1. The ICGFM Conference Miami, Florida May 21, 2007
The IIA Research Foundation Draft Internal Auditing Capability Maturity Model (IA-CMM)
The ICGFM Conference
Miami, Florida
May 21, 2007

2. Presentation Outline The IIA and The IIA Research Foundation
Draft IA-CMM
Objectives
Background
Structure
Underlying Principles
Next Steps

3. The Institute of Internal Auditors (IIA)
Established in 1941, The Institute of Internal Auditors (IIA) is an international professional association of more than 125,000 members in 160 countries.
Throughout the world, The IIA is recognized as the internal audit profession’s leader in certification, education, research, and technological guidance.

4. The Internal Auditing Capability Maturity Model Objectives
GRC of The IIA recommended that an IA-CMM be developed as:
A basis for implementing and institutionalizing effective internal auditing in the public sector
A roadmap for orderly improvement to strengthen capabilities

5. Capability Maturity Models – Their History
Based on Quality Management Principles
Software Engineering Institute
The original developers of capability maturity models ®TM
Software
Human Resource Management
Office of the Auditor General of Canada
Financial Management Capability Model

6. What is an IA-CMM?
A tool that describes the key elements needed for effective IA
Describes an evolutionary path for a public sector organization to follow in developing effective IA to meet its governance needs and meet professional expectations
An advocacy tool to market IA to decision makers
Model links to “recommended practices” at each level

7. Why in the Public Sector?
IA varies widely from country to country
Differences in culture, management practices and processes
Need for a governance model including IA
Opportunities to modernize/evolve IA, improve its effectiveness and deliver value added
Critical need for a developmental model, especially in developing countries

8. What the IA-CMM will Provide When Completed
A communication vehicle
A framework for assessment
A roadmap for orderly improvement

9. IA-CMM Capability Maturity Levels
Optimizing
LEVEL 4
Managed
LEVEL 3
Integrated
LEVEL 2
Infrastructure A
LEVEL 1
Initial

10. Why Levels in a Capability Maturity Level?
Different performance expectations and measures exist now
Capacity gets built in steps/stages
Need a common map/conceptual framework
Roadmap to build capacity to achieve higher level of functionality
Guidance to determine the capacity level that an organization wants/needs

11. IA-CMM Capability Maturity Levels
Optimizing
LEVEL 4
Managed
LEVEL 3
Integrated
LEVEL 2
Infrastructure
LEVEL 1
Initial

12. Typical Structure of a Capability Maturity Model
Capability Level
Key Process Area
Key Process Area
Key Process Area
Goals
Activities
Outputs & Outcomes
Mastery

13. Institutionalizing a Key Process Area
Commitment
Verification
Measurement
& Analysis
Activities
Abilities
Key Process Area

14. Project Approach To explore and identify:
Characteristics of each capability level
Elements that make up the internal auditing activity
Key process areas at each capability level and within each element
Goals that need to be achieved and activities and practices of each KPA that need to function effectively to move to next level

15. How will this be done? Through extensive consultation and validation
Input from global, national organizations involved with governance, public sector auditing, internal auditing

16. Underlying Principles
IA’s Obligations
IA is an integral component of effective governance in the public sector
IA assists organizations achieve their objectives and account for their results

17. Underlying Principles
An Organization’s Obligations
To determine the optimum level of internal auditing capability to support the required governance structures
To achieve and maintain the desired capability

18. Underlying Principles
Optimum Capability
Three variables must be considered
IA activity
The organization
The Environment
Not every organization requires the same degree of capability or sophistication
IA must be delivered in a cost-effective manner
No “one size fits all”

19. IA-CMM Not prescriptive – what should be done rather than how to do it
A universal model with comparability around principles, practices and processes to improve IA and be applied globally

20. What the IA-CMM will Provide When Completed
A communication vehicle
A framework for assessment
A roadmap for orderly improvement
Progress over time

21. Next Steps
Refine and validate the draft model globally–broad-based input
Benchmarking partners
Illustrative recommended and leading practices
Completed IA-CMM–November 2007
Summary
Implementation Workbook/s