Internal Audit Quality Assessment Reviews
Internal Audit departments must meet the objectives of the Institute of Internal Auditor’s Quality Assessment standards. In addition to evaluating the department’s compliance with the standards, GBQ’s approach helps answer the company managements’ overall question: “Is my Internal Audit department adding value to the company?” We provide management with an assessment of their investment in Internal Audit, including whether that investment is at an appropriate level, is properly directed, and is producing the most value. For Internal Audit Directors, we provide recommendations on how to bolster and invigorate their department, assurance as to whether he/she has developed an appropriate plan and has the correct skill set to address the company’s business risks, and can appropriately monitor the company’s control environment.
- The Institute of Internal Auditors’ (The IIA) Standard 1300 requires the Chief Audit Executive (CAE) to develop and maintain a Quality Assurance & Improvement Program (QAIP).
- Companies are required to have an external quality assessment that evaluates conformance with the International Standards for the Professional Practice of Internal Auditing (Standards), the internal audit and audit committee charters, the organization’s risk and control assessment, and the use of successful practices.
- External Assessments should be conducted at least once every five years by a qualified, independent reviewer or review team from outside the organization.
- The external assessment provides a benefit to the organization — It builds stakeholder confidence by documenting management’s commitment to quality and leading practices, as well as sound professionalism.
- The external assessment provides evidence to the board, the audit committee, management and other stakeholders that the internal audit function is concerned about the organization’s internal control environment and activities, governance, ethics, and risk management.
Approach #1: Independent assessment with independent validation
- Involves an outside team under the leadership of an experienced and professional project manager.
- Team is composed of competent professionals, well versed in internal audit best practices.
Approach #2: Independent validation of an internal self assessment
- A competent independent evaluator who is well versed in quality assessment methodology is used to validate the self-assessment performed by the internal audit function.
- In addition to validating the self-assessment, the external validator substantiates some of the work performed by the self-assessment, including performing on-site visits, interviews with management, etc.
- The external validator can co-sign the Chief Audit Executive’s (CAE) report regarding conformity with the Standards or can issue a separate report indicating any discrepancies with the CAE’s report.
- Note: The CAE must obtain board approval regarding the approach chosen.
GBQ RAS’ Quality Assurance Review consists of a Three Phase Approach and is designed to:
- Grant assurance as to whether IA is acting in accordance with its mission and charter
- Identify whether IA meets or exceeds applicable industry standards
- Evaluate whether the company’s audit planning process is sufficiently comprehensive and appropriately focused
- Provide an independent assessment over audit report quality, timeliness and completeness of follow-up procedures
- Provide evidence of how IA is received by the audit committee, senior management and internal clients (line management)
- Supply senior management with real-world recommendations for Internal Audit “Best Practices”