EVALUATING THE INTERNAL AUDIT ACTIVITY ACCT 1163 OPERATIONS AUDITING INTRODUCTION • THE STANDARDS OF THE INSTITUTE OF INTERNAL AUDITORS REQUIRE THAT THIS SHOULD BE DONE. THE REQUIREMENT IS ADDRESSED IN THE SECTION OF THE STANDARDS TITLED “QUALITY ASSURANCE AND IMPROVEMENT PROGRAM”. THERE ARE TWO MAIN PARTS TO THIS PROGRAMME, THE FIRST PART OF WHICH IS DIVIDED INTO TWO: • INTERNAL ASSESSMENTS, COMPRISING (A) ONGOING MONITORING OF THE PERFORMANCE OF THE INTERNAL AUDIT ACTIVITY, AND (B) PERIODIC REVIEWS PERFORMED BY SELF ASSESSMENT OR BY OTHER PERSONS WITHIN THE ORGANISATION WITH SUFFICIENT KNOWLEDGE OF INTERNAL AUDIT PRACTICES. • EXTERNAL ASSESSMENTS. • NEVERTHELESS THE QUALITY ASSURANCE AND IMPROVEMENT PROGRAMME, IN EACH OF ITS THREE ASPECTS, SHOULD BE: . . . DESIGNED TO ENABLE AN EVALUATION OF THE INTERNAL AUDIT ACTIVITY’S CONFORMANCE WITH THE DEFINITION OF INTERNAL AUDITING AND THE STANDARDS AND AN EVALUATION OF WHETHER INTERNAL AUDITORS APPLY THE CODE OF ETHICS. THE PROGRAM ALSO ASSESSES THE EFFICIENCY AND EFFECTIVENESS OF THE INTERNAL AUDIT ACTIVITY AND IDENTIFIED OPPORTUNITIES FOR IMPROVEMENT. ONGOING MONITORING • IS A NATURAL MANAGEMENT RESPONSIBILITY. • IT IS DONE BY INTERNAL AUDIT MANAGEMENT AND BY SENIOR GENERAL MANAGEMENT AS PART OF THEIR OVERSIGHT ROLE OF INTERNAL AUDIT. PERIODIC INTERNAL REVIEWS • CAN BEST BE DESCRIBED AS AN INTERNAL AUDIT ENGAGEMENT OF THE INTERNAL AUDIT FUNCTION ITSELF, PERFORMED BY ONE OR MORE MEMBER(S) OF THE INTERNAL AUDITING FUNCTION OR BY OTHERS FROM WITHIN THE ORGANISATION WHO ARE CAPABLE OF UNDERTAKING THIS ENGAGEMENT EFFECTIVELY. • AUDITOR INDEPENDENCE, AND THUS THE OBJECTIVITY OF THE AUDIT RESULTS, IS CHALLENGED WHEN PERIODIC INTERNAL REVIEWS ARE CONDUCTED, ESPECIALLY WHEN THESE ARE UNDERTAKEN BY MEMBERS OF THE INTERNAL AUDIT ACTIVITY. • IT SHOULD BE IMPRESSED UPON THE INTERNAL AUDITORS IN THE TEAM THAT THEY ARE EXPECTED TO COME TO AN UNBIASED ASSESSMENT. EXTERNAL REVIEWS • EXTERNAL REVIEWS ARE REQUIRED TO BE CONDUCTED AT LEAST ONCE EVERY FIVE YEARS AND POSSIBLY MORE FREQUENTLY. • THEY MUST BE CONDUCTED BY A COMPETENT INDIVIDUAL OR TEAM FROM OUTSIDE THE ORGANISATION. • THE CHIEF AUDIT EXECUTIVE MUST DISCUSS WITH THE BOARD: • THE NEED FOR MORE FREQUENT EXTERNAL ASSESSMENTS; AND • THE QUALIFICATIONS AND INDEPENDENCE OF THE EXTERNAL REVIEWER OR REVIEW TEAM, INCLUDING ANY POTENTIAL CONFLICT OF INTEREST. COMMON WEAKNESSES NOTED BY QUALITY ASSURANCE REVIEWS VERY COMMON FAILINGS OF INTERNAL AUDITING ACTIVITIES WHICH FEATURE IN REPORTS OF PERIODIC INTERNAL REVIEWS AND EXTERNAL ASSESSMENTS, INCLUDE: • SCOPE OF WORK THAT DOES NOT EMBRACE EVERYTHING SET OUT IN THE DEFINITION OF INTERNAL AUDITING. • CHARTER THAT DOES NOT EXIST, OR IS OUT-OF-DATE, OR INADEQUATE IN ITS COVERAGE. • INSUFFICIENT INTERNAL AUDIT RESOURCES TO PROVIDE ADEQUATE ASSURANCE TO MANAGEMENT AND TO THE BOARD. • RESTRICTED SCOPE OF INTERNAL AUDIT ACTIVITY, WITH SOME “NO GO” AREAS. • INADEQUATE INDEPENDENCE FROM MANAGEMENT. • ONLY INDIRECT OR NO REPORTING TO THE BOARD OR TO ITS AUDIT COMMITTEE. • INADEQUATE OR NO HANDBOOK SETTING OUT THE INTERNAL AUDIT ACTIVITY’S METHODS OF WORK. • INADEQUATE ON-GOING TRAINING FOR INTERNAL AUDITORS. • INADEQUATE BASIS FOR DETERMINING THE PLAN OF FUTURE AUDIT ENGAGEMENTS. • ROUTINE FAILURE TO COMPLETE THE PLANNED PROGRAMME OF AUDIT ENGAGEMENTS. • INSUFFICIENT PLANNING (INCLUDING DOCUMENTATION OF THE PLAN) FOR INDIVIDUAL AUDIT ENGAGEMENTS. • COMMON FAILURE TO COMPLETE THE PLANNED PROGRAMME OF WORK AT THE LEVEL OF INDIVIDUAL ENGAGEMENTS. • INSUFFICIENT OR INCONSISTENT EVIDENCE TO SUPPORT AUDIT FINDINGS CONTAINED WITHIN ENGAGEMENT REPORTS. • INADEQUATE AUDIT ENGAGEMENT RECORDS. • INADEQUATE EVIDENCE OF AUDIT SUPERVISION CONTAINED WITHIN AUDIT ENGAGEMENT RECORDS. • SUPERFICIAL AUDIT WORK, USUALLY WITH INADEQUATE TESTING OF CONTROLS. • LACK OF TIMELINESS IN AUDIT REPORTING. • INADEQUATE USE OF AUDIT TOOLS, SUCH AS AUDIT SOFTWARE. • POOR COORDINATION WITH OTHER REVIEW AGENCIES (SUCH AS EXTERNAL AUDIT, THE COMPLIANCE FUNCTION, QUALITY ASSURANCE, ETC.). EFFECTIVE MEASURING OF INTERNAL AUDITING’S CONTRIBUTION TO THE ENTERPRISE’S PROFITABILITY • WE TAKE A LOOK AT PERFORMANCE MEASURES FOR INTERNAL AUDITING— MEASURES OF INPUTS (ECONOMY), PROCESS (EFFICIENCY) AND ESPECIALLY OUTPUTS (EFFECTIVENESS). • WE PLACE THE MEASUREMENT OF INTERNAL AUDIT IN CONTEXT WITH: (A) THE GENERAL BUSINESS ENVIRONMENT, (B) PROFESSIONAL STANDARDS FOR INTERNAL AUDITING AND (C) GOOD MANAGEMENT PRACTICE ON PLANNING AND CONTROL. LASTLY, WE PRESENT A PARTICULAR APPROACH TO THE USE OF PERFORMANCE MEASURES IN VALUE FOR MONEY AUDITING WHICH MAY BE APPLIED TO ASSESSING INTERNAL AUDITING PERFORMANCE. THE GENERAL BUSINESS ENVIRONMENT— THE RECESSION • HISTORICALLY THE GROWTH OF INTERNAL AUDITING AS A BUSINESS SERVICE HAS BEEN “COUNTER CYCLICAL”, THOUGH THERE ARE INDICATIONS THAT THIS MAY NOT BE SO DURING THE PRESENT RECESSION. • WHETHER OR NOT INTERNAL AUDIT PROSPERS IN CONSTRAINED TIMES, IT CERTAINLY BEHOVES INTERNAL AUDIT TO BE ABLE TO DEMONSTRATE THAT ITS FUNCTION IS COST-EFFECTIVE AND IS MANAGED SO AS TO MAXIMISE ITS COST-EFFECTIVENESS. • WHERE INTERNAL AUDITING IS NOT A MANDATORY REQUIREMENT BY STATUTE LAW OR BY REGULATION, THERE IS ADDED PRESSURE FOR AUDIT TO BE ABLE TO DEMONSTRATE ITS WORTH. • INTERNAL AUDITING IS A COSTLY SERVICE TO RUN. COMPETITIVE TENDERING • EVEN WHERE INTERNAL AUDITING IS A MANDATORY REQUIREMENT THE VOGUE FOR COMPETITIVE TENDERING MAKES INTERNAL AUDITING A PRIME CANDIDATE FOR MARKET TESTING AND CONTRACTING OUT. • IF MANAGEMENT AND THE BOARD ALLOW DECISIONS ON LETTING CONTRACTS FOR INTERNAL AUDIT WORK TO BE MADE ON PRICE ALONE, RATHER THAN VALUE FOR MONEY, THEY ARE ACTING IRRESPONSIBLY. POTENTIAL ADVANTAGES OF CONTRACTING OUT INTERNAL AUDITING 1. THE BUSINESS CAN MORE READILY VARY ITS SPEND ON INTERNAL AUDITING, ACCORDING TO WHAT IT CAN AFFORD, FROM TIME TO TIME. 2. THE CONTRACTOR IS MOTIVATED TO PERFORM WELL AND CAN BE HELD TO ACCOUNT FOR THAT PERFORMANCE. 3. THE PROVIDER CAN BE CHANGED MORE EASILY. 4. THE SERVICE MAY BE PROVIDED AT A LOWER PRICE. 5. AN EXTERNAL PROVIDER MAY HAVE A WIDER UNDERSTANDING AS TO HOW OTHER ENTERPRISES TACKLE SIMILAR BUSINESS ISSUES. 6. AN EXTERNAL PROVIDER MAY HAVE MORE EXTENSIVE AUDIT SUPPORT RESOURCES TO DRAW UPON. 7. AN EXTERNAL PROVIDER MAY BE ABLE TO DEVELOP THE ENTERPRISE’S OWN STAFF. 8. THE ACTUAL AND PERCEIVED INDEPENDENCE OF AN EXTERNAL PROVIDER MAY BE GREATER— LEADING TO MORE CONFIDENCE IN THE RESULTS OF THE AUDIT WORK. POTENTIAL ADVANTAGES OF IN-HOUSE INTERNAL AUDIT PROVISION 1. A DEEPER GRASP OF THE ENTERPRISE’S AFFAIRS. 2. A FINER ADJUSTMENT OF INTERNAL AUDIT EMPHASIS TO THE ENTERPRISE’S NEEDS. 3. “ON THE SPOT” RESPONSIVENESS TO MANAGEMENT AND THE BOARD; BETTER ABLE TO TAKE ON UNPLANNED WORK. 4. A TRAINING GROUND FOR THE FUTURE SENIOR EXECUTIVES. 5. CONFIDENTIALITY. 6. MORE LIKELY TO HAVE A GENUINE INTERNAL AUDIT ORIENTATION AS DISTINCT FROM AN EXTERNAL ORIENTATION. 7. UNABLE TO “WALK AWAY”. CATEGORIES OF PERFORMANCE MEASURES • MEASURES OF INTERNAL AUDIT PERFORMANCE HAVE TENDED TO FOCUS UPON INPUT AND PROCESS RATHER THAN UPON OUTPUT. AUDITORS WILL UNDERSTAND THE ASSOCIATION BETWEEN THESE THREE AND ECONOMY, EFFICIENCY AND EFFECTIVENESS • THE GREATEST CHALLENGE IS NOW TO DEVELOP A RANGE OF MEASURES WHICH THROW LIGHT UPON INTERNAL AUDIT EFFECTIVENESS QUANTITATIVE, QUASI-QUANTITATIVE AND QUALITATIVE MEASURES • IN REALITY EACH PERFORMANCE MEASURE CAN BE CONCEIVED AS BEING SOMEWHERE ON A GRADATION BETWEEN THE EXTREMES OF OBJECTIVE (QUANTITATIVE) AND SUBJECTIVE (QUALITATIVE). • SUBJECTIVE MEASURES ARE OFTEN GIVEN AN AURA OF OBJECTIVITY, SO THAT THEY MAY BE TERMED QUASI-QUANTITATIVE. • PERFORMANCE MEASURES WITH A HIGHER DEGREE OF OBJECTIVITY THAN OTHERS ARE NOT NECESSARILY THE PREFERRED ONES TO USE • USING OUR MODEL OF INPUT, PROCESS AND OUTPUT, WE NOW CONSIDER FOR EACH OF • THESE CATEGORIES THE MOST IMPORTANT ASPECTS OF PERFORMANCE AS THEY RELATE TO INTERNAL AUDIT. SOME MEASURES OF PERFORMANCE INFORM ABOUT MORE THAN ONE OF THESE CATEGORIES. • ANOTHER EXAMPLE OF THIS OVERLAP BETWEEN CATEGORIES OF PERFORMANCE MEASURE IS THE CLIENT SATISFACTION SURVEY WHICH PROVIDES DATA ON THE REPUTATION OF AUDIT. INPUT MEASURES THESE PERFORMANCE MEASURES THROW LIGHT UPON THE ECONOMY WITH WHICH THE INTERNAL AUDITING ACTIVITY IS PROVIDED—WHETHER BY IN-HOUSE PROVISION OR BY EXTERNAL PROVIDERS. POSSIBLE CANDIDATES FOR USE AS ECONOMY MEASURES ARE: • NUMBERS OF AUDITORS PER 1000 STAFF COMPARED TO SECTOR AVERAGE. • LEVELS OF EXPENDITURE: • BUDGET: ACTUAL • COST PER AUDITOR DAY • RATIO OF PAYROLL TO OTHER COSTS • COMPARISON BETWEEN AUDIT SECTIONS • COMPARISON WITH PREVIOUS PERIODS. • ALLOCATION OF PRODUCTIVE TIME ACCORDING TO TYPE OF WORK (AUDIT TYPE; AUDIT AND NON AUDIT WORK [SUCH AS FIRE FIGHTING] ETC.) • EXTENT TO WHICH AUDIT STAFF ARE STRETCHED. PROCESS MEASURES • THE EMPHASIS WITH RESPECT TO PROCESS MEASURES IS THE EFFICIENCY WITH WHICH THE INTERNAL AUDIT ACTIVITY FUNCTIONS. • IT SHOULD BE POINTED OUT THAT CONFORMITY REQUIRES COMMITMENT TO THEM BY THE INTERNAL AUDITING FUNCTION, BUT ALSO NEEDS SUPPORT BY SENIOR GENERAL MANAGEMENT AND THE BOARD. OUTPUT MEASURES • HERE WE ARE CONSIDERING (A) WHETHER OR NOT INTERNAL AUDIT ACHIEVES ITS OBJECTIVES, AND (B) INDEED, EVEN WHETHER IT ACHIEVES THE RIGHT OBJECTIVES. • THE CHARTER OF THE INTERNAL AUDITING FUNCTION, AS A STATEMENT OF THE DISTINCTIVE RIGHTS AND OBLIGATIONS OF THE AUDIT FUNCTION, IS AN IMPORTANT YARDSTICK AGAINST WHICH AUDIT EFFECTIVENESS OR OUTPUT SHOULD BE MEASURED. • INTERNAL AUDIT REPORTS ARE A REPOSITORY OF INFORMATION ON AUDIT OUTPUT. • THE EXISTENCE OF AN AUDIT FUNCTION WITH BROAD COVERAGE PROVIDES A MEASURE OF REASSURANCE TO MANAGEMENT AND THE BOARD WITH RESPECT TO REASSURE MANAGEMENT THAT INTERNAL CONTROL IS SOUND AND DISCOURAGES FUTURE ABUSE DUE TO THE DETERRENT EFFECT OF AUDIT. THE IMPLICIT AND EXPLICIT OBJECTIVES OF INTERNAL AUDITING: 1. TO REASSURE MANAGEMENT THAT INTERNAL CONTROL IS SOUND. 2. TO IDENTIFY NON COMPLIANCE AND URGE FUTURE COMPLIANCE. 3. TO IDENTIFY SYSTEM WEAKNESSES AND MAKE RECOMMENDATIONS FOR IMPROVEMENT. 4. TO PERSUADE MANAGEMENT TO ACCEPT AND IMPLEMENT SUCCESSFULLY THE AUDIT RECOMMENDATIONS FOR IMPROVEMENT. INTERPRETATION OF PERFORMANCE MEASURES • MEASURES OF REPORTING SUCCESS SHOULD BE LINKED WITH MEASURES OF COST SAVINGS, TIME UTILIZATION AND THE ACHIEVEMENT OF AUDIT PLAN. • WE ALSO NEED TO BE CAUTIOUS ABOUT PLACING TOO MUCH CONFIDENCE IN OUR PERFORMANCE MEASURES. HERE WE HIGHLIGHT JUST TWO POSSIBLE ISSUES OF THIS SORT: • FIRST, AUDIT INDEPENDENCE. THIS IS A PREREQUISITE OF SUCCESSFUL INTERNAL AUDITING. • SECONDLY, THE SCOPE OF INTERNAL AUDITING WORK. INTEGRATING PERFORMANCE MEASURES WITH GOOD MANAGEMENT PRACTICE • THE CHARTERED INSTITUTE OF PUBLIC FINANCE AND ACCOUNTANCY (CIPFA) SUGGESTED THERE ARE FOUR FUNDAMENTAL QUESTIONS TO BE ASKED OF INTERNAL AUDITING, WITHOUT WHICH PERFORMANCE MEASURES FOR INTERNAL AUDIT HAVE LITTLE MEANING: 1. DOES INTERNAL AUDIT HAVE AGREED AND ESTABLISHED GOALS? 2. IS THE WORK PLANNED AND RESOURCED IN SUCH A WAY AS TO MAKE ACHIEVEMENT A REALISTIC POSSIBILITY? 3. DOES THE ACHIEVEMENT OF THESE GOALS CONTRIBUTE TO THE ATTAINMENT OF THE CORPORATE OBJECTIVES, I.E. ESTABLISHING AND MAINTAINING INTERNAL CONTROL? 4. DOES INTERNAL AUDIT ACHIEVE ITS DEFINED GOALS? THESE QUESTIONS SHOULD BE ADDRESSED BY THE AUDIT COMMITTEE, BY MANAGEMENT, BY THE HEAD OF INTERNAL AUDIT AND BY EXTERNAL AUDIT. THE CHARTER OF THE INTERNAL AUDITING DEPARTMENT SHOULD ENSURE POSITIVE ANSWERS TO THESE FOUR QUESTIONS. A VALUE FOR MONEY APPROACH TO EVALUATING INTERNAL AUDIT, USING PERFORMANCE MEASURES CONTROL OBJECTIVES FOR THE INTERNAL AUDIT ACTIVITY (A) TO ENSURE THAT THE INTERNAL AUDIT ACTIVITY PROVIDES SUFFICIENT AND RELIABLE ASSURANCE TO THE BOARD AND TO MANAGEMENT ON GOVERNANCE PROCESSES, RISK MANAGEMENT AND INTERNAL CONTROL. (B) TO PROVIDE QUALITY CONSULTANCY SERVICES TO THE ORGANISATION WITHIN THE COMPETENCE OF THE INTERNAL AUDIT ACTIVITY TO DO SO, WITHOUT ASSUMING MANAGEMENT RESPONSIBILITIES. (C) TO ACHIEVE A SCOPE FOR INTERNAL AUDIT THAT IS UNRESTRICTED ACROSS THE ORGANIZATION AT ALL LEVELS. (D) TO BE ORGANISATIONALLY AND OPERATIONALLY INDEPENDENT SO THAT THE JUDGEMENT OF INTERNAL AUDIT ON PROFESSIONAL MATTERS IS NEVER SUBORDINATED TO THAT OF OTHERS. (E) TO CONFORM TO APPLICABLE ETHICAL CODES AND PROFESSIONAL STANDARDS. (F) GENERALLY, TO ADD VALUE TO THE ORGANISATION. THANK YOU!!!
