IIA April 2010.pdf - UAE IAA

By: Andrew Cox
What Is the Range
of the Internal
Auditor’s Work?
Nowadays, Table 2 could be the best representation.
Table 2: The evolution of internal auditing, 1990s–2000s
Now (1990s–2000s)
• Areas for internal audit identified on a functional,
cross-organisational and strategic basis, may use the
organisation’s risk register.
• Discussed with senior management, additional
internal audit areas may be added.
• Set of risk factors applied, input into a model,
prioritized based on risk rankings.
• 3-year strategic internal audit plan based on risk
rankings.
• Annual internal audit plan based on available
resources. Presented to the audit committee.
Advantages
• Well known to internal
auditors.
• Done in consultation with the
business.
• Broader scope that considers
business risks.
• Facilitates integration of internal
audit, risk management and
strategic planning.
• Requires strong understanding
of the business.
Disadvantages
• Can be challenging.
• Time-consuming.
• May not be timely, relevant, or
responsive.
Executive Summary
The range of the Internal Auditor’s work is dependent on:
• The mandate for internal audit contained in the internal audit charter.
• What the audit committee and management want internal audit to do.
• To whom the chief audit executive (head of internal audit) reports.
• The capability and skills of the internal auditors.
• Any legislative or regulatory requirements of internal audit.
Introduction
Internal auditing is an evolving profession. It has been around for a very long time, probably since
the pharaohs in Egypt. But it wasn’t until 1947, when the foremost professional body for internal
auditing, the Institute of Internal Auditors (IIA), was formed that internal auditing was set on its
path to emerging as a profession.
Subsequently, professional standards and a code of ethics for internal auditing have been established
and in 1974 professional certification for internal auditing was created, with the designation
Certified Internal Auditor. Over time, the scope of internal auditing has changed significantly.
The Evolution of Internal Auditing
The evolution of how internal audit determined what it would audit can be tracked in Table 1.
Then (up to the 1990s)
• Areas for internal audit identified on a functional
basis from historic information.
• Set of one-dimensional risk factors applied
(high, moderate, low).
• Input into a model and prioritization based on risk
rankings.
• 3 or 5-year strategic internal audit plan based on risk
rankings.
• Annual internal audit plan based on available
resources. Presented to the audit committee (but
not always).
Advantages
• Often cyclical (every year).
• Well known to internal
auditors.
• Safe approach.
Disadvantages
• Done in isolation of the business.
• Time-consuming.
• Focus on functional areas.
• May not be timely, relevant or
responsive.
• Correlation between risk rankings
and internal audit plan often weak.
• Assumed a static organisation.
In the future Table 3 would be more accurate.
Table 3: The evolution of internal auditing, 2000s onward
Future (2000s onward)
• Areas for internal audit identified on a functional,
cross-organisational and strategic basis using the
organisation’s risk register and other relevant
information.
• Develop base audit plan.
• Discuss with senior management, including facilitated
workshops - additional audit areas may be added.
• Develop annual or longer-term assurance plan.
• Develop flexible, rolling internal audit consulting plan
to provide timely, relevant and responsive services.
• Present to audit committee.
The point is this: The range of an internal
auditor’s work will generally be related
to where he or she is currently placed in
regard to these three evolutionary phases
of the internal audit continuum. As we move
into the more difficult methods of operating
an internal audit function, the complexity
of internal audit work increases, and the
capability and skills of the internal auditor
need to be greater. Many internal auditors
are still in the early evolutionary phases of
internal auditing, because the future is seen
as too difficult and daunting.
What do the Standards say?
The internal auditing standards we will
consider here are those issued by the
Institute of Internal Auditors (IIA). The
internationally accepted definition of
internal auditing issued by the IIA is:
“Internal auditing is an independent, objective
Advantages
• Done in consultation with the
business.
• Timely, relevant, and
responsive.
• Broader scope taking into
account business risks.
• Facilitates integration of internal
audit, risk management, and
strategic planning.
assurance and consulting activity designed
to add value and improve an organisation’s
operations. It helps an organisation accomplish
its objectives by bringing a systematic,
disciplined approach to evaluate and improve
the effectiveness of risk management, control
and governance processes.”
This was a step up from the previous
definition, which concentrated on assurance.
This definition expanded the role of internal
audit to encompass consulting services.
To understand the difference between
assurance services and consulting services,
we need a couple of definitions:
Assurance: An objective examination
of the evidence for the purpose of
providing an independent assessment of
risk management, control, or governance
processes for an organisation. Examples
may include financial, performance,
Disadvantages
• Requires strong commitment
from senior management.
• Requires discipline to ensure
that the internal audit
consultation process is effective.
• May not be well known to
internal auditors.
compliance, system security and due
diligence engagements.
Consulting: Advisory and related client
service activities, the nature and scope of
which are agreed with the client, and which
are intended to add value and improve an
organisation’s governance, risk management,
and control processes without the internal
auditor assuming management responsibility.
Examples include counsel, advice, facilitation
and training.
It should be noted that the definitions of
internal auditing and the standards, focus on
risk management, control and governance:
Risk management: Internal audit should
assist the organisation by identifying and
evaluating significant exposures to risk and
contributing to the improvement of risk
management and control systems.
16 April 2010 17 April 2010