Internal Audit Quality Assurance and Improvement Program

1. Internal Audit Quality Assurance and Improvement Program Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

2. Quality Assurance and Improvement ProgramAGENDA ITEM • Requirements of the Quality Assurance and Improvement Program • Internal Assessments • Internal Assessment Guidance • Internal Assessment Sample • External Assessments – Common Issues Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

3. Requirements of the Quality Assurance and Improvement Program “The Quality Assurance and Improvement Program must include both internal and external assessments.” Internal assessments must include: • Ongoing monitoring of the performance of the internal audit activity. • Periodic self–assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

4. Requirements of the Quality Assurance and Improvement Program “The Quality Assurance and Improvement Program must include both internal and external assessments.” External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. The Chief Audit Executive must discuss with the Board: • The form and frequency of external assessment. • The qualifications and independence of the external assessor or assessment team, including any potential conflict of interest. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

5. Internal Assessments - Guidance Internal Assessments – Ongoing • Work paper reviews and supervisor sign-off for in-house internal audit engagements. • Performance evaluations for in-house internal audit engagements. • A regular statement from service providers (i.e. after each audit, or quarterly, or annually) confirming their work conforms to the Standards. • Performance evaluations for outsourced internal audit engagements. • Actual versus budgeted analysis (monitoring metrics). • Client feedback surveys. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

6. Internal Assessments - Guidance Internal Assessments – Periodic • Review of the Internal Audit Charter. • Self-assessment to assess conformance with the Standards for both internal engagements and those completed by service providers. • Assessment of competency planning for the internal audit activity overall, and progress in delivering identified professional development initiatives. • Staff performance reviews (HR process). Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

7. Internal Assessments - Guidance Internal Assessments – Periodic • Performance measures (KPIs). • File reviews for in-house internal audit engagements. • File reviews for outsourced internal audit engagements. • Staff declarations. • Assertion on conformance with Internal Auditing Standards. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

8. Internal Assessments - Sample Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

9. Internal/External Assessments Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

10. External Assessments • At least once every 5 years. • By a qualified, independent assessor or assessment team. • The assessor must be from outside the organization to be independent. • It is a good idea to include the 5-yearly Quality assessment in the Internal Audit Plan. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

11. External Assessments – Common Issues Internal Audit Foundations • Internal Audit Charter not reviewed annually. • Chief Audit Executive reporting relationship not sufficiently independent. Internal Audit Staffing • Lack of structured induction for new starters. • Career development and methods of broadening Internal Auditor skills and experience not considered. Quality Assurance and Improvement Program • Quality Assurance and Improvement Program not documented. • Periodic Internal Assessments against the Standards not performed annually. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322

12. External Assessments – Common Issues Risk Assessment and Internal Audit Planning • Internal Audit does not have a documented Risk Assessment model for audit planning. • The Internal Audit Plan fails to show what will not be audited. Internal Audit Policies and Procedures • There is no Internal Audit Manual or it is out-of-date. • Internal Audit Manual is not sufficiently comprehensive. Internal Audit Reports • Issue of reports later than planned. • Recommendations developed but not agreed with management – may be ‘throwaway lines’. Standards: 1300, 1310, 1311, 1312, 1320, 1321, 1322