External Quality Assessments

Session Overview Quality Standards Internal Quality Assessments External Quality Assessments Peer Reviews Common Problems Observed Online Resources Available

Professional Practices Framework International Standards for the Professional Practice of Internal Auditing (Standards) Mandatory Guidance Attribute Performance Implementation Assurance Consulting Practice Advisories Development and Practice Aids

Quality Standards 1300 - Quality Assurance and Improvement Program 1310 - Quality Program Assessments 1311 - Internal Assessments 1312 - External Assessments 1320 - Reporting on the Quality Program 1321 - Use of “Conducted in Accordance with the Standards” 1322 - Disclosure of Noncompliance

Standard 1311 Internal Quality Assessments Ongoing Work Paper Reviews Performance Evaluations Actual vs. Budgeted Analysis Various Monitoring Metrics Customer Surveys Periodic Self-Assessment Annually – Covering all Standards over 5 years Quarterly/Semi-Annual – Portions of Standards each year Assess compliance with IA Activity Charter

Standard 1312 External Quality Assessments Required every 5 years Standard enacted January 1, 2002 Two methods: External Quality Assessment with the review and report by an independent team Self Assessment with report validation by an Independent Validator

Objectives of External Reviews Provide an opinion on the internal audit activity’s conformance to the spirit and intent of the Standards. Assess the efficiency and effectiveness of the internal audit activity in light of: Its charter Expectations of the board, executive management, and the CAE Identify opportunities and offer ideas and counsel to the CAE and staff for: Improving their performance Increasing the value they add to the enterprise

Why Conduct an External Quality Assessment? To provide independent analyses: Do we meet professional standards? Can things be done better? Should more be done? Is maximum value being received for each dollar of expense? Can we add more value to management and the audit committee? Can we enhance our image, perceptions, and credibility within the organization?

Standard 1321 Use of "Conforms with the Standards" Internal auditors are encouraged to report that activities are in conformance with the Standards However, internal auditors may use the statement only if assessments of the quality assurance and improvement program demonstrates conformance with Standards.

External Quality Assessment Contract with outside provider to perform review, write the report and determine the compliance with the Standards: Regional accounting firms Outsource providers Independent consultants Independent Peers

Self Assessment with Independent Validation Internal Audit Activity conducts their own Self assessment, determines compliance with the Standards and writes the report Internal Audit Activity then engages an independent Validator to review documentation and perform limited testing Validator concurs with report or disagrees and issues own report (opinion) Validator can be an external service provider or from a peer pool

Peer Reviews Peer reviews between three or more organizations does meet the requirements of an external quality assessment. Reciprocal peer reviews between two organizations would not pass the independence test. Contract between three (3) or more companies within the same industry or other affinity group, regional association, or other group of organizations.

Competence of Assessors and Validators Practice Advisory 1312-1 recommends: Be a competent, certified audit professional. Be well versed in the best practices of the profession. Have at least three years of recent experience in the practice of internal auditing at a management level. Have additional competence gained from working previously as a team member on an external quality assessment.

Independence of Assessors and Validators Practice Advisory 1312-1 recommends: “be free from any obligation to, or interest in, the organization whose internal audit activity is the subject of the assessment …”

A 12-Point Process Select and train a QA team Have the CAE complete the QA self-study Make a preliminary visit to the organization Use customer and staff surveys Perform the on-site work including: Review of administrative policies and procedures Consideration of enterprise risk’ Evaluation of risk assessment in audit planning Review of working papers and final reports for selected engagements Review of number and skills of internal audit staff Evaluate adequacy of IT audit coverage

A 12-Point Process Evaluate the internal audit activity’s effectiveness at remaining current and adding value through interviews with: Selected members of the board Executive management Operating managers Internal audit staff Consider other monitoring functions, and evaluate coordination of internal audit work with that of independent auditors. Evaluate the internal audit activity’s conformance with IIA Standards and other relevant standards.

A 12-Point Process Review quality/process improvement actions currently underway Provide a summary of issues and recommendations, and hold a closing conference with the CAE and/or other requestors. Draft a report, obtain comments, and issue a final report Hold a follow-up executive conference (optional)

Common Problems Observed by IIA External Assessment Teams Inappropriate CAE reporting relationships Out-of-date charters for internal audit activity Lack of board approved policy on internal control responsibility Client perception of inadequate audit staff knowledge Lack of a formalized risk assessment process Lack of understanding regarding: Internal audit activity’s consulting responsibilities Reflection of consulting in the mission and charter Inadequate IT coverage or technical skills

Quality Assessment Resources at www.theiia.org/quality Frequently Asked Questions about Quality Providers of External Quality Assessments List of Organizations with Completed External Quality Assessments Becoming a QA Volunteer

Quality Assessment Resources at www.theiia.org/quality Sample request for a quality assessment proposal Quality Assessment Advanced Preparation Audit Customer (Client) Survey Internal Audit Staff Survey Self-Assessment Guide Models Model Audit Committee Charter Model Internal Audit Activity Charter Model Management Control Policy Model Quality Assurance and Improvement Program

Questions?

IIA Contact 247 Maitland Avenue Altamonte Spring, Florida 32701-4201 USA Tel + 1.407.937.1399 Fax +1.407.937.1101 E-mail: quality@theiia.org