External Quality Assessments www theiia org Session Overview

External Quality Assessments www. theiia. org

Session Overview • Quality Standards • Internal Quality Assessments • External Quality Assessments • Peer Reviews • Common Problems Observed • Online Resources Available www. theiia. org

Professional Practices Framework • International Standards for the Professional Practice of Internal Auditing (Standards) – Mandatory Guidance • Attribute • Performance • Implementation – Assurance – Consulting • Practice Advisories • Development and Practice Aids www. theiia. org

Quality Standards • 1300 - Quality Assurance and Improvement Program • 1310 - Quality Program Assessments • 1311 - Internal Assessments • 1312 - External Assessments • 1320 - Reporting on the Quality Program • 1321 - Use of “Conducted in Accordance with the Standards” • 1322 - Disclosure of Noncompliance www. theiia. org

Standard 1311 Internal Quality Assessments • Ongoing • • • Work Paper Reviews Performance Evaluations Actual vs. Budgeted Analysis Various Monitoring Metrics Customer Surveys • Periodic • Self-Assessment – Annually – Covering all Standards over 5 years – Quarterly/Semi-Annual – Portions of Standards each year – Assess compliance with IA Activity Charter www. theiia. org

Standard 1312 External Quality Assessments • Required every 5 years • Standard enacted January 1, 2002 • Two methods: – External Quality Assessment with the review and report by an independent team – Self Assessment with report validation by an Independent Validator www. theiia. org

Objectives of External Reviews • Provide an opinion on the internal audit activity’s conformance to the spirit and intent of the Standards. • Assess the efficiency and effectiveness of the internal audit activity in light of: – Its charter – Expectations of the board, executive management, and the CAE • Identify opportunities and offer ideas and counsel to the CAE and staff for: – Improving their performance – Increasing the value they add to the enterprise www. theiia. org

Why Conduct an External Quality Assessment? To provide independent analyses: – Do we meet professional standards? – Can things be done better? – Should more be done? – Is maximum value being received for each dollar of expense? – Can we add more value to management and the audit committee? – Can we enhance our image, perceptions, and credibility within the organization? www. theiia. org

Standard 1321 Use of "Conforms with the Standards" • Internal auditors are encouraged to report that activities are in conformance with the Standards • However, internal auditors may use the statement only if assessments of the quality assurance and improvement program demonstrates conformance with Standards. www. theiia. org

External Quality Assessment • Contract with outside provider to perform review, write the report and determine the compliance with the Standards: – Regional accounting firms – Outsource providers – Independent consultants – Independent Peers www. theiia. org

Self Assessment with Independent Validation • Internal Audit Activity conducts their own Self assessment, determines compliance with the Standards and writes the report • Internal Audit Activity then engages an independent Validator to review documentation and perform limited testing • Validator concurs with report or disagrees and issues own report (opinion) • Validator can be an external service provider or from a peer pool www. theiia. org

Peer Reviews • Peer reviews between three or more organizations does meet the requirements of an external quality assessment. • Reciprocal peer reviews between two organizations would not pass the independence test. • Contract between three (3) or more companies within the same industry or other affinity group, regional association, or other group of organizations. www. theiia. org

Competence of Assessors and Validators • Practice Advisory 1312 -1 recommends: – Be a competent, certified audit professional. – Be well versed in the best practices of the profession. – Have at least three years of recent experience in the practice of internal auditing at a management level. – Have additional competence gained from working previously as a team member on an external quality assessment. www. theiia. org

Independence of Assessors and Validators • Practice Advisory 1312 -1 recommends: – “be free from any obligation to, or interest in, the organization whose internal audit activity is the subject of the assessment …” www. theiia. org

A 12 -Point Process 1. 2. 3. 4. 5. Select and train a QA team Have the CAE complete the QA self-study Make a preliminary visit to the organization Use customer and staff surveys Perform the on-site work including: – – – Review of administrative policies and procedures Consideration of enterprise risk’ Evaluation of risk assessment in audit planning Review of working papers and final reports for selected engagements Review of number and skills of internal audit staff Evaluate adequacy of IT audit coverage www. theiia. org

A 12 -Point Process 6. Evaluate the internal audit activity’s effectiveness at remaining current and adding value through interviews with: – Selected members of the board – Executive management – Operating managers – Internal audit staff 7. Consider other monitoring functions, and evaluate coordination of internal audit work with that of independent auditors. 8. Evaluate the internal audit activity’s conformance with IIA Standards and other relevant standards. www. theiia. org

A 12 -Point Process 9. Review quality/process improvement actions currently underway 10. Provide a summary of issues and recommendations, and hold a closing conference with the CAE and/or other requestors. 11. Draft a report, obtain comments, and issue a final report 12. Hold a follow-up executive conference (optional) www. theiia. org

Common Problems Observed by IIA External Assessment Teams • Inappropriate CAE reporting relationships • Out-of-date charters for internal audit activity • Lack of board approved policy on internal control responsibility • Client perception of inadequate audit staff knowledge • Lack of a formalized risk assessment process • Lack of understanding regarding: – Internal audit activity’s consulting responsibilities – Reflection of consulting in the mission and charter • Inadequate IT coverage or technical skills www. theiia. org

Quality Assessment Resources at www. theiia. org/quality • Frequently Asked Questions about Quality • Providers of External Quality Assessments • List of Organizations with Completed External Quality Assessments • Becoming a QA Volunteer www. theiia. org

Quality Assessment Resources at www. theiia. org/quality • • • Sample request for a quality assessment proposal Quality Assessment Advanced Preparation Audit Customer (Client) Survey Internal Audit Staff Survey Self-Assessment Guide Models – – Model Audit Committee Charter Model Internal Audit Activity Charter Model Management Control Policy Model Quality Assurance and Improvement Program www. theiia. org

Questions? www. theiia. org

IIA Contact 247 Maitland Avenue Altamonte Spring, Florida 32701 -4201 USA Tel + 1. 407. 937. 1399 Fax +1. 407. 937. 1101 E-mail: quality@theiia. org www. theiia. org