By Stephen Were, CIA
The biggest room in the world is the room for improvement – Helmut Schmidt
Internal auditors primarily aim is to improve governance by critiquing the work of others (audit clients) within the organizations they serve. Audit work involve among others evaluating those clients’ performance and processes to assess their adequacy in adding value, and in supporting the achievement of missions and goals.
The internal auditors expect their clients to never be afraid of critique, and to embrace the audit process in the interest of continuous improvement. That requires cooperation, positively accommodating internal audit observations, and implementing the auditors’ recommendations to address control weaknesses.
If Internal audit is about improving organizations, and internal auditors are part of organizations, isn’t it appropriate that internal auditors also be subjected to audits for the purposes of improving the internal audits’ own operations and (the auditors’) performance?
You will agree, the sound answer is YES. Similar to the way in which internal audit provides independent assurance, Chief Audit Executives (CAEs) should also receive impartial reviews of the quality of their operations, and their performance. The Institute of Internal Auditors (IIA) Attribute Standard 1300 – Quality Assurance and Improvement Program require CAEs to develop and maintain quality assurance and improvement programs (QAIPs) that cover all aspects of the internal audit activity. A QAIP incorporates an external assessment that need to be conducted at least once every five years by qualified, independent assessors or assessment teams from outside organizations. External assessments are designed to measure the efficiency and effectiveness of internal audit functions, their conformance with professional standards, and to identify opportunities for improvement (Standard 1312 – External Assessments).
From the above, it is clear that as per IIA guidelines, there is a requirement for internal auditors to be audited. The quality assurance reviews done in line with the IIA Standard 1312 give reasonable assurance that the internal audit activity and each member of their staff conform to all mandatory elements of the International Professional Practices Framework (IPPF). An internal audit activity that can demonstrate conformance to the IPPF is perceived as professional, and enjoys credibility with its stakeholders. Credibility is a critical asset to the internal audit activity.
However, studies undertaken by the IIA at a global level, as well as national institutes, have found that a large number of internal audit functions fail to undertake periodic external assessments as required by the Standard 1312. Of note however, mere conformance to the IPPF should not be the primary driver of internal audit quality assessments. The main aim should be the achievement of audit quality, which ultimately enhances performance, and increases the value of the organization.
To start with, it would serve internal auditors well if in their behavior, they mirror what they expect of their audit clients’, that is, to not be afraid of critique. Good internal auditors will understand that an independent person might identify issues that they may have overlooked, or remind them of processes that could be undertaken more efficiently and offer useful insights for improvement of internal audit operations and performance, the same way they expect their clients to have similar understanding.
Of note is that, the IIA Standards require the communication of results of quality assessments to senior management and the Board. By embracing regular external assessments, internal auditors also demonstrate that they are accountable, that they themselves are not afraid of audits, they are walking the talk of “no blind spots” and answering the question of “who audits the auditor?”. It also demonstrates that internal auditors too appreciate the knowledge external professionals can bring to the internal auditors’ processes. This can result in better acceptance of internal audit by corporate management.
While quality reviews may not necessarily make it easier for internal auditors when it comes to having their own activities being reviewed, internal auditors should at least gain insight into how their clients normally feel during audits. Such experiences can make internal auditors more empathic collaborators with the areas of the organization they regularly audit.
It is not uncommon for most internal audit services to articulate their shared valued in their strategy documents, key among them; accountability, transparency, commitment to the pursuit of excellence, professionalism, and collaborative relationships with stakeholders. Putting in place sustainable quality assurance programmes that incorporate regular external assessments go a long way in translating such value statements into concrete actions.
In any case, internal auditors can only expect to improve the organizations they serve when their audit work is of the highest quality. Realization of quality based on stakeholder expectations can be possible only when internal auditors remain open to constructive challenge that they rightfully expect of their audit clients.
So, internal auditors should rise up to the challenge and be open to regular audits. Stakeholders interested continued success of their organizations should also demand regular audits of the internal audit activity.
Adapted from: Internal Audit Quality – Developing a Quality Assurance and Improvement Programme – Sally-Anne Pitt
Stephen Were, CIA, is an Internal Auditor. He may be reached on swere36@gmail.com
ChesterCoads
January 28, 2022 at 6:37 pm
I think, that you are mistaken. Write to me in PM, we will discuss.
diamondpainting
February 9, 2022 at 11:18 am
this is a magnificent review