IIA April 2010.pdf - UAE IAA

a significant commitment to internal
auditing provided sufficient funds to
resource an internal audit function of
25,000 audit hours each year. The audit
committee wanted an internal audit plan
of work that provided assurance and
examined how well the organisation was
operating, but which was also responsive
to the changing needs and risks of the
organisation. The risk-based internal audit
plan of work to achieve this designed by
the chief audit executive is summarized
in Table 4.
Rather than have a static internal audit
plan, the plan shown in the table was
designed to cover an 18-month period
with a refresher every six months so that
workflows could be smoothed and work
allocated to internal auditors continuously.
The plan encompassed the following
areas:
• Cyclical 12 months scheduled: For highrisk
areas worthy of annual internal
audit attention.
• Rolling 6 months scheduled: Higherrisk
areas scheduled for periodic or
one-off internal audits.
• Rolling 3 months reserve: Areas held
in reserve in case of postponement or
cancellation of other internal audits.
• Rolling 3 months unassigned: Reserved
for on-demand internal audits initiated
by management for emerging business
issues and risks.
Conclusion
The range and type of the internal auditor’s
work depend on a number of factors:
• The mandate for internal audit
contained in the internal audit charter.
• What the audit committee wants
internal audit to do, and how
enlightened it is.
• What management wants internal
audit to do.
• To whom the chief audit executive
(head of internal audit) reports.
• The capability and skills of the internal
auditors.
• Any legislative or regulatory
requirements of internal audit.
Making It Happen
Chief audit executives should look to his
or her audit committee and management
for guidance on the range and type of
work to be performed by the internal
audit function. However, the chief audit
executive, as an internal audit professional,
should be using his or her knowledge and
experience to identify and influence the
formulation of a risk-based internal audit
plan of work that best provides for the
needs of the organisation. This is likely to
be a blended plan of internal audit work
that encompasses both assurance services
and consulting services:
Assurance Services
• Part of the overall internal audit plan
of work.
• Annual or longer-term focus.
• Risk-based.
• May include cyclical internal audits of
higher-risk areas.
• Need to consider legislative and
regulatory requirements.
• Need to consider external audit to
avoid duplication of audit effort.
• Estimated hours for audit topics
assessed from previous internal audits
(structured gut feel).
• Focus on compliance, financial issues
and risks, financial controls, and IT
reviews.
Consulting Services
• Part of the overall internal audit plan
of work.
• Flexible, rolling focus - rather than
fixed in time.
• Risk-based and customer-focused.
• If limited previous data are available,
estimate hours needed for internal
audit topics on the basis of the
best available information and past
experience (unstructured gut feel).
• Focus on current and emerging
business issues and risks, and system
under development reviews.
Further reading:
Books:
• Australian National Audit Office.
Public Sector Audit Committees:
Having the Right People is the Key.
Canberra: Australian National Audit
Office, 2005.
• Australian National Audit Office.
Public Sector Internal Audit - An
Investment in Assurance and Business
Improvement. Canberra: Australian
National Audit Office, 2007.
• Picket, K. H. Spencer. Audit Planning:
A Risk-Based Approach. Hoboken, NJ:
Wiley, 2006.
• Reding, Kurt F., Paul J. Sobel, Unton
L. Anderson, Michael J. Head, Sridhar
Ramamoorti, and Mark Salamasick.
Internal Auditing: Assurance and
Consulting Services. Altamonte
Springs, FL: IIA Research Foundation,
2007.
• Sawyer, Lawrence B., Mortimer A.
Dittenhofer, and James H. Scheiner.
Sawyer’s Internal Auditing: The
Practice of Modern Internal Auditing.
5th ed. Altamonte Springs, FL: IIA
Research Foundation, 2003.
Standards:
• Institute of Internal Auditors (IIA).
International Standards for the
Professional Practice of Internal
Auditing. Altamonte Springs, FL: IIA,
2007. Online at: www.theiia.org/
guidance/standards-and-guidance/
ippf/standards
Website:
• The Institute of Internal Auditors:
www.theiia.org
Article originally published in “QFinance:
The Ultimate Resource”, 2009. Republished
by courtesy of Bloomsbury. For further
details visit www.bloomsbury.com/qfinance
or www.qfinance.com
About the Author:
Andrew Cox MBA MEC CIA CISA CFE CGAP CSQA MACS is
acknowledged as a leader in quality assurance and improvement
of internal audit activities in organisations. In recent times he
worked for IIA - Australia and conducted 25 quality assessments
of Internal Audit Departments in various organisations. Over his
career he has been a senior internal audit executive in Australia
and has managed 8 internal audit activities. He is now working in
the United Arab Emirates.
20 April 2010