The Institute of Internal Auditors (IIA) has released Internal Audit Assessment Tool for Audit Committees to assist boards and audit committees in evaluating the internal audit (IA) function. The IIA notes that boards and audit committees “depend on IA to provide accurate, timely, and objective information and observations about the broad spectrum of areas” and that a regular evaluation can give boards and audit committees confidence that internal audit is performing effectively. The IIA’s assessment tool suggests issues that could usefully be addressed in such an evaluation.
The tool begins with a discussion of the assessment process, including possible legal requirements, and of the benefits of monitoring internal audit performance. It suggests that audit committees should consider three “big-picture questions”:
Is there an annual IA assessment process that is effective but not overly burdensome?
Is there an assessment of how well IA is gathering and using information and helping the business to drive decisions?
Is the assessment effective in helping leadership and IA activity leaders understand the role of IA in the organization and the need or opportunities for changes in its role?
The remainder of the assessment tool is divided into three sections, each of which provides guidance on assessing a different facet of internal audit’s work. Each section includes sample questions to consider as part of that phase of the assessment.
1. Quality of services and sufficiency of resources provided by the internal audit activity.
The goals of an evaluation of the quality of internal audit’s services and resources are to enable the audit committee (AC) to consider such matters as the committee’s ability to evaluate internal audit’s activities; whether internal audit is performing in line with the responsibilities in its charter; the quality of the insights and foresights that internal audit provides on governance, risk management, and control matters; and internal audit’s use of technology and technical expertise. Sample questions include:
Did the IA activity properly disclose, if necessary, if the activity was prohibited by law or regulation from conformance with certain parts of The IIA’s Standards?
Does the IA activity lend its expertise to key implementation initiatives, such as compliance with new laws and regulations, an unexpected event like the COVID-19 epidemic, or the organization’s implementation of enabling technology?
Is the AC informed about whether IA continually enhances its team through effective recruitment, retention, and promotion? Are team members rotated within the department to broaden their knowledge and perspectives?
How does IA approach integrated/combined assurance to ensure it coordinates its activities with other internal and external assurance service providers?
2. Communication and interaction with the internal audit team.
The objective of the communications and interaction phase of the assessment is to enhance oversight by promoting “robust and constructive dialogue” between the audit committee and internal audit, including the chief audit executive (CAE). Sample questions in this area include:
Does IA communicate its plan and seek feedback and approval? Does it follow up to ensure it is still applicable?
Does the AC have executive sessions with the CAE without management? If yes, how often? If not, why not?
Do IA activity communications to the AC provide a good understanding of the risks being covered, the process for monitoring emerging risks, and potential for fraud?
Do the communications offer the information necessary for the AC to determine whether IA team processes are carried out in a professional manner and that its results are accurate?
3. Auditor independence, objectivity, and professional skepticism.
The IIA states that best practice calls for internal audit’s charter to establish its independence through a dual reporting relationship under which the CAE reports administratively to senior management and to the audit committee for strategic direction and accountability. The third part of the evaluation focuses on whether and how internal audit “maintains a delicate balance between its role as an independent auditor and a key resource for the organization.” Sample questions related to this issue include:
Does the CAE promote a culture that actively encourages objectivity and skepticism?
Is IA staff sufficiently trained in the importance of independence, objectivity, and skepticism? Does it receive refresher training as needed?
Are the IA team and CAE able to develop a collaborative relationship with management, the board, and AC without allowing that relationship to interfere with their independence, objectivity, and skepticism?
If the CAE or other members of the team receive incentive-based compensation, do you feel it seems to affect their objectivity?
Does the audit team have sufficient knowledge of the company, its industry, and the risks and challenges it faces to recognize questionable data or observations?
Comment: The IIA assessment tool concludes with this advice:
“Boards and AC members should then ask themselves if assessment results were what was expected and if there are opportunities to improve. Assessments may develop benchmarks and will likely pave the way for additional considerations. They can also help boards and ACs consider whether the organization is getting its full value from the IA activity, or if there are consultative projects and roles that would allow the team to enhance their contribution. Once they’ve completed the assessment, the board and AC can use their conclusions to address any needed changes and take advantage of potential new opportunities to further engage IA in moving the organization to the next level.”
The audit committee is key to ensuring that internal audit performs effectively and is respected within the company, and internal audit can be an important tool for the audit committee in discharging its responsibilities. See How Audit Committees Can Get the Most Value from Internal Audit, September 2020 Update. A periodic assessment of internal audit’s performance, patterned on the IIA’s recommendations, would be beneficial to both the audit committee and the internal audit function.