Internal audit (IA) can be a great benefit to an organization. In accordance with the Institute of Internal Auditors’ International Standards for the Professional Practice of Internal Auditing, “The Chief Audit Executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity.” Such a program must include both internal and external assessments. However, while a requirement of the standards, there is a much better reason for performance of such an assessment—the value it can add to IA activity.
While internal Quality Assessments (QA) include ongoing monitoring of the performance of the IA activity and periodic reviews through self-assessment, external QAs should be conducted at least once every five years by a qualified, independent reviewer from outside the organization. Whether internal or external, the QA will focus on six areas that we’ll cover in this series of blog posts. The first area is internal audit structure.
The foundation of an IA department is its structure, providing basic guidelines by which it operates. The audit charter outlines the purpose, authority and scope, independence, responsibility and reporting requirements of the IA activity. Formal reporting lines—typically to an audit committee or senior executive—indicate the level of internal support and guidance the activity will receive to maintain independence and objectivity throughout execution of the internal audit plan.
Independence is of utmost importance, and care must be taken to ensure the IA reporting structure does not compromise this independence. Even if independence exists, the appearance of a lack of independence sometimes can be a result of reporting structure. For instance, IA may report to the vice president of finance, who in reality understands the need for and grants true independence to the activity. However, if the VP of finance is responsible for the chief audit executive’s (CAE) compensation review and adjustment, the appearance of independence might be compromised if IA performs audits of functions (such as treasury) that also report to the V.P. of finance. There could be concern that since the V.P. of finance is responsible for the CAE’s compensation adjustments, the CAE may issue favorable results for audits of functions that report to the V.P. of finance.
The QA reviewer must decide whether the various policies and procedures, coupled with the activity’s purpose and reporting structure, provide an appropriate infrastructure to add value to the company while following the strict guidelines of the profession.
How BKD CPAs & Advisors Can Help
BKD’s Enterprise Risk Solutions (ERS) practice provides specialized resources that deliver the right combination of expertise and skills to achieve integrated results. Our ERS division features experienced professionals who provide Quality Assessment services to organizations seeking to improve their IA activity’s effectiveness and value. Contact us to learn more.
Latest posts by Cynthia Bosotin (see all)
- Six Ways a Quality Assessment Adds Value to Internal Audit: Part 6 - October 29, 2014
- Six Ways a Quality Assessment Adds Value to Internal Audit: Part 5 - October 27, 2014
- Six Ways a Quality Assessment Adds Value to Internal Audit – Part 4 - October 21, 2014