What are the most common focus areas for the reviews?
The focus areas covered by the reviews are generally grouped under five categories namely: Structure, Strategy, System, Staffing and Style.
- Structure refers to the quality of the strategic oversights and operational monitoring over the internal audit function. The reporting hierarchy, authority levels, governance teams, job roles and responsibilities.
- Strategy -refers to the quality of the linkages between the internal functions and the overall corporate goals, objectives and strategies. It covers the strategic and operational planning activities and actions taking to sustain the capabilities and specializations within the internal audit function.
- System refers to the quality of standard operational procedures and policies, infrastructures including technologies and capital assets for executing the strategic and operational plans.
- Staffing refers to the quality of the capabilities and capacities within the internal audit function, the People Management and Talent Development including the hiring and retention programs,
- Style refers to the quality of stakeholders’ engagements, communications and business relationships and the general perception about the internal audit function and perspectives for the future.
How often should the quality assessments be done?
IIA recommended the adoption of three types of reviews for the assessment of the internal audit function, and these are:
- Continuous assessment.
- Periodic internal assessment and
- Five-year cycle Independent External Assessment.
The Continuous assessment is done on an ongoing basis through self-and peer reviews done by the internal audit staff and also regular feedbacks received from auditees on completion of audit engagements.
The Periodic internal assessment is done regularly based on the cycle determined by the business or the internal audit function for example annually. Internal assessments are done by a dedicated inhouse quality assurance team outside the internal audit function. Where the knowledge and competency to conduct the quality assessment is lacking in the quality assurance team, the services can be procured from a third-party service organisation. If there is no separate quality assurance function in the organisation, the Chief Audit Executive will act as the project sponsor and can initiate the procurement of the services from consulting firms.
The Independent external assessment is done every five years and should done by a qualified external assessor from outside the organisation. Independent external quality reviews are generally sponsored by the Board Audit Committee and most times to meet the legal and regulatory compliance requirements.