Internal Audit Process Maturity - The Institute of ...

1 Internal Audit Process Maturity 19. Internal Audit Process Maturity Quality Assurance and Improvement Program Key Characteristics Methodology Systems and Communication Policy And Process People Information And Reporting IIA Standards require that the The methodology upon which Internal Audit staff are aware A standardized Audit The results of periodic Internal Chief Audit Executive establish the Quality Assurance and of their responsibilities related management system is used to assessments are summarized and maintain a Quality Improvement Program is based to the Quality Assurance and document workpapers and can and discussed with Audit Assurance and Improvement is derived from the IIA Improvement Program and be heavily relied upon during management and

2 An action Program. Standards and related Practice have received training as the quality assessment plan for improvements is Advisories. appropriate. Process . developed and implemented. IIA Standards require that the The Process to execute the Responsibility for Significant company systems The results of periodic Internal Chief Audit Executive Quality Assurance and implementation of the Quality are used to derive relevant Key assessments are reported to communicate the results of the Improvement Program is Assurance and Improvement Performance Indicators (KPIs) and reviewed with senior quality assurance and documented in the Internal Program is assigned to that are monitored and used management and the Audit improvement program to Audit Policy and Procedure personnel who are during the Internal quality Committee.

3 Senior management and the Manual. independent and objective. assessment Process . board. The Internal Audit Policy and The Process is reviewed External assessments are External assessment providers Procedure Manual describes periodically to ensure it is conducted by qualified deliver qualitative and the Quality Assurance and current with IIA Standard personnel who are quantitative benchmarks that Improvement Program requirements as well as independent from the are reported to both requirements. consistent with leading organization. management and the Audit Internal Audit practice. Committee to facilitate continuous improvement. The Internal Audit activity Fully dedicated Internal Audit Client Feedback forms are charter establishes the staff are assigned to perform solicited and received back requirement for the Quality the periodic Internal quality from each client and Assurance and Improvement assessments, with strong documented within the work Program.

4 Experience in Internal Audit papers to assist in continuous and performing quality improvement of the Internal assessments. Audit processes. 20. Internal Audit Process Maturity Quality Assurance and Improvement Program Overall Methodology Systems and Communication Maturity Policy People And Process Information And Reporting Level Continuous Continuous SMEs identified and Extensive use of data Communication and monitoring and monitoring and used; training and mining and reporting highly Realization updating for updating for development analytics; continuous effective; high level Of Value Optimized necessary changes necessary changes monitored; robust Audit and monitoring of quality Proposition and emerging and emerging succession planning processes in place demonstrated in leading practices leading practices in place driving value timely reports Policies are Methodology and All resources have Data integrity is high; Communication and communicated to processes are appropriate skills automated reports reporting highly personnel and communicated to and credentials; are reliable; key data effective.

5 Quality and Managed training occurs as personnel and targeted training and is monitored timeliness metrics necessary training occurs as development in continuously defined and necessary place monitored Policies are defined, Uniform Appropriate skills Stable systems in Communication and in place, and methodology and and credentials in place; information reporting processes documented processes are place; training generated is reliable are defined, in place, Defined defined, in place, requirements and relied upon and documented;. and documented documented and effective use of executed reporting templates Policies are defined Uniform Some specialized Fairly effective Communication and and in place but may methodology and technical skills and systems are in place; reporting processes not be documented processes are credentials.

6 Training low reliance on data are defined and in Repeatable defined and in place and development and information place but may not be but may not be defined but may not generated from documented documented be documented systems Policies are not Methodology and Resource skills and High reliance on Communication and defined or in place processes are not credentials do not manual systems and reporting done on an defined or in place match Process spreadsheets; ad hoc basis; no Initial requirements; critical information validation of results Risk of training programs not readily available or focus on quality not defined Failure 21. Internal Audit Process Maturity Recruiting, On-Boarding, and Staff Development Key Characteristics Methodology Systems and Communication Policy And Process People Information And Reporting Job descriptions for Internal An approach for measuring the Internal Audit 's staffing model Internal Audit has designed Job roles and responsibilities, Audit demonstrate a clear link levels and quality of includes the concept of the and implemented a as well as career development to the achievement of the capabilities, skills, and business "guest auditor" - personnel comprehensive on-board opportunities.

7 Are discussed Internal Audit Charter and experience for individual from the business participate training program for newly with staff and reviewed on a strategy and are reviewed on a Internal Audit staff has been on audits as a member of the hired Internal Audit personnel. regular basis. regular basis. established and used as the Audit team, contributing real- The on-board training program basis to perform a skills time risk and business orients new personnel to both inventory. expertise . In turn, they gain a the Internal Audit department unique and well-regarded and the larger organization. development experience. IIA Standards require that the The processes to recruit Rotation program is in place, Internal Audit has developed Performance against Chief Audit Executive ensure talented individuals into the yielding high-performing and implemented a robust expectations is reviewed on a that Internal Audit resources organization, provide individuals into the business staff development and training regular basis and is are appropriate, sufficient, and orientation/on-boarding having experience within curriculum.

8 Communicated to the effectively deployed to achieve training, and provide Internal Audit . individual for continuous the approved plan. continuing development and development. career opportunities for resources are documented in the Internal Audit Policy and Procedure Manual. IIA Standards require that An Internal Audit training Professional certification is Internal auditors enhance their curriculum is formalized and required for career growth. knowledge, skills, and other includes both Internal and competencies through external courses. Career paths, continuing professional succession plans, and development. mentoring programs are formalized and in place. 23. Internal Audit Process Maturity Recruiting, On-Boarding, and Staff Development Overall Methodology Systems and Communication Maturity Policy People And Process Information And Reporting Level Continuous Continuous SMEs identified and Extensive use of data Communication and monitoring and monitoring and used; training and mining and reporting highly Realization updating for updating for development analytics; continuous effective; high level Of Value Optimized necessary changes necessary changes monitored.

9 Robust Audit and monitoring of quality Proposition and emerging and emerging succession planning processes in place demonstrated in leading practices leading practices in place driving value timely reports Policies are Methodology and All resources have Data integrity is high; Communication and communicated to processes are appropriate skills automated reports reporting highly personnel and communicated to and credentials; are reliable; key data effective; quality and Managed training occurs as personnel and targeted training and is monitored timeliness metrics necessary training occurs as development in continuously defined and necessary place monitored Policies are defined, Uniform Appropriate skills Stable systems in Communication and in place, and methodology and and credentials in place; information reporting processes documented processes are place; training generated is reliable are defined, in place, Defined defined, in place, requirements and relied upon and documented.

10 And documented documented and effective use of executed reporting templates Policies are defined Uniform Some specialized Fairly effective Communication and and in place but may methodology and technical skills and systems are in place; reporting processes not be documented processes are credentials; training low reliance on data are defined and in Repeatable defined and in place and development and information place but may not be but may not be defined but may not generated from documented documented be documented systems Policies are not Methodology and Resource skills and High reliance on Communication and defined or in place processes are not credentials do not manual systems and reporting done on an defined or in place match Process spreadsheets; ad hoc basis; no Initial requirements; critical information validation of results Risk of training programs not readily available or focus on quality not defined Failure 24.