Norman Marks on Governance, Risk Management, and Internal Audit

The Institute of Internal Auditing is in the process of updating its International Professional Practices Framework (IPPF), which includes the International Standards for the Professional Practice of Internal Auditing.

It is necessary, as some in the profession need a kick.

A friend recently told me that they connected with audit leaders at peer organizations (other mid to large, complex organizations) to understand how long/large their audits typically are. They perform cyclical audits of auditable entities (an audit universe) that last up to 12 weeks. 

So cyclical audits are alive and well, even though the practice should have died off decades ago.

Also alive and well are long audits of an entire process or business unit.

Too few are taking a risk-based approach to internal auditing.

Audit the controls over the risks, not entire business processes!

Don’t waste your or management’s time auditing more than you need to provide the assurance, advice, and insight management and the board need.

I have asked the IIA to use the opportunity of the IPPF update to jolt people out of these poor practices.

They replied, “That is our goal too, business objective-based and risk-based audit”.

Excellent!

Let’s have a quick look at what the IIA currently says about the role of internal audit.

The Definition of Internal Auditing is:

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

The Mission of Internal Audit takes the ideas to a higher and more active level:

The mission of internal audit is to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.

This is supported by the last three of the IIA’s Core Principles for the Profession of Internal Auditing:

• Provides risk-based assurance.
• Is insightful, proactive, and future-focused.
• Promotes organizational improvement.

I don’t think you achieve these through full scope, cyclical audits of business processes or units.

I think you achieve them through audits that focus on the more significant risks to the enterprise: enterprise risk-based auditing.

That is what the current Standards say:

2010 – Planning

The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization’s goals.

Interpretation:

To develop the risk-based plan, the chief audit executive consults with senior management and the board and obtains an understanding of the organization’s strategies, key business objectives, associated risks, and risk management processes. The chief audit executive must review and adjust the plan, as necessary, in response to changes in the organization’s business, risks, operations, programs, systems, and controls.

 

2130.A1 – The internal audit activity must evaluate the adequacy and effectiveness of controls in responding to risks within the organization’s governance, operations, and information systems regarding the:

• • Achievement of the organization’s strategic objectives.
  • Reliability and integrity of financial and operational information.
  • Effectiveness and efficiency of operations and programs.
  • Safeguarding of assets.
  • Compliance with laws, regulations, policies, procedures, and contracts.

Frankly, I don’t understand how an internal audit function passes a Quality Assurance Review when they practice cyclical or full scope auditing.

Moving on, the IIA has shared a draft Purpose statement. I’m not sure how a Purpose statement differs from a Mission statement, and why you need both. But here it is:

Internal auditing enhances the organization’s success by providing the board and management with independent advice and assurance.

Tim Leech doesn’t like it (see here). He prefers:

Ensure the board and CEO are receiving reliable information on the likelihood/risk top value creation and preservation objectives will be achieved with a level of uncertainty acceptable to the board

I prefer something more active, more than providing assurance on risk reporting. Frankly, the draft is weaker than the existing Mission statement.

I would like to see something like:

Provide the risk-based assurance, advice, and insight that leaders of the organization need for success.

Why this?

• It talks about risk, while the current draft does not. It just talks about advice and assurance, but does not say on what.
• The current and proposed guidance allows for any level of assurance. Mine requires a more complete level of assurance. An Interpretation statement would explain that the assurance should be on the risks that matter to the achievement of enterprise objectives.
• I have added “insight”, which is an important source of value to our customers.
• It makes it clear that we should provide what our customers need, not just what we think is valuable or would contribute to their success.
• Independence is a given, and anyway objectivity is more important.

What do you think?

1. How do we persuade CAEs to discard cyclical auditing and full scope auditing, replacing them with risk-based auditing?
2. How would you modify the Purpose statement?