improving internal audit performance through quality assurance Dr Ian Peters, Chief Executive IIA Scotland Annual Conference Thursday, 1 st November, 2012

A changing world Loss of confidence in financial services Public sector under pressure Globalisation of risk Increasing expectations of governance, control and internal audit

Low expectations Low expectations of internal audit meant that it was largely ignored in the analysis of corporate governance in the banks Walker review (Nov 2009): “Some concern was expressed at the very limited discussion of audit, in particular internal audit… this reflected judgement that the principal failures that afflicted problem banks did not principally arise under the rubric of ‘audit’.”

Increasing expectations Surveys: E&Y- 80% of boards and CEO’s acknowledged that their internal audit functions have room for improvement - Internal audit needs to increase relevance to achieving strategic objectives PwC - Internal audit needs to develop a more strategic, proactive mindset, capable of identifying risk in relation to strategic objectives, evaluating their threat, recommending controls

Increasing expectations National Audit Office Value for Money Report (June 2012) “There needs to be a clearer statement of the important role of internal audit from the Treasury on one side and a determined move to deliver internal audit’s full potential across government on the other.“ Amyas Morse, Comptroller and Auditor General, NAO, 20th June, 2012

Increasing expectations National Audit Office Value for Money Report (June 2012) Key findings: Government has not ‘set a clear expectation’ of what an effective internal audit function should deliver Chairs of audit committees and other senior stakeholders expect more from their internal audit service - Internal audit should be the eyes and ears of management Variations in quality and coverage mean that internal audit work is often not reliable to support NAO’s external audit work Little consistency in the application of standards by internal audit. Little consistency in the scope of internal audit coverage across the range from strategic issues to core information systems.

Increasing expectations Basel principles for internal audit functions in banks (June 2012) “Banks should have an internal audit function with sufficient authority, stature, independence, resources and access to the board of directors. Independent, competent and qualified internal auditors are vital to sound corporate governance.”

Increasing expectations Basel principles for internal audit functions in banks (June 2012) The bank’s internal audit function must be independent of the audited activities, which requires it to have sufficient standing and authority within the bank, thereby enabling internal auditors to carry out their assignments with objectivity The board should support the internal audit function in discharging its duties effectively Bank internal auditors should comply with and to contribute to the development of national and international professional standards, such as those of the IIA. Professional competence, including the knowledge and experience of each internal auditor and of internal auditors collectively, is essential to the effectiveness of the bank’s internal audit function.

Increasing expectations Andrew Bailey, Executive Director and member of the Financial Policy Committee, Bank of England; Managing Director of the Prudential Business Unit, FSA “In my view the risk management and internal audit functions of firms must be active and able to push their case strongly …[boards] and senior management must be supported by robust and well - functioning risk and audit functions (internal and external). Unfortunately, when I look across the landscape, I don’t believe that we are in the right place today in terms of the role and influence of these risk and audit functions.”

Common themes Status and authority The right relationship with the board and the audit committee Clear expectations Independence and objectivity Adherence to standards Skills and competence

Meeting expectations ‘Internal Audit in Practice’ – a series of case studies with the National Audit Office – promoting new ideas and best practice Public sector standards (in collaboration with CIPFA) – a joined-up approach across the public sector Financial services sector guidance project – responding to the demands of the sector and the regulator External Quality Assessment (EQA) - a new service for members

Are internal audit teams evaluating their capabilities? IIA Survey Internal Auditing 2012 : Trends and Outlook - 90% of boards and executives indicate that adherence to the IIA Standards increases their confidence in internal audit. - However: 30% of internal audit teams have no formal quality assurance programme. And 60% have not undergone an external quality assessment.

Why measure quality ? Not only because the Standards say so… Attribute standard 1312: ‘External assessments must be conducted at least once every five years by a qualified, independent reviewer or review team from outside the organisation.’

…But because it helps you to :- Understand how /where to deliver greater value to stakeholders, customers and your organisation Establish a culture of continuous improvement –Improve efficiency and effectiveness –Develop and motivate your people through opportunities and increased job satisfaction Demonstrate credibility and professionalism to management and non-executives. Why measure quality ?

External Quality Assessment services Self Assessment Checklist Validated Self Assessment Facilitated or Guided Self Assessment External Quality Assessment Mob

External Quality Assessment (EQA) Services Already proving popular across sectors : Completed : A higher education internal audit consortium An international insurance group A global healthcare and medical insurance company An international charity A food ingredients and consumer goods manufacturer A regional accountancy and financial advisory firm Agreed : An international insurance and risk management company A defence agency

EQA findings Weak links between an organisation’s key risks and their internal audit plans - Due to under developed risk management processes Poor co ordination of assurance - Duplication /gaps in assurance, making it difficult for audit committees to see the full picture Audit committees seeking to understand what the right level of internal audit resource is Narrow assessments of internal audit’s performance Poor internal communication/promotion of internal audit to aid understanding and build relationships.

Questions ? Follow me on Follow the Institute on