Role reversal

By Yves Giard + Massimo Cecere
Illustration : Blair Kelly

What happens when the internal auditor becomes the auditee: some say it can only mean positive returns for the team

On January 1, 2007, the Institute of Internal Auditors (IIA) adopted a standard making external assessments mandatory for internal audit departments. Under this standard, newly established internal audit departments have five years to undergo an initial audit and subsequent assessments are to be conducted every five years thereafter.

According to the IIA, 95% of assessments are requested by internal audit department heads, a figure that should come as no surprise given the added value and numerous benefits these assessments provide.

Main benefits
Validating the department’s proficiency and professionalism with the audit committee and shareholders The objective of an external assessment is to hand senior management a clean bill of health confirming the proficiency and effectiveness of the internal audit department’s methods, thus alleviating some concerns of corporate directors. The recommended assessment is also intended to reassure the audit committee that internal audit is complying with applicable professional standards. In addition, the Standards for the Professional Practice of Internal Auditing recommended in the IIA’s conceptual framework contain general guidance on methods to measure the department’s performance. They may be in the form of ratios illustrating the proportion of recommendations the business units have implemented, the files that were completed on time and on budget, or reviewed files shown to be in compliance with standards established by the internal audit department.

Enhancing the department’s credibility with management and business units The internal audit department should demonstrate a genuine concern for effectiveness, efficiency and transparency. In this sense, validation by an independent reviewer would demonstrate that the department is determined to achieve the same degree of proficiency it expects from the divisions or departments it audits.

Since auditees often ask who audits the auditor, the assessment would show business units that the internal audit department practises what it preaches.

Obtaining feedback from senior managers is an essential component of any periodic quality assurance review of internal audit practices. In fact, the IIA’s conceptual framework recommends feedback as a means to measure the level of satisfaction with the internal audit function.

Having an independent reviewer assess practices makes it possible to measure the quality of services and determine where there is room for improvement. Improvements could target the internal audit department’s organization;the nature, frequency and content of reports; the consistency of department self-assessments; the risks assumed by the organization; and the quality and degree of expertise of the human resources involved and the training and methodological support available to them. Such measures enable the internal audit department to determine elements that should be incorporated into its strategic directions. In any event, they can only serve to enhance the internal audit department’s credibility, now and in the future.

Monitoring best practice and new standards Developments in internal auditing have been fast and furious, especially in the past few years. Internal audit department heads have had a heavy load to carry with responsibility for various projects, including compliance with Bill 198, operational auditing and risk management, and EDP and value-for-money auditing. What’s more, standards and best practices change frequently in these areas. An assessment by an independent reviewer can substantiate timeliness and compliance of the methods and work tools used and lead to recommendations in line with best practices.

Motivating internal auditors to aim for the highest quality standards An external assessment will encourage and motivate the internal audit team to aim for superior performance standards. Individual internal auditors will benefit from working for a department that has been externally assessed. Motivation of the department’s human resources should be a key assessment objective for all internal audit department managers.

Obtaining an independent opinion The overall assessment is based on the opinion of an independent reviewer, which may be another internal audit department that has satisfied generally accepted internal auditing standards or is affiliated with a firm that has recognized internal auditing expertise.

Canada’s Auditor General Sheila Fraser was independently assessed by a group of international experts from the audit offices of the UK, Norway, France and The Nether-lands. It submitted a report on the practices of the Office of the Auditor General of Canada as regards value-for-money audits. The group used applicable CICA auditing standards, the Auditor General Act and the practice standards for value-for-money auditing established by the Office of the Auditor General as reference criteria for value-for-money audit work. While the Auditor General’s office is well-known for the quality of its services, the attestation of value-for-money audit activities by an independent reviewer illustrates the importance the office places on having the quality of its work assessed. The Auditor General is also subject to internal audits, which further reinforces the office’s credibility.

The internal auditor of Hydro-Québec, Élie Rabat, explains his organization’s position: “We have been conducting a similar exercise. Every three years, our audit committee appoints an independent external reviewer to analyze the operations and activities of its internal audit group. This quality assurance approach is consistent with the mandate of Hydro-Québec’s internal auditor. The purpose of the exercise is to assure the audit committee that the internal auditing operations and activities are carried out in accordance with IIA professional standards. A third quality assurance review was recently performed by an accounting firm, while the two previous ones were entrusted to the institute.” Clearly, achieving high performance standards and bolstering credibility are key elements underlying any external assessment.

How to prepare
Regardless of an organization’s size, it is important to thoroughly prepare for an assessment. Preparation is a multistage process. For example, it may be advisable to retain staff that has experience in order to properly identify key issues and be adequately prepared.

The planning stage is crucial given the importance of the assessment. Since the review is carried out concurrently with the regular audit program, it is essential to ensure that sufficient resources are available. In this respect, the planning could take the form of a self-assessment where the audit team evaluates its performance and measures deviations from standards. As is the case for any other internal audit project, resources and work plans for a review should be incorporated into the department’s annual plan and budget.

Knowledge of the entity’s business sector and industry should weigh more heavily in the decision to select a reviewer than knowledge of audit techniques. If some of the internal audit services are provided by an external entity, the assessment should always be based on an independent audit, even though the planning may have consisted of a self-assessment exercise.

Independent assessment
Before an independent assessment is conducted, the department should correct any deficiencies identified during the self-assessment exercise. An independent review will take all the following factors into account: the organization chart of both the entity and the internal audit department; type of assessment; starting date and deadline for submitting files; activities performed; resources used; supporting working papers and audit reports.

Reporting of results
The ultimate objective of the external assessment is to acquire a perspective on the internal audit department’s situation and share this view with all stakeholders in its efficient operation. The external assessment report may be communicated via the organization’s or department’s intranet site, on official stationery, or in reports and e-mails sent out for the purpose of boosting the department’s visibility. The report could also be used for recruitment purposes or shown to suppliers or clients to maximize value creation and enhance the organization’s brand image.

To sum up, while validation of the internal audit department by an independent reviewer is an ambitious exercise, it can only generate positive spin-offs for the development of the internal audit team and the organization it represents.

Yves Giard, CA, is a senior consultant with RSM Richter in Montreal. Massimo Cecere, CA, is manager, risk management consulting services, with RSM Richter LLP in Montreal

Technical editor: Yves Nadeau, CA, partner, RSM Richter in Montreal