1. www.theiia.org/Quality Speaker: Who Audits the Auditors? The value of Internal and External Quality Assessments

2. www.theiia.org/Quality Speaker Background Information

3. www.theiia.org/Quality Topics we will cover Today

4. www.theiia.org/Quality Key Areas of Discussion Today Quality Improvement & Assurance Program External quality assessments and why your audit group should have one What to expect from an external QA How to get the most value from a QA How an Audit professional should prepare for a QA

5. www.theiia.org/Quality Some areas we will NOT talk about today All of the Standards with which you need to comply to pass a QA All of the components of an effective quality program There just isnt enough time to do this and the IIA and other organizations have seminars, books and CDs covering these topics

6. www.theiia.org/Quality A Show of Hands How many Internal Audit Activities have a QA&IP in place today?

7. www.theiia.org/Quality A Show of Hands How many work for an organization that has had an external QA?

8. www.theiia.org/Quality A Show of Hands How many work for an organization that has not had an external QA? Is anyone planning to have one?

9. www.theiia.org/Quality A Show of Hands How many have been part of an external QA team?

10. www.theiia.org/Quality Does this look familiar? http://www.theiia.org/guidance/standards-and-practices/professional-practices-framework/

11. www.theiia.org/Quality Standard 1300 Quality Assurance and Improvement Standard 1310 Quality Program Assessments Standard 1311 Internal Assessments Standard 1312 External Assessments Have you read the Quality Standards?

12. www.theiia.org/Quality Standard 1300: Quality Assurance and Improvement Program (QA&IP) must must The chief audit executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity and continuously monitors its effectiveness. The program must be designed to help the internal auditing activity add value and improve the organizations operations and to provide assurance that the internal audit activity is in conformity with the Standards and the Code of Ethics.

13. www.theiia.org/Quality Why is a Quality Assurance & Improvement Program necessary? As an Organization and its Internal Audit shops grow, its operations undergo refinement, and its internal processes change and evolve, its quality monitoring process must keep pace. Quality Assurance and Improvement Program

14. www.theiia.org/Quality Quality and Improvement Program What would be the elements of a Quality and Improvement Program? QA

15. www.theiia.org/Quality 1311: Internal Assessments Must include: Ongoing reviews of the performance of the internal audit activity; and Periodic reviews performed through self- assessment or by other persons within the organization, with knowledge of internal auditing practices and the Standards. Person(s) conducting assessment can be part of internal audit activity or from another area in the company.

16. www.theiia.org/Quality Some Elements of a QA&IP Staff Information (education, skills, certifications) Audit Plan Budget to Actual Audit Cycle Time Issues and Recommendations Tracking Customer Satisfaction Survey Staff Meeting Benchmarking to Best Practices Training Work Paper Review (ongoing) QA Review Action Plan

17. www.theiia.org/Quality List here. Balanced Scorecard for Internal Auditing Board/Audit Committee OBJECTIVES MEASURES List here. Management/Audit Customers OBJECTIVES MEASURES List here. List here Innovation/Capabilities OBJECTIVES MEASURES List here. Internal Audit Processes OBJECTIVES MEASURES List here. INTERNAL AUDIT STRATEGY CORPORATE STRATEGY Experience Education Training Certification Reporting Relationships Expectations Perspective on IA Roles Satisfaction Surveys Requests Complaints Importance Levels Improvements Findings Repeat Findings Savings Quality Assessment Perspective on IA Roles Satisfaction Surveys Risk Concerns CAE/AC Private Meetings

18. www.theiia.org/Quality What is the Value of Quality to Internal Audit ABC Organization Internal Audit Executive Level At this level Internal Audit is not considered a valued resource to the Organization

19. www.theiia.org/Quality What is the Value of Quality to Internal Audit ABC Organization Internal Audit Executive Level As the Quality of Internal Audit increases the acceptance at the Executive Level gets Internal Audit closer

20. www.theiia.org/Quality What is the Value of Quality to Internal Audit ABC Organization Executive Level Internal Audit Once Quality is achieved Internal Audit is embraced by the Executive Level as a valuable resource within the Organization

21. www.theiia.org/Quality Whos Responsible for the Quality of Internal Audit? Organization Chief Audit Executive (CAE) Internal Audit Profession IA Stakeholders (AC, BOD, Regulatory Body, Sr. Mgmt) Internal Auditor specially CIAs Who Will Benefit?

22. www.theiia.org/Quality Professionalism & Commitment The Drive to be the Best Success (individual & organization) Persistence with a Purpose Professional Development The Pride to be an Internal Auditor

23. www.theiia.org/Quality By the way, whats an external quality assessment (QA)? Professional standards require each internal audit function to obtain an external quality assessment at least once every five years (Standard 1312)

24. www.theiia.org/Quality IIA Code of Ethics International Standards for the Professional Practice of Internal Auditing Audit committee & internal audit charters Professional certification and education Process improvement & best practices Whats the focus of an external QA?

25. www.theiia.org/Quality Interview & survey stakeholders Assess compliance with the IIA Code of Ethics and the Standards Assess charters, policies & procedures Review staff experience & qualifications Inspect workpapers What happens in an external QA?

26. www.theiia.org/Quality What are the benefits of an external QA? Expert advice & counsel from practitioners with decades of experience and broad exposure to the best IA functions Sounding Board Leverage for funding, authority, independence & training Visibility Pipeline to the audit committee & senior management

27. www.theiia.org/Quality HBS or equivalent executive training program for CAE Staffing increases Training and certification support Implementation of CAATs Making a difference…

28. www.theiia.org/Quality Why have an external QA? Professional credibility Organizational credibility Legal liability Compliance with Standards Continuous improvement Audit Committee oversight

29. www.theiia.org/Quality Why are some IA functions not in compliance? 28% of IA functions are less than 5 years old Internal audit is not regulated Unaware of the requirement Unfazed by the penalty Costs in money and time (The IIA Common Body of Knowledge survey reports 39% of IA functions have never had an external QA)

30. www.theiia.org/Quality Inadequate Quality Assurance & Improvement Program Consulting omitted from the mission and charter Inadequate IT coverage or technical skills Lack of performance measures What problems are commonly found?

31. www.theiia.org/Quality Inappropriate CAE reporting relationships Out-of-date charters Client perception of inadequate audit staff knowledg e No formalized risk assessment process What problems are commonly found?

32. www.theiia.org/Quality What Does It *Cost? Number of Internal Audit Staff Average Size of External QA Team Average IA Staff Preparation (Hours) Avg IA Staff Support of QA Team (Hrs) Average Time to Complete QA (Days) Average Cost 1 to 2220033.56.6$13,000 3 to 63110404.2$15,000 7 to 154100605$22,000 16 to 20390709.2$35,000 21 to 306135609$42,000 31 to 505N/A 10.5N/A 51 to 706805013$75,000 71 to 100320012020$80,000 *Source: IIARF Survey April 2007

33. www.theiia.org/Quality How long does an external QA take? RFP 8/1 – 8/15 Prepare background info 9/1- 9/15 Stakeholder surveys 9/15 – 9/30 A sample timeline… GAIN data input on IIA website 9/15 Preliminary meeting 10/15 On-site fieldwork 10/30 – 11/3 Issue draft report 11/15 Receive reply to draft report 11/22 Issue final report 11/29

34. www.theiia.org/Quality What is a self-assessment with independent validation (SAIV)? Perform your own internal assessment and then… Engage an independent party to review your work

35. www.theiia.org/Quality Whats the advantage of the SAIV? It costs less!

36. www.theiia.org/Quality Whats the trade-off for a SAIV? Independence Outside perspective Expertise Board leverage Senior management leverage Oomph Diminished: Requires IAA to budget more resources

37. www.theiia.org/Quality What should you do? If you cant get the budget for an external QA, go the SAIV route to get into compliance Consider SAIV for your 1 st QA and follow-up with an external QA in 2-3 years

38. www.theiia.org/Quality What about peer reviews? Even if he is lucky, the best barber can count on no more than the 2 nd best haircut Issues: quality, independence, experience, industry knowledge, confidentiality, etc.

39. www.theiia.org/Quality How long does an SAIV take? RFP 8/1 – 8/31 Prepare self-assessment 9/1- 9/30 Stakeholder surveys 9/15 – 9/30 A sample timeline… GAIN data input on IIA website 9/15 Preliminary meeting 10/15 On-site validation 10/30 – 11/1 Issue draft report 11/15 Receive reply to draft report 11/22 Issue final report 11/29

40. www.theiia.org/Quality IIA Recognition Plaque Organizations that have an external quality assessment completed by The IIA with a General Conformance opinion will receive a recognition plaque

41. www.theiia.org/Quality Where to Find Quality Resources? Free Web-Based Resources by IIA Inc. and IIA Affiliates (www.theiia.org /Quality)www.theiia.org QA training seminars by IIA Inc. and IIA Affiliates Local Chapters and Study Groups Quality Services by IIA Inc., Affiliates, and Other Service Providers

42. www.theiia.org/Quality Time for…. Questions???

43. www.theiia.org/Quality This presentation is from The Institute of Internal Auditors Global Headquarters www.theiia.org Contact us at Quality@theiia.org