Internal Audit - Managing the Internal Audit Function

Chapter 8 - for the final exam

What does the CAE need to report on periodically?

The purpose, authority, responsibility (mandate), performance relative to its plan, and conformance to the standards of the internal audit function

What significant risk and control issues must reporting include?

Fraud risks, governance issues, and other matters requiring the attention of senior management and the board

What items should the CAE Consider communicating?

• Significant deviations from the approved engagement work schedules and the reasons for such

• Staffing plans and financial budgets

• Action taken or needed

• SIgnificant engagement observations and recommendations

• Instances of senior management and/or the audit committee acceptance of the risk of not correcting a significant engagement observation

What do reports coordinated by management and the CAE cover?

• Business Unit Monitoring and risk monitoring reports

• Independent outside auditor activity reports

• Key financial activity reports

• Risk management activity reports

• Legal and compliance monitoring reports

What does the report submitted to the audit committee by senior management or the CAE outline?

The results of management’s self-assessment regarding the design adequacy and operating effectiveness of the organization’s internal controls

Internal audit mandate

Empowers the internal audit function to enhance the organization’s success. by providing senior management and the board with objective assurance and advice

Internal Audit Charter

A formal document that includes the internal audit function’s mandate, organizational position, reporting relationships, scope of work, types of services, and other specifications

What is standard 6.1?

The Internal Audit Mandate

Responsibility of the CAE under the internal audit function charter

• Strategic planning

• Obtaining/deploying resources

• Building relationships

• Communicating with stakeholders

• Ensuring and enhancing the performance of the function

Under standard 6.2, what is necessary for the CAE to create in a charter

• Establishes the internal audit function’s position within the organization

• Authorizes access to records, personnel, and physical properties relevant to the performance of engagements

• Defines the scope of internal audit activities

• Takes into consideration assurance and consulting services

What does the internal audit charter provide?

• Formal criteria for review and understanding by management and the audit committee

• Facilitation of a periodic assessment of the adequacy of the internal audit function’s purpose, authority and responsibility, which establishes the role of the internal audit function

• A formal, written agreement with management and the audit committee regarding the organization’s internal audit function

Who is responsible for reviewing and approving the internal audit mandate and charter annually?

The audit committee

Under standard 9.1, what must the CAE understand to develop and effective internal audit strategy and plan?

The organizations governance, risk management, and control processes

What should policies and procedures be consistent with?

The size of the internal audit function

Standard 9.4

The Internal Audit Plan

What does the internal audit plan incorporate?

Risk-Based Planning

What is a significant consideration in implementing an internal audit function

How to allocate resources.

What is the CAE’s responsibility regarding resources

To ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan

What does the CAE orchestrate to ensure resource management?

• Organizational structure and staffing strategy

• Right-sizing

• Staffing plans/ HR

• Hiring Practices

• Strategic Sourcing

• Training and Mentoring

• Career Planning and Professional Development

• Scheduling

• Financial Budget

• Use of professional practice groups

Technological Tools to Support the Internal Audit Process

• Enable increased productivity and efficiency

• Allow for less time to be spent on administrative responsibilities

• Provide for more time on assurance and consulting services

• Should enhance an internal audit function’s productivity

• Should not divert attention away from the task of auditing

• Allow for less time spent documenting, retaining, and accessing supporting documentation

• Data Analysis

• Automated monitoring

• Automated working papers

• Department Administration and Management

What does effective communication require

• Building relationships

• Establishing trust

• Enabling stakeholders to benefit from the results of internal audit services

What type of communication should the CAE promote?

Accurate, objective, clear, concise, constructive, complete, and timely internal audit communications

QAIP

Quality Assurance and Improvement Program

What does the QAIP do?

Evaluate the internal audit function and its conformance with the Global Internal Audit Standards. Also an evaluation of whether internal auditors apply ethics and professionalism to these activities

Quality Formula

Quality = Conformance + Performance

Principle 12

Enhance Quality

CAE Responsibility for Principle 12

Ensuring the internal audit function is continuously seeking improvement

Standard 12.1

Internal Quality Assessment

CAE Responsibility in standard 12.1

develop and conduct internal assessments of the internal audit function’s conformance with Global Internal Audit Standards and progress toward performance objectives

New unconditional requirement in standard 12.1

The CAE must establish a methodology for internal assessments

Standard 8.4

External Quality Assessment

How often must an external assessment take place?

Once every five years

Who must do the external assessment?

A Qualified, independent assessor or assessment team. The requirement may also be met through a self-assessment with independent validation

QAIP

Quality Assurance and Improvement Program

What does the QAIP framework include?

Ongoing monitoring, periodic self-assessment, and external assessment

What does the output of the QAIP activities include?

Findings, observations, and recommendations

Five characteristics of a successful QAIP?

• Policy

• Methodology and process

• People

• Systems and information

• Communication and reporting

Key points to remember regarding reporting on the QAIP

• Internal Assessments

• External assessments

• Follow-up