From appliance manufacturers to paint retailers and legal consultants to roofing contractors, the type of business or service makes no difference. What matters to their clientele and, in the long run, assures continued patronage, is quality. That also applies to internal auditors, for whom quality must be a paramount concern.

Now, more than ever, leading organizations are recognizing the importance of maintaining an effective internal audit function. Given the extensive regulatory developments and increased liability in today’s business environment, audit committees and company management, among other stakeholders, have placed greater emphasis on the need for enhanced governance, transparency and sound internal controls within their organizations. A quality internal audit function is a critical component in achieving this goal.

Quality’s significance was officially recognized by a standard established in January 2002 by The Institute of Internal Auditors (IIA). Up until then, there was always an inference that quality was embedded in everything that audit shops did. This quality standard calls for the chief audit executive (CAE) to establish a quality and assurance improvement program with both an internal and an external assessment component.  The program should be consistent with IIA Standard requirements and leading internal auditing practice.  It should be formally incorporated into the policies and procedures that govern the practice of internal auditing in the organization.

Quality assessments are a key element to the International Standards for the Professional Practice of Internal Auditing (Standards):

• Internal Assessment – Encompasses what a CAE would want to have in place on an audit-by-audit basis to enhance consistency and assure quality: everything from checklists to receiving customer feedback.  A periodic internal assessment component that goes beyond what is done on an audit-by-audit basis focuses more on an evaluation of conformance with IIA Standards and should be done at least annually.  The results of the ongoing monitoring component should be reported to the audit committee at least annually and the results of the periodic assessment should be reported as it is completed.  This is a new requirement that was established with the new International Professional Practices Framework (IPPF) effective January 1, 2009.
• External Assessment – Evaluates conformance with the Standards, the IIA Code of Ethics, the Definition of Internal Auditing, the internal audit activity charter, internal audit policy and procedure and leading internal audit practice. The designated time frame is once every five years, though it could occur with greater frequency.  An external assessment can be performed as a full-scope assessment by a qualified reviewer or review team from outside the organization or can be done as a self-assessment with validation from an independent reviewer or review team.

 
While this requirement caused initial consternation among many internal auditors because they never had to undergo such a peer review by someone outside their organization, CAEs who readily embraced the quality assurance and improvement program concept discovered an opportunity to not only evaluate how their audit activities conformed with the Standards and leading internal audit practice, but also to avail themselves of new ideas presented by reviewers with different backgrounds and experience.

 
Consider the Tangible Benefits
A major benefit organizations undergoing a quality assessment accrue is the right to use the term “performed in accordance with the International Standards for the Professional Practice of Internal Auditing.” In addition, as The IIA notes, “It also builds stakeholder confidence by documenting management’s commitment to quality and leading practices and the internal auditor’s mindset for professionalism. Obtaining an external quality assessment provides evidence to the board, management and staff that the audit committee and the internal audit activity are concerned about the organization’s internal controls, ethics, governance and risk management practices.”  
 
However, despite such proven benefits, and for varying reasons from budgetary constraints to not fully recognizing the value, widespread adoption has yet to occur. Nearly seven years after its promulgation, there is still a relatively high level of non-conformance to the standard both in the United States and globally. In fact, the latest data suggests that less than 40 percent of organizations have had external quality assessments performed.
 
An external quality assessment gives the CAE a chance at least every five years to talk with a peer or reviewer from outside the organization to get a flavor of where the organization stands in terms of the standard and what things it is doing really well, where further work is needed and other insights on what key stakeholders (i.e., senior management, the audit committee, audit staff and customers) think about internal audit and how it might improve. That, in my mind, is the ultimate challenge in terms of being able to demonstrate value. 
 
As an internal auditor, you want to make sure you have an effective control structure in place and that everything you do is aligned with the role as set forth within the audit charter. An outside party can provide an independent view of this alignment.  Thus, it is critical during the assessment process to understand how internal audit is viewed within the organization by its key stakeholders and how this aligns with the underlying charters, policies and procedures that guide the internal audit activity.  The assessment process can effectively strengthen the relationship between internal audit and its key stakeholders by providing a high degree of transparency in the operation of internal audit.  Insights into governance processes of the organization and the role of internal audit, how the organization manages risk, and whether an appropriate level of control is in place to mitigate risk to a desired level are all aspects that are addressed during the review.  Additionally, the assessment process provides critical insights into the effective use of technology by the internal audit activity as a measure of its efficiency and effectiveness.  The information derived from the assessment provides value that goes beyond the internal audit activity. 
 
Similarly, in looking to become more efficient, internal audit should have a mindset of improving processes as opposed to finding fault with specific controls. I have always been a firm believer in the need for an appropriate level of control.  Having excessive controls in a low-risk area is not smart allocation of resources. Likewise, with a high risk area, internal auditors need to understand their risk appetite and how much they want to control that risk. Then it becomes a matter of seeing if the controls are working or, if they are not, making recommendations to rectify the situation.


Taking a Positive Approach
In organizations that have embraced the quality standard, the champion is usually the CAE.  Establishing a quality internal audit assurance and improvement program is a significant responsibility. While the mandate to establish a quality program might come from the outside internal audit (the audit committee), it is a much more positive experience when the CAE is the one leading this initiative. Where quality becomes part of the internal audit operating culture supported by the “tone at the top” by the CAE, there is usually a high degree of conformance with the Standards, leading practice and key stakeholder expectations.
 
A CAE who is a quality champion looks for feedback on performance and uses the external review process in a very positive manner.  In a typical scenario, here is how a CAE might inform the audit committee of plans for an external review: “It is part of the standards, and while I think we are doing a really good job, it is likely there are things we could do better. I will establish plans to address any of the recommendations that come up from the review team and want to use this as a mechanism for us to improve and play a better overall role in monitoring.” 
 
A CAE who fosters quality by describing it that way to the audit committee is on the path to winning their full support and encouragement – they may even suggest repeating it once every three years. It also reinforces on the audit staff management’s commitment to quality rather than merely paying it lip service.  
 
Familiar quality concepts in business such as total quality management (TQM), Six Sigma and ISO 9000 standards represent ways to help drive quality into an organization and to measure whether or not the desired benchmarks are attained. They are consistent with the view of quality in an organization, so it is no surprise that companies using such tools also are onboard with The IIA’s quality standard for internal audit.
 
A New Mindset
Internal audit departments committed to achieving high quality embrace the challenge with both hands. It becomes a defining element within the internal audit activity itself. Searching for new ideas to improve processes never stops. Everything is fair game: How they pick areas for audit, how they actually perform the audit, how they report results and follow up. If someone discovers an area where an organization falls short, they regard that as good information, an opportunity to strive for the next level.
 
Deep down, while every internal audit shop wants to do a good job, real-world issues cited earlier – budget constraints, resource limitations and long-established comfort zones from following approaches that have worked well in the past – may impede progress. 
 
It is time for a new mindset about quality, one that entails a deep-rooted passion. I have encountered some fine shops that perform in conformance with the quality standard, but they just do not have the drive for continuous improvement. These I would rank in the second quartile. But the ones that have sold the value of internal audit as a driver of quality throughout the organization fit squarely at the top.
 
 
Find out what The IIA has to say on the subject at http://www.theiia.org.