1. Small Internal Audit Activity Challenges
Quality Assessments
Small Internal Audit Activity Challenges

2. Presented by Judy Gunther-Grobler Max Haege From Germany
From South Africa
and
Max Haege
From Germany
Co-authors of the
QAIP Practice Guide

3. Contents Defining a small Internal Audit Activity (IAA)
Standards compliance challenges
Other challenges
Small IAA critical success and compliance factors
Questions?

4. Defining a small IAA
It is not only how many internal auditors are appointed that classify the IAA as small.
Consider also the
Co-sourcing with outside service providers
Size of the organization
Audit universe
Geographic complexity of the organisation
Organisational change and expansion
Size of the IAA and maturity of organization
Size in comparison to required skills and scope.

5. Small IAA’s Can add substantial value
To do this it is required that the IAA is:
Versatile
Flexible
Professionally competent and has
Broad range of expertise and knowledge

6. Standards compliance challenges
Attribute Standards
Performance Standards
Std – Organisational Independence
Std – Direct Interaction with the Board
Std – Individual Objectivity
Std Proficiency
Std – Planning
Std – Governance
Std – Risk Assessment
Std – Control
Std – Engagement Resource Allocation
Std – Engagement Supervision

7. Organisational Independence/ Individual Objectivity/ Conflict of Interest
Management level of the CAE
Direct Interaction with the Board
Reporting lines (to other than the CEO)
Standing meeting invitations
Auditor/s employed from within the organisation
Std. 1110, 1120

8. Planning
Limited resources to assess the adequacy of all required controls / areas => liability risk if board is not fully aware of achievable coverage compared to identified risk areas and audit needs.
Limited resources in terms of staff and expertise may prevent deploying IA resources to achieve the approved plan effectively.
Audit scope and depth of audit activities conducted may not be sufficiently broad due to inadequate time and resources
Small IAA’s could have audit time budget challenges
Frequently organizational setup in that IAA is responsible for Risk Management, Compliance etc.  potentially conflicts of interest
Std 2600, 2030

9. Proficiency
Lack of qualification and experience (IT, engineering, fraud)
Limited training and development opportunities or even lack of budget
Lack of time and motivation to obtain related professional certifications to demonstrate knowledge of IA topics
Communication Skills including Marketing/PR
Std 1210

10. Personnel
Inappropriate staff resources to delegate leading to a lack of segregation of duties
Lack of resources to perform in depth risk oriented planning
Limited resources to assess the adequacy of all required controls / areas
No staff rotation possibilities
Consulting activities cannot be audited by the same auditor
Documentation flaw
Std. 2130

11. Independent Review/ Quality Assurance within IAA
No [direct] supervision (1 person IAA/ limited audit expertise)
Resource constraints (not enough time to audit, document and review, CAE also required to perform audits and not only manage).
Scale for review to be applied (if quality approach is lean anyhow)?
No quality assurance system implemented in some cases (1 person IAA)
Std. 2340

12. Direct Interaction with the Board
Does not exist in many cases
Standing senior management meeting invitations
Board knowledge and appreciation of Internal Audit
Does owner manager want to be audited directly by internal auditor? (“standing tall”)
Std. 1111

13. Overcoming Challenges
Important Factors for a small IAA
HR selection, induction, training, coaching and motivation.
Communication skills including Marketing/PR
CAE must be accepted and convincing personality, esp. in relation to Senior Management / Board
Broad skills base (Engineering, Operations, IT, Finance, Accounting, Legal Compliance, Investion, etc.).
Flexibility / Creativity
Efficiency and effectiveness of work

14. Small IAA’s should Take into account the expectations of stakeholders
Build their plans around an effective ERM system
Develop a dynamic framework
Link with the Board and AC
Effectively network
Align HR and skills

15. And as some-one once said….
“Everything will be all right in the end…..
and if is not,
Then trust me, it is not the end!”

16. Questions?