PRESENTATION TO THE PARTNERS OF IG MPW

IndII Activity P243-02: Governance Reform in Internal Audit Function (IG-MPW)

Internal Audit Capability Model (IA-CM) for the Public Sector

Overview Presentation Libby MacRae Bob McDonald

2

Agenda

The IA-CM

– Its structure and underlying concepts

– Principles in its application

– Using the IA-CM

3

3

What is the IA-CM?

• A universal model with comparability – principles, processes and practices

• To be used globally to improve internal auditing

• Framework for assessing capabilities against standards and practices

• Communication vehicle for defining and advocating the importance of internal auditing

• Roadmap and toolkit for orderly improvement

4

Underlying Principles

IA Activity’s Obligations

• Be an integral component of effective governance in the public sector

• Assist organizations achieve their objectives and account for their results

Organization’s Obligations

• Determine optimum level of IA capability to support required governance structures

• Achieve and maintain the desired capability

5

5

Underlying Principles

Selecting Optimum Capability

• Three variables

– Environment

– Organization

– IA Activity

• Different capability required

• Auditing must be cost-effective

• No “one size fits all”

6

6

IA-CM Levels

LEVEL 5

Optimizing

LEVEL 4

Managed

LEVEL 3

Integrated

LEVEL 2

Infrastructure

LEVEL 1

Initial

No sustainable, repeatable

capabilities – dependent upon

individual efforts

Sustainable and repeatable IA practices and procedures

IA management and professional practices uniformly applied

IA learning from inside and outside the organization for continuous improvement

IA integrates information from across the organization to improve governance and risk management

7

7

Level 1- Initial

• Ad hoc or unstructured

• Isolated single audits, document reviews, transaction verification

• Outputs dependent on incumbent skills

• No professional practices or standards applied

• Funding approved by management as needed

• Absence of Infrastructure

• Auditors likely belong to a larger organizational unit

• Institutional capability not developed

8

Level 2- Infrastructure

• Repeatable processes or capability established

• Reporting relationships, management, administrative infrastructure, professional practices established

• Audit planning based principally on management priorities

• Continued reliance essentially on skills and competencies of incumbents

• Partial conformance with IIA Standards

9

Level 3 - Integrated

• Defined IA policies, procedures, documented and integrated into organization structure

• IA management and professional practices well established, uniformly applied

• IA beginning to align with business and its risks • IA providing advice on performance and

management of risks • Focus on team building and IA capacity and

independence and objectivity • Generally conforms to IIA Standards

10

IA-CM 1-page Matrix Services and Role

of IA

People Management Professional

Practices

Performance

Management and

Accountability

Organizational

Relationships

and Culture

Governance

Structures

Level 5 –

Optimizing

IA Recognized as

Key Agent of

Change

Leadership

Involvement with

Professional Bodies

Workforce Projection

Continuous

Improvement in

Professional

Practices

Strategic IA

Planning

Public Reporting of

IA Effectiveness

Effective and

Ongoing

Relationships

Independence,

Power, and

Authority of the IA

Activity

Level 4 –

Managed

Overall Assurance

on Governance,

Risk Management,

and Control

IA Contributes to

Management

Development

IA Activity Supports

Professional Bodies

Workforce Planning

Audit Strategy

Leverages

Organization’s

Management of

Risk

Integration of

Qualitative and

Quantitative

Performance

Measures

CAE Advises and

Influences Top-

level

Management

Independent

Oversight of the

IA Activity

CAE Reports to

Top-level

Authority

Level 3 –

Integrated

Advisory Services

Performance/

Value-for-Money

Audits

Team Building and

Competency

Professionally

Qualified Staff

Workforce

Coordination

Quality

Management

Framework

Risk-based Audit

Plans

Performance

Measures

Cost Information

IA Management

Reports

Coordination with

Other Review

Groups

Integral

Component of

Management

Team

Management

Oversight of the

IA Activity

Funding

Mechanisms

Level 2 –

Infrastructure

Compliance

Auditing

Individual

Professional

Development

Skilled People

Identified and

Recruited

Professional

Practices and

Processes

Framework

Audit Plan Based

on Management/

Stakeholder

Priorities

IA Operating

Budget

IA Business Plan

Managing within

the IA Activity

Full Access to the

Organization’s

Information,

Assets, and

People

Reporting

Relationships

Established

Level 1 –

Initial

Ad hoc and unstructured; isolated single audits or reviews of documents and transactions for accuracy and compliance; outputs

dependent upon the skills of specific individuals holding the position; no specific professional practices established other than those

provided by professional associations; funding approved by management, as needed; absence of infrastructure; auditors likely part of a

larger organizational unit; no established capabilities; therefore, no specific key process areas

© 2009, The IIA Research Foundation – All Rights Reserved

Key Process Area (KPA)

Purpose

Essential

Activities

Outputs

Outcomes

Institutionalizing Practice

Examples

Key Process Area

12

12

People Management Level 2 – Infrastructure

Skilled People Identified and Recruited

Purpose – To identify and attract people with the necessary competencies and relevant skills to carry out the work of the IA activity. Appropriately qualified and recruited internal auditors are more likely to provide credibility to the internal audit results.

Essential Activities • Identify and define the specific audit tasks to be conducted • Identify the knowledge, skills (technical and behavioral), and other

competencies required to conduct audit tasks • Develop job descriptions for positions • Determine proper pay classification for positions • Conduct valid, credible recruitment process to select appropriate candidates

13

13

People Management Level 2 – Infrastructure

Skilled People Identified and Recruited

Outputs • Internal audit positions are filled with appropriately qualified persons

Outcomes • Audit work is conducted with due professional care • There are credible audit observations, conclusions, and recommendations

Institutionalizing Practice Examples • Visible commitment and support through senior management action to ensure that a

competent and qualified CAE is in place, and the necessary resources are provided to appropriately staff the IA activity

• Staffing and recruitment policy • Job descriptions • Classification system, including levels specific to internal auditing

14

14

Institutionalizing a Key Process Area

Commitment To Perform Activities

Ability to Perform

Activities

Activities Verified

Activities Performed

Activities Measured

Key Process Area

15

Using the IA-CM as an Assessment Tool

• Understand the purpose and structure of the IA-CM • Identify the KPAs that appear to be institutionalized by

the IA activity • Obtain and review documentation re: IA activity,

organization, and environment • Interview managers/stakeholders • Confirm the actual KPAs institutionalized • Determine the capability level • Communicate and confirm the opportunities for

improvement • Develop and implement the improvement plan

16

16

Principles in its Application

• Apply professional judgment

• Environmental and organizational factors

• A practice cannot be improved if it cannot be repeated

• Capability gets built in steps/stages

• KPAs at one level set the foundation for KPAs at the next level

• A KPA is achieved when it is institutionalized into the culture of the IA activity

• All KPAs, up to and including the KPAs at a given level, must be institutionalized to achieve that level

• Not all all elements need be at the same level

17

17

Important Considerations

• All levels in the IG participate

• Organizational management and stakeholder support

• Processes are institutionalized and sustainable

18

Procurement Standards in Indonesia

IndII Activity P243-02: Governance Reform in Internal Audit Function (IG-MPW)

9/6/2012 IndII Activity P243-02: Governance Reform

in Internal Audit Function (IG-MPW)

Presented by Rob Thompson

Identify the Need

Develop the Specification

Define the Contractual Terms

Research the Market

Identify Pre-Qualification and Select Bidders

Invite Quotes/ Tenders

Analyse Quotes/ Tenders

Clarify/ PTN VFM

Contract Award

Review of Performance

Payment

Approval to Proceed

Monitor Performance

Develop Contract Strategy

Manage Relationship

Set Evaluation Criteria

The Procurement Process

Key Areas of Procurement Activity

• Good Sourcing Principles and Practices

• Price and Cost Analysis

• Inventory Management

• Legal Protection

Procurement Competencies being prepared

Approach • Analysis of current competencies, procedures, practices and policies

• Work with MPW management and selected DG’s to enhance procurement competency

• Develop and support the ULP in developing good procurement practice

• Applying Risk Assessment & Management techniques to all procurement

• Introduction of best practice procurement training

• Presenting and mentoring the introduction of new procurement tools and techniques

• Providing practical guidance to MPW & DG’s to ensure a consistent application of best practice techniques

Key Messages • Early involvement (by both parties) in the

procurements to resolve potential risk areas in time

• Shared understanding of what is procurement • Integrate lessons learnt from past experience in

future training and procurement practices • Best practice contract management • Cost not price • Performance not conformance • Consistency in actions.

Best Practice Procurement WILL

achieve compliance,

Compliance alone does not ensure a best value for money

procurement.

9/6/2012 IndII Activity P243-02: Governance Reform

in Internal Audit Function (IG-MPW)