Speaker: Who Audits the Auditors? The value of Internal and External Quality Assessments

Speaker Background Information

Topics we will cover Today

Key Areas of Discussion Today Quality Improvement & Assurance Program External quality assessments and why your audit group should have one What to expect from an external QA How to get the most value from a QA How an Audit professional should prepare for a QA

Some areas we will NOT talk about today All of the Standards with which you need to comply to pass a QA All of the components of an effective quality program There just isnt enough time to do this and the IIA and other organizations have seminars, books and CDs covering these topics

A Show of Hands How many Internal Audit Activities have a QA&IP in place today?

A Show of Hands How many work for an organization that has had an external QA?

A Show of Hands How many work for an organization that has not had an external QA? Is anyone planning to have one?

A Show of Hands How many have been part of an external QA team?

Does this look familiar?

Standard 1300 Quality Assurance and Improvement Standard 1310 Quality Program Assessments Standard 1311 Internal Assessments Standard 1312 External Assessments Have you read the Quality Standards?

Standard 1300: Quality Assurance and Improvement Program (QA&IP) must must The chief audit executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity and continuously monitors its effectiveness. The program must be designed to help the internal auditing activity add value and improve the organizations operations and to provide assurance that the internal audit activity is in conformity with the Standards and the Code of Ethics.

Why is a Quality Assurance & Improvement Program necessary? As an Organization and its Internal Audit shops grow, its operations undergo refinement, and its internal processes change and evolve, its quality monitoring process must keep pace. Quality Assurance and Improvement Program

Quality and Improvement Program What would be the elements of a Quality and Improvement Program? QA

1311: Internal Assessments Must include: Ongoing reviews of the performance of the internal audit activity; and Periodic reviews performed through self- assessment or by other persons within the organization, with knowledge of internal auditing practices and the Standards. Person(s) conducting assessment can be part of internal audit activity or from another area in the company.

Some Elements of a QA&IP Staff Information (education, skills, certifications) Audit Plan Budget to Actual Audit Cycle Time Issues and Recommendations Tracking Customer Satisfaction Survey Staff Meeting Benchmarking to Best Practices Training Work Paper Review (ongoing) QA Review Action Plan

List here. Balanced Scorecard for Internal Auditing Board/Audit Committee OBJECTIVES MEASURES List here. Management/Audit Customers OBJECTIVES MEASURES List here. List here Innovation/Capabilities OBJECTIVES MEASURES List here. Internal Audit Processes OBJECTIVES MEASURES List here. INTERNAL AUDIT STRATEGY CORPORATE STRATEGY Experience Education Training Certification Reporting Relationships Expectations Perspective on IA Roles Satisfaction Surveys Requests Complaints Importance Levels Improvements Findings Repeat Findings Savings Quality Assessment Perspective on IA Roles Satisfaction Surveys Risk Concerns CAE/AC Private Meetings

What is the Value of Quality to Internal Audit ABC Organization Internal Audit Executive Level At this level Internal Audit is not considered a valued resource to the Organization

What is the Value of Quality to Internal Audit ABC Organization Internal Audit Executive Level As the Quality of Internal Audit increases the acceptance at the Executive Level gets Internal Audit closer

What is the Value of Quality to Internal Audit ABC Organization Executive Level Internal Audit Once Quality is achieved Internal Audit is embraced by the Executive Level as a valuable resource within the Organization

Whos Responsible for the Quality of Internal Audit? Organization Chief Audit Executive (CAE) Internal Audit Profession IA Stakeholders (AC, BOD, Regulatory Body, Sr. Mgmt) Internal Auditor specially CIAs Who Will Benefit?

Professionalism & Commitment The Drive to be the Best Success (individual & organization) Persistence with a Purpose Professional Development The Pride to be an Internal Auditor

By the way, whats an external quality assessment (QA)? Professional standards require each internal audit function to obtain an external quality assessment at least once every five years (Standard 1312)

IIA Code of Ethics International Standards for the Professional Practice of Internal Auditing Audit committee & internal audit charters Professional certification and education Process improvement & best practices Whats the focus of an external QA?

Interview & survey stakeholders Assess compliance with the IIA Code of Ethics and the Standards Assess charters, policies & procedures Review staff experience & qualifications Inspect workpapers What happens in an external QA?

What are the benefits of an external QA? Expert advice & counsel from practitioners with decades of experience and broad exposure to the best IA functions Sounding Board Leverage for funding, authority, independence & training Visibility Pipeline to the audit committee & senior management

HBS or equivalent executive training program for CAE Staffing increases Training and certification support Implementation of CAATs Making a difference…

Why have an external QA? Professional credibility Organizational credibility Legal liability Compliance with Standards Continuous improvement Audit Committee oversight

Why are some IA functions not in compliance? 28% of IA functions are less than 5 years old Internal audit is not regulated Unaware of the requirement Unfazed by the penalty Costs in money and time (The IIA Common Body of Knowledge survey reports 39% of IA functions have never had an external QA)

Inadequate Quality Assurance & Improvement Program Consulting omitted from the mission and charter Inadequate IT coverage or technical skills Lack of performance measures What problems are commonly found?

Inappropriate CAE reporting relationships Out-of-date charters Client perception of inadequate audit staff knowledg e No formalized risk assessment process What problems are commonly found?

What Does It *Cost? Number of Internal Audit Staff Average Size of External QA Team Average IA Staff Preparation (Hours) Avg IA Staff Support of QA Team (Hrs) Average Time to Complete QA (Days) Average Cost 1 to $13,000 3 to $15,000 7 to $22, to $35, to $42, to 505N/A 10.5N/A 51 to $75, to $80,000 *Source: IIARF Survey April 2007

How long does an external QA take? RFP 8/1 – 8/15 Prepare background info 9/1- 9/15 Stakeholder surveys 9/15 – 9/30 A sample timeline… GAIN data input on IIA website 9/15 Preliminary meeting 10/15 On-site fieldwork 10/30 – 11/3 Issue draft report 11/15 Receive reply to draft report 11/22 Issue final report 11/29

What is a self-assessment with independent validation (SAIV)? Perform your own internal assessment and then… Engage an independent party to review your work

Whats the advantage of the SAIV? It costs less!

Whats the trade-off for a SAIV? Independence Outside perspective Expertise Board leverage Senior management leverage Oomph Diminished: Requires IAA to budget more resources

What should you do? If you cant get the budget for an external QA, go the SAIV route to get into compliance Consider SAIV for your 1 st QA and follow-up with an external QA in 2-3 years

What about peer reviews? Even if he is lucky, the best barber can count on no more than the 2 nd best haircut Issues: quality, independence, experience, industry knowledge, confidentiality, etc.

How long does an SAIV take? RFP 8/1 – 8/31 Prepare self-assessment 9/1- 9/30 Stakeholder surveys 9/15 – 9/30 A sample timeline… GAIN data input on IIA website 9/15 Preliminary meeting 10/15 On-site validation 10/30 – 11/1 Issue draft report 11/15 Receive reply to draft report 11/22 Issue final report 11/29

IIA Recognition Plaque Organizations that have an external quality assessment completed by The IIA with a General Conformance opinion will receive a recognition plaque

Where to Find Quality Resources? Free Web-Based Resources by IIA Inc. and IIA Affiliates ( /Quality) QA training seminars by IIA Inc. and IIA Affiliates Local Chapters and Study Groups Quality Services by IIA Inc., Affiliates, and Other Service Providers

Time for…. Questions???

This presentation is from The Institute of Internal Auditors Global Headquarters Contact us at