February 2013 53Internal audItor

A multi-dimensional assessment tool can help audit practitioners determine how their department rates along a spectrum of performance levels.

Manny rosenfeld

Framework for ExcEllEncE

rue leaders strive to create world-class organizations. Regardless of the profession, world-class perfor-mance maximizes our ability to contribute, pleases

our stakeholders, and helps fulfill our mission. This principle certainly applies to internal auditing. However, the path to a world-class audit department is not always clear or easy.

To facilitate efforts toward enhancing the audit function, I’ve created an assessment tool — intended for audit shops of any size or industry — that enables audit leaders to deter-mine where their group falls across a range of performance levels. This framework, the Audit Department Excellence Model, is intended primarily as a means to help guide audit functions toward improved practices, though it can also be used to facilitate dialogue with senior management and the

T

Audit performAnce

February 201354 Internal audItor

Framework For excellence

audit committee when seeking their support for improvement. Practices within the model draw from numerous professional white papers, operational improvement and audit leadership experience with Fortune 500 compa-nies, IIA recommended practices, and chief audit executive (CAE) round-table discussions.

The Excellence Model includes four stages — Lagging, Professional, Advanced, and World-class — with each stage designating a progressively

higher level of performance. To deter-mine which stage their audit depart-ment falls within, auditors complete a series of tables with itemized point values. The first two tables highlight critical aspects of audit performance. For each of these, audit practitioners choose the one statement that best describes their department. The third table contains a list of possible audit best practices — auditors should select from these all practices that are appli-cable to their department. The sum

of points from selections in the first two tables plus the sum of all points in the third table will generate a grand total. Matching this total to the ranges provided reveals the audit shop’s overall level of performance, as well as prac-tices that can help move the depart-ment toward the World-class portion of the spectrum.

AssessmentOnce the point total from the three tables has been tabulated, it can be

1. MIssIon of audIt departMent as descrIbed In the Internal audIt charter Choose one “best fit” statement and circle the appropriate point value for that selection.

poInt Value

broadly risk focused as listed below; plus the strategic risks and opportunities for internal audit are fully integrated with the company’s enterprise risk management (erM) program. additionally, internal audit pursues substantial operational improvement opportunities, and significant audit resources are allocated toward consultative projects based on management’s requests for assistance.

25

broadly risk focused; if a business risk can be mitigated by a process or control, then the area is subject to possible audit assessment and improvement. risk types would include financial, IT, compliance, assurance, fraud, and operational.

15

Mostly focused on assessing internal controls over financial reporting, assurance controls in financial business processes, and important compliance and operational controls (e.g., inventory management, capital project justification, and order fulfillment).

10

Mostly focused on assessing internal controls over financial reporting and assurance controls in traditional financial audit process (e.g., accounts payable, accounts receivable, payroll, fixed assets, payroll, inventory accounting, and ledger accounting).

5

2. audIt staffIng practIces Choose one “best fit” statement and circle the corresponding point value.

poInt Value

Most staff members have more than 3 years of audit experience and several years of non-audit work experience, including operational and other financial/accounting/IT roles. Some of the auditors have deep expertise in particular areas such as operations, compliance, and technology and may be serving a stint in the audit department for developmental purposes. auditors must be certified — or actively pursuing certification — to maintain employment, and more than half possess pertinent advanced degrees.

25

Most staff members have more than 3 years of audit experience (senior auditors and above) as well as some non-audit work experience, including operational, financial, accounting, and IT backgrounds. audit management communicates support for certifications, and more than 80% of the auditors are professionally certified or actively pursuing a certification. More than half the auditors have pertinent advanced degrees.

15

Most staff members have 2-3 years of audit experience. Some of the auditors have business experience, including operational and accounting backgrounds. Professional certifications are desired, but not a requirement.

10

Most audit staff members have less than 2 years of audit experience and little business experience. Professional certifications (CIa, CISa, CPa, etc.) are not a requirement.

5

for More InforMatIon

on audit function performance,

see the the IIa’s Internal audit competency

framework at www.theiia.org.

February 2013 55Internal audItor

A recent IIA Audit Executive Center survey notes that only 5 percent of 2013 audit plans will be devoted to providing assurance on the effectiveness of risk management efforts, a “notably weak” proportion.

3. general audIt practIces Choose all that apply and circle the point value for each.

poInt Value

an independent quality assurance review has concluded that the internal audit function generally meets The IIa’s International Standards for the Professional Practice of Internal Auditing.

25

The Cae has regular and frequent private discussions with the audit committee chair or other audit committee members.

20

The Cae reports functionally to the audit committee and administratively to a top-level authority — ideally the CeO. The Cae has a “seat at the table” and routinely participates in the CeO’s executive meetings. Internal audit is consistently represented on other critical business and functional committees.

15

The audit department uses computer-assisted audit techniques as part of most audits. It also uses data analytics extensively and monitors selected key risks/controls continuously.

15

Functional and business management discuss their areas with the audit staff periodically, expanding the auditors’ knowledge and more closely aligning audit coverage to the most important business drivers and concerns.

10

The department maintains a database of historical audit observations and uses analytics capabilities to identify audit-issue trends for specific businesses and processes, categorize the audit issues, identify common root causes of problems, and provide a mechanism for issue tracking and follow-up.

5

The department’s electronic workpaper tool is integrated with the organization’s erM tool and methodology.

5

established metrics/targets for the audit staff are in place (i.e., a balanced scorecard). For example: 10 days to issue the final audit report following the exit conference; 60 days to announce an audit prior to fieldwork; and 95% of remediation steps are completed as promised and on time.

5

a client satisfaction survey is requested following each audit, with a goal of 90% or higher favorable average responses (target may vary).

5

a “guest auditor” program is in place, where functional experts from within the organization (non-auditors) routinely join a specific audit engagement under the direction of an experienced auditor or manager.

5

a training and development program is established that includes traditional technical audit skills training as well as interpersonal or soft skills (e.g., communications, conflict management, team dynamics, and cultural awareness). auditors are required to have at least 60 hours/year of relevant training.

5

The audit group keeps abreast of emerging best practices by, for example, participating in Cae roundtables, attending seminars, reading professional white papers, and using benchmarking studies such as The IIa’s annual GaIN program.

5

bonus points: The department engages in at least one other practice that could be considered World-class.

5

total poInts: To obtain rating, add the circled point values for all three tables.

compared to the following ranges to categorize the audit department’s perfor-mance level. There are a variety of ways to earn points, but to reach the World-class range of performance, the highest point practices of the first two tables,

and many of the practices in the third table have to be selected.

from 140 to 170 Audit shops fall-ing within this range are considered World-class. These visionary audit

departments have a passion for being at the forefront of the profession and continually implement best prac-tices. This stage is difficult to achieve unless the underlying organization is also striving for operational excellence

The excellence Model appears in succinct form here due to space limitations. a more comprehensive model is certainly possible, with additional tables for categories of audit practices.

February 201356 Internal audItor

Framework For excellence

and views internal audit as a full partner in improving processes, add-ing value, managing risk, and helping achieve strategic objectives. In my experience, relatively few audit func-tions perform at this level. Because maintaining World-class performance requires continual effort, departments that achieve it must be careful to avoid complacency.

from 110 to 139 A total in this range classifies the audit function as Advanced. The advanced audit function not only meets professional standards, but with support from senior management and the board it works to implement mod-ern audit practices. The department focuses not only on providing assurance, compliance, and risk assessment, but also on process improvement via opera-tional and consultative audits. As such, it exhibits noteworthy performance but should nonetheless keep striving for improvement.

from 80 to 109 Scores within this range merit a rating of Professional. This type of audit department is well-established, has a broader mission than a Lagging department, and meets The IIA’s professional standards. It has not kept up with current best audit practices, perhaps because of limited organizational support and encouragement.

Although Professional is the mini-mum level an audit function should possess, those who take the time to complete this assessment likely have a desire to improve. Audit management probably needs to convince senior management and the board to increase their support of internal audit so it can better serve the organization.

below 80 Audit groups scoring less than 80 points are considered Lag-ging in performance. A Lagging audit department generally falls short of

meeting The IIA’s professional stan-dards, has a limited mission, and has not kept up with modern audit prac-tices. Audit groups with insufficient organizational support have a hard time breaking out of this stage.

Lagging departments are mostly geared toward compliance and basic assurance and focus little on rec-ommending improvements. If the

department is in the early stages of formation, there are many practices it can implement to improve. If senior management and the board do not support improving the audit func-tion, the CAE could try to encourage them to reconsider by providing con-crete examples of how internal audit has contributed to the success of the organization.

Ultimately, an audit department can only be as advanced as the board and senior management want it to be. If the overall organization strives to be operationally excellent and pro-vides appropriate support for internal audit, then audit leaders are well- positioned to advance their depart-ment to World-class levels. Without sufficient support and encourage-ment, however, audit departments will struggle to get beyond a basic level of performance. If the organiza-tion has limited or low expectations for the audit function, then World-class status cannot be achieved even if the audit department fully meets those limited expectations. Moreover, a CAE who cannot get support to improve a Lagging audit function is assuming high professional risk.

An evolving modelOf course, the internal audit profession needs to adapt and improve constantly based on external pressures, chang-ing business objectives, and advancing technologies. Accordingly, the Excel-lence Model will need to evolve as new audit practices and tools emerge, and as new external events/risks occur. The U.S. Foreign Corrupt Practices Act and

the Sarbanes Oxley Act of 2002, for example, both drove massive changes in the direction and function of audit departments. The immense global haz-ards experienced in the last decade have driven companies to implement ERM programs, and high-performing internal audit functions have actively champi-oned this effort. New challenges inevi-tably will arise, requiring audit shops to respond and model criteria to adapt.

But regardless of the methodol-ogy used to assess performance, the most important factors in determin-ing an audit function’s success are organizational support and relentless effort to drive improvement. With these key elements in place, even low-performing audit departments can progress to serve their stakeholders effectively and add value to the orga-nization. World-class performance is a journey, not a final destination. Once the path toward improvement has begun, it should be pursued continu-ally and with great rigor.

Manny rosenfeld, cIa, crMa, is an

internal audit and operational excellence

leader with CAE-level experience at sev-

eral Fortune 500 organizations.

Ultimately, an audit department can only be as advanced as the board and senior management want it to be.

to coMMent on this article, eMaIl the author at manny.rosenfeld@theiia.org