1
Q
Governance (Program based QAIP structure)
A
IA charter, IPPF, Legislation, Independence & Objectivity, Risk management, Resourcing
2
Q
Professional practice (Program based QAIP structure)
A
Roles & Responsibilities, Risk-based audit planning, other assurance providers, audit engagement planning, performing the engagement, proficiency & due professional care, quality assurance
3
Q
Communication (program based QAIP structure)
A
Communication Results, Follow Up, Stakeholder Communication
4
Q
QAIP components
A
- Governance 2. Professional Practice 3. Communication
5
Q
Internal Audit Charter (Governance)
A
- Internal audit’s purpose, authority, and responsibility are formally defined in a charter, consistent with the Definition of Internal Auditing, Code of Ethics, and the Standards.
- The internal audit strategy is aligned with the organizational strategy.
- Charter provides assurance that the internal audit activity will add value and improve the organization’s operations.
- Charter, mission, statements, goals, and similar documents are implemented in an effective manner.
6
Q
Independence and objectivity (Governance)
A
- The internal audit activity’s structure, objectivity, roles and responsibilities, and key governance processes are appropriate for managing the function.
- The internal audit activity is independent and objective in the performance of its work.
- The organizational status of the internal audit activity is sufficient to permit accomplishment of the objectives.
- Broader organizational governance arrangements provide assurance regarding auditor independence and objectivity.
7
Q
Risk impacting the Internal Audit Activity (Governance)
A
Risks impacting the internal audit activity have been identified and managed.
8
Q
Risk impacting the Internal Audit Activity (Governance)
A
Risks impacting the internal audit activity have been identified and managed.
9
Q
Resourcing (Governance)
The appropriate level of…
A
financial and IT resources are available to the internal audit activity to enable it to achieve its objectives in an efficient and effective manner.
10
Q
Resourcing (Governance)
The appropriate level of…
A
financial and IT resources are available to the internal audit activity to enable it to achieve its objectives in an efficient and effective manner.
11
Q
Roles and Responsibilities (Professional Practice)
A
- Roles and responsibilities of staff within the internal audit activity are formally documented.
- The internal audit activity has fulfilled its responsibilities in regards to governance, risk management, and control.
12
Q
Risk based audit planning (Professional Practice)
A
- The audit planning process is aligned with the organization’s strategic objectives.
- The perspectives of senior management and the board are considered in audit planning.
- The process of audit planning ensures that all activities of the organization are considered for audit, subjected to a risk assessment, ranked in order of priority, and that appropriate audit objectives for each audit selected have been established. This includes documentation of an audit universe.
13
Q
An effective annual planning (Professional Practice)
A
An effective annual planning process exists including appropriate processes for the reporting of progress toward achieving the established plan.
14
Q
Coordination with Other Assurance Providers (Professional Practice)
A
Internal audit activities are coordinated with those of other assurance providers.
15
Q
Audit Engagement Planning (Professional Practice)
A
- Risks relevant to the activity under review are assessed. The engagement objectives reflect the results of the assessment.
- Appropriate resources are allocated for audit work to identify significant issues.
Work programs to achieve the engagement objectives are developed.
16
Q
Performing the Engagement (Professional Practice)
A
- Engagement processes, including identifying information, analysis, and evaluation, ensure that the steps in the audit program developed at the end of the planning phase are completed in an effective and efficient manner.
- Audit techniques, including the use of internal audit automation and computer assisted auditing techniques, are used as appropriate to provide assurance that work is performed efficiently and effectively.
- The evidence gathered substantiates the audit findings and establishes the cause and effect of issues identified as needing improvement.
Information acquired when the audit is conducted is described and retained in working papers to clearly document the audit process and identify findings. - Audit records are appropriately maintained.
- Audits are appropriately supervised for professional development and to provide assurance that due professional care us applied.
17
Q
Proficiency and Due Professional Care (Professional Practice)
A
- The internal audit activity collectively possesses of sources the knowledge, skills, and other competencies to perform its responsibilities.
- Internal auditors display due professional care in the performance of their responsibilities.
Continuing professional development is provided to allow internal auditors to enhance their knowledge, skills, and other competencies. - Management and leadership development is embedded within the internal audit activity.
18
Q
Quality Assurance (Professional Practice - Internal audit activity)
A
- A QAIP is in place that covers all aspects of the internal audit activity and the QAIP effectiveness is continuously monitored.
- Internal audit has processes in place to track and record progress toward established objectives, plans, and budgeted resources.
19
Q
Audit engagement reports (communication)
A
- The final audit report presents the purpose, scope, and significant findings, including the causes and effects, conclusions, recommendations, and the engagement client’s action plans to address the issues outlined.
- An effective process is in place to ensure that the audit results are presented to the appropriate level of managers timely for discussion and response.
- Reports are provided to and/or are reviewed by senior management and the board.
- The form and content of audit communications meet stakeholder expectations.
- The phrase “conducted in accordance with the Standards” is utilized only under appropriate circumstances.
20
Q
Follow-Up Phase (Communication)
An appropriate follow-up process to ensure that …
A
management actions have been effectively implemented has been established and is being maintained.
21
Q
Stakeholder communications (communication)
A
- The internal audit activity’s communication practices inform the board and appropriate stakeholders of work undertaken.
- A performance management and measurement process is in place to ensure that the effectiveness of the internal activity is optimized and recognized.
- Engagement client satisfaction with the audit process is measured by the internal audit activity, including the level of professionalism demonstrated by the internal auditors and opportunities for improvement.
- The extent of satisfaction of other stakeholders with the internal audit process and products is measured (this may include a self-assessment questionnaire and a satisfaction survey for engagement clients)
- The role and services offered by internal audit are understood by stakeholders and considered to be value-added.
22
Q
A well-developed QAIP will endure that
A
quality is built in to, rather than on to, the way the internal audit activity operates.
23
Q
Tone at the top
A
The management and board of director’s leadership and their commitment to being honest and ethical.
24
Q
Assessment scales
(conform, opportunities)
A
Conforms (generally, partially, does not)
Opportunities for improvement
Effectiveness and efficiency of IAA
25
Beyond confirming
(leading, leveraging)
Leading:
- Innovated best practices
- Strategic partner
- Leader in IA profession
Leveraging:
- Emphasizes best practices
- Anticipates change
- Expanding roles
26
Conforming (Path to Quality(maturity model) scale)
- Generally conforms
- External assessment
- Continuous improvement
27
Non-conforming (Path to Quality scale)
Emerging, beginning
Emerging:
- Partially conforms
-Self Assessment
- Action plan
Beginning:
- Innovates
- Does not conform
- New Internal Audit Activity QAIP
28
Engagement working papers generally:
- Provide the principal support for engagement communication
- Aid in the planning, performance, and review of engagements
- Document whether the engagement objectives were achieved
- Facilitate third-party reviews
- Provide a basis for evaluating the internal audit activity’s audit program
- Provide support in circumstances such as discussions with management, fraud cases, and lawsuits
- Aid in the professional development of internal audit staff
- Demonstrate the internal audit activity’s conformance with the Definition of Intrusion Auditing, the Code of Ethics, and the Standards.
29
Engagement supervision is intended to ensure that internal audit staff at all levels are appropriately supervised through-out audit engagements to monitor progress, assess quality, and provide coaching. (the work of outside resources, such as consultants) Supervision should include:
- Ensuring conformance with the Definition of Internal Auditing, the Code of Ethics, the Standards, and the organization’s policies and procedures
- Providing suitable instructions at the outset of audit engagement
- Approving audit objectives, scope, and work plans prior to the commencement of fieldwork.
- Ensuring audits are conducted as planned or that variations are approved
- Ensuring that appropriate audit techniques are used
- Ensuring that audit findings, conclusions, and recommendations are adequately supported by relevant, reliable, and sufficient evidence
- Ensuring that appropriate working papers have been prepared and maintained
- Ensuring that reports are accurate, objective, clear, concise, and timely.
- Ensuring that work is achieved within resource budgets (time and expense control) or that variations are approved
- Ensuring that international audit staff are trained and developed, and employee performance evaluations are completed.
30
A general description of effectiveness and efficiency is
the degree (including quality) to which established objectives are achieved.
31
Internal stakeholders may include:
- Board of directors(
(or a committee such as the audit committee)
- Senior management
- Operations and support management
- Internal auditors
32
External stakeholders may include:
- Regulatory bodies and standard setters
- External auditors
- Third-part vendors
- Third-party customers
33
Internal auditing must effectively demonstrate its value as a key component of the
organization’s governance framework.
34
Establishing the Performance Measurement Process could follow these types of steps;
1. Define Internal Audit Effectiveness
2. Identify Key Internal and External Stakeholders
3. Develop Measurements of Internal Audit Effectiveness
4. Monitoring and reporting results
35
Internal auditing’s performance measurement objectives (Specific measures) may include:
- level of contribution to the improvement of GRC processes
- Achievement of key goals and objectives assigned
- Evaluation of progress against audit plan
- Staff productivity
- Cost-efficiency of the audit process
- Number of action plans for process improvements
- Effectiveness in meetings the needs of stakeholders
- The sufficiency of quality assurance reviews
36
Define Internal Audit Effectiveness
- Review relevant IPPF guidance including Standards
- Review the strategic plans of the internal audit activity and organization
- Review the board, audit committee, and internal audit charters
- Assess basic, expected, and targeted/preferred internal audit activity deliverables
- Formulate an initial definition of internal audit effectiveness and efficiency
- Define agreement from key stakeholders of the definition of effectiveness and efficiency
37
Define Internal Audit Effectiveness
- Review relevant IPPF guidance including Standards
- Review the strategic plans of the internal audit activity and organization
- Review the board, audit committee, and internal audit charters
- Assess basic, expected, and targeted/preferred internal audit activity deliverables
- Formulate an initial definition of internal audit effectiveness and efficiency
- Define agreement from key stakeholders of the definition of effectiveness and efficiency
38
Identify key internal and external stakeholders
- Determine key internal and external stakeholders for the activity and organization
- Determine who directly or indirectly relies upon the internal audit activity’s work
- Determine who benefits, directly or indirectly, from the internal audit activity’s work
- Consider who supports the internal audit activity
39
Develop measurements of individual audit effectiveness
- Understand key stakeholders’ expectations of the internal audit activity
- Understand what internal audit attributes, deliverables, and capabilities key stakeholders value and related shortcomings or advancements in these areas
- Develop measurement tools such as a balanced scorecard to document relevant attributes of effectiveness and efficiency and related performance against these
- Agree upon effectiveness and efficiency metrics with key stakeholders
40
Monitoring and reporting results
- Establish an agreed upon format and frequency for reporting that considers the organization’s size, nature, and governance structure
- Establish a periodic review of such monitoring and reporting to ensure relevance, efficiency, and effectiveness
- Use the results of reporting to shape and guide internal audit activities
- Align internal audit activities to the defined measures of internal audit effectiveness and efficiency
41
Audit committee (measures)
- Satisfaction survey
- Risk concerns
- Plan input
42
Management/Auditees (measures)
- Satisfaction survey
- Average number of recommendations per audit
- Percent of recommendations implemented by corrective action date
- Cost savings
- Changes to processes
43
Innovation and capabilities (measures)
- Staff experience
- Training hours/auditor
- Percentage of staff holding relevant designations
- Number of innovative improvements implemented
- Number of process improvements
- Percentage of surprise risk events
44
Internal audit processes (measures)
- Risk coverage
- Percent completed vs. planned audits
- Number of recommendations/audits
- Actual vs. planned costs
- Elapsed audit time start to finish
- Conformance to policy and Standards
- Quality assurance techniques developed
45
Monitoring and reporting results
reporting to the board might be less frequent and in less detail to meet its needs in overseeing the activities of internal auditing. Reporting to management would likely be much more detailed.
46
Performance measurement category
- Basic measures
- Service to stakeholders
- Knowledge of business
- Technical development
- Innovation
- People development
CIA
flashcards
Decks in class (8)
# Cards
