Dan's Internal Audit Corner
Implementing A World Class Internal Audit Function
By Dan Swanson
Each month Dan Swanson, a senior security and internal audit professional will provide his list of recommended resources for AuditNet readers. If you have questions about this page or the links, you can reach Dan at www.securitybenchmark.com and dswanson_2005@yahoo.com.
For more IT and Information Security resources check out the latest Taylor and Francis publications.
Internal
auditing provides managers and the board with valuable assistance by
giving objective assurance and consulting opinions regarding the
organization’s governance, risk-management and control processes.
Where an organization has not staffed an internal audit department the identification of the benefits and various role(s) internal audit should play is the initial step. Where an internal audit function has been in operation, a review of its recent performance and a revisiting of the organization’s assurance requirements are recommended.
Have another great month and all the best in your effort.
Dan Swanson
If internal audit is not in place, the organization will need an executive sponsor to lead the analysis of the many issues, benefits, costs, activities, and so forth, that is involved in establishing a new internal audit function. A senior executive from within the organization should drive the research and “business case” efforts with engaged oversight being provided by the audit committee chair. You could also work with a recruiting company that has done this before—although I believe internal ownership is critical, and you should not totally outsource efforts to set up the department because it is too important a task.
What are your organization’s assurance priorities?
The assurance requirements of the board and management are key drivers for determining internal audit priorities. The chair of the audit committee, the chief executive officer, and the chief financial officer are the three key executives to be interviewed, although other officers certainly should provide ideas and input.
The Recommended Roadmap
-
Review the recommendations and resources provided (see summary).
-
Study the IIA’s “Establishing an Internal Audit Function” repository.
-
Study the “20 Questions Directors Should Ask of Internal Audit” guide.
-
Study the IIA’s “Why Standards Matter” audit committee briefing.
-
Study the IIA’s “Resourcing Alternatives for Internal Audit” paper.
-
Complete an external assessment of the internal audit function, where possible.
-
Decide what’s needed; write it up; and then “implement” your long term plan.
Investment In Tools, Techniques, & Technology Recommended
Audit best practices are important to every internal audit function. Operating below acceptable standards is never acceptable and learning from others’ efforts is always highly recommended. There are a variety of benchmarking services available, plus leading edge information from professional associations and various audit service providers and vendors that will be helpful.
For an existing internal audit function, a comprehensive external quality assessment review can provide numerous suggestions for taking the function to the next level of performance.
Internal audit requires highly skilled resources, and the competition for staff becomes more difficult each year. A long-term workforce plan would be very beneficial in today’s complex and fast-changing business environment. An annual audit committee review of internal audit and enterprise-wide human resource planning can be invaluable.
Key Resources
Where is your internal audit function going?
The Institute of Internal Auditors has developed a variety of position papers and other guidance including a comprehensive 16-step “roadmap” repository for establishing the internal audit function that includes links to various resources to assist your journey. It is very important to realize that much of the 16-step guidance provided is also very useful in taking an established internal audit function to the next level of performance.
The board, audit committee, and executive management must be satisfied that their internal audit function is appropriate and adds value to the organization. A world class internal audit function strengthens corporate performance and provides assurance to the audit committee and the board that the organization is doing all the things it should be doing.
The opinions, beliefs and viewpoints expressed by the various authors and forum participants on this web site do not necessarily reflect the opinions, beliefs and viewpoints of AuditNet®




