Purpose
The purpose of regular assessment of the internal audit activity is to ensure that issues raised are addressed by appropriate leadership, thereby increasing the value added by the internal audit activity to the organisation over time. The conclusions based on the evaluations conducted need to be discussed in appropriate forums, with the Audit & Risk Committee to ensure that there is clear communication of the achievement of both acceptable and unacceptable performance and guidance is provided where improvements can be made.
Applicable internal audit standards
The International Standards for the Professional Practices of Internal Auditing (Standards) that are issued by The Institute of Internal Auditors (IIA) are mandatory guidance for internal audit practitioners as well as internal audit activity. The IIA has developed the globally accepted definition of internal auditing, as follows:
Internal Auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.
According to Standard 2000 – Managing the Internal Audit Activity; the Internal Audit must effectively manage the internal audit activity to ensure it adds value to the organization.
Furthermore Standard 2100 – Nature of Work; states that the internal audit activity must evaluate and contribute to the improvement of governance, risk management, and control processes using a systematic disciplined approach.
Evaluating internal audit effectiveness
In evaluating the effectiveness of an internal audit, the Audit & Risk Committee needs to assess the effectiveness of internal audit against agreed performance criteria, including:
- compliance by internal audit – be it in-house, outsourced, or co-sourced– with its agreed charter or plan/scope and level of performance.
- the overall comprehensiveness of the internal audit plan and its relationship with the strategic objectives of the business.
- delivery of timely internal audit services in accordance with the plan; and
- competency of internal audit staff and adequacy of resources to achieve the scope as outlined in the plan. This may require outsourcing certain specialist skills not available in the internal audit function.
The Audit & Risk Committee, should, on an annual basis, request a review of internal audit performance from various sources including management, the external auditor and through a self-assessment.