3 Professional Practices Framework International Standards for the Professional Practice of Internal Auditing (Standards)Mandatory GuidanceAttributePerformanceImplementationAssuranceConsultingPractice AdvisoriesDevelopment and Practice Aids
4 Quality Standards 1300 - Quality Assurance and Improvement Program Quality Program AssessmentsInternal AssessmentsExternal AssessmentsReporting on the Quality ProgramUse of “Conducted in Accordance with the Standards”Disclosure of Noncompliance
5 Standard 1311 Internal Quality Assessments OngoingWork Paper ReviewsPerformance EvaluationsActual vs. Budgeted AnalysisVarious Monitoring MetricsCustomer SurveysPeriodicSelf-AssessmentAnnually – Covering all Standards over 5 yearsQuarterly/Semi-Annual – Portions of Standards each yearAssess compliance with IA Activity Charter
6 Standard 1312 External Quality Assessments Required every 5 yearsStandard enacted January 1, 2002Two methods:External Quality Assessment with the review and report by an independent teamSelf Assessment with report validation by an Independent Validator
7 Objectives of External Reviews Provide an opinion on the internal audit activity’s conformance to the spirit and intent of the Standards.Assess the efficiency and effectiveness of the internal audit activity in light of:Its charterExpectations of the board, executive management, and the CAEIdentify opportunities and offer ideas and counsel to the CAE and staff for:Improving their performanceIncreasing the value they add to the enterprise
8 Why Conduct an External Quality Assessment? To provide independent analyses:Do we meet professional standards?Can things be done better?Should more be done?Is maximum value being received for each dollar of expense?Can we add more value to management and the audit committee?Can we enhance our image, perceptions, and credibility within the organization?
9 Standard 1321 Use of "Conforms with the Standards" Internal auditors are encouraged to report that activities are in conformance with the StandardsHowever, internal auditors may use the statement only if assessments of the quality assurance and improvement program demonstrates conformance with Standards.
10 External Quality Assessment Contract with outside provider to perform review, write the report and determine the compliance with the Standards:Regional accounting firmsOutsource providersIndependent consultantsIndependent Peers
11 Self Assessment with Independent Validation Internal Audit Activity conducts their own Self assessment, determines compliance with the Standards and writes the reportInternal Audit Activity then engages an independent Validator to review documentation and perform limited testingValidator concurs with report or disagrees and issues own report (opinion)Validator can be an external service provider or from a peer pool
12 Peer ReviewsPeer reviews between three or more organizations does meet the requirements of an external quality assessment.Reciprocal peer reviews between two organizations would not pass the independence test.Contract between three (3) or more companies within the same industry or other affinity group, regional association, or other group of organizations.
13 Competence of Assessors and Validators Practice Advisory recommends:Be a competent, certified audit professional.Be well versed in the best practices of the profession.Have at least three years of recent experience in the practice of internal auditing at a management level.Have additional competence gained from working previously as a team member on an external quality assessment.
14 Independence of Assessors and Validators Practice Advisory recommends:“be free from any obligation to, or interest in, the organization whose internal audit activity is the subject of the assessment …”
15 A 12-Point Process Select and train a QA team Have the CAE complete the QA self-studyMake a preliminary visit to the organizationUse customer and staff surveysPerform the on-site work including:Review of administrative policies and proceduresConsideration of enterprise risk’Evaluation of risk assessment in audit planningReview of working papers and final reports for selected engagementsReview of number and skills of internal audit staffEvaluate adequacy of IT audit coverage
16 A 12-Point ProcessEvaluate the internal audit activity’s effectiveness at remaining current and adding value through interviews with:Selected members of the boardExecutive managementOperating managersInternal audit staffConsider other monitoring functions, and evaluate coordination of internal audit work with that of independent auditors.Evaluate the internal audit activity’s conformance with IIA Standards and other relevant standards.
17 A 12-Point ProcessReview quality/process improvement actions currently underwayProvide a summary of issues and recommendations, and hold a closing conference with the CAE and/or other requestors.Draft a report, obtain comments, and issue a final reportHold a follow-up executive conference (optional)
18 Common Problems Observed by IIA External Assessment Teams Inappropriate CAE reporting relationshipsOut-of-date charters for internal audit activityLack of board approved policy on internal control responsibilityClient perception of inadequate audit staff knowledgeLack of a formalized risk assessment processLack of understanding regarding:Internal audit activity’s consulting responsibilitiesReflection of consulting in the mission and charterInadequate IT coverage or technical skills
19 Quality Assessment Resources at www.theiia.org/quality Frequently Asked Questions about QualityProviders of External Quality AssessmentsList of Organizations with Completed External Quality AssessmentsBecoming a QA Volunteer
20 Quality Assessment Resources at www.theiia.org/quality Sample request for a quality assessment proposalQuality Assessment Advanced PreparationAudit Customer (Client) SurveyInternal Audit Staff SurveySelf-Assessment GuideModelsModel Audit Committee CharterModel Internal Audit Activity CharterModel Management Control PolicyModel Quality Assurance and Improvement Program