External Quality Assurance Review
The IIA Standards for the Professional Practice of Internal Auditing require that an external review of the Internal Audit function be carried out every five years at a minimum.
Richard Cascarino and Associates uses one of the country's leading Certified Internal Auditors to head our review team and carry out the review to the highest standards using the procedures recommended by the IIA-Inc. We involve your own staff within the process which means that this approach offers you a team of professionals who understand your organisation, led by an expert who is a leading authority on both the practice of internal auditing and IS auditing.
Our evaluation of your department's independence, scope of operations, professional proficiency, performance of audit work and audit management can tell you whether your department:
At the conclusion of the review, a comprehensive report identifies your department's strengths, together with recommendations for improvements.
We follow the standard IIA quality assurance review methodology which allows the review team to assess:
The review team also evaluates other issues that affect the internal audit function, including:
Performing a Quality Assurance Review
To comply with the requirements of Standard 1310, we follow the standardized IIA approach which takes the form of a five-stage process, including:
Planning and Preparation
As part of the planning and preparation process, the quality assurance review team reviews the latest quality standards and internal audit best practices as established by the IIA. At this stage, the team will normally plan its initial meetings with stakeholders and prepare its information requests for the internal audit department.
Determining the Customer’s Needs
The main aim of this phase is an assessment of management's commitment to and support of internal auditing. This is done by getting comments and observations about the internal audit function from its customers, including management, the audit committee and auditees.
An understanding of the environment within which the internal audit function operates is essential to gaining a clearer understanding of corporate objectives. In addition, where performance shortfalls are subsequently noted, practical recommendations for improvement can be drawn up.
Analyzing the Internal Audit Process
Critical internal audit processes are generally taken to include:
In order to evaluate the process against the IIA Standards, the quality assurance review team must obtain a comprehensive understanding of the internal audit process implemented within the organization and be up-to-date with the latest of the IIA’s Practice Advisories in order to make acceptable recommendations for improving the existing process.
Communicating the Results of the Review
As with any audit, the aim of this phase is to communicate the results of the review to management and the audit committee in a form that meets their requirements.
The report will make clear to management the overall conclusions, significant points and items requiring action. As such, it interprets the results of the findings and focus the reporting on high-level aspects of the review, particularly for the audit committee.
The audit committee may have questions about the review, and the quality assurance review team will be prepared to respond to requests for additional information or further insights on their findings.
The report will include an assessment of the extent to which specific standards were achieved. Where deficiencies are noted, the findings, improvement opportunities and recommendations should be stated. As in any conventional audit, an action plan with dates and allocated responsibilities will have been agreed with the head of internal audit and will be included in the report.
As with any audit, the recommendations resulting from the quality assurance review are of little value if they are not effectively implemented. The quality assurance review team, together with the audit committee, will establish a clear follow-up process to make sure that the action plan is implemented and effective.
Quality Assurance Methodology
In order to achieve professionally acceptable standards of review, the conducting of a quality assurance review has been carefully structured to follow the IIA’s specific methodology. This involves, at a minimum, interviews with internal auditing stakeholders, and a review of the internal auditing department charter and of a representative sample of working papers and reports.
The stakeholder interviews are scheduled as early as possible in the process in order to structure the review to meet stakeholders’ requirements and expectations.
In a typical medium-sized Internal Audit function, the process will take two to three weeks