20 Questions Directors Should Ask About Internal Audit

1
20 Questions Directors Should Ask About Internal
Audit

• Ingrid Loewen
• Director, Internal Audit
• Manitoba Liquor Control Commission

CAUBO 2005 June 21 1045 - 1200
2
About . . .

• Manitoba Liquor Control Commission (MLCC)
• You
• Institute of Internal Auditors (IIA)
• Chief Audit Executive (CAE)
• CICA Risk Management Governance Board
• The 20 Questions Series

3
(No Transcript)
4
20 Questions Directors Should Ask About Internal
Audit

• Liaison Committee
• Process
• Overview and advice on how to respond

5
Categories

• Internal Audit Role Mandate
• Internal Audit Relationships
• Internal Audit Resources
• Internal Audit Process
• Closing Questions
• Audit Committee Assessment

6
Internal Audit Role Mandate
7
1. Should we have an Internal Audit function?

• Legal requirements
• Independent objective assurance on the adequacy
  of internal control
• Size of organization
• Distinction between external and internal audit

8
2. What should our Internal Audit function do?

• IIA Definition
• Determined by CAE in consultation with senior
  management and the Audit Committee
• Formal Internal Audit Charter
• Annual audit plan

9
IIA Definition of Internal Auditing

• Internal Auditing is an independent, objective
  assurance and consulting activity designed to add
  value and improve an organizations operations.
  It helps an organization accomplish its
  objectives by bringing a systematic, disciplined
  approach to evaluate and improve the
  effectiveness of risk management, control, and
  governance processes.

10
Type of Internal Audit Work

• Documentation and testing of internal controls
• Efficiency, effectiveness, and economy of
  operations
• Review major projects and new computer systems
• Consulting services
• Fraud investigation
• Compliance with legislation
• Risk management

11
3. What should be the mandate of the Internal
Audit function?

• Established by written charter
• Compatible with role of Audit Committee
• Non-operational
• Unrestricted access to employees and records

12
Internal Audit Relationships
13
4. What is the relationship between Internal
Audit and the Audit Committee?

• Audit Committee
• Appointment/replacement of CAE
• IA charter
• IA annual plan
• Internal Audit
• Attends AC meetings
• Reports on work performed
• Private meetings with Chair of AC and CAE
  (unrestricted access)
• Periodic meetings without management present

14
5. To whom does Internal Audit report
administratively?

• Functional reporting to Audit Committee
• Administrative reporting to
• President CEO
• Chief Administrative Officer
• Chief Financial Officer
• Other

15
IIA Standard 1110

• The CAE should report to a level within the
  organization that allows the internal audit
  activity to fulfill its responsibilities
• The internal audit activity should be free from
  interference in determining the scope of internal
  auditing, performing work, and communicating
  results
• Practice Advisory Organizational Independence

16
Internal Audit Resources
17
6. How is the Internal Audit function staffed?

• Resources required to complete the audit plan
• Number
• Skills
• Combination of staff and service providers

18
7. How does Internal Audit get and maintain the
expertise it needs to conduct its assignments?

• Qualifications
• Professional accountant, CIA, CISA, other
• Ongoing professional development
• Supplement internal expertise with service
  providers

19
8. Are the activities of Internal Audit
appropriately coordinated with those of the
external auditors?

• CAE to coordinate to avoid duplication of effort
• Audit Committee to monitor
• Avoid using IA to reduce external audit fees

20
Internal Audit Process
21
9. How is the Internal Audit plan developed?

• Annual plan
• Based on Risk!
• Input from management
• Includes all IA activities
• Adequate resources
• Flexibility
• Approved by AC
• Changes during the year

22
10. What does the Internal Audit plan not cover?

• Ensure adequate resources
• Areas of risk ranked just below those selected
  for inclusion

23
11. How are Internal Audit findings reported?

• In writing
• Scope, objectives, findings, recommendations
• Action oriented
• Balanced
• Recommendations rated (H, M, L)
• Summaries to Senior Management Audit Committee

24
12. How are corporate managers required to
respond to Internal Audit findings and
recommendations?

• With action plans and implementation dates or
  
• Reasons for accepting risk
• Implementation monitored by senior management
• Periodic follow up by IA
• IA updates Audit Committee

25
13. What services does Internal Audit provide in
connection with fraud?

• Management is responsible to prevent, deter,
  detect fraud
• IA should consider risk of fraud
• IAs role in investigations may vary

26
14. How do you assess the effectiveness of your
Internal Audit function?

• Performance measures
• Benchmarking
• Quality assurance reviews

27
Closing Questions
28
15. Does Internal Audit have sufficient resources?

• Highly sensitive
• Quantity and quality
• If not, why not
• IA not respected by management
• Funding crisis
• IA resources diverted to special projects

29
16. Does the Internal Audit function get
appropriate support from the CEO and senior
management team?

• Ensure good working relationship between CEO and
  CAE
• Support of audit findings
• CAE as member of executive team
• Ask CAE and CEO

30
17. Are you satisfied that this organization has
adequate internal controls over its major risks?

• AC expectations
• CAE to summarize results of various audit
  activities
• IA is not the only source

31
18. Are there any other matters that you wish to
bring to the Audit Committees attention?

• Trust!
• In-camera discussions are confidential
• Extreme caution is advised

32
19. Are there other ways in which Internal Audit
and the Audit Committee could support each other?

• Continuous improvement

33
Audit Committee Assessment
34
20. Are we (the Audit Committee) satisfied with
our Internal Audit function?

• CAE responds well to AC questions
• CAE respected by external auditors
• Frequency of surprises
• CAE assurance adequate
• IA raises significant issues
• CAE respected within profession

35
LINKS

• www.theiia.org
• www.theiia.org/index.cfm?doc_id5175
• www.cica.ca
• www.rmgb.ca/index.cfm/ci_id/3083/la_id/1.htm

36
Questions?