Quality Assessment Review. Agenda. The Law Says 11/16/2015. Internal Audit Management November 19-20, 2015

Transcription

1 Quality Assessment Review Internal Audit Management November 19-20, 2015 Flerida Rivera-Alsing MBA,CPA, CIA, CFE, CISA, CRMA, CIDA, LIFA Chief Audit Executive State Board of Administration of Florida Agenda Requirements of the Law Requirements of the IIA To Check for Conformance Areas to Assess Degree of Challenges on Conformance The The Law Says Section (6)(a), Florida Statutes.the director of auditing shall perform the functions listed in this subsection. (a) Such audits shall be conducted in accordance with the current International Standards for the Professional Practice of Internal Auditing as published by the Institute of Internal Auditors, Inc., or, where appropriate, in accordance with generally accepted governmental auditing standards. All audit reports issued by internal audit staff shall include a statement that the audit was conducted pursuant to the appropriate standards. 1

2 The IIA Says 1321 Use of Conforms with the International Standards for the Professional Practice of Internal Auditing The chief audit executive may state that the internal audit activity conforms with the International Standards for the Professional Practice of Internal Auditing only if the results of the quality assurance and improvement program support this statement. To Check for Conformance 11.45(2)(i), Florida Statutes, the Auditor General shall: Once every 3 years, review a sample of internal audit reports at each state agency, as defined in s (1), to determine compliance with current Standards for the Professional Practice of Internal Auditing or, if appropriate, government auditing standards. To Check for Conformance Standard External Assessments External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. The chief audit executive must discuss with the board: The form and frequency of external assessment; and The qualifications and independence of the external assessor or assessment team, including any potential conflict of interest. 2

3 Main Differences Between The IIA & the Statute Frequency: Statute IIA every three years every five years QA Team: Statute IIA Auditor General qualified, independent assessor or team from outside the organization Areas to Assess International Professional Practice Framework (IPPF) Mandatory Guidance 10 Core Principles Code of Ethics Definition of Internal Auditing Standards Degree of Challenges on Conformance Standard Standard Title Degree of Challenge Attribute Standards 1000 Purpose, Authority, and Responsibility L Attribute Standards 1100 Independence and Objectivity H Attribute Standards 1200 Proficiency and Due Professional Care M Attribute Standards 1300 Quality Assurance and Improvement Program H Performance Standards 2000 Managing the Internal Audit Activity H Performance Standards 2100 Nature of work M Performance Standards 2200 Engagement Planning H Performance Standards 2300 Performing the Engagement H Performance Standards 2400 Communicating Results M Performance Standards 2500 Monitoring Progress M Performance Standards 2600 Communicating the Acceptance of Risks M 3

4 1300 Quality Assurance and Improvement Program 1310 Requirements of the Quality Assurance and Improvement Program 1311 Internal Assessments External Assessments 1320 Reporting on the Quality Assurance and Improvement Program 1321 Use of Conforms with the International Standards for the Professional Practice of Internal Auditing 1322 Disclosure of Nonconformance 1300 Quality Assurance and Improvement Program The chief audit executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity. IIA QAIP Standard1300 All aspects of the internal audit activity IIA Standard 1000: Purpose, Authority, & Responsibility Requirement The purpose, authority, and responsibility of the internal audit activity must be formally defined in an internal audit charter, consistent with the Definition of Internal Auditing, the Code of Ethics, and the Standards. The chief audit executive must periodically review the internal audit charter and present it to senior management and the board for approval. 1100: Independence & Objectivity The internal audit activity must be independent, and internal auditors must be objective in performing their work. 1200: Proficiency & Due Engagements must be performed with proficiency and due professional care. Professional Care 1300: QAIP The chief audit executive must develop and maintain a quality assurance and improvement program that covers all aspects of the internal audit activity. 4

5 IIA QAIP Standard1300 All aspects of the internal audit activity IIA Standard Requirement The chief audit executive must effectively manage the internal audit activity 2000: Managing the IA Activity to ensure it adds value to the organization. The internal audit activity must evaluate and contribute to the improvement 2100: Nature of Work of governance, risk management, and control processes using a systematic and disciplined approach. Internal auditors must develop and document a plan for each engagement, 2200: Engagement Planning including the engagement s objectives, scope, timing, and resource allocations. Internal auditors must identify, analyze, evaluate, and document sufficient 2300: Performing the Engagement information to achieve the engagement s objectives. Internal auditors must communicate the results of engagements. 2400: Communicating Results The chief audit executive must establish and maintain a system to monitor 2500: Monitoring Progress the disposition of results communicated to management. When the chief audit executive concludes that management has accepted a 2600: Communicating the level of risk that may be unacceptable to the organization, the chief audit Acceptance of Risks executive must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, the chief audit executive must communicate the matter to the board Requirements of the Quality Assurance and Improvement Program The quality assurance and improvement program must include both internal and external assessments. IIA QAIP Standard 1310 Internal assessments- comprised of two interrelated parts: a. ongoing monitoring, and b. periodic self-assessments. External assessments can be in the form of: a. A full external assessment, or b. A self-assessment with independent external validation. 5

6 1311 Internal Assessments Internal assessments must include: Ongoing monitoring of the performance of the internal audit activity; and Periodic self-assessments or assessments by other persons within the organization with sufficient knowledge of internal audit practices. IIA QAIP Standard 1311 Ongoing Monitoring Practice Advisory Standard working practices Engagement planning Supervision Using checklists or automation tools to provide assurance on compliance with established practices and procedures Working paper procedures and signoff by engagement supervisors SBA OIA Assess the progress of the OIA Annual Audit Plan Maintain an updated OIA procedure manual Perform engagement-specific quality assurance assessments and related verifications Review working papers and audit reports Maintain a database of recommendations/action plans and related status Review of reports and supporting documentation for comments IIA QAIP Standard 1311 Periodic Assessments Assessment May SBA OIA Be a self-assessment, or an assessment by a CIA (or other competent professional) from a different Annual self-assessment department Encompass a combination of self-assessments Annual review of the OIA Charter Include interviews and surveys Serve to facilitate & reduce the cost for an external assessment 6

7 External Assessments External assessments must be conducted at least once every five years by a qualified, independent assessor or assessment team from outside the organization. The chief audit executive must discuss with the board: The form and frequency of external assessment; and The qualifications and independence of the external assessor or assessment team, including any potential conflict of interest. IIA QAIP Standard 1312 External Assessment Forms per IIA Standard SBA OIA Full external assessment Self-assessment with independent external validation Self-assessment with independent external validation 1320 Reporting on the Quality Assurance and Improvement Program The chief audit executive must communicate the results of the quality assurance and improvement program to senior management and the board. 7

8 1322 Disclosure of Nonconformance When nonconformance with the Definition of Internal Auditing, the Code of Ethics, or the Standards impacts the overall scope or operation of the internal audit activity, the chief audit executive must disclose the nonconformance and the impact to senior management and the board. Primary Objective of QAIP The primary objective of QAIP is to promote continuous improvement. QAIP presumes that quality is built into the structure of the internal audit activity. Benefits of Internal QA Demonstrate consistency across audit teams Increase audit oversight from audit senior management Foster a culture of continuous improvement in internal audit Identify professional development and training needs for the internal audit staff Lay the foundation for external QA. Help IA achieve smooth review and receive clean opinion 8

9 Benefits of External QA Increased stakeholder confidence Evidence of commitment to quality External audit reliance Benefits of External QA Answers the question: Who audits the auditors? An opportunity to make a statement about your commitment to quality Tips to Consider Ensure conformance is built into your activity: Procedures manual Audit program Annual and per engagement certifications Planning memo Perform self-assessment Buy the IIA Quality Assessment Manual 9

10 Questions/Comments? Resources The IIA AUDITNET KnowledgeLeader New IPPF Resources releases/pages/iia-introduces-updated- Guidance-Framework.aspx Thank you Flerida Rivera-Alsing Phone: (850)