“My internal audit team audits several functions, but no one ever audits them.”
How do you know your internal audit team is up to snuff? Are they keeping up with changes in the organization? Following accepted standards?
Know for sure with a quality assurance review (QAR).
A QAR is an audit of your internal audit team. It’s a way to gauge how well your internal audit function is performing and assess the value they’re providing. Basically, a QAR answers: “What is this team doing, and is it helpful?”
Benefits of an internal audit quality assurance review
According to the Institute of Internal Auditors (IIA) standards, external assessments should be conducted at least once every five years. The quality assurance review determines whether an organization’s internal audit program meets the expectations of the IIA’s International Standards for the Professional Practice of Internal Audit.
Any organization that states its audits are “conducted in accordance with the IIA standards” must meet this five-year review requirement. Many organizations, however, find immense value in a QAR, regardless of regulation or reporting requirements.
Benefits include:
- Personnel planning and review: Make sure you have the right team with the right skill sets in place.
- Continuous improvement: Discover areas of improvement and receive guidance on how to increase effectiveness and value, in line with industry best practices.
- Keep pace with change: An outside opinion can help an internal team spot opportunities and blind spots that can sometimes go undetected by those closest to the work.
- Enhance credibility: Enhance internal audit’s credibility within the organization and enhance the organization’s credibility with investors/partners.
First things first
Internal audit shops should meet some basic benchmarks in order to provide ongoing value and adhere to professional standards. These are some of the base-level requirements you’ll need to receive a positive QAR review rating of “generally conforming”:
- Have a detailed internal audit plan
- Conduct annual self-assessments
- Keep supporting documentation for all work performed by the internal audit department
- Provide internal audit team with direct access to an audit committee or board, outside of direct management
Likewise, your internal audit team can contribute to audit quality by building their skills, keeping pace with best practices and continually striving to apply a proper amount of professional skepticism and judgement to their work — it’s a learned art.
In this way, a QAR isn’t just a “test” of your internal audit team. It’s a tangible way you can contribute to their development by helping them see where to focus their learning and growth.
External quality assurance review: Two approaches
There are two approaches to performing an external quality assurance review: A full scope review (Standard 1312), or a self-assessment with validation (Standard 1312-2).
Some audit committees request full-scope reviews. This is often the case when an organization conducts complex internal audit activities, when significant transformation is desired or when a new leader/chief audit executive takes charge.
Smaller audit shops typically opt for a self-assessment with validation, as it’s generally more economical in terms of time and resources. However, some areas of focus (e.g., interviews with key stakeholders, benchmarking, best practice recommendations) may be reduced.
That said, self-assessment is not just for small shops, and organizations can opt for a hybrid assessment model that builds off the self-validation process while including some additional value-add QAR activities.
What goes into an external quality assurance review?
To be efficient and effective, a quality assurance review requires coordination and internal support. Here’s what goes into the process and how you can best facilitate the project:
Scoping, prep and background: Your QAR provider will work with you to determine the right scope and depth for the audit. Appropriate planning and scheduling helps the engagement run smoothly and on time. Audit leaders can facilitate the process by communicating and setting expectations with key stakeholders.
In this stage, your QAR provider is gathering information on your internal audit team, their background and certifications, the maturity of the function, policies and procedures, etc. They’ll also be making a document request to include your internal audit and audit committee charters, your CPE records, audit plan and code of ethics.
Surveys and interviews: Depending on the scope of the engagement, your external partner will use survey tools and/or personal interviews to review stakeholder needs and expectations — including those of your internal customers as well as your internal audit staff.
Interview areas address issues such as internal satisfaction, the audit team’s understanding of the standards, their independence and perceptions of management’s response to audit feedback.
Performance evaluation: Select internal audit engagements will be reviewed. The general objective is to determine whether internal auditors come to the correct conclusions related to work performed, and whether they properly report what they detect.
Poor audit quality can occur because the auditor failed to detect concerning trends or systemic concerns or because they detected them but failed to influence management to make the appropriate changes.
Reporting, feedback and next steps: Your quality assurance review will include a judgement on how well your organization conforms with IIA Standards and Code of Ethics. Your report should also include performance findings, successful practices and strengths, and opportunities for continuous improvement.
Your next steps are to share this feedback with your audit committee and other relevant stakeholders. The goal is to use the information provided toward continuous improvement.
In the end, a quality assurance review is a tool to improve the information your organization uses for decision making. By improving your internal audit function, you enhance the quality and value of their work and their usefulness to the organization.
How Wipfli can help
Need help auditing your internal auditors? We can perform a full scope audit assessment, validate your own internal self-assessment or even perform your first “internal assessment” to lay the groundwork for a more defined internal audit department. Our internal audit specialists have experience working with a wide range of industries.
A quality assurance review from Wipfli can provide insight into performance gaps and build greater value in your internal audit function.
Sign up to receive additional audit-related content and information in your inbox, or continue reading on:
Author(s)
