One of the common questions faced by internal auditors is: “Who audits the auditor?” Internal Audit examines many parts of the organisation, so it is only natural that the quality of Internal Audit itself should be reviewed from time to time. Internal Audit is covered by the International Professional Practices Framework issued by the Institute of Internal Auditors globally.
What is Quality?
Quality is not absolute. The quality of a product or service is the degree to which the product or service meets the customer’s expectations — the degree of conformance. Internal Audit needs to be fit for purpose to provide the service expected by the Audit Committee, the Chief Executive Officer and top management.
Delivery of a quality product or service does not just happen – it needs to be managed. Quality management involves an ongoing effort to identify what good quality looks like and to ensure it is being achieved consistently. Periodic review by an independent assessment team can assist Internal Audit on the Path to Quality (Institute of Internal Auditors Practice Guide Quality Assurance & Improvement Program). Where does your Internal Audit function rate on the Path to Quality? Please refer to the diagram shown below.
Quality Assurance and Improvement Program
Standard 1300 requires Internal Audit to develop and maintain a Quality Assurance and Improvement Program that includes:
• Ongoing Internal Assessments, for example:
- Working paper reviews.
- Actual versus budgeted analysis for time spent on internal audit engagements.
- Audit feedback forms from management after each internal audit engagement.
- Performance evaluations.
- Results of Internal Audit performance measures.
• Periodic Internal Assessments to be performed annually:
- Review of the Internal Audit Charter for conformance with the Standards.
- Self–assessment of conformance with the Standards
• External Assessments performed at least once every 5 years by a qualified, independent assessor or assessment team from outside the organisation.
Why have an External Assessment?
An External Assessment is a comprehensive review that examines Internal Audit for such things as:
• Conformance of Internal Audit services with the mandatory IIA guidance.
• Expectations of Internal Audit services expressed by the Audit Committee, the Chief Executive Officer and top management, and whether these are being met.
• Skills, knowledge and experience within Internal Audit.
• Whether Internal Audit adds value.
• Opportunities for improvement.
It is a way of proving to the Audit Committee and top management the value that Internal Audit is adding to the organisation. It can also harness the experience of the independent assessment team to share insights gained from other Internal Audit functions.
The External Assessment process usually includes confidential discussions with Audit Committee members, the Chief Executive Officer and top management to obtain their perceptions of Internal Audit’s performance. It can also include confidential surveys of middle management and benchmarking against other Internal Audit functions in similar industries. An assessment of Internal Audit maturity by the assessment team can also be included.
Above all, an Independent External Assessment promotes a culture of professionalism in the Internal Audit Function by:
• Scrutinizing its activities the same way as it audits other parts of the organisation.
• Assessing conformance to mandatory IIA guidance.
UMAIR KADIR, ACCA, CIA is Manager Internal Audit at Burj Bank Ltd in Pakistan.