Ten Ways To Measure The Success Of Internal Auditing PDF Free Download

2y ago

22 Views

1 Downloads

2.66 MB

38 Pages

Report/dmca

Download PDF

Transcription

Ten Ways to Measure theSuccess of Internal AuditingHow do you know if internal auditing is successful? How do you know if it isadding value? Recent publications in IIA Practice Guides and the CommonBody of Knowledge provide many ideas, but what is actually being measuredin audit departments? Based on many Quality Assurance Review projects andworking with internal auditors all over the world, Larry will share his real-world,back-to-basics view of how IA departments can know if they are meeting theirorganization's needs.[1]

Larry’s Top Ten1. Key controls working (risk mitigated)2. Reported issues resolved3. Coverage provided (measurement against AAP)4. Quality assessment – internal and external5. Measurement using Capability Model6. Achievement of IA objectives7. Audit process and people metrics - BSC8. Board survey results9. Upward feedback results (within department)10.Customer feedback scores from audits[2]2

Key Controls Working[3]3

The Most-Ignored Standard 2210.A3 – Adequate criteria are needed to evaluate governance, riskmanagement, and controls. Internal auditors must ascertain the extentto which management and/or the board has established adequatecriteria to determine whether objectives and goals have beenaccomplished. If adequate, internal auditors must use such criteria intheir evaluation. If inadequate, internal auditors must identify appropriateevaluation criteria through discussion with management and/or theboard.[4]4

QAIP1311 – Internal AssessmentsInternal assessments must include:– Ongoing monitoring of the performance of the internal audit activity; and– Periodic reviews performed through self-assessment or by other persons within theorganization with sufficient knowledge of internal audit practices.Interpretation:Ongoing monitoring is an integral part of the day-to-day supervision, review, and measurement ofthe internal audit activity. Ongoing monitoring is incorporated into the routine policies and practicesused to manage the internal audit activity and uses processes, tools, and information considerednecessary to evaluate conformance with the Code of Ethics and the Standards.[8]8

[9]9

One Page Matrix[10]10

Self-Assessment Tool[11]11

Strategy Measurement Model The future goals of organizationWhat the organization isWhat the organization stands forKSF & BusinessFundamentals What the organization needs to focuson to achieve its visionPerformanceMeasures A balanced scorecardPast - Present – Future The desired annual and long-termlevels for each metric Controls implemented to achieve thegoalsVMVObjectives/GoalsControls to ReachGoals[13]13

The Balanced ScorecardFinancial PerspectiveHow docustomerssee us?ObjectivesMeasuresWhat must weexcel at?Customer PerspectiveObjectivesHow do we look toshareholders?MeasuresInternal BusinessProcess PerspectiveObjectivesMeasuresLearning and GrowthPerspectiveSource: Robert S.Kaplan and David P.Norton, 1994ObjectivesMeasuresCan we continue toimprove and createvalue?Slide 15[15]

Measures for Auditing Control Perspective (instead of Financial)– % of issues resolved; % of audits with no control issues;% of key controls working; % of frauds found vs. reported Business Process Perspective– Report issuance time; Budgets met; Coverage obtained;QA program results Learning and Growth Perspective– % certifications; Transfers from department; Upwardfeedback results; Leadership in organizations Customer Perspective– Client service evaluation scores; # requests for audits;Board, senior management surveys[16]

Control Perspective, dependent on:What is a control? Who is a framework for?ManagementFrameworksModels Management byObjectives BalancedScorecards Six Sigma Management ByWalking Around Etc. Etc. tors need some way to evaluate controls in the many differentmanagement models we see – that’s a framework![17]

Business Process, dependent on PlanExecute(2200)“Preliminary Assessment”Report (2400)(2300)“Fieldwork”“Reporting”Prepare AuditReportEvaluateOperationalEffectiveness ofInternal Controls------------ Develop Audit Findings ontrolsMap Controlsto aFrameworkPrepare Risk andControls Matrix’sDevelopWork/AuditProgramsPerform AuditTestsEvaluate DesignAdequacy ofInternal ------------------------- Audit Workpapers --------------------------------------[18]

Learning and Growth, dependent on A “management model” for the organization,and a related model for internal audit.– What is valued?– What gets someone rewarded/promoted?– How is success measured?[19]

Customer Perspective, dependent on What does management need from internalaudit? What does the board need from internalaudit?And, they may not always know [20]

It Takes a Score, and a Direction Is 300 people attending this conference a goodor bad score?[21]21

Other Sources - IIA22

Still Other Sources[23]23

Chicken Sold[24]24

Key Concepts - Metrics Fewer are better Link to VMV, KSF Mix of past, present, and future;customers, employees, stakeholders Start at top and flow downward Combine multiple indices into singleindex Change with environment and strategy Need goals based on research; notarbitrary[25]

Problems with Metrics Too much data – 15 to 20 maxToo short-term focusedLack of detailDrive the wrong performance – ChickenMeasures– Courtesy vs. competence– Behavior vs. accomplishments– Encourage competition not teamwork[26]

Too Much Data[27]27

Quantity, not QualityOr, 20 PowerPoints per hour[28]28

Chicken Efficiency[29]29

Don’t Cook the Chicken![30]

But They Are Nice!Or, “Can we help you to yourcar with that?”[31]

Sales[32]

Internal Audit Feedback Survey1.2.3.4.5.6.Opening conference was held and all questions/comments were adequately addressed.The final audit objectives and scope were agreed to.The audit was completed within the timeframe communicated.The audit was conducted in a professional and courteous manner.The audit team kept you informed of key issues throughout the auditThe closing conference allowed both sides to adequately discuss and address allcomments.7. The audit report was accurate and findings clearly communicated.8. The audit report fairly reflected your team’s comments and corrective action. Give out at START of the audit, to use as a “contract” for doing auditGet “many” back at end of audit[34]34

Just One More Thing Consider doing an audit of Audit. Use your normal audit approach andtechniques on the audit department or theaudit process.[36]36

[4] 2210.A3 –Adequate criteria are needed to evaluate governance, risk management, and controls. Internal auditors must ascertain the extent to which management and/or the board has established adequate cri